Any Terraform getting started with Linkerd2

[learning813]

Hello,

Do anyone have any terraform implementation to get started with linkerd2 and expose the dahsboard service ?

thanks

[sayrer]

This works on GCP with Terraform 1.0:

# linkerd Mutual TLS certs
resource "tls_private_key" "trustanchor_key" {  
  algorithm   = "ECDSA"
  ecdsa_curve = "P256"
}

resource "tls_self_signed_cert" "trustanchor_cert" {  
  key_algorithm         = tls_private_key.trustanchor_key.algorithm
  private_key_pem       = tls_private_key.trustanchor_key.private_key_pem
  validity_period_hours = 87600
  is_ca_certificate     = true

  subject {
    common_name = "identity.linkerd.cluster.local"
  }

  allowed_uses = [
    "crl_signing",
    "cert_signing",
    "server_auth",
    "client_auth"
  ]
}

resource "tls_private_key" "issuer_key" {  
  algorithm   = "ECDSA"
  ecdsa_curve = "P256"
}

resource "tls_cert_request" "issuer_req" {  
  key_algorithm   = tls_private_key.issuer_key.algorithm
  private_key_pem = tls_private_key.issuer_key.private_key_pem

  subject {
    common_name = "identity.linkerd.cluster.local"
  }
}

resource "tls_locally_signed_cert" "issuer_cert" {  
  cert_request_pem      = tls_cert_request.issuer_req.cert_request_pem
  ca_key_algorithm      = tls_private_key.trustanchor_key.algorithm
  ca_private_key_pem    = tls_private_key.trustanchor_key.private_key_pem
  ca_cert_pem           = tls_self_signed_cert.trustanchor_cert.cert_pem
  validity_period_hours = 8760
  is_ca_certificate     = true

  allowed_uses = [
    "crl_signing",
    "cert_signing",
    "server_auth",
    "client_auth"
  ]
}

# Helm setup
provider "helm" {
  kubernetes {
    host     = var.host
    username = var.username
    password = var.password

    client_certificate     = base64decode(var.client_certificate)
    client_key             = base64decode(var.client_key)
    cluster_ca_certificate = base64decode(var.cluster_ca_certificate)
  }
}

resource "helm_release" "linkerd" {  
  name       = "linkerd"
  repository = "https://helm.linkerd.io/stable"
  chart      = "linkerd2"
  version    = "2.10.2"

  set {
    name  = "identityTrustAnchorsPEM"
    value = tls_self_signed_cert.trustanchor_cert.cert_pem
  }

  set {
    name  = "identity.issuer.crtExpiry"
    value = tls_locally_signed_cert.issuer_cert.validity_end_time
  }

  set {
    name  = "identity.issuer.tls.crtPEM"
    value = tls_locally_signed_cert.issuer_cert.cert_pem
  }

  set {
    name  = "identity.issuer.tls.keyPEM"
    value = tls_private_key.issuer_key.private_key_pem
  }
}

resource "helm_release" "linkerd_viz" {
    name       = "viz"
    repository = "https://helm.linkerd.io/stable"
    chart      = "linkerd-viz"
}

[argais]

This saved me a day or two of work, thanks a lot!

[argais]

@sayrer out of curiosity, how do you/would you handle the anchor/issuer cert rotations at the end of the 1y period? there are docs for manual rotation, but we cant import resources back into the tls provider, so any further terraform runs would break stuff.
I'm stuck a bit considering this and would appreciate any ideas :D

[sayrer]

Have a look at the interaction of early_renewal_hours and the Automatic Renewal section on this page:
https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/self_signed_cert#early_renewal_hours

[learning813]

@sayrer : Thanks for sharing the example
I'm being a little greedy, is there any terraform implementation for linkerd-multicluster too ?
I searched linkerd2 slack channel, I see one person has asked there but I did not find any reference of implementation

[learning813]

There is a repository having a good terraform implementation without using helm
https://github.com/rtlnl/terraform-kubernetes-linkerd2/