Skip to content

Commit 28cdcbe

Browse files
hyderhyder
authored
added support for Cardiff, secret name to be customized.. (#232)
* added support for Cardiff, secret name to be customized, IAM requirements already linked to OKE documentation * updated IAM
1 parent c183eb1 commit 28cdcbe

File tree

11 files changed

+141
-120
lines changed

11 files changed

+141
-120
lines changed

‎docs/prerequisites.adoc‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,13 @@ You can proceed to {uri-instructions}[creating the cluster] if you have already
4141

4242
== Identity and Access Management Rights
4343

44-
The Terraform user must have the rights to:
44+
The Terraform user must have the permission to:
4545

4646
. manage dynamic groups
4747
. manage policies in root tenancy
48+
. manage cluster-family in compartment
49+
. manage virtual-network-family in compartment
50+
. manage instance-family in compartment
4851

4952
== Install Terraform
5053

@@ -86,7 +89,7 @@ Follow the steps below to configure your path on Windows:
8689
[source,bash]
8790
----
8891
terraform -v
89-
Terraform v0.12.4
92+
Terraform v0.12.24
9093
----
9194

9295
== Generate API keys

‎docs/quickstart.adoc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ provider "oci" {
116116
----
117117
module "oke" {
118118
source = "oracle-terraform-modules/oke/oci"
119-
version = "2.2.2"
119+
version = "2.3.2"
120120
# insert the 9 required variables here
121121
}
122122
----
@@ -145,8 +145,8 @@ module "oke" {
145145
bastion_shape = var.bastion_shape
146146
bastion_timezone = var.bastion_timezone
147147
148-
admin_shape = var.admin_shape
149-
admin_timezone = var.admin_timezone
148+
operator_shape = var.operator_shape
149+
operator_timezone = var.operator_timezone
150150
151151
# add additional parameters for availability_domains, oke etc as you need
152152

‎locals.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,9 +123,10 @@ locals {
123123
oke_ocir = {
124124
email_address = var.email_address
125125
ocir_urls = var.ocir_urls
126+
secret_id = var.secret_id
127+
secret_name = var.secret_name
126128
tenancy_name = var.tenancy_name
127129
username = var.username
128-
secret_id = var.secret_id
129130
}
130131

131132
calico = {

‎modules/oke/k8stools.tf‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# Copyright 2017, 2019, Oracle Corporation and/or affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
3+
4+
# kubectl
5+
data "template_file" "install_kubectl" {
6+
template = file("${path.module}/scripts/install_kubectl.template.sh")
7+
}
8+
9+
resource "null_resource" "install_kubectl_operator" {
10+
connection {
11+
host = var.oke_operator.operator_private_ip
12+
private_key = file(var.oke_ssh_keys.ssh_private_key_path)
13+
timeout = "40m"
14+
type = "ssh"
15+
user = "opc"
16+
17+
bastion_host = var.oke_operator.bastion_public_ip
18+
bastion_user = "opc"
19+
bastion_private_key = file(var.oke_ssh_keys.ssh_private_key_path)
20+
}
21+
22+
provisioner "file" {
23+
content = data.template_file.install_kubectl.rendered
24+
destination = "~/install_kubectl.sh"
25+
}
26+
27+
provisioner "remote-exec" {
28+
inline = [
29+
"chmod +x $HOME/install_kubectl.sh",
30+
"bash $HOME/install_kubectl.sh",
31+
"rm -f $HOME/install_kubectl.sh"
32+
]
33+
}
34+
35+
count = var.oke_operator.bastion_enabled == true && var.oke_operator.operator_enabled == true ? 1 : 0
36+
}
37+
38+
# wait for 1. operator being ready 2. kubectl is installed (the script will create the .kube directory)
39+
resource null_resource "wait_for_operator" {
40+
connection {
41+
host = var.oke_operator.operator_private_ip
42+
private_key = file(var.oke_ssh_keys.ssh_private_key_path)
43+
timeout = "40m"
44+
type = "ssh"
45+
user = "opc"
46+
47+
bastion_host = var.oke_operator.bastion_public_ip
48+
bastion_user = "opc"
49+
bastion_private_key = file(var.oke_ssh_keys.ssh_private_key_path)
50+
}
51+
52+
depends_on = [null_resource.install_kubectl_operator]
53+
54+
provisioner "remote-exec" {
55+
inline = [
56+
"while [ ! -f /home/opc/operator.finish ]; do sleep 10; done",
57+
]
58+
}
59+
60+
count = var.oke_operator.bastion_enabled == true && var.oke_operator.operator_enabled == true ? 1 : 0
61+
}
62+
63+
# helm
64+
data "template_file" "install_helm" {
65+
template = file("${path.module}/scripts/install_helm.template.sh")
66+
67+
count = var.oke_operator.operator_enabled == true ? 1 : 0
68+
}
69+
70+
resource null_resource "install_helm_operator" {
71+
connection {
72+
host = var.oke_operator.operator_private_ip
73+
private_key = file(var.oke_ssh_keys.ssh_private_key_path)
74+
timeout = "40m"
75+
type = "ssh"
76+
user = "opc"
77+
78+
bastion_host = var.oke_operator.bastion_public_ip
79+
bastion_user = "opc"
80+
bastion_private_key = file(var.oke_ssh_keys.ssh_private_key_path)
81+
}
82+
83+
depends_on = [null_resource.install_kubectl_operator, null_resource.write_kubeconfig_on_operator]
84+
85+
provisioner "file" {
86+
content = data.template_file.install_helm[0].rendered
87+
destination = "~/install_helm.sh"
88+
}
89+
90+
provisioner "remote-exec" {
91+
inline = [
92+
"chmod +x $HOME/install_helm.sh",
93+
"bash $HOME/install_helm.sh",
94+
"rm -f $HOME/install_helm.sh"
95+
]
96+
}
97+
98+
count = var.oke_operator.bastion_enabled == true && var.oke_operator.operator_enabled == true ? 1 : 0
99+
}

‎modules/oke/kubeconfig.tf‎

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -25,64 +25,6 @@ resource "local_file" "kube_config_file" {
2525
filename = "${path.root}/generated/kubeconfig"
2626
}
2727

28-
data "template_file" "install_kubectl" {
29-
template = file("${path.module}/scripts/install_kubectl.template.sh")
30-
}
31-
32-
resource "null_resource" "install_kubectl_operator" {
33-
connection {
34-
host = var.oke_operator.operator_private_ip
35-
private_key = file(var.oke_ssh_keys.ssh_private_key_path)
36-
timeout = "40m"
37-
type = "ssh"
38-
user = "opc"
39-
40-
bastion_host = var.oke_operator.bastion_public_ip
41-
bastion_user = "opc"
42-
bastion_private_key = file(var.oke_ssh_keys.ssh_private_key_path)
43-
}
44-
45-
provisioner "file" {
46-
content = data.template_file.install_kubectl.rendered
47-
destination = "~/install_kubectl.sh"
48-
}
49-
50-
provisioner "remote-exec" {
51-
inline = [
52-
"chmod +x $HOME/install_kubectl.sh",
53-
"bash $HOME/install_kubectl.sh",
54-
"rm -f $HOME/install_kubectl.sh"
55-
]
56-
}
57-
58-
count = var.oke_operator.bastion_enabled == true && var.oke_operator.operator_enabled == true ? 1 : 0
59-
}
60-
61-
# wait for 1. operator being ready 2. kubectl is installed (the script will create the .kube directory)
62-
resource null_resource "wait_for_operator" {
63-
connection {
64-
host = var.oke_operator.operator_private_ip
65-
private_key = file(var.oke_ssh_keys.ssh_private_key_path)
66-
timeout = "40m"
67-
type = "ssh"
68-
user = "opc"
69-
70-
bastion_host = var.oke_operator.bastion_public_ip
71-
bastion_user = "opc"
72-
bastion_private_key = file(var.oke_ssh_keys.ssh_private_key_path)
73-
}
74-
75-
depends_on = [null_resource.install_kubectl_operator]
76-
77-
provisioner "remote-exec" {
78-
inline = [
79-
"while [ ! -f /home/opc/operator.finish ]; do sleep 10; done",
80-
]
81-
}
82-
83-
count = var.oke_operator.bastion_enabled == true && var.oke_operator.operator_enabled == true ? 1 : 0
84-
}
85-
8628
data "template_file" "generate_kubeconfig" {
8729
template = file("${path.module}/scripts/generate_kubeconfig.template.sh")
8830

‎modules/oke/kubernetestools.tf‎

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎modules/oke/scripts/secret.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,10 @@
99

1010
compartment_id = '${compartment_id}'
1111
region = '${region}'
12-
secret_id = '${secret_id}'
1312
email_address = '${email_address}'
1413
region_registry = '${region_registry}'
14+
secret_id = '${secret_id}'
15+
secret_name = '${secret_name}'
1516
tenancy_name = '${tenancy_name}'
1617
username = '${username}'
1718

@@ -34,10 +35,10 @@ def read_secret_value(secret_client, secret_id):
3435
try:
3536
secret_content = read_secret_value(secret_client, secret_id=secret_id)
3637
secret_content = re.escape(secret_content)
37-
delsecret = "kubectl -n default delete secret ocirsecret"
38+
delsecret = "kubectl -n default delete secret ${secret_name}"
3839
os.system(delsecret)
3940

40-
crtsecret = ("kubectl create secret docker-registry ocirsecret -n default --docker-server=${region_registry} --docker-username=${tenancy_name}/${username} --docker-email=${email_address} --docker-password=%s" % secret_content)
41+
crtsecret = ("kubectl create secret docker-registry ${secret_name} -n default --docker-server=${region_registry} --docker-username=${tenancy_name}/${username} --docker-email=${email_address} --docker-password=%s" % secret_content)
4142

4243
subprocess.call(["/bin/bash" , "-c" , crtsecret])
4344

‎modules/oke/secrets.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,11 @@
77
vars = {
88
compartment_id = var.compartment_id
99
region = var.region
10-
secret_id = var.oke_ocir.secret_id
10+
1111
email_address = var.oke_ocir.email_address
1212
region_registry = var.oke_ocir.ocir_urls[var.region]
13+
secret_id = var.oke_ocir.secret_id
14+
secret_name = var.oke_ocir.secret_name
1315
tenancy_name = var.oke_ocir.tenancy_name
1416
username = var.oke_ocir.username
1517

‎modules/oke/variables.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,10 @@ variable "lbs" {
7373
# ocir
7474
variable "oke_ocir" {
7575
type = object({
76-
secret_id = string
7776
email_address = string
78-
ocir_urls = map(string)
77+
ocir_urls = map(string)
78+
secret_id = string
79+
secret_name = string
7980
tenancy_name = string
8081
username = string
8182
})

‎terraform.tfvars.example‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,9 +168,11 @@ public_lb_ports = [80, 443]
168168
waf_enabled = false
169169

170170
# ocir
171+
email_address = ""
172+
171173
secret_id = "none"
172174

173-
email_address = ""
175+
secret_name = "ocirsecret"
174176

175177
tenancy_name = ""
176178

@@ -196,4 +198,4 @@ service_account_name = "kubeconfigsa"
196198

197199
service_account_namespace = "kube-system"
198200

199-
service_account_cluster_role_binding = ""
201+
service_account_cluster_role_binding = "cluster-admin"

0 commit comments

Comments
 (0)