Skip to content

Commit 2c4690a

Browse files
mikeruumikeruu
authored
Cluster init (#7)
* FEAT: added cluster iac init files * added makefile
1 parent aeeb6c9 commit 2c4690a

File tree

4 files changed

+338
-0
lines changed

4 files changed

+338
-0
lines changed

‎infrastructure/init/Makefile‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
.PHONY: terraform kubectl
2+
3+
BIN := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))/.bin
4+
TERRAFORM_VERSION := 1.12.2
5+
KUBECTL_VERSION := 1.28.0
6+
7+
export PATH := $(BIN):$(PATH)
8+
9+
UNAME_S := $(shell uname -s)
10+
UNAME_M := $(shell uname -m)
11+
ifeq ($(UNAME_S),Linux)
12+
OS = linux
13+
ifeq ($(UNAME_M),x86_64)
14+
ARCH = amd64
15+
endif
16+
ifeq ($(UNAME_M),aarch64)
17+
ARCH = arm64
18+
endif
19+
endif
20+
ifeq ($(UNAME_S),Darwin)
21+
OS = darwin
22+
ifeq ($(UNAME_M),x86_64)
23+
ARCH = amd64
24+
endif
25+
ifeq ($(UNAME_M),arm64)
26+
ARCH = arm64
27+
endif
28+
endif
29+
30+
terraform:
31+
@if ! terraform --version | head -n 1 | grep $(TERRAFORM_VERSION); then \
32+
mkdir -p $(BIN); \
33+
curl -L https://releases.hashicorp.com/terraform/$(TERRAFORM_VERSION)/terraform_$(TERRAFORM_VERSION)_$(OS)_$(ARCH).zip > $(BIN)/terraform.zip; \
34+
unzip $(BIN)/terraform.zip -d $(BIN); \
35+
rm $(BIN)/terraform.zip; \
36+
fi;
37+
38+
kubectl:
39+
@if ! kubectl version --client --output=yaml 2>/dev/null | grep -q "gitVersion: v$(KUBECTL_VERSION)"; then \
40+
mkdir -p $(BIN); \
41+
curl -L "https://dl.k8s.io/release/v$(KUBECTL_VERSION)/bin/$(OS)/$(ARCH)/kubectl" -o $(BIN)/kubectl; \
42+
chmod +x $(BIN)/kubectl; \
43+
fi;

‎infrastructure/init/main.tf‎

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
locals {
2+
# this will be the user's name and the DNS zone prefix
3+
cluster_name = "opencenter-dev"
4+
# Prefix to add to Openstack resource names
5+
naming_prefix = local.cluster_name
6+
openstack_auth_url = "https://keystone.api.sjc3.rackspacecloud.com/v3/"
7+
openstack_insecure = false
8+
openstack_region = "SJC3"
9+
availability_zone = "az1"
10+
openstack_user_name = var.openstack_user_name == "" ? local.cluster_name : var.openstack_user_name
11+
openstack_user_password = var.openstack_user_password
12+
openstack_admin_password = var.openstack_admin_password
13+
openstack_project_domain_name = "rackspace_cloud_domain"
14+
openstack_user_domain_name = "rackspace_cloud_domain"
15+
openstack_tenant_name = "981977_Flex"
16+
floatingip_pool = "PUBLICNET"
17+
router_external_network_id = "723f8fa2-dbf7-4cec-8d5f-017e62c12f79"
18+
# VLAN settings
19+
vlan_id = ""
20+
mtu = ""
21+
network_provider = "physnet1"
22+
#CIDR that the openstack VMs will use for K8s nodes
23+
subnet_nodes = "10.2.188.0/22"
24+
subnet_nodes_oct = join(".", slice(split(".", split("/", local.subnet_nodes)[0]), 0, 3))
25+
#Leave some IPs free for the VRRP IP and the MetalLB Range
26+
allocation_pool_start = "${local.subnet_nodes_oct}.50"
27+
allocation_pool_end = "${local.subnet_nodes_oct}.254"
28+
# vrrp_ip Must be an IP from subnet_nodes and will be used as the internal Kubernetes API VIP.
29+
vrrp_ip = "${local.subnet_nodes_oct}.10"
30+
#CIDR that will be used by kubernetes pods. Not an openstack network.
31+
subnet_pods = "10.42.0.0/16"
32+
#CIDR that will be used for kubernetes services. Not an openstack network.
33+
subnet_services = "10.43.0.0/16"
34+
# use_octavia set to false to create a floating IP associated with the vrrp_ip port. true will create an octavia LB with a floating IP
35+
use_octavia = false
36+
loadbalancer_provider = "amphora"
37+
# vrrp_enabled cannot be set to true if use_octavia is true
38+
vrrp_enabled = true
39+
# Creates a DNS record using the LB floating IP and dns_zone_name
40+
use_designate = false
41+
# dns_zone_name is the dns zone to create if use_designate is true
42+
dns_zone_name = "${local.cluster_name}.demo.mk8s.net"
43+
# DNS servers to configure on the nodes
44+
dns_nameservers = ["8.8.8.8", "8.8.4.4"]
45+
image_id = "56277265-8f0c-40dc-87e2-944b7d320dae"
46+
image_id_windows = "899af84f-d98f-4255-bf98-ceba5e3a8257"
47+
k8s_api_port = 443
48+
worker_count = 2
49+
worker_count_windows = 0
50+
# Enter 1 or 3 masters.
51+
master_count = 3
52+
ssh_user = "ubuntu"
53+
# these are the ssh public keys that will be able to connect to the cluster's bastion node
54+
ssh_authorized_keys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDogzEullM89m//Vd8IGPERto2DotXnUCKGH6II1Vk/klEuDVqXx9kCb981XJKh8mU15bfJVdE4h078q/shK9EIcPMRKSQSMs2LkgF/1yUeVYPNYiIBph6CaqjIxKHy1kYxw3KUTIh8IIl1M4t5fc5c49Gr3QuDpeMN4Z/wrbR1DceIbFDiVxYNeyJWfOdowKgTn4AKh0n1xtg6/XLin3cCstpvfUJUKm0WOcmn3+DHK6cBNqNAMKdtxgnGwlY4MfizJOZE30Y7hwPqXUjOgLgB2vybcdcMpUvw9e8HopogOFQnVwwmlc9/7ZKPCaCKRBEC38IV82CJ6+/eePIMriPF migu4903@MNF0TUDV30"]
55+
node_worker = "-wn"
56+
node_master = "-cp"
57+
node_worker_windows = "-win"
58+
ub_version = "24"
59+
#FLEX Flavor Settings ==========================
60+
flavor_bastion = "gp.0.2.2"
61+
flavor_master = "gp.0.4.4"
62+
flavor_worker = "gp.0.4.8"
63+
# flavor_worker_windows = "gp.0.8.16"
64+
65+
worker_node_bfv_volume_size = 100
66+
worker_node_bfv_destination_type = "volume"
67+
worker_node_bfv_source_type = "image"
68+
worker_node_bfv_volume_type = "HA-Standard"
69+
70+
# ====================================
71+
#ca_certificates add CA certificates to server's trusts. Good for trusting internal private Certificate Authorities.
72+
ca_certificates = ""
73+
openstack_ca = ""
74+
75+
# ====================================
76+
#Kubespray Settings
77+
kubespray_version = "v2.28.1"
78+
kubernetes_version = "1.32.5"
79+
network_plugin = "calico"
80+
deploy_cluster = true
81+
#kub-vip settings
82+
kube_vip_enabled = true
83+
#Hardening
84+
k8s_hardening_enabled = true
85+
kube_pod_security_exemptions_namespaces = ["trivy-temp"]
86+
kubelet_rotate_server_certificates = false
87+
os_hardening_enabled = true
88+
89+
#OIDC Settings
90+
# kube_oidc_auth_enabled = true
91+
# kube_oidc_url = ""
92+
# kube_oidc_client_id = "kubernetes"
93+
# # Optional settings fo OIDC
94+
# kube_oidc_ca_file = ""
95+
# kube_oidc_username_claim = "sub"
96+
# kube_oidc_username_prefix = "oidc:"
97+
# kube_oidc_groups_claim = "groups"
98+
# kube_oidc_groups_prefix = "oidc:"
99+
100+
#Calico Settings
101+
cni_iface = "enp3s0"
102+
#Interface detection method for Calico nodeAddressAutodetectionV4. Can be "first-found", "interface", "cidr"
103+
#https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io%2fv1.NodeAddressAutodetection
104+
calico_interface_autodetect = "interface"
105+
calico_interface_autodetect_cidr = ""
106+
calico_encapsulation_type = "VXLAN"
107+
calico_nat_outgoing = true
108+
109+
# ## Windows settings
110+
# windows_user = "Administrator"
111+
# windows_admin_password = ""
112+
# worker_node_bfv_size_windows = 0
113+
# worker_node_bfv_type_windows = "local"
114+
}
115+
116+
module "openstack-nova" {
117+
# source = "../../../install/iac/infra/openstack-nova"
118+
source = "git@github.com:rackerlabs/openCenter.git//iac/infra/openstack-nova?ref=initial-iac"
119+
availability_zone = local.availability_zone
120+
ca_certificates = local.ca_certificates
121+
use_octavia = local.use_octavia
122+
use_designate = local.use_designate
123+
dns_nameservers = local.dns_nameservers
124+
dns_zone_name = local.dns_zone_name
125+
flavor_bastion = local.flavor_bastion
126+
openstack_auth_url = local.openstack_auth_url
127+
openstack_ca = local.openstack_ca
128+
openstack_insecure = local.openstack_insecure
129+
openstack_region = local.openstack_region
130+
openstack_tenant_name = local.openstack_tenant_name
131+
openstack_user_name = local.openstack_user_name
132+
openstack_password = local.openstack_user_password
133+
openstack_project_domain_name = local.openstack_project_domain_name
134+
openstack_user_domain_name = local.openstack_user_domain_name
135+
naming_prefix = local.naming_prefix
136+
ssh_user = local.ssh_user
137+
floatingip_pool = local.floatingip_pool
138+
image_id = local.image_id
139+
image_id_windows = local.image_id_windows
140+
router_external_network_id = local.router_external_network_id
141+
network_id = ""
142+
vlan_id = local.vlan_id
143+
vrrp_enabled = local.vrrp_enabled
144+
vrrp_ip = local.vrrp_ip
145+
ssh_authorized_keys = local.ssh_authorized_keys
146+
subnet_nodes = local.subnet_nodes
147+
subnet_services = local.subnet_services
148+
subnet_pods = local.subnet_pods
149+
allocation_pool_start = local.allocation_pool_start
150+
allocation_pool_end = local.allocation_pool_end
151+
k8s_api_port = local.k8s_api_port
152+
size_master = {
153+
count = local.master_count
154+
flavor = local.flavor_master
155+
}
156+
size_worker = {
157+
count = local.worker_count
158+
flavor = local.flavor_worker
159+
}
160+
# size_worker_windows = {
161+
# count = local.worker_count_windows
162+
# flavor = local.flavor_worker_windows
163+
# }
164+
node_master = local.node_master
165+
node_worker = local.node_worker
166+
node_worker_windows = local.node_worker_windows
167+
ub_version = local.ub_version
168+
# windows_admin_password = local.windows_admin_password
169+
# worker_node_bfv_size_windows = local.worker_node_bfv_size_windows
170+
# worker_node_bfv_type_windows = local.worker_node_bfv_type_windows
171+
# master_node_bfv_volume_size = 39
172+
# master_node_bfv_destination_type = "local"
173+
174+
worker_node_bfv_volume_size = local.worker_node_bfv_volume_size
175+
worker_node_bfv_destination_type = local.worker_node_bfv_destination_type
176+
worker_node_bfv_source_type = local.worker_node_bfv_source_type
177+
worker_node_bfv_volume_type = local.worker_node_bfv_volume_type
178+
}
179+
180+
module "kubespray-cluster" {
181+
# source = "git@github.com:rackerlabs/terraform-mpk-kubespray.git/calico?ref=main"
182+
source = "git@github.com:rackerlabs/openCenter.git//iac/kubespray?ref=initial-iac"
183+
# source = "../../../install/iac/kubespray"
184+
address_bastion = module.openstack-nova.bastion_floating_ip
185+
cluster_name = local.cluster_name
186+
cni_iface = local.cni_iface
187+
deploy_cluster = local.deploy_cluster
188+
dns_zone_name = local.dns_zone_name
189+
master_nodes = module.openstack-nova.master_nodes
190+
network_plugin = local.network_plugin
191+
k8s_hardening_enabled = local.k8s_hardening_enabled
192+
os_hardening_enabled = local.os_hardening_enabled
193+
ssh_user = local.ssh_user
194+
subnet_nodes = local.subnet_nodes
195+
subnet_pods = local.subnet_pods
196+
subnet_services = local.subnet_services
197+
kubernetes_version = local.kubernetes_version
198+
kubespray_version = local.kubespray_version
199+
kube_vip_enabled = local.kube_vip_enabled
200+
kube_pod_security_exemptions_namespaces = local.kube_pod_security_exemptions_namespaces
201+
kubelet_rotate_server_certificates = local.kubelet_rotate_server_certificates
202+
worker_nodes = module.openstack-nova.worker_nodes
203+
k8s_api_ip = module.openstack-nova.k8s_api_ip
204+
k8s_api_port = local.k8s_api_port
205+
vrrp_ip = local.vrrp_ip
206+
vrrp_enabled = local.vrrp_enabled
207+
windows_nodes = module.openstack-nova.windows_nodes
208+
use_octavia = local.use_octavia
209+
# kube_oidc_auth_enabled = local.kube_oidc_auth_enabled
210+
# kube_oidc_url = local.kube_oidc_url
211+
# kube_oidc_client_id = local.kube_oidc_client_id
212+
# kube_oidc_ca_file = local.kube_oidc_ca_file
213+
# kube_oidc_username_claim = local.kube_oidc_username_claim
214+
# kube_oidc_username_prefix = local.kube_oidc_username_prefix
215+
# kube_oidc_groups_claim = local.kube_oidc_groups_claim
216+
# kube_oidc_groups_prefix = local.kube_oidc_groups_prefix
217+
}
218+
219+
220+
module "calico" {
221+
# source = "../../../install/iac/calico"
222+
source = "git@github.com:rackerlabs/openCenter.git//iac/calico?ref=initial-iac"
223+
224+
calico_interface_autodetect = local.calico_interface_autodetect
225+
calico_encapsulation_type = local.calico_encapsulation_type
226+
calico_nat_outgoing = local.calico_nat_outgoing
227+
calico_interface_autodetect_cidr = local.calico_interface_autodetect_cidr == "" ? local.subnet_nodes : local.calico_interface_autodetect_cidr
228+
cni_iface = local.cni_iface
229+
deploy_cluster = local.deploy_cluster
230+
k8s_internal_ip = module.openstack-nova.k8s_internal_ip
231+
k8s_api_port = local.k8s_api_port
232+
subnet_nodes = local.subnet_nodes
233+
subnet_pods = local.subnet_pods
234+
subnet_services = local.subnet_services
235+
windows_dataplane = length(module.openstack-nova.windows_nodes) > 0 ? "HSN" : ""
236+
}

‎infrastructure/init/provider.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
backend "s3" {
3+
bucket = "opencenter-dev"
4+
key = "opencenter-dev/tfstate/terraform.tfstate"
5+
region = "us-west-2"
6+
use_lockfile = true
7+
encrypt = true
8+
}
9+
}

‎infrastructure/init/variables.tf‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
variable "openstack_admin_name" {
2+
type = string
3+
default = "admin"
4+
}
5+
6+
variable "openstack_admin_password" {
7+
type = string
8+
default = ""
9+
}
10+
11+
variable "openstack_user_name" {
12+
type = string
13+
default = ""
14+
}
15+
16+
variable "openstack_user_password" {
17+
type = string
18+
default = ""
19+
}
20+
21+
variable "pf9_account_url" {
22+
type = string
23+
default = ""
24+
}
25+
26+
variable "pf9_username" {
27+
type = string
28+
default = ""
29+
}
30+
31+
variable "pf9_password" {
32+
type = string
33+
default = ""
34+
}
35+
36+
variable "worker_count" {
37+
type = string
38+
default = "1"
39+
40+
}
41+
42+
variable "master_count" {
43+
type = string
44+
default = "3"
45+
}
46+
47+
variable "windows_admin_password" {
48+
type = string
49+
default = ""
50+
}

0 commit comments

Comments
 (0)