Updates cluster to support private endpoints (#21)

* Allows access tp 30000-32767 from any source
* Sets alb_type based on value of disable_public_endpoint variable
* Moves in-cluster configuration to a different module to handle via VPN bootstrap for private cluster
* Map kms_id to kms module guid output in metdata

Signed-off-by: Sean Sundberg <[email protected]>

Author: Sean Sundberg

chart/cloud-setup/.helmignore

@@ -18,13 +18,11 @@ locals {
     }
   }
   cluster_config_dir    = "${path.cwd}/.kube"
-  cluster_config        = data.ibm_container_cluster_config.cluster.config_file_path
   cluster_type_file     = "${path.cwd}/.tmp/cluster_type.val"
   name_prefix           = var.name_prefix != "" ? var.name_prefix : var.resource_group_name
   name_list             = [local.name_prefix, "cluster"]
   cluster_name          = var.name != "" ? var.name : join("-", local.name_list)
   tmp_dir               = "${path.cwd}/.tmp"
-  config_namespace      = "default"
   server_url            = data.ibm_container_vpc_cluster.config.public_service_endpoint_url
   ingress_hostname      = data.ibm_container_vpc_cluster.config.ingress_hostname
   tls_secret            = data.ibm_container_vpc_cluster.config.ingress_secret
@@ -39,7 +37,6 @@ locals {
   cluster_type_code     = local.config_values[local.cluster_type_cleaned].type_code
   cluster_type_tag      = local.cluster_type == "kubernetes" ? "iks" : "ocp"
   cluster_version       = local.cluster_type == "openshift" ? local.openshift_versions[local.config_values[local.cluster_type_cleaned].version] : ""
-  ibmcloud_release_name = "ibmcloud-config"
   vpc_subnet_count      = var.vpc_subnet_count
   vpc_id                = !var.exists ? data.ibm_is_vpc.vpc[0].id : ""
   vpc_subnets           = !var.exists ? var.vpc_subnets : []
@@ -185,7 +182,6 @@ resource ibm_is_security_group_rule rule_tcp_k8s {
 
   group     = local.security_group_id
   direction = "inbound"
-  remote    = local.ipv4_cidr_blocks[count.index]
 
   tcp {
     port_min = 30000
@@ -197,6 +193,6 @@ data ibm_container_vpc_cluster config {
   depends_on = [ibm_container_vpc_cluster.cluster, null_resource.create_dirs, ibm_is_security_group_rule.rule_tcp_k8s]
 
   name              = local.cluster_name
-  alb_type          = "public"
+  alb_type          = var.disable_public_endpoint ? "private" : "public"
   resource_group_id = data.ibm_resource_group.resource_group.id
 }

chart/cloud-setup/Chart.lock

@@ -57,7 +57,7 @@ versions:
     - name: kms_id
       moduleRef:
         id: kms
-        output: id
+        output: guid
       optional: true
     - name: kms_key_id
       optional: true

chart/cloud-setup/Chart.yaml

@@ -1,7 +1,6 @@
 output "id" {
-  value       = data.ibm_container_cluster_config.cluster.id
+  value       = data.ibm_container_vpc_cluster.config.id
   description = "ID of the cluster."
-  depends_on  = [helm_release.cloud_setup]
 }
 
 output "name" {
@@ -12,31 +11,25 @@ output "name" {
 output "resource_group_name" {
   value       = var.resource_group_name
   description = "Name of the resource group containing the cluster."
-  depends_on  = [helm_release.cloud_setup]
+  depends_on  = [data.ibm_container_vpc_cluster.config]
 }
 
 output "region" {
   value       = var.region
   description = "Region containing the cluster."
-  depends_on  = [helm_release.cloud_setup]
-}
-
-output "config_file_path" {
-  value       = local.cluster_config
-  description = "Path to the config file for the cluster."
-  depends_on  = [helm_release.cloud_setup]
+  depends_on  = [data.ibm_container_vpc_cluster.config]
 }
 
 output "platform" {
   value = {
-    id         = data.ibm_container_cluster_config.cluster.id
-    kubeconfig = local.cluster_config
+    id         = data.ibm_container_vpc_cluster.config.id
+    server_url = local.server_url
     type       = local.cluster_type
     type_code  = local.cluster_type_code
     version    = local.cluster_version
     ingress    = local.ingress_hostname
     tls_secret = local.tls_secret
   }
   description = "Configuration values for the cluster platform"
-  depends_on  = [helm_release.cloud_setup]
+  depends_on  = [data.ibm_container_vpc_cluster.config]
 }