tjo-cloud/infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: folder structure change

Browse source
This commit is contained in:
Tine 2024-07-14 12:19:37 +02:00
parent 43c856ed5c
commit dfd7e36eec
Signed by: mentos1386
SSH key fingerprint: SHA256:MNtTsLbihYaWF8j1fkOHfkKNlnN1JQfxEU/rBU8nCGw
13 changed files with 366 additions and 240 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

0
terraform/.terraform.lock.hcl → clusters/pink/.terraform.lock.hcl
View file

26
clusters/pink/kubeconfig Executable file
View file

@ -0,0 +1,26 @@
apiVersion: v1
kind: Config
clusters:
- name: pink
cluster:
server: https://api.pink.k8s.tjo.cloud:6443
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpakNDQVRDZ0F3SUJBZ0lSQVBPU2NEaVZVUGNmRkI1OXl3cE1rQmt3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOREEzTVRReE1ERXhORGxhRncwek5EQTNNVEl4TURFeApORGxhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVFpa1Y0cVVyVFY5WW1VUzRQZGp5UWhnYkgxaHNNWTlVK0RVVFdWU1pqaGFsRkZuWjBLYTFkMUtGTkoKSFRSa3psdW9va3kxK3JZRkhLejM4SFpqczVIaG8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGS1VSWnVWTUlHcHhqRFNKdC80OVBTSDZUSzBmTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUFKZXVSdEMKYkR3VGhLSDBYV0hid3YveDV6clJhU2ZhRi9sSnVqcGY3bTMwQWlFQWxyTkx3L056dXFRQmorcnozbXVBdW5ZSAp5NzNNVm9zakRQOTJ2RWo5clBZPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
contexts:
- name: oidc@pink
context:
cluster: pink
namespace: default
user: oidc
current-context: oidc@pink
users:
- name: oidc
user:
exec:
apiVersion: client.authentication.k8s.io/v1beta1
command: kubectl
args:
- oidc-login
- get-token
- --oidc-issuer-url=https://id.tjo.space/application/o/k8stjocloud/
- --oidc-client-id=HAI6rW0EWtgmSPGKAJ3XXzubQTUut2GMeTRS2spg
- --oidc-extra-scope=profile

160
clusters/pink/kubernetes.tf Normal file
View file

@ -0,0 +1,160 @@
module "cluster" {
source = "../../modules/cluster"
providers = {
helm.template = helm.template
}
nodes = {
one = {
public = true
type = "controlplane"
host = "hetzner"
boot_pool = "hetzner-main-data"
},
two = {
public = true
type = "controlplane"
host = "hetzner"
boot_pool = "hetzner-main-data"
},
three = {
public = true
type = "controlplane"
host = "hetzner"
boot_pool = "hetzner-main-data"
},
four = {
public = false
type = "worker"
host = "hetzner"
boot_pool = "hetzner-main-data"
}
five = {
public = false
type = "worker"
host = "hetzner"
boot_pool = "hetzner-main-data"
}
}
versions = {
talos = "v1.7.5"
kubernetes = "v1.30.0"
}
iso = "proxmox-backup-tjo-cloud:iso/talos-v1.7.5-tailscale-metal-amd64.iso"
cluster = {
name = "pink"
domain = "k8s.tjo.cloud"
oidc = {
client_id = var.oidc_client_id
issuer_url = var.oidc_issuer_url
}
}
tailscale_authkey = var.tailscale_authkey
}
resource "local_file" "kubeconfig" {
content = module.cluster.kubeconfig
filename = "${path.module}/kubeconfig"
}
resource "kubernetes_manifest" "hetzner-nodes-as-loadbalancers" {
manifest = {
apiVersion = "cilium.io/v2alpha1"
kind = "CiliumLoadBalancerIPPool"
metadata = {
name = "hetzner-nodes"
}
spec = {
blocks = concat(
[for k, node in module.cluster.nodes : { start : node.address_ipv4 } if node.public],
# [for k, node in module.cluster.nodes : { start : node.address_ipv6 } if node.public],
)
}
}
}
# TODO: Certmanager, externaldns...
resource "helm_release" "cert-manager" {
name = "cert-manager"
chart = "cert-manager"
repository = "https://charts.jetstack.io"
version = "v1.15.1"
namespace = "kube-system"
set {
name = "crds.enabled"
value = true
}
}
resource "kubernetes_manifest" "gateway" {
manifest = {
apiVersion = "gateway.networking.k8s.io/v1"
kind = "Gateway"
metadata = {
name = "gateway"
namespace = "kube-system"
}
spec = {
gatewayClassName = "cilium"
listeners = [
{ name : "http", protocol : "HTTP", port : 80 },
{ name : "https", protocol : "HTTPS", port : 443 },
]
}
}
}
resource "helm_release" "dashboard" {
name = "kubernetes-dashboard"
repository = "https://kubernetes.github.io/dashboard"
chart = "kubernetes-dashboard"
version = "7.5.0"
namespace = "kube-system"
}
resource "kubernetes_manifest" "dashoard-http-route" {
depends_on = [
kubernetes_manifest.gateway,
]
manifest = {
apiVersion = "gateway.networking.k8s.io/v1"
kind = "HTTPRoute"
metadata = {
name = "dashboard"
namespace = "kube-system"
}
spec = {
parentRefs = [
{ name : "gateway" }
]
hostnames = [
"dashboard.${module.cluster.name}.${module.cluster.domain}"
]
rules = [
{
matches = [
{
path : {
value : "/"
type : "PathPrefix"
}
}
]
backendRefs = [
{
name : "kubernetes-dashboard-kong-proxy"
port : 443
}
]
}
]
}
}
}

8
terraform/providers.tf → clusters/pink/providers.tf
View file

@ -50,8 +50,8 @@ provider "helm" {
provider "helm" {
kubernetes {
host = local.cluster_endpoint
cluster_ca_certificate = base64decode(data.talos_cluster_kubeconfig.this.kubernetes_client_configuration.ca_certificate)
host = module.cluster.api.endpoint
cluster_ca_certificate = base64decode(module.cluster.api.ca)
exec {
api_version = "client.authentication.k8s.io/v1beta1"
command = "kubectl"
@ -70,8 +70,8 @@ provider "helm" {
}
provider "kubernetes" {
host = local.cluster_endpoint
cluster_ca_certificate = base64decode(data.talos_cluster_kubeconfig.this.kubernetes_client_configuration.ca_certificate)
host = module.cluster.api.endpoint
cluster_ca_certificate = base64decode(module.cluster.api.ca)
exec {
api_version = "client.authentication.k8s.io/v1beta1"
command = "kubectl"

21
clusters/pink/variables.tf Normal file
View file

@ -0,0 +1,21 @@
variable "tailscale_authkey" {
type = string
sensitive = true
}
variable "oidc_username" {
type = string
}
variable "oidc_password" {
type = string
sensitive = true
}
variable "oidc_client_id" {
type = string
}
variable "oidc_issuer_url" {
type = string
}

0
terraform/manifests/gateway-api-crds.yaml → modules/cluster/gateway-api-crds.yaml
View file

0
terraform/templates/kubeconfig.tftpl → modules/cluster/kubeconfig.tftpl
View file

221
terraform/kubernetes.tf → modules/cluster/main.tf
View file

@ -1,18 +1,14 @@
locals {
# Downloaded from factory.talos.dev
# https://factory.talos.dev/?arch=amd64&board=undefined&cmdline-set=true&extensions=-&extensions=siderolabs%2Fqemu-guest-agent&extensions=siderolabs%2Ftailscale&platform=metal&secureboot=undefined&target=metal&version=1.7.0
iso = "proxmox-backup-tjo-cloud:iso/talos-${var.talos_version}-tailscale-metal-amd64.iso"
cluster_domain = "${var.cluster.name}.${var.cluster.domain}"
cluster_api_domain = "${var.cluster.api.subdomain}.${local.cluster_domain}"
boot_pool = "hetzner-main-data"
cluster_endpoint = "https://${local.cluster_api_domain}:${var.cluster.api.port}"
cluster_domain = "api.${var.cluster_name}.${var.domain}"
cluster_port = 6443
cluster_endpoint = "https://${local.cluster_domain}:${local.cluster_port}"
nodes = { for k, v in var.nodes : k => merge(v, { name = "${k}.node.${local.cluster_domain}" }) }
nodes = { for k, v in var.nodes : k => merge(v, { name = "${k}.node.${var.cluster_name}.${var.domain}" }) }
nodes_with_address = { for k, v in local.nodes : k => merge(v, { address_ipv4 = proxmox_vm_qemu.this[k].default_ipv4_address, address_ipv6 = proxmox_vm_qemu.this[k].default_ipv6_address }) }
first_controlplane_node = values({ for k, v in local.nodes_with_address : k => v if v.type == "controlplane" })[0]
nodes_public_controlplane = { for k, v in proxmox_vm_qemu.this : k => v if var.nodes[k].public && var.nodes[k].type == "controlplane" }
podSubnets = [
"10.200.0.0/16",
@ -29,8 +25,6 @@ locals {
"100.64.0.0/10",
"fd7a:115c:a1e0::/96"
]
apply_mode = "reboot"
}
resource "macaddress" "this" {
@ -47,8 +41,8 @@ resource "proxmox_vm_qemu" "this" {
each.value.public ? ["public"] : ["private"],
))
cores = 4
memory = 4096
cores = each.value.cores
memory = each.value.memory
scsihw = "virtio-scsi-pci"
qemu_os = "l26"
@ -65,15 +59,15 @@ resource "proxmox_vm_qemu" "this" {
scsi {
scsi0 {
cdrom {
iso = local.iso
iso = var.iso
}
}
}
virtio {
virtio0 {
disk {
size = "32G"
storage = local.boot_pool
size = each.value.boot_size
storage = each.value.boot_pool
}
}
}
@ -83,9 +77,9 @@ resource "proxmox_vm_qemu" "this" {
resource "digitalocean_record" "controlplane-A" {
for_each = { for k, v in proxmox_vm_qemu.this : k => v if var.nodes[k].public && var.nodes[k].type == "controlplane" }
domain = var.domain
domain = var.cluster.domain
type = "A"
name = "api.${var.cluster_name}"
name = "${var.cluster.api.subdomain}.${var.cluster.name}"
value = each.value.default_ipv4_address
ttl = 30
}
@ -93,9 +87,9 @@ resource "digitalocean_record" "controlplane-A" {
resource "digitalocean_record" "controlplane-AAAA" {
for_each = { for k, v in proxmox_vm_qemu.this : k => v if var.nodes[k].public && var.nodes[k].type == "controlplane" }
domain = var.domain
domain = var.cluster.domain
type = "AAAA"
name = "api.${var.cluster_name}"
name = "${var.cluster.api.subdomain}.${var.cluster.name}"
value = each.value.default_ipv6_address
ttl = 30
}
@ -103,13 +97,13 @@ resource "digitalocean_record" "controlplane-AAAA" {
resource "talos_machine_secrets" "this" {}
data "talos_machine_configuration" "controlplane" {
cluster_name = var.cluster_name
cluster_name = var.cluster.name
machine_type = "controlplane"
cluster_endpoint = local.cluster_endpoint
machine_secrets = talos_machine_secrets.this.machine_secrets
talos_version = var.talos_version
kubernetes_version = var.kubernetes_version
talos_version = var.versions.talos
kubernetes_version = var.versions.kubernetes
depends_on = [
digitalocean_record.controlplane-A,
@ -118,13 +112,13 @@ data "talos_machine_configuration" "controlplane" {
}
data "talos_machine_configuration" "worker" {
cluster_name = var.cluster_name
cluster_name = var.cluster.name
machine_type = "worker"
cluster_endpoint = local.cluster_endpoint
machine_secrets = talos_machine_secrets.this.machine_secrets
talos_version = var.talos_version
kubernetes_version = var.kubernetes_version
talos_version = var.versions.talos
kubernetes_version = var.versions.kubernetes
depends_on = [
digitalocean_record.controlplane-A,
@ -153,7 +147,7 @@ data "helm_template" "cilium" {
version = "1.15.6"
namespace = "kube-system"
kube_version = var.kubernetes_version
kube_version = var.versions.kubernetes
api_versions = [
"gateway.networking.k8s.io/v1/GatewayClass",
]
@ -194,8 +188,8 @@ data "helm_template" "cilium" {
},
hostRoot : "/sys/fs/cgroup"
},
k8sServiceHost : local.cluster_domain
k8sServicePort : local.cluster_port
k8sServiceHost : local.cluster_api_domain
k8sServicePort : var.cluster.api.port
ipv4 : {
enabled : true
},
@ -222,11 +216,6 @@ data "helm_template" "cilium" {
enabled : true
hostNetwork : {
enabled : true
nodes : {
matchLabels : {
"k8s.tjo.cloud/gateway" : "true"
}
}
}
}
envoy : {
@ -254,14 +243,14 @@ resource "talos_machine_configuration_apply" "controlplane" {
node = each.value.name
endpoint = each.value.address_ipv4
apply_mode = local.apply_mode
apply_mode = "reboot"
config_patches = [
yamlencode({
cluster : {
controlPlane : {
endpoint : local.cluster_endpoint
localAPIServerPort : local.cluster_port
localAPIServerPort : var.cluster.api.port
}
etcd : {
#advertisedSubnets : [
@ -309,7 +298,7 @@ resource "talos_machine_configuration_apply" "controlplane" {
},
{
name : "gateway-api-crds"
contents : file("${path.module}/manifests/gateway-api-crds.yaml")
contents : file("${path.module}/gateway-api-crds.yaml")
},
{
name : "cilium"
@ -327,11 +316,12 @@ resource "talos_machine_configuration_apply" "controlplane" {
hostname = each.value.name
}
install = {
image = "factory.talos.dev/installer/7d4c31cbd96db9f90c874990697c523482b2bae27fb4631d5583dcd9c281b1ff:${var.talos_version}"
image = "factory.talos.dev/installer/7d4c31cbd96db9f90c874990697c523482b2bae27fb4631d5583dcd9c281b1ff:${var.versions.talos}"
disk = data.talos_machine_disks.boot[each.key].disks[0].name
}
nodeLabels = {
"k8s.tjo.cloud/gateway" = "true"
"k8s.tjo.cloud/public" = each.value.public ? "true" : "false"
"k8s.tjo.cloud/host" = each.value.host
}
}
}),
@ -355,14 +345,14 @@ resource "talos_machine_configuration_apply" "worker" {
node = each.value.name
endpoint = each.value.address_ipv4
apply_mode = local.apply_mode
apply_mode = "reboot"
config_patches = [
yamlencode({
cluster : {
controlPlane : {
endpoint : local.cluster_endpoint
localAPIServerPort : local.cluster_port
localAPIServerPort : var.cluster.api.port
}
network : {
cni : {
@ -374,17 +364,6 @@ resource "talos_machine_configuration_apply" "worker" {
proxy : {
disabled : true
}
allowSchedulingOnControlPlanes : true
apiServer : {
extraArgs : {
"oidc-issuer-url" : var.oidc_issuer_url
"oidc-client-id" : var.oidc_client_id
"oidc-username-claim" : "sub"
"oidc-username-prefix" : "oidc:"
"oidc-groups-claim" : "groups"
"oidc-groups-prefix" : "oidc:groups:"
}
}
}
machine = {
kubelet = {
@ -396,9 +375,13 @@ resource "talos_machine_configuration_apply" "worker" {
hostname = each.value.name
}
install = {
image = "factory.talos.dev/installer/7d4c31cbd96db9f90c874990697c523482b2bae27fb4631d5583dcd9c281b1ff:${var.talos_version}"
image = "factory.talos.dev/installer/7d4c31cbd96db9f90c874990697c523482b2bae27fb4631d5583dcd9c281b1ff:${var.versions.talos}"
disk = data.talos_machine_disks.boot[each.key].disks[0].name
}
nodeLabels = {
"k8s.tjo.cloud/public" = each.value.public ? "true" : "false"
"k8s.tjo.cloud/host" = each.value.host
}
}
}),
yamlencode({
@ -429,135 +412,5 @@ data "talos_cluster_kubeconfig" "this" {
]
client_configuration = talos_machine_secrets.this.client_configuration
node = values(local.nodes_public_controlplane)[0].default_ipv4_address
}
resource "local_file" "kubeconfig" {
content = templatefile("${path.module}/templates/kubeconfig.tftpl", {
cluster : {
name : var.cluster_name,
endpoint : local.cluster_endpoint,
ca : data.talos_cluster_kubeconfig.this.kubernetes_client_configuration.ca_certificate,
}
oidc : {
issuer : var.oidc_issuer_url,
id : var.oidc_client_id,
}
})
filename = "${path.module}/kubeconfig"
}
resource "kubernetes_manifest" "hetzner-nodes-as-loadbalancers" {
depends_on = [
talos_machine_bootstrap.this
]
manifest = {
apiVersion = "cilium.io/v2alpha1"
kind = "CiliumLoadBalancerIPPool"
metadata = {
name = "hetzner-nodes"
}
spec = {
blocks = concat(
[for k, v in proxmox_vm_qemu.this : { start : v.default_ipv4_address } if var.nodes[k].public],
#[for k, v in proxmox_vm_qemu.this : { start : v.default_ipv6_address } if var.nodes[k].public],
)
}
}
}
# TODO: Certmanager, externaldns...
resource "helm_release" "cert-manager" {
depends_on = [
talos_machine_bootstrap.this
]
name = "cert-manager"
chart = "cert-manager"
repository = "https://charts.jetstack.io"
version = "v1.15.1"
namespace = "kube-system"
set {
name = "crds.enabled"
value = true
}
}
resource "kubernetes_manifest" "gateway" {
depends_on = [
talos_machine_bootstrap.this
]
manifest = {
apiVersion = "gateway.networking.k8s.io/v1"
kind = "Gateway"
metadata = {
name = "gateway"
namespace = "kube-system"
}
spec = {
gatewayClassName = "cilium"
listeners = [
{ name : "http", protocol : "HTTP", port : 80 },
{ name : "https", protocol : "HTTPS", port : 443 },
]
}
}
}
resource "helm_release" "dashboard" {
depends_on = [
talos_machine_bootstrap.this
]
name = "kubernetes-dashboard"
repository = "https://kubernetes.github.io/dashboard"
chart = "kubernetes-dashboard"
version = "7.5.0"
namespace = "kube-system"
}
resource "kubernetes_manifest" "dashoard-http-route" {
depends_on = [
talos_machine_bootstrap.this,
kubernetes_manifest.gateway,
]
manifest = {
apiVersion = "gateway.networking.k8s.io/v1"
kind = "HTTPRoute"
metadata = {
name = "dashboard"
namespace = "kube-system"
}
spec = {
parentRefs = [
{ name : "gateway" }
]
hostnames = [
"dashboard.${var.cluster_name}.${var.domain}"
]
rules = [
{
matches = [
{
path : {
value : "/"
type : "PathPrefix"
}
}
]
backendRefs = [
{
name : "kubernetes-dashboard-kong-proxy"
port : 443
}
]
}
]
}
}
node = local.first_controlplane_node.address_ipv4
}

32
modules/cluster/outputs.tf Normal file
View file

@ -0,0 +1,32 @@
output "kubeconfig" {
value = templatefile("${path.module}/kubeconfig.tftpl", {
cluster : {
name : var.cluster.name,
endpoint : local.cluster_endpoint,
ca : data.talos_cluster_kubeconfig.this.kubernetes_client_configuration.ca_certificate,
}
oidc : {
issuer : var.cluster.oidc.issuer_url,
id : var.cluster.oidc.client_id,
}
})
}
output "name" {
value = var.cluster.name
}
output "domain" {
value = var.cluster.domain
}
output "api" {
value = merge(var.cluster.api, {
endpoint : local.cluster_endpoint,
ca : data.talos_cluster_kubeconfig.this.kubernetes_client_configuration.ca_certificate,
})
}
output "nodes" {
value = local.nodes_with_address
}

45
modules/cluster/variables.tf Normal file
View file

@ -0,0 +1,45 @@
variable "nodes" {
type = map(object({
public = bool
type = string
host = string
cores = optional(number, 4)
memory = optional(string, 4096)
boot_pool = string
boot_size = optional(string, "32G")
}))
}
variable "versions" {
type = object({
talos = optional(string, "v1.7.5")
kubernetes = optional(string, "v1.30.0")
})
}
variable "iso" {
type = string
description = "Downloaded from factory.talos.dev, select quemu agent and tailscale extensions."
}
variable "cluster" {
type = object({
name = string
domain = string
api = optional(object({
subdomain = optional(string, "api")
port = optional(number, 6443)
}), {})
oidc = object({
client_id = string
issuer_url = string
})
})
}
variable "tailscale_authkey" {
type = string
sensitive = true
}

39
modules/cluster/versions.tf Normal file
View file

@ -0,0 +1,39 @@
terraform {
required_providers {
proxmox = {
source = "Telmate/proxmox"
version = "3.0.1-rc3"
}
talos = {
source = "siderolabs/talos"
version = "0.5.0"
}
local = {
source = "hashicorp/local"
version = "1.4.0"
}
digitalocean = {
source = "digitalocean/digitalocean"
version = "~> 2.0"
}
random = {
source = "hashicorp/random"
version = "3.6.2"
}
macaddress = {
source = "ivoronin/macaddress"
version = "0.3.2"
}
helm = {
source = "hashicorp/helm"
version = "2.14.0"
configuration_aliases = [
helm.template
]
}
kubernetes = {
source = "hashicorp/kubernetes"
version = "2.31.0"
}
}
}

3
terraform/.gitignore vendored
View file

@ -1,3 +0,0 @@
kubeconfig
!templates/kubeconfig
talosconfig

47
terraform/variables.tf
View file

@ -1,47 +0,0 @@
variable "nodes" {
type = map(object({
public = bool
type = string
host = string
}))
}
variable "talos_version" {
type = string
default = "v1.7.5"
}
variable "kubernetes_version" {
type = string
default = "v1.30.0"
}
variable "cluster_name" {
type = string
}
variable "domain" {
type = string
}
variable "tailscale_authkey" {
type = string
sensitive = true
}
variable "oidc_username" {
type = string
}
variable "oidc_password" {
type = string
sensitive = true
}
variable "oidc_client_id" {
type = string
}
variable "oidc_issuer_url" {
type = string
}