diff --git a/CHANGELOG.md b/CHANGELOG.md index c0d681c7a3..96999b97cd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,29 @@ # Changelog +## [0.49.0](https://www.github.com/ckaenzig/devops-stack/compare/v0.48.0...v0.49.0) (2021-11-18) + + +### ⚠ BREAKING CHANGES + +* **eks:** send http traffic on NLB to port 80 on cluster (#810) + +### Features + +* **keycloak:** pass a user list to keycloak ([#788](https://www.github.com/ckaenzig/devops-stack/issues/788)) ([c2835ec](https://www.github.com/ckaenzig/devops-stack/commit/c2835ecaba5ffb02908fa77049cffecb976787e3)) +* **kind:** add experimental support for KIND ([#785](https://www.github.com/ckaenzig/devops-stack/issues/785)) ([518e3e6](https://www.github.com/ckaenzig/devops-stack/commit/518e3e6885082429298607314215e15fcacb0d07)) +* **sks:** add output for cluster security group id ([d3cd164](https://www.github.com/ckaenzig/devops-stack/commit/d3cd164d6ebd802bc7b45d731819518ab0759103)) +* **sks:** add variable to control SG rule to node ports ([dbcfe4d](https://www.github.com/ckaenzig/devops-stack/commit/dbcfe4de849967acee405ac2ed40a8f7c22ebf31)) +* **sks:** expose k8s cluster credentials in outputs ([f60150c](https://www.github.com/ckaenzig/devops-stack/commit/f60150ca329aebef4d618f93cebb839dd7bc6aeb)) +* **sks:** make NLB creation optional ([f008cc3](https://www.github.com/ckaenzig/devops-stack/commit/f008cc3ca29f65288d448ea018e330fab023137d)) +* **traefik:** tls version >= 1.2 ([#793](https://www.github.com/ckaenzig/devops-stack/issues/793)) ([c49580e](https://www.github.com/ckaenzig/devops-stack/commit/c49580efa834d1a5001abb18f0d9cf120970efc3)) + + +### Bug Fixes + +* **argocd:** fix kube-prometheus-stack dependency on OIDC ([#795](https://www.github.com/ckaenzig/devops-stack/issues/795)) ([5848af8](https://www.github.com/ckaenzig/devops-stack/commit/5848af8970a8c273b8243fae3f5dd98167af17d2)) +* **eks:** keycloak admin pass output when not installed ([67c0234](https://www.github.com/ckaenzig/devops-stack/commit/67c0234c7800d15cae8a928c9cd9365fddffab96)) +* **eks:** send http traffic on NLB to port 80 on cluster ([#810](https://www.github.com/ckaenzig/devops-stack/issues/810)) ([0cbd0eb](https://www.github.com/ckaenzig/devops-stack/commit/0cbd0eb05fcb818a623fa70489ad6b5f9302198b)) + ## [0.48.0](https://www.github.com/camptocamp/devops-stack/compare/v0.47.0...v0.48.0) (2021-09-22) diff --git a/modules/sks/exoscale/main.tf b/modules/sks/exoscale/main.tf index 7622a90d1e..28bb0e4ee4 100644 --- a/modules/sks/exoscale/main.tf +++ b/modules/sks/exoscale/main.tf @@ -1,5 +1,5 @@ locals { - base_domain = coalesce(var.base_domain, format("%s.nip.io", replace(exoscale_nlb.this.ip_address, ".", "-"))) + base_domain = coalesce(var.base_domain, var.create_nlb ? format("%s.nip.io", replace(exoscale_nlb.this[0].ip_address, ".", "-")) : "example.com") kubeconfig = module.cluster.kubeconfig context = yamldecode(module.cluster.kubeconfig) @@ -13,8 +13,11 @@ locals { default_nodepools = { "router-${var.cluster_name}" = { - size = 2 - instance_type = "standard.large" + size = 2 + instance_type = "standard.large" + instance_prefix = "pool" + disk_size = "50" + private_network_ids = [] }, } @@ -41,25 +44,32 @@ provider "kubernetes" { } module "cluster" { - source = "camptocamp/sks/exoscale" - version = "0.3.0" + source = "git::https://github.com/ckaenzig/terraform-exoscale-sks.git?ref=main" +# source = "camptocamp/sks/exoscale" +# version = "0.3.0" kubernetes_version = var.kubernetes_version name = var.cluster_name zone = var.zone nodepools = local.nodepools + + node_ports_world_accessible = var.node_ports_world_accessible } resource "exoscale_nlb" "this" { + count = var.create_nlb ? 1 : 0 + zone = var.zone name = format("ingresses-%s", var.cluster_name) } resource "exoscale_nlb_service" "http" { - zone = exoscale_nlb.this.zone + count = var.create_nlb ? 1 : 0 + + zone = exoscale_nlb.this[0].zone name = "ingress-contoller-http" - nlb_id = exoscale_nlb.this.id + nlb_id = exoscale_nlb.this[0].id instance_pool_id = module.cluster.nodepools[local.router_nodepool].instance_pool_id protocol = "tcp" port = 80 @@ -76,9 +86,11 @@ resource "exoscale_nlb_service" "http" { } resource "exoscale_nlb_service" "https" { - zone = exoscale_nlb.this.zone + count = var.create_nlb ? 1 : 0 + + zone = exoscale_nlb.this[0].zone name = "ingress-contoller-https" - nlb_id = exoscale_nlb.this.id + nlb_id = exoscale_nlb.this[0].id instance_pool_id = module.cluster.nodepools[local.router_nodepool].instance_pool_id protocol = "tcp" port = 443 @@ -95,6 +107,8 @@ resource "exoscale_nlb_service" "https" { } resource "exoscale_security_group_rule" "http" { + count = var.create_nlb ? 1 : 0 + security_group_id = module.cluster.this_security_group_id type = "INGRESS" protocol = "TCP" @@ -104,6 +118,8 @@ resource "exoscale_security_group_rule" "http" { } resource "exoscale_security_group_rule" "https" { + count = var.create_nlb ? 1 : 0 + security_group_id = module.cluster.this_security_group_id type = "INGRESS" protocol = "TCP" @@ -167,7 +183,7 @@ module "argocd" { { root_cert = base64encode(tls_self_signed_cert.root.cert_pem) root_key = base64encode(tls_private_key.root.private_key_pem) - router_pool_id = module.cluster.nodepools[local.router_nodepool].id + router_pool_id = var.create_nlb ? module.cluster.nodepools[local.router_nodepool].id : "" } ), var.app_of_apps_values_overrides, diff --git a/modules/sks/exoscale/outputs.tf b/modules/sks/exoscale/outputs.tf index 8fb37090a5..a2b1618683 100644 --- a/modules/sks/exoscale/outputs.tf +++ b/modules/sks/exoscale/outputs.tf @@ -9,10 +9,31 @@ output "keycloak_users" { output "keycloak_admin_password" { description = "The password of Keycloak's admin user." - value = data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD + value = data.kubernetes_secret.keycloak_admin_password.data != null ? data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD : null sensitive = true } output "nlb_ip_address" { - value = exoscale_nlb.this.ip_address + value = var.create_nlb ? exoscale_nlb.this[0].ip_address : null +} + +output "cluster_security_group_id" { + description = "Security group ID attached to the SKS nodepool instances." + value = module.cluster.this_security_group_id +} + +output "kubernetes_host" { + value = local.kubernetes.host +} + +output "kubernetes_cluster_ca_certificate" { + value = local.kubernetes.cluster_ca_certificate +} + +output "kubernetes_client_key" { + value = local.kubernetes.client_key +} + +output "kubernetes_client_certificate" { + value = local.kubernetes.client_certificate } diff --git a/modules/sks/exoscale/values.tmpl.yaml b/modules/sks/exoscale/values.tmpl.yaml index 9d9b95ad06..9f30cb260b 100644 --- a/modules/sks/exoscale/values.tmpl.yaml +++ b/modules/sks/exoscale/values.tmpl.yaml @@ -5,11 +5,6 @@ apps: metrics-server: enabled: false -argo-cd: - server: - extraArgs: - - "--insecure" - cert-manager: tlsCrt: "${root_cert}" tlsKey: "${root_key}" diff --git a/modules/sks/exoscale/variables.tf b/modules/sks/exoscale/variables.tf index a6d80b71de..d2e7ce7123 100644 --- a/modules/sks/exoscale/variables.tf +++ b/modules/sks/exoscale/variables.tf @@ -27,8 +27,20 @@ variable "router_nodepool" { default = null } +variable "node_ports_world_accessible" { + description = "Whether NodePort services should be accessible without IP restriction." + type = bool + default = true +} + variable "keycloak_users" { description = "List of keycloak users" type = map(map(string)) default = {} } + +variable "create_nlb" { + description = "Whether to create an NLB" + type = bool + default = true +} diff --git a/version.txt b/version.txt index a758a09aae..5c4503b704 100644 --- a/version.txt +++ b/version.txt @@ -1 +1 @@ -0.48.0 +0.49.0