From f008cc3ca29f65288d448ea018e330fab023137d Mon Sep 17 00:00:00 2001 From: Christian Kaenzig Date: Wed, 20 Oct 2021 15:06:43 +0200 Subject: [PATCH 1/8] feat(sks): make NLB creation optional This allows using the devops stack with an existing or externally managed load balancer. --- modules/sks/exoscale/main.tf | 22 ++++++++++++++++------ modules/sks/exoscale/outputs.tf | 2 +- modules/sks/exoscale/variables.tf | 6 ++++++ 3 files changed, 23 insertions(+), 7 deletions(-) diff --git a/modules/sks/exoscale/main.tf b/modules/sks/exoscale/main.tf index 7622a90d1e..3d2847a5e6 100644 --- a/modules/sks/exoscale/main.tf +++ b/modules/sks/exoscale/main.tf @@ -1,5 +1,5 @@ locals { - base_domain = coalesce(var.base_domain, format("%s.nip.io", replace(exoscale_nlb.this.ip_address, ".", "-"))) + base_domain = coalesce(var.base_domain, var.create_nlb ? format("%s.nip.io", replace(exoscale_nlb.this[0].ip_address, ".", "-")) : "example.com") kubeconfig = module.cluster.kubeconfig context = yamldecode(module.cluster.kubeconfig) @@ -52,14 +52,18 @@ module "cluster" { } resource "exoscale_nlb" "this" { + count = var.create_nlb ? 1 : 0 + zone = var.zone name = format("ingresses-%s", var.cluster_name) } resource "exoscale_nlb_service" "http" { - zone = exoscale_nlb.this.zone + count = var.create_nlb ? 1 : 0 + + zone = exoscale_nlb.this[0].zone name = "ingress-contoller-http" - nlb_id = exoscale_nlb.this.id + nlb_id = exoscale_nlb.this[0].id instance_pool_id = module.cluster.nodepools[local.router_nodepool].instance_pool_id protocol = "tcp" port = 80 @@ -76,9 +80,11 @@ resource "exoscale_nlb_service" "http" { } resource "exoscale_nlb_service" "https" { - zone = exoscale_nlb.this.zone + count = var.create_nlb ? 1 : 0 + + zone = exoscale_nlb.this[0].zone name = "ingress-contoller-https" - nlb_id = exoscale_nlb.this.id + nlb_id = exoscale_nlb.this[0].id instance_pool_id = module.cluster.nodepools[local.router_nodepool].instance_pool_id protocol = "tcp" port = 443 @@ -95,6 +101,8 @@ resource "exoscale_nlb_service" "https" { } resource "exoscale_security_group_rule" "http" { + count = var.create_nlb ? 1 : 0 + security_group_id = module.cluster.this_security_group_id type = "INGRESS" protocol = "TCP" @@ -104,6 +112,8 @@ resource "exoscale_security_group_rule" "http" { } resource "exoscale_security_group_rule" "https" { + count = var.create_nlb ? 1 : 0 + security_group_id = module.cluster.this_security_group_id type = "INGRESS" protocol = "TCP" @@ -167,7 +177,7 @@ module "argocd" { { root_cert = base64encode(tls_self_signed_cert.root.cert_pem) root_key = base64encode(tls_private_key.root.private_key_pem) - router_pool_id = module.cluster.nodepools[local.router_nodepool].id + router_pool_id = var.create_nlb ? module.cluster.nodepools[local.router_nodepool].id : "" } ), var.app_of_apps_values_overrides, diff --git a/modules/sks/exoscale/outputs.tf b/modules/sks/exoscale/outputs.tf index 8fb37090a5..64f5baca82 100644 --- a/modules/sks/exoscale/outputs.tf +++ b/modules/sks/exoscale/outputs.tf @@ -14,5 +14,5 @@ output "keycloak_admin_password" { } output "nlb_ip_address" { - value = exoscale_nlb.this.ip_address + value = var.create_nlb ? exoscale_nlb.this[0].ip_address : null } diff --git a/modules/sks/exoscale/variables.tf b/modules/sks/exoscale/variables.tf index a6d80b71de..40a77e9c75 100644 --- a/modules/sks/exoscale/variables.tf +++ b/modules/sks/exoscale/variables.tf @@ -32,3 +32,9 @@ variable "keycloak_users" { type = map(map(string)) default = {} } + +variable "create_nlb" { + description = "Whether to create an NLB" + type = bool + default = true +} From 1eee6355fafb9bafffb53598c1f51a86733d55e1 Mon Sep 17 00:00:00 2001 From: Christian Kaenzig Date: Thu, 21 Oct 2021 08:48:31 +0200 Subject: [PATCH 2/8] DEBUGGING --- modules/sks/exoscale/main.tf | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/modules/sks/exoscale/main.tf b/modules/sks/exoscale/main.tf index 3d2847a5e6..cba468db1f 100644 --- a/modules/sks/exoscale/main.tf +++ b/modules/sks/exoscale/main.tf @@ -13,8 +13,11 @@ locals { default_nodepools = { "router-${var.cluster_name}" = { - size = 2 - instance_type = "standard.large" + size = 2 + instance_type = "standard.large" + instance_prefix = "pool" + disk_size = "50" + private_network_ids = [] }, } @@ -41,8 +44,9 @@ provider "kubernetes" { } module "cluster" { - source = "camptocamp/sks/exoscale" - version = "0.3.0" + source = "git::https://github.com/ckaenzig/terraform-exoscale-sks.git?ref=main" +# source = "camptocamp/sks/exoscale" +# version = "0.3.0" kubernetes_version = var.kubernetes_version name = var.cluster_name From f60150ca329aebef4d618f93cebb839dd7bc6aeb Mon Sep 17 00:00:00 2001 From: Christian Kaenzig Date: Wed, 27 Oct 2021 11:17:42 +0200 Subject: [PATCH 3/8] feat(sks): expose k8s cluster credentials in outputs --- modules/sks/exoscale/outputs.tf | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/modules/sks/exoscale/outputs.tf b/modules/sks/exoscale/outputs.tf index 64f5baca82..f9d1a6c7e5 100644 --- a/modules/sks/exoscale/outputs.tf +++ b/modules/sks/exoscale/outputs.tf @@ -16,3 +16,19 @@ output "keycloak_admin_password" { output "nlb_ip_address" { value = var.create_nlb ? exoscale_nlb.this[0].ip_address : null } + +output "kubernetes_host" { + value = local.kubernetes.host +} + +output "kubernetes_cluster_ca_certificate" { + value = local.kubernetes.cluster_ca_certificate +} + +output "kubernetes_client_key" { + value = local.kubernetes.client_key +} + +output "kubernetes_client_certificate" { + value = local.kubernetes.client_certificate +} From dbcfe4de849967acee405ac2ed40a8f7c22ebf31 Mon Sep 17 00:00:00 2001 From: Christian Kaenzig Date: Wed, 27 Oct 2021 13:44:45 +0200 Subject: [PATCH 4/8] feat(sks): add variable to control SG rule to node ports --- modules/sks/exoscale/main.tf | 2 ++ modules/sks/exoscale/variables.tf | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/modules/sks/exoscale/main.tf b/modules/sks/exoscale/main.tf index cba468db1f..28bb0e4ee4 100644 --- a/modules/sks/exoscale/main.tf +++ b/modules/sks/exoscale/main.tf @@ -53,6 +53,8 @@ module "cluster" { zone = var.zone nodepools = local.nodepools + + node_ports_world_accessible = var.node_ports_world_accessible } resource "exoscale_nlb" "this" { diff --git a/modules/sks/exoscale/variables.tf b/modules/sks/exoscale/variables.tf index 40a77e9c75..d2e7ce7123 100644 --- a/modules/sks/exoscale/variables.tf +++ b/modules/sks/exoscale/variables.tf @@ -27,6 +27,12 @@ variable "router_nodepool" { default = null } +variable "node_ports_world_accessible" { + description = "Whether NodePort services should be accessible without IP restriction." + type = bool + default = true +} + variable "keycloak_users" { description = "List of keycloak users" type = map(map(string)) From d3cd164d6ebd802bc7b45d731819518ab0759103 Mon Sep 17 00:00:00 2001 From: Christian Kaenzig Date: Wed, 27 Oct 2021 13:48:51 +0200 Subject: [PATCH 5/8] feat(sks): add output for cluster security group id --- modules/sks/exoscale/outputs.tf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/sks/exoscale/outputs.tf b/modules/sks/exoscale/outputs.tf index f9d1a6c7e5..ce3c392b61 100644 --- a/modules/sks/exoscale/outputs.tf +++ b/modules/sks/exoscale/outputs.tf @@ -17,6 +17,11 @@ output "nlb_ip_address" { value = var.create_nlb ? exoscale_nlb.this[0].ip_address : null } +output "cluster_security_group_id" { + description = "Security group ID attached to the SKS nodepool instances." + value = module.cluster.this_security_group_id +} + output "kubernetes_host" { value = local.kubernetes.host } From a25e09bc917a4582526f1538ca1c80e5d2ce14c2 Mon Sep 17 00:00:00 2001 From: Christian Kaenzig Date: Wed, 3 Nov 2021 15:11:41 +0100 Subject: [PATCH 6/8] DEBUGGING --insecure argocd config --- modules/sks/exoscale/values.tmpl.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/modules/sks/exoscale/values.tmpl.yaml b/modules/sks/exoscale/values.tmpl.yaml index 9d9b95ad06..9f30cb260b 100644 --- a/modules/sks/exoscale/values.tmpl.yaml +++ b/modules/sks/exoscale/values.tmpl.yaml @@ -5,11 +5,6 @@ apps: metrics-server: enabled: false -argo-cd: - server: - extraArgs: - - "--insecure" - cert-manager: tlsCrt: "${root_cert}" tlsKey: "${root_key}" From 67c0234c7800d15cae8a928c9cd9365fddffab96 Mon Sep 17 00:00:00 2001 From: Christian Kaenzig Date: Thu, 11 Nov 2021 16:04:21 +0100 Subject: [PATCH 7/8] fix(eks): keycloak admin pass output when not installed --- modules/sks/exoscale/outputs.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/sks/exoscale/outputs.tf b/modules/sks/exoscale/outputs.tf index ce3c392b61..a2b1618683 100644 --- a/modules/sks/exoscale/outputs.tf +++ b/modules/sks/exoscale/outputs.tf @@ -9,7 +9,7 @@ output "keycloak_users" { output "keycloak_admin_password" { description = "The password of Keycloak's admin user." - value = data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD + value = data.kubernetes_secret.keycloak_admin_password.data != null ? data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD : null sensitive = true } From 03e5ff673b254a153543bdf5f43a6b0409a358bb Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 18 Nov 2021 08:04:33 +0000 Subject: [PATCH 8/8] chore: release 0.49.0 --- CHANGELOG.md | 24 ++++++++++++++++++++++++ version.txt | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c0d681c7a3..96999b97cd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,29 @@ # Changelog +## [0.49.0](https://www.github.com/ckaenzig/devops-stack/compare/v0.48.0...v0.49.0) (2021-11-18) + + +### ⚠ BREAKING CHANGES + +* **eks:** send http traffic on NLB to port 80 on cluster (#810) + +### Features + +* **keycloak:** pass a user list to keycloak ([#788](https://www.github.com/ckaenzig/devops-stack/issues/788)) ([c2835ec](https://www.github.com/ckaenzig/devops-stack/commit/c2835ecaba5ffb02908fa77049cffecb976787e3)) +* **kind:** add experimental support for KIND ([#785](https://www.github.com/ckaenzig/devops-stack/issues/785)) ([518e3e6](https://www.github.com/ckaenzig/devops-stack/commit/518e3e6885082429298607314215e15fcacb0d07)) +* **sks:** add output for cluster security group id ([d3cd164](https://www.github.com/ckaenzig/devops-stack/commit/d3cd164d6ebd802bc7b45d731819518ab0759103)) +* **sks:** add variable to control SG rule to node ports ([dbcfe4d](https://www.github.com/ckaenzig/devops-stack/commit/dbcfe4de849967acee405ac2ed40a8f7c22ebf31)) +* **sks:** expose k8s cluster credentials in outputs ([f60150c](https://www.github.com/ckaenzig/devops-stack/commit/f60150ca329aebef4d618f93cebb839dd7bc6aeb)) +* **sks:** make NLB creation optional ([f008cc3](https://www.github.com/ckaenzig/devops-stack/commit/f008cc3ca29f65288d448ea018e330fab023137d)) +* **traefik:** tls version >= 1.2 ([#793](https://www.github.com/ckaenzig/devops-stack/issues/793)) ([c49580e](https://www.github.com/ckaenzig/devops-stack/commit/c49580efa834d1a5001abb18f0d9cf120970efc3)) + + +### Bug Fixes + +* **argocd:** fix kube-prometheus-stack dependency on OIDC ([#795](https://www.github.com/ckaenzig/devops-stack/issues/795)) ([5848af8](https://www.github.com/ckaenzig/devops-stack/commit/5848af8970a8c273b8243fae3f5dd98167af17d2)) +* **eks:** keycloak admin pass output when not installed ([67c0234](https://www.github.com/ckaenzig/devops-stack/commit/67c0234c7800d15cae8a928c9cd9365fddffab96)) +* **eks:** send http traffic on NLB to port 80 on cluster ([#810](https://www.github.com/ckaenzig/devops-stack/issues/810)) ([0cbd0eb](https://www.github.com/ckaenzig/devops-stack/commit/0cbd0eb05fcb818a623fa70489ad6b5f9302198b)) + ## [0.48.0](https://www.github.com/camptocamp/devops-stack/compare/v0.47.0...v0.48.0) (2021-09-22) diff --git a/version.txt b/version.txt index a758a09aae..5c4503b704 100644 --- a/version.txt +++ b/version.txt @@ -1 +1 @@ -0.48.0 +0.49.0