chore: release 0.49.0

CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.49.0](https://www.github.com/ckaenzig/devops-stack/compare/v0.48.0...v0.49.0) (2021-11-18)
+
+
+### ⚠ BREAKING CHANGES
+
+* **eks:** send http traffic on NLB to port 80 on cluster (#810)
+
+### Features
+
+* **keycloak:** pass a user list to keycloak ([#788](https://www.github.com/ckaenzig/devops-stack/issues/788)) ([c2835ec](https://www.github.com/ckaenzig/devops-stack/commit/c2835ecaba5ffb02908fa77049cffecb976787e3))
+* **kind:** add experimental support for KIND ([#785](https://www.github.com/ckaenzig/devops-stack/issues/785)) ([518e3e6](https://www.github.com/ckaenzig/devops-stack/commit/518e3e6885082429298607314215e15fcacb0d07))
+* **sks:** add output for cluster security group id ([d3cd164](https://www.github.com/ckaenzig/devops-stack/commit/d3cd164d6ebd802bc7b45d731819518ab0759103))
+* **sks:** add variable to control SG rule to node ports ([dbcfe4d](https://www.github.com/ckaenzig/devops-stack/commit/dbcfe4de849967acee405ac2ed40a8f7c22ebf31))
+* **sks:** expose k8s cluster credentials in outputs ([f60150c](https://www.github.com/ckaenzig/devops-stack/commit/f60150ca329aebef4d618f93cebb839dd7bc6aeb))
+* **sks:** make NLB creation optional ([f008cc3](https://www.github.com/ckaenzig/devops-stack/commit/f008cc3ca29f65288d448ea018e330fab023137d))
+* **traefik:** tls version >= 1.2 ([#793](https://www.github.com/ckaenzig/devops-stack/issues/793)) ([c49580e](https://www.github.com/ckaenzig/devops-stack/commit/c49580efa834d1a5001abb18f0d9cf120970efc3))
+
+
+### Bug Fixes
+
+* **argocd:** fix kube-prometheus-stack dependency on OIDC ([#795](https://www.github.com/ckaenzig/devops-stack/issues/795)) ([5848af8](https://www.github.com/ckaenzig/devops-stack/commit/5848af8970a8c273b8243fae3f5dd98167af17d2))
+* **eks:** keycloak admin pass output when not installed ([67c0234](https://www.github.com/ckaenzig/devops-stack/commit/67c0234c7800d15cae8a928c9cd9365fddffab96))
+* **eks:** send http traffic on NLB to port 80 on cluster ([#810](https://www.github.com/ckaenzig/devops-stack/issues/810)) ([0cbd0eb](https://www.github.com/ckaenzig/devops-stack/commit/0cbd0eb05fcb818a623fa70489ad6b5f9302198b))
+
 ## [0.48.0](https://www.github.com/camptocamp/devops-stack/compare/v0.47.0...v0.48.0) (2021-09-22)
 
 

modules/sks/exoscale/main.tf

@@ -1,5 +1,5 @@
 locals {
-  base_domain = coalesce(var.base_domain, format("%s.nip.io", replace(exoscale_nlb.this.ip_address, ".", "-")))
+  base_domain = coalesce(var.base_domain, var.create_nlb ? format("%s.nip.io", replace(exoscale_nlb.this[0].ip_address, ".", "-")) : "example.com")
 
   kubeconfig = module.cluster.kubeconfig
   context    = yamldecode(module.cluster.kubeconfig)
@@ -13,8 +13,11 @@ locals {
 
   default_nodepools = {
     "router-${var.cluster_name}" = {
-      size          = 2
-      instance_type = "standard.large"
+      size                = 2
+      instance_type       = "standard.large"
+      instance_prefix     = "pool"
+      disk_size           = "50"
+      private_network_ids = []
     },
   }
 
@@ -41,25 +44,32 @@ provider "kubernetes" {
 }
 
 module "cluster" {
-  source  = "camptocamp/sks/exoscale"
-  version = "0.3.0"
+  source = "git::https://github.com/ckaenzig/terraform-exoscale-sks.git?ref=main"
+#  source  = "camptocamp/sks/exoscale"
+#  version = "0.3.0"
 
   kubernetes_version = var.kubernetes_version
   name               = var.cluster_name
   zone               = var.zone
 
   nodepools = local.nodepools
+
+  node_ports_world_accessible = var.node_ports_world_accessible
 }
 
 resource "exoscale_nlb" "this" {
+  count = var.create_nlb ? 1 : 0
+
   zone = var.zone
   name = format("ingresses-%s", var.cluster_name)
 }
 
 resource "exoscale_nlb_service" "http" {
-  zone             = exoscale_nlb.this.zone
+  count = var.create_nlb ? 1 : 0
+
+  zone             = exoscale_nlb.this[0].zone
   name             = "ingress-contoller-http"
-  nlb_id           = exoscale_nlb.this.id
+  nlb_id           = exoscale_nlb.this[0].id
   instance_pool_id = module.cluster.nodepools[local.router_nodepool].instance_pool_id
   protocol         = "tcp"
   port             = 80
@@ -76,9 +86,11 @@ resource "exoscale_nlb_service" "http" {
 }
 
 resource "exoscale_nlb_service" "https" {
-  zone             = exoscale_nlb.this.zone
+  count = var.create_nlb ? 1 : 0
+
+  zone             = exoscale_nlb.this[0].zone
   name             = "ingress-contoller-https"
-  nlb_id           = exoscale_nlb.this.id
+  nlb_id           = exoscale_nlb.this[0].id
   instance_pool_id = module.cluster.nodepools[local.router_nodepool].instance_pool_id
   protocol         = "tcp"
   port             = 443
@@ -95,6 +107,8 @@ resource "exoscale_nlb_service" "https" {
 }
 
 resource "exoscale_security_group_rule" "http" {
+  count = var.create_nlb ? 1 : 0
+
   security_group_id = module.cluster.this_security_group_id
   type              = "INGRESS"
   protocol          = "TCP"
@@ -104,6 +118,8 @@ resource "exoscale_security_group_rule" "http" {
 }
 
 resource "exoscale_security_group_rule" "https" {
+  count = var.create_nlb ? 1 : 0
+
   security_group_id = module.cluster.this_security_group_id
   type              = "INGRESS"
   protocol          = "TCP"
@@ -167,7 +183,7 @@ module "argocd" {
       {
         root_cert      = base64encode(tls_self_signed_cert.root.cert_pem)
         root_key       = base64encode(tls_private_key.root.private_key_pem)
-        router_pool_id = module.cluster.nodepools[local.router_nodepool].id
+        router_pool_id = var.create_nlb ? module.cluster.nodepools[local.router_nodepool].id : ""
       }
     ),
     var.app_of_apps_values_overrides,

modules/sks/exoscale/outputs.tf

@@ -9,10 +9,31 @@ output "keycloak_users" {
 
 output "keycloak_admin_password" {
   description = "The password of Keycloak's admin user."
-  value       = data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD
+  value       = data.kubernetes_secret.keycloak_admin_password.data != null ? data.kubernetes_secret.keycloak_admin_password.data.ADMIN_PASSWORD : null
   sensitive   = true
 }
 
 output "nlb_ip_address" {
-  value = exoscale_nlb.this.ip_address
+  value = var.create_nlb ? exoscale_nlb.this[0].ip_address : null
+}
+
+output "cluster_security_group_id" {
+  description = "Security group ID attached to the SKS nodepool instances."
+  value       = module.cluster.this_security_group_id
+}
+
+output "kubernetes_host" {
+  value = local.kubernetes.host
+}
+
+output "kubernetes_cluster_ca_certificate" {
+  value = local.kubernetes.cluster_ca_certificate
+}
+
+output "kubernetes_client_key" {
+  value = local.kubernetes.client_key
+}
+
+output "kubernetes_client_certificate" {
+  value = local.kubernetes.client_certificate
 }

modules/sks/exoscale/values.tmpl.yaml

@@ -5,11 +5,6 @@ apps:
   metrics-server:
     enabled: false
 
-argo-cd:
-  server:
-    extraArgs:
-      - "--insecure"
-
 cert-manager:
   tlsCrt: "${root_cert}"
   tlsKey: "${root_key}"

modules/sks/exoscale/variables.tf

@@ -27,8 +27,20 @@ variable "router_nodepool" {
   default     = null
 }
 
+variable "node_ports_world_accessible" {
+  description = "Whether NodePort services should be accessible without IP restriction."
+  type        = bool
+  default     = true
+}
+
 variable "keycloak_users" {
   description = "List of keycloak users"
   type        = map(map(string))
   default = {}
 }
+
+variable "create_nlb" {
+  description = "Whether to create an NLB"
+  type        = bool
+  default     = true
+}

version.txt

@@ -1 +1 @@
-0.48.0
+0.49.0