Felix Nehrke
4beb9e2844
With this change we no longer use user-data scripts on the provided machines. That makes it way easier for me to handle all the configuration, since I only have to run ansible. Furthermore this the burdon to think what may went wrong, since ansible is easier to debug than some arbitrary scripts which run at provisioning-time on the machines. With this change I should also think about restructuring the code a bit as well. Since it's actually easier to provide the initial software-stack for the cluster via ansible than via terraform, at least as far as I can tell right now.
117 lines
3.1 KiB
HCL
117 lines
3.1 KiB
HCL
locals {
|
|
network = "10.0.0.0/16"
|
|
subnet_eu_central = "10.0.0.0/24"
|
|
servers = {
|
|
for idx, config in var.servers : "${var.name}-server-${idx + 1}" => merge(
|
|
config,
|
|
{
|
|
ip = cidrhost(local.subnet_eu_central, idx + 2)
|
|
first_ip = idx == 0 ? "" : cidrhost(local.subnet_eu_central, 2)
|
|
}
|
|
)
|
|
}
|
|
agents = merge([
|
|
for idx, config in var.agents : {
|
|
for n in range(0, config.count) : "${var.name}-agent-${idx + 1}-${n + 1}" => merge(
|
|
config,
|
|
{ ip = cidrhost(local.subnet_eu_central, 255 - (idx * 20) - n - 1) }
|
|
)
|
|
}
|
|
]...)
|
|
all_ips = ["0.0.0.0/0", "::/0"]
|
|
ping_firewall = var.ping_enabled ? { "ping" : [{ protocol = "icmp", port = null }] } : {}
|
|
k8s_firewall = { "kubernetes" : [{ port = "6443", source_ips = concat([local.network], var.kubernetes_exposed_ips) }] }
|
|
ssh_firewall = length(var.ssh_exposed_ips) > 0 ? { "ssh" : [{ port = 1022, source_ips = var.ssh_exposed_ips }] } : {}
|
|
service_firewalls = { for service, ports in var.public_tcp_services : service => [for port in ports : { port = port }] }
|
|
firewalls = merge(
|
|
local.ping_firewall,
|
|
local.k8s_firewall,
|
|
local.ssh_firewall,
|
|
local.service_firewalls
|
|
)
|
|
}
|
|
|
|
resource "hcloud_network" "this" {
|
|
name = var.name
|
|
ip_range = local.network
|
|
}
|
|
|
|
resource "hcloud_network_subnet" "this" {
|
|
type = "cloud"
|
|
network_id = hcloud_network.this.id
|
|
network_zone = "eu-central"
|
|
ip_range = local.subnet_eu_central
|
|
}
|
|
|
|
resource "hcloud_network_route" "this" {
|
|
network_id = hcloud_network.this.id
|
|
destination = "0.0.0.0/0"
|
|
gateway = cidrhost(local.subnet_eu_central, 2)
|
|
}
|
|
|
|
resource "random_string" "k3s_token" {
|
|
length = 100
|
|
special = false
|
|
}
|
|
|
|
resource "hcloud_firewall" "this" {
|
|
for_each = local.firewalls
|
|
|
|
name = each.key
|
|
dynamic "rule" {
|
|
for_each = each.value
|
|
content {
|
|
direction = lookup(rule.value, "direction", "in")
|
|
protocol = lookup(rule.value, "protocol", "tcp")
|
|
source_ips = lookup(rule.value, "source_ips", local.all_ips)
|
|
port = lookup(rule.value, "port")
|
|
}
|
|
}
|
|
}
|
|
resource "hcloud_server" "server" {
|
|
depends_on = [hcloud_network_subnet.this]
|
|
for_each = local.servers
|
|
|
|
lifecycle {
|
|
ignore_changes = [ user_data ]
|
|
}
|
|
|
|
name = each.key
|
|
image = "ubuntu-24.04"
|
|
server_type = each.value.type
|
|
location = each.value.location
|
|
ssh_keys = var.ssh_keys
|
|
public_net {
|
|
ipv4 = each.value.ipv4_id
|
|
ipv6 = each.value.ipv6_id
|
|
}
|
|
network {
|
|
network_id = hcloud_network.this.id
|
|
ip = each.value.ip
|
|
}
|
|
firewall_ids = [for firewall in hcloud_firewall.this : firewall.id]
|
|
}
|
|
|
|
resource "hcloud_server" "agent" {
|
|
depends_on = [hcloud_server.server]
|
|
for_each = local.agents
|
|
|
|
lifecycle {
|
|
ignore_changes = [ user_data ]
|
|
}
|
|
|
|
name = each.key
|
|
image = "ubuntu-24.04"
|
|
server_type = each.value.type
|
|
location = each.value.location
|
|
ssh_keys = var.ssh_keys
|
|
public_net {
|
|
ipv4_enabled = false
|
|
ipv6_enabled = false
|
|
}
|
|
network {
|
|
network_id = hcloud_network.this.id
|
|
ip = each.value.ip
|
|
}
|
|
}
|