kjuulh/terraform-hcloud-kube-hetzner
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

clarified Hetzner IPs

Browse Source
This commit is contained in:
Karim Naufal 2022-02-27 23:51:05 +01:00
parent c0c27229f4
commit 48b15fafbf
1 changed files with 22 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
locals.tf
View File

@ -17,39 +17,35 @@ locals {
csi_version = var.hetzner_csi_version != null ? var.hetzner_csi_version : data.github_release.hetzner_csi.release_tag csi_version = var.hetzner_csi_version != null ? var.hetzner_csi_version : data.github_release.hetzner_csi.release_tag
kured_version = data.github_release.kured.release_tag kured_version = data.github_release.kured.release_tag
# The following IPs are important to be whitelisted because they communicate with Hetzner services and enable the CCM and CSI to work properly.
# Source https://github.com/hetznercloud/csi-driver/issues/204#issuecomment-848625566
hetzner_metadata_service_ipv4 = "169.254.169.254/32"
hetzner_cloud_api_ipv4 = "213.239.246.1/32"
whitelisted_ips = [
var.network_ipv4_range,
local.hetzner_metadata_service_ipv4,
local.hetzner_cloud_api_ipv4,
"127.0.0.1/32",
]
base_firewall_rules = [ base_firewall_rules = [
# Allowing internal cluster traffic and Hetzner metadata service and cloud API IPs # Allowing internal cluster traffic and Hetzner metadata service and cloud API IPs
{ {
direction = "in" direction = "in"
protocol = "tcp" protocol = "tcp"
port = "any" port = "any"
source_ips = [ source_ips = local.whitelisted_ips
var.network_ipv4_range,
"127.0.0.1/32",
"169.254.169.254/32",
"213.239.246.1/32"
]
}, },
{ {
direction = "in" direction = "in"
protocol = "udp" protocol = "udp"
port = "any" port = "any"
source_ips = [ source_ips = local.whitelisted_ips
var.network_ipv4_range,
"127.0.0.1/32",
"169.254.169.254/32",
"213.239.246.1/32"
]
}, },
{ {
direction = "in" direction = "in"
protocol = "icmp" protocol = "icmp"
source_ips = [ source_ips = local.whitelisted_ips
var.network_ipv4_range,
"127.0.0.1/32",
"169.254.169.254/32",
"213.239.246.1/32"
]
}, },
# Allow all traffic to the kube api server # Allow all traffic to the kube api server