112 lines
2.4 KiB
HCL
112 lines
2.4 KiB
HCL
resource "random_password" "k3s_token" {
|
|
length = 48
|
|
special = false
|
|
}
|
|
|
|
resource "hcloud_ssh_key" "default" {
|
|
name = "K3S terraform module - Provisioning SSH key"
|
|
public_key = local.ssh_public_key
|
|
}
|
|
|
|
resource "hcloud_network" "k3s" {
|
|
name = "k3s-net"
|
|
ip_range = "10.0.0.0/8"
|
|
}
|
|
|
|
resource "hcloud_network_subnet" "k3s" {
|
|
network_id = hcloud_network.k3s.id
|
|
type = "cloud"
|
|
network_zone = "eu-central"
|
|
ip_range = "10.0.0.0/16"
|
|
}
|
|
|
|
resource "hcloud_firewall" "k3s" {
|
|
name = "k3s-firewall"
|
|
|
|
# Internal cluster traffic, kube api server, kubelet metrics, cilium, etcd,
|
|
# and Hetzner metadata service and cloud api
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "any"
|
|
source_ips = [
|
|
"127.0.0.1/32",
|
|
"10.0.0.0/8",
|
|
"169.254.169.254/32",
|
|
"213.239.246.1/32"
|
|
]
|
|
}
|
|
rule {
|
|
direction = "in"
|
|
protocol = "udp"
|
|
port = "any"
|
|
source_ips = [
|
|
"127.0.0.1/32",
|
|
"10.0.0.0/8",
|
|
"169.254.169.254/32",
|
|
"213.239.246.1/32"
|
|
]
|
|
}
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = [
|
|
"127.0.0.1/32",
|
|
"10.0.0.0/8",
|
|
"169.254.169.254/32",
|
|
"213.239.246.1/32"
|
|
]
|
|
}
|
|
|
|
# Allow all traffic to the kube api server
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "6443"
|
|
source_ips = [
|
|
"0.0.0.0/0"
|
|
]
|
|
}
|
|
|
|
# Allow all traffic to the ssh port
|
|
rule {
|
|
direction = "in"
|
|
protocol = "tcp"
|
|
port = "22"
|
|
source_ips = [
|
|
"0.0.0.0/0"
|
|
]
|
|
}
|
|
|
|
# Allow ping on ipv4
|
|
rule {
|
|
direction = "in"
|
|
protocol = "icmp"
|
|
source_ips = [
|
|
"0.0.0.0/0"
|
|
]
|
|
}
|
|
}
|
|
|
|
|
|
locals {
|
|
first_control_plane_network_ip = cidrhost(hcloud_network.k3s.ip_range, 2)
|
|
ssh_public_key = trimspace(file(var.public_key))
|
|
hcloud_image_name = "ubuntu-20.04"
|
|
|
|
k3os_install_commands = [
|
|
"apt install -y grub-efi grub-pc-bin mtools xorriso",
|
|
"latest=$(curl -s https://api.github.com/repos/rancher/k3os/releases | jq '.[0].tag_name')",
|
|
"curl -Lo ./install.sh https://raw.githubusercontent.com/rancher/k3os/$(echo $latest | xargs)/install.sh",
|
|
"chmod +x ./install.sh",
|
|
"./install.sh --config /tmp/config.yaml /dev/sda https://github.com/rancher/k3os/releases/download/$(echo $latest | xargs)/k3os-amd64.iso",
|
|
"shutdown -r +1",
|
|
"sleep 3",
|
|
"exit 0"
|
|
]
|
|
}
|
|
|
|
data "hcloud_image" "linux" {
|
|
name = local.hcloud_image_name
|
|
}
|