mirror of
https://github.com/openshift/installer.git
synced 2026-02-05 15:47:14 +01:00
48922dc6e3
Currently all nodes are exposed on the default public network. This fixes it by only exposing the master nodes on the public network and restricts etcd and worker nodes on a private subnet.
79 lines
2.0 KiB
HCL
79 lines
2.0 KiB
HCL
resource "openstack_compute_instance_v2" "control_node" {
|
|
count = "${var.controller_count}"
|
|
name = "${var.cluster_name}_control_node_${count.index}"
|
|
image_id = "${var.image_id}"
|
|
flavor_id = "${var.flavor_id}"
|
|
key_pair = "${openstack_compute_keypair_v2.k8s_keypair.name}"
|
|
security_groups = ["${openstack_compute_secgroup_v2.k8s_control_group.name}"]
|
|
|
|
metadata {
|
|
role = "controller"
|
|
}
|
|
|
|
user_data = "${data.template_file.userdata-master.*.rendered[count.index]}"
|
|
config_drive = false
|
|
|
|
network {
|
|
uuid = "${openstack_networking_network_v2.network.id}"
|
|
}
|
|
|
|
network {
|
|
name = "${var.public_network_name}"
|
|
access_network = true
|
|
}
|
|
}
|
|
|
|
resource "openstack_compute_secgroup_v2" "k8s_control_group" {
|
|
name = "${var.cluster_name}_control_group"
|
|
description = "security group for k8s controllers: SSH and https"
|
|
|
|
rule {
|
|
from_port = 22
|
|
to_port = 22
|
|
ip_protocol = "tcp"
|
|
cidr = "0.0.0.0/0"
|
|
}
|
|
|
|
rule {
|
|
from_port = 443
|
|
to_port = 443
|
|
ip_protocol = "tcp"
|
|
cidr = "0.0.0.0/0"
|
|
}
|
|
|
|
rule {
|
|
from_port = -1
|
|
to_port = -1
|
|
ip_protocol = "icmp"
|
|
cidr = "0.0.0.0/0"
|
|
}
|
|
}
|
|
|
|
resource "null_resource" "copy_assets" {
|
|
# Changes to any instance of the cluster requires re-provisioning
|
|
triggers {
|
|
cluster_instance_ids = "${join(" ", openstack_compute_instance_v2.control_node.*.id)}"
|
|
}
|
|
|
|
# Bootstrap script can run on any instance of the cluster
|
|
# So we just choose the first in this case
|
|
connection {
|
|
user = "core"
|
|
private_key = "${tls_private_key.core.private_key_pem}"
|
|
host = "${element(openstack_compute_instance_v2.control_node.*.access_ip_v4, 0)}"
|
|
}
|
|
|
|
provisioner "file" {
|
|
source = "${path.module}/../assets"
|
|
destination = "/home/core/assets"
|
|
}
|
|
|
|
provisioner "remote-exec" {
|
|
inline = [
|
|
"sudo mv /home/core/assets /opt/bootkube/",
|
|
"sudo chmod a+x /opt/bootkube/assets/bootkube-start",
|
|
"sudo systemctl start bootkube",
|
|
]
|
|
}
|
|
}
|