mirror of https://github.com/kubernetes/kops.git
910 lines
35 KiB
HCL
910 lines
35 KiB
HCL
locals {
|
|
cluster_name = "complex.example.com"
|
|
master_autoscaling_group_ids = [aws_autoscaling_group.master-us-test-1a-masters-complex-example-com.id]
|
|
master_security_group_ids = [aws_security_group.masters-complex-example-com.id, "sg-exampleid5", "sg-exampleid6"]
|
|
masters_role_arn = aws_iam_role.masters-complex-example-com.arn
|
|
masters_role_name = aws_iam_role.masters-complex-example-com.name
|
|
node_autoscaling_group_ids = [aws_autoscaling_group.nodes-complex-example-com.id]
|
|
node_security_group_ids = [aws_security_group.nodes-complex-example-com.id, "sg-exampleid3", "sg-exampleid4"]
|
|
node_subnet_ids = [aws_subnet.us-test-1a-complex-example-com.id]
|
|
nodes_role_arn = aws_iam_role.nodes-complex-example-com.arn
|
|
nodes_role_name = aws_iam_role.nodes-complex-example-com.name
|
|
region = "us-test-1"
|
|
route_table_public_id = aws_route_table.complex-example-com.id
|
|
subnet_us-test-1a_id = aws_subnet.us-test-1a-complex-example-com.id
|
|
vpc_cidr_block = aws_vpc.complex-example-com.cidr_block
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
output "cluster_name" {
|
|
value = "complex.example.com"
|
|
}
|
|
|
|
output "master_autoscaling_group_ids" {
|
|
value = [aws_autoscaling_group.master-us-test-1a-masters-complex-example-com.id]
|
|
}
|
|
|
|
output "master_security_group_ids" {
|
|
value = [aws_security_group.masters-complex-example-com.id, "sg-exampleid5", "sg-exampleid6"]
|
|
}
|
|
|
|
output "masters_role_arn" {
|
|
value = aws_iam_role.masters-complex-example-com.arn
|
|
}
|
|
|
|
output "masters_role_name" {
|
|
value = aws_iam_role.masters-complex-example-com.name
|
|
}
|
|
|
|
output "node_autoscaling_group_ids" {
|
|
value = [aws_autoscaling_group.nodes-complex-example-com.id]
|
|
}
|
|
|
|
output "node_security_group_ids" {
|
|
value = [aws_security_group.nodes-complex-example-com.id, "sg-exampleid3", "sg-exampleid4"]
|
|
}
|
|
|
|
output "node_subnet_ids" {
|
|
value = [aws_subnet.us-test-1a-complex-example-com.id]
|
|
}
|
|
|
|
output "nodes_role_arn" {
|
|
value = aws_iam_role.nodes-complex-example-com.arn
|
|
}
|
|
|
|
output "nodes_role_name" {
|
|
value = aws_iam_role.nodes-complex-example-com.name
|
|
}
|
|
|
|
output "region" {
|
|
value = "us-test-1"
|
|
}
|
|
|
|
output "route_table_public_id" {
|
|
value = aws_route_table.complex-example-com.id
|
|
}
|
|
|
|
output "subnet_us-test-1a_id" {
|
|
value = aws_subnet.us-test-1a-complex-example-com.id
|
|
}
|
|
|
|
output "vpc_cidr_block" {
|
|
value = aws_vpc.complex-example-com.cidr_block
|
|
}
|
|
|
|
output "vpc_id" {
|
|
value = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
provider "aws" {
|
|
region = "us-test-1"
|
|
}
|
|
|
|
resource "aws_autoscaling_group" "master-us-test-1a-masters-complex-example-com" {
|
|
enabled_metrics = ["GroupDesiredCapacity", "GroupInServiceInstances", "GroupMaxSize", "GroupMinSize", "GroupPendingInstances", "GroupStandbyInstances", "GroupTerminatingInstances", "GroupTotalInstances"]
|
|
launch_template {
|
|
id = aws_launch_template.master-us-test-1a-masters-complex-example-com.id
|
|
version = aws_launch_template.master-us-test-1a-masters-complex-example-com.latest_version
|
|
}
|
|
max_size = 1
|
|
metrics_granularity = "1Minute"
|
|
min_size = 1
|
|
name = "master-us-test-1a.masters.complex.example.com"
|
|
tag {
|
|
key = "KubernetesCluster"
|
|
propagate_at_launch = true
|
|
value = "complex.example.com"
|
|
}
|
|
tag {
|
|
key = "Name"
|
|
propagate_at_launch = true
|
|
value = "master-us-test-1a.masters.complex.example.com"
|
|
}
|
|
tag {
|
|
key = "Owner"
|
|
propagate_at_launch = true
|
|
value = "John Doe"
|
|
}
|
|
tag {
|
|
key = "foo/bar"
|
|
propagate_at_launch = true
|
|
value = "fib+baz"
|
|
}
|
|
tag {
|
|
key = "k8s.io/cluster-autoscaler/node-template/label/kubernetes.io/role"
|
|
propagate_at_launch = true
|
|
value = "master"
|
|
}
|
|
tag {
|
|
key = "k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/control-plane"
|
|
propagate_at_launch = true
|
|
value = ""
|
|
}
|
|
tag {
|
|
key = "k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/master"
|
|
propagate_at_launch = true
|
|
value = ""
|
|
}
|
|
tag {
|
|
key = "k8s.io/role/master"
|
|
propagate_at_launch = true
|
|
value = "1"
|
|
}
|
|
tag {
|
|
key = "kops.k8s.io/instancegroup"
|
|
propagate_at_launch = true
|
|
value = "master-us-test-1a"
|
|
}
|
|
tag {
|
|
key = "kubernetes.io/cluster/complex.example.com"
|
|
propagate_at_launch = true
|
|
value = "owned"
|
|
}
|
|
target_group_arns = [aws_lb_target_group.tcp-complex-example-com-vpjolq.id, aws_lb_target_group.tls-complex-example-com-5nursn.id]
|
|
vpc_zone_identifier = [aws_subnet.us-test-1a-complex-example-com.id]
|
|
}
|
|
|
|
resource "aws_autoscaling_group" "nodes-complex-example-com" {
|
|
enabled_metrics = ["GroupDesiredCapacity", "GroupInServiceInstances", "GroupMaxSize", "GroupMinSize", "GroupPendingInstances", "GroupStandbyInstances", "GroupTerminatingInstances", "GroupTotalInstances"]
|
|
launch_template {
|
|
id = aws_launch_template.nodes-complex-example-com.id
|
|
version = aws_launch_template.nodes-complex-example-com.latest_version
|
|
}
|
|
max_size = 2
|
|
metrics_granularity = "1Minute"
|
|
min_size = 2
|
|
name = "nodes.complex.example.com"
|
|
suspended_processes = ["AZRebalance"]
|
|
tag {
|
|
key = "KubernetesCluster"
|
|
propagate_at_launch = true
|
|
value = "complex.example.com"
|
|
}
|
|
tag {
|
|
key = "Name"
|
|
propagate_at_launch = true
|
|
value = "nodes.complex.example.com"
|
|
}
|
|
tag {
|
|
key = "Owner"
|
|
propagate_at_launch = true
|
|
value = "John Doe"
|
|
}
|
|
tag {
|
|
key = "foo/bar"
|
|
propagate_at_launch = true
|
|
value = "fib+baz"
|
|
}
|
|
tag {
|
|
key = "k8s.io/cluster-autoscaler/node-template/label/kubernetes.io/role"
|
|
propagate_at_launch = true
|
|
value = "node"
|
|
}
|
|
tag {
|
|
key = "k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/node"
|
|
propagate_at_launch = true
|
|
value = ""
|
|
}
|
|
tag {
|
|
key = "k8s.io/role/node"
|
|
propagate_at_launch = true
|
|
value = "1"
|
|
}
|
|
tag {
|
|
key = "kops.k8s.io/instancegroup"
|
|
propagate_at_launch = true
|
|
value = "nodes"
|
|
}
|
|
tag {
|
|
key = "kubernetes.io/cluster/complex.example.com"
|
|
propagate_at_launch = true
|
|
value = "owned"
|
|
}
|
|
vpc_zone_identifier = [aws_subnet.us-test-1a-complex-example-com.id]
|
|
}
|
|
|
|
resource "aws_ebs_volume" "a-etcd-events-complex-example-com" {
|
|
availability_zone = "us-test-1a"
|
|
encrypted = false
|
|
size = 20
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "a.etcd-events.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"k8s.io/etcd/events" = "a/a"
|
|
"k8s.io/role/master" = "1"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
type = "gp2"
|
|
}
|
|
|
|
resource "aws_ebs_volume" "a-etcd-main-complex-example-com" {
|
|
availability_zone = "us-test-1a"
|
|
encrypted = false
|
|
size = 20
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "a.etcd-main.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"k8s.io/etcd/main" = "a/a"
|
|
"k8s.io/role/master" = "1"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
type = "gp2"
|
|
}
|
|
|
|
resource "aws_iam_instance_profile" "masters-complex-example-com" {
|
|
name = "masters.complex.example.com"
|
|
role = aws_iam_role.masters-complex-example-com.name
|
|
}
|
|
|
|
resource "aws_iam_instance_profile" "nodes-complex-example-com" {
|
|
name = "nodes.complex.example.com"
|
|
role = aws_iam_role.nodes-complex-example-com.name
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "masters-complex-example-com" {
|
|
name = "masters.complex.example.com"
|
|
policy = file("${path.module}/data/aws_iam_role_policy_masters.complex.example.com_policy")
|
|
role = aws_iam_role.masters-complex-example-com.name
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "nodes-complex-example-com" {
|
|
name = "nodes.complex.example.com"
|
|
policy = file("${path.module}/data/aws_iam_role_policy_nodes.complex.example.com_policy")
|
|
role = aws_iam_role.nodes-complex-example-com.name
|
|
}
|
|
|
|
resource "aws_iam_role" "masters-complex-example-com" {
|
|
assume_role_policy = file("${path.module}/data/aws_iam_role_masters.complex.example.com_policy")
|
|
name = "masters.complex.example.com"
|
|
permissions_boundary = "arn:aws:iam:00000000000:policy/boundaries"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "masters.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "nodes-complex-example-com" {
|
|
assume_role_policy = file("${path.module}/data/aws_iam_role_nodes.complex.example.com_policy")
|
|
name = "nodes.complex.example.com"
|
|
permissions_boundary = "arn:aws:iam:00000000000:policy/boundaries"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "nodes.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
|
|
resource "aws_internet_gateway" "complex-example-com" {
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_launch_template" "master-us-test-1a-masters-complex-example-com" {
|
|
block_device_mappings {
|
|
device_name = "/dev/xvda"
|
|
ebs {
|
|
delete_on_termination = true
|
|
encrypted = true
|
|
iops = 3000
|
|
kms_key_id = "arn:aws:kms:us-test-1:000000000000:key/1234abcd-12ab-34cd-56ef-1234567890ab"
|
|
throughput = 125
|
|
volume_size = 64
|
|
volume_type = "gp3"
|
|
}
|
|
}
|
|
block_device_mappings {
|
|
device_name = "/dev/sdc"
|
|
virtual_name = "ephemeral0"
|
|
}
|
|
iam_instance_profile {
|
|
name = aws_iam_instance_profile.masters-complex-example-com.id
|
|
}
|
|
image_id = "ami-12345678"
|
|
instance_type = "m3.medium"
|
|
lifecycle {
|
|
create_before_destroy = true
|
|
}
|
|
metadata_options {
|
|
http_endpoint = "enabled"
|
|
http_put_response_hop_limit = 1
|
|
http_tokens = "required"
|
|
}
|
|
name = "master-us-test-1a.masters.complex.example.com"
|
|
network_interfaces {
|
|
associate_public_ip_address = true
|
|
delete_on_termination = true
|
|
security_groups = [aws_security_group.masters-complex-example-com.id, "sg-exampleid5", "sg-exampleid6"]
|
|
}
|
|
tag_specifications {
|
|
resource_type = "instance"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "master-us-test-1a.masters.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"k8s.io/cluster-autoscaler/node-template/label/kubernetes.io/role" = "master"
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/control-plane" = ""
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/master" = ""
|
|
"k8s.io/role/master" = "1"
|
|
"kops.k8s.io/instancegroup" = "master-us-test-1a"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
tag_specifications {
|
|
resource_type = "volume"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "master-us-test-1a.masters.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"k8s.io/cluster-autoscaler/node-template/label/kubernetes.io/role" = "master"
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/control-plane" = ""
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/master" = ""
|
|
"k8s.io/role/master" = "1"
|
|
"kops.k8s.io/instancegroup" = "master-us-test-1a"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "master-us-test-1a.masters.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"k8s.io/cluster-autoscaler/node-template/label/kubernetes.io/role" = "master"
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/control-plane" = ""
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/master" = ""
|
|
"k8s.io/role/master" = "1"
|
|
"kops.k8s.io/instancegroup" = "master-us-test-1a"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
user_data = filebase64("${path.module}/data/aws_launch_template_master-us-test-1a.masters.complex.example.com_user_data")
|
|
}
|
|
|
|
resource "aws_launch_template" "nodes-complex-example-com" {
|
|
block_device_mappings {
|
|
device_name = "/dev/xvda"
|
|
ebs {
|
|
delete_on_termination = true
|
|
encrypted = true
|
|
iops = 3000
|
|
throughput = 125
|
|
volume_size = 128
|
|
volume_type = "gp3"
|
|
}
|
|
}
|
|
block_device_mappings {
|
|
device_name = "/dev/xvdd"
|
|
ebs {
|
|
delete_on_termination = true
|
|
encrypted = true
|
|
kms_key_id = "arn:aws:kms:us-test-1:000000000000:key/1234abcd-12ab-34cd-56ef-1234567890ab"
|
|
volume_size = 20
|
|
volume_type = "gp2"
|
|
}
|
|
}
|
|
iam_instance_profile {
|
|
name = aws_iam_instance_profile.nodes-complex-example-com.id
|
|
}
|
|
image_id = "ami-12345678"
|
|
instance_type = "t2.medium"
|
|
lifecycle {
|
|
create_before_destroy = true
|
|
}
|
|
metadata_options {
|
|
http_endpoint = "enabled"
|
|
http_put_response_hop_limit = 1
|
|
http_tokens = "required"
|
|
}
|
|
monitoring {
|
|
enabled = true
|
|
}
|
|
name = "nodes.complex.example.com"
|
|
network_interfaces {
|
|
associate_public_ip_address = true
|
|
delete_on_termination = true
|
|
security_groups = [aws_security_group.nodes-complex-example-com.id, "sg-exampleid3", "sg-exampleid4"]
|
|
}
|
|
tag_specifications {
|
|
resource_type = "instance"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "nodes.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"k8s.io/cluster-autoscaler/node-template/label/kubernetes.io/role" = "node"
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/node" = ""
|
|
"k8s.io/role/node" = "1"
|
|
"kops.k8s.io/instancegroup" = "nodes"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
tag_specifications {
|
|
resource_type = "volume"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "nodes.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"k8s.io/cluster-autoscaler/node-template/label/kubernetes.io/role" = "node"
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/node" = ""
|
|
"k8s.io/role/node" = "1"
|
|
"kops.k8s.io/instancegroup" = "nodes"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "nodes.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"k8s.io/cluster-autoscaler/node-template/label/kubernetes.io/role" = "node"
|
|
"k8s.io/cluster-autoscaler/node-template/label/node-role.kubernetes.io/node" = ""
|
|
"k8s.io/role/node" = "1"
|
|
"kops.k8s.io/instancegroup" = "nodes"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
user_data = filebase64("${path.module}/data/aws_launch_template_nodes.complex.example.com_user_data")
|
|
}
|
|
|
|
resource "aws_lb_listener" "api-complex-example-com-443" {
|
|
certificate_arn = "arn:aws:acm:us-test-1:000000000000:certificate/123456789012-1234-1234-1234-12345678"
|
|
default_action {
|
|
target_group_arn = aws_lb_target_group.tls-complex-example-com-5nursn.id
|
|
type = "forward"
|
|
}
|
|
load_balancer_arn = aws_lb.api-complex-example-com.id
|
|
port = 443
|
|
protocol = "TLS"
|
|
ssl_policy = "ELBSecurityPolicy-2016-08"
|
|
}
|
|
|
|
resource "aws_lb_listener" "api-complex-example-com-8443" {
|
|
default_action {
|
|
target_group_arn = aws_lb_target_group.tcp-complex-example-com-vpjolq.id
|
|
type = "forward"
|
|
}
|
|
load_balancer_arn = aws_lb.api-complex-example-com.id
|
|
port = 8443
|
|
protocol = "TCP"
|
|
}
|
|
|
|
resource "aws_lb_target_group" "tcp-complex-example-com-vpjolq" {
|
|
health_check {
|
|
healthy_threshold = 2
|
|
protocol = "TCP"
|
|
unhealthy_threshold = 2
|
|
}
|
|
name = "tcp-complex-example-com-vpjolq"
|
|
port = 443
|
|
protocol = "TCP"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "tcp-complex-example-com-vpjolq"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_lb_target_group" "tls-complex-example-com-5nursn" {
|
|
health_check {
|
|
healthy_threshold = 2
|
|
protocol = "TCP"
|
|
unhealthy_threshold = 2
|
|
}
|
|
name = "tls-complex-example-com-5nursn"
|
|
port = 443
|
|
protocol = "TLS"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "tls-complex-example-com-5nursn"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_lb" "api-complex-example-com" {
|
|
enable_cross_zone_load_balancing = true
|
|
internal = false
|
|
load_balancer_type = "network"
|
|
name = "api-complex-example-com-vd3t5n"
|
|
subnets = [aws_subnet.us-test-1a-complex-example-com.id]
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "api.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
|
|
resource "aws_route53_record" "api-complex-example-com" {
|
|
alias {
|
|
evaluate_target_health = false
|
|
name = aws_lb.api-complex-example-com.dns_name
|
|
zone_id = aws_lb.api-complex-example-com.zone_id
|
|
}
|
|
name = "api.complex.example.com"
|
|
type = "A"
|
|
zone_id = "/hostedzone/Z1AFAKE1ZON3YO"
|
|
}
|
|
|
|
resource "aws_route_table_association" "us-test-1a-complex-example-com" {
|
|
route_table_id = aws_route_table.complex-example-com.id
|
|
subnet_id = aws_subnet.us-test-1a-complex-example-com.id
|
|
}
|
|
|
|
resource "aws_route_table" "complex-example-com" {
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
"kubernetes.io/kops/role" = "public"
|
|
}
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_route" "route-0-0-0-0--0" {
|
|
destination_cidr_block = "0.0.0.0/0"
|
|
gateway_id = aws_internet_gateway.complex-example-com.id
|
|
route_table_id = aws_route_table.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-1-1-1-0--24-ingress-tcp-443to443-masters-complex-example-com" {
|
|
cidr_blocks = ["1.1.1.0/24"]
|
|
from_port = 443
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 443
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-1-1-1-1--32-ingress-tcp-22to22-masters-complex-example-com" {
|
|
cidr_blocks = ["1.1.1.1/32"]
|
|
from_port = 22
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 22
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-1-1-1-1--32-ingress-tcp-22to22-nodes-complex-example-com" {
|
|
cidr_blocks = ["1.1.1.1/32"]
|
|
from_port = 22
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 22
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-2001_0_8500__--40-ingress-tcp-443to443-masters-complex-example-com" {
|
|
cidr_blocks = ["2001:0:8500::/40"]
|
|
from_port = 443
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 443
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-2001_0_85a3__--48-ingress-tcp-22to22-masters-complex-example-com" {
|
|
cidr_blocks = ["2001:0:85a3::/48"]
|
|
from_port = 22
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 22
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-2001_0_85a3__--48-ingress-tcp-22to22-nodes-complex-example-com" {
|
|
cidr_blocks = ["2001:0:85a3::/48"]
|
|
from_port = 22
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 22
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-masters-complex-example-com-egress-all-0to0-0-0-0-0--0" {
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
from_port = 0
|
|
protocol = "-1"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 0
|
|
type = "egress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-masters-complex-example-com-ingress-all-0to0-masters-complex-example-com" {
|
|
from_port = 0
|
|
protocol = "-1"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
source_security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 0
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-masters-complex-example-com-ingress-all-0to0-nodes-complex-example-com" {
|
|
from_port = 0
|
|
protocol = "-1"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
source_security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 0
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-nodes-complex-example-com-egress-all-0to0-0-0-0-0--0" {
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
from_port = 0
|
|
protocol = "-1"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 0
|
|
type = "egress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-nodes-complex-example-com-ingress-all-0to0-nodes-complex-example-com" {
|
|
from_port = 0
|
|
protocol = "-1"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
source_security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 0
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-nodes-complex-example-com-ingress-tcp-1to2379-masters-complex-example-com" {
|
|
from_port = 1
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
source_security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 2379
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-nodes-complex-example-com-ingress-tcp-2382to4000-masters-complex-example-com" {
|
|
from_port = 2382
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
source_security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 4000
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-nodes-complex-example-com-ingress-tcp-4003to65535-masters-complex-example-com" {
|
|
from_port = 4003
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
source_security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 65535
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "from-nodes-complex-example-com-ingress-udp-1to65535-masters-complex-example-com" {
|
|
from_port = 1
|
|
protocol = "udp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
source_security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 65535
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "https-elb-to-master" {
|
|
cidr_blocks = ["172.20.0.0/16"]
|
|
from_port = 443
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 443
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "https-lb-to-master-10-1-0-0--16" {
|
|
cidr_blocks = ["10.1.0.0/16"]
|
|
from_port = 443
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 443
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "https-lb-to-master-10-2-0-0--16" {
|
|
cidr_blocks = ["10.2.0.0/16"]
|
|
from_port = 443
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 443
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "icmp-pmtu-api-elb-1-1-1-0--24" {
|
|
cidr_blocks = ["1.1.1.0/24"]
|
|
from_port = 3
|
|
protocol = "icmp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 4
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "icmp-pmtu-api-elb-2001_0_8500__--40" {
|
|
cidr_blocks = ["2001:0:8500::/40"]
|
|
from_port = 3
|
|
protocol = "icmp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 4
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "nodeport-tcp-external-to-node-1-2-3-4--32" {
|
|
cidr_blocks = ["1.2.3.4/32"]
|
|
from_port = 28000
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 32767
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "nodeport-tcp-external-to-node-10-20-30-0--24" {
|
|
cidr_blocks = ["10.20.30.0/24"]
|
|
from_port = 28000
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 32767
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "nodeport-udp-external-to-node-1-2-3-4--32" {
|
|
cidr_blocks = ["1.2.3.4/32"]
|
|
from_port = 28000
|
|
protocol = "udp"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 32767
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "nodeport-udp-external-to-node-10-20-30-0--24" {
|
|
cidr_blocks = ["10.20.30.0/24"]
|
|
from_port = 28000
|
|
protocol = "udp"
|
|
security_group_id = aws_security_group.nodes-complex-example-com.id
|
|
to_port = 32767
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "tcp-api-1-1-1-0--24" {
|
|
cidr_blocks = ["1.1.1.0/24"]
|
|
from_port = 8443
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 8443
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "tcp-api-2001_0_8500__--40" {
|
|
cidr_blocks = ["2001:0:8500::/40"]
|
|
from_port = 8443
|
|
protocol = "tcp"
|
|
security_group_id = aws_security_group.masters-complex-example-com.id
|
|
to_port = 8443
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group" "api-elb-complex-example-com" {
|
|
description = "Security group for api ELB"
|
|
name = "api-elb.complex.example.com"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "api-elb.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_security_group" "masters-complex-example-com" {
|
|
description = "Security group for masters"
|
|
name = "masters.complex.example.com"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "masters.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_security_group" "nodes-complex-example-com" {
|
|
description = "Security group for nodes"
|
|
name = "nodes.complex.example.com"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "nodes.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_subnet" "us-test-1a-complex-example-com" {
|
|
availability_zone = "us-test-1a"
|
|
cidr_block = "172.20.32.0/19"
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "us-test-1a.complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"SubnetType" = "Public"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
"kubernetes.io/role/elb" = "1"
|
|
}
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_vpc_dhcp_options_association" "complex-example-com" {
|
|
dhcp_options_id = aws_vpc_dhcp_options.complex-example-com.id
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_vpc_dhcp_options" "complex-example-com" {
|
|
domain_name = "us-test-1.compute.internal"
|
|
domain_name_servers = ["AmazonProvidedDNS"]
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
|
|
resource "aws_vpc_ipv4_cidr_block_association" "cidr-10-1-0-0--16" {
|
|
cidr_block = "10.1.0.0/16"
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_vpc_ipv4_cidr_block_association" "cidr-10-2-0-0--16" {
|
|
cidr_block = "10.2.0.0/16"
|
|
vpc_id = aws_vpc.complex-example-com.id
|
|
}
|
|
|
|
resource "aws_vpc" "complex-example-com" {
|
|
cidr_block = "172.20.0.0/16"
|
|
enable_dns_hostnames = true
|
|
enable_dns_support = true
|
|
tags = {
|
|
"KubernetesCluster" = "complex.example.com"
|
|
"Name" = "complex.example.com"
|
|
"Owner" = "John Doe"
|
|
"foo/bar" = "fib+baz"
|
|
"kubernetes.io/cluster/complex.example.com" = "owned"
|
|
}
|
|
}
|
|
|
|
terraform {
|
|
required_version = ">= 0.12.26"
|
|
required_providers {
|
|
aws = {
|
|
"source" = "hashicorp/aws"
|
|
"version" = ">= 2.46.0"
|
|
}
|
|
}
|
|
}
|