Skip to content

Commit e9e9d56

Browse files
muse-sisaymuse-sisay
committed
feat: create module for creating kubernetes cluster
1 parent a2dde0a commit e9e9d56

File tree

12 files changed

+359
-229
lines changed

12 files changed

+359
-229
lines changed

‎civo-github/templates/gpu-cluster/infrastructure/workspace.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,5 @@ spec:
1919
value: "<WORKLOAD_NODE_COUNT>"
2020
- key: node_type
2121
value: <WORKLOAD_NODE_TYPE>
22+
- key: cluster_type
23+
value: "talos"

‎civo-github/templates/workload-cluster/infrastructure/workspace.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,5 @@ spec:
1919
value: "<WORKLOAD_NODE_COUNT>"
2020
- key: node_type
2121
value: <WORKLOAD_NODE_TYPE>
22+
- key: cluster_type
23+
value: "k3s"

‎civo-github/terraform/civo/modules/civo-cluster/main.tf‎

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
resource "civo_network" "kubefirst" {
2+
label = var.cluster_name
3+
}
4+
5+
resource "civo_firewall" "kubefirst" {
6+
name = var.cluster_name
7+
network_id = civo_network.kubefirst.id
8+
create_default_rules = true
9+
}
10+
11+
resource "civo_kubernetes_cluster" "kubefirst" {
12+
name = var.cluster_name
13+
network_id = civo_network.kubefirst.id
14+
firewall_id = civo_firewall.kubefirst.id
15+
write_kubeconfig = true
16+
cluster_type = var.cluster_type
17+
pools {
18+
label = var.cluster_name
19+
size = var.node_type
20+
node_count = var.node_count
21+
labels = var.labels
22+
}
23+
}
24+
25+
resource "vault_generic_secret" "clusters" {
26+
path = "secret/clusters/${var.cluster_name}"
27+
28+
data_json = jsonencode(
29+
{
30+
kubeconfig = civo_kubernetes_cluster.kubefirst.kubeconfig
31+
client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data)
32+
client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data)
33+
cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data)
34+
host = civo_kubernetes_cluster.kubefirst.api_endpoint
35+
cluster_name = var.cluster_name
36+
argocd_manager_sa_token = kubernetes_secret_v1.argocd_manager.data.token
37+
}
38+
)
39+
}
40+
41+
provider "kubernetes" {
42+
host = civo_kubernetes_cluster.kubefirst.api_endpoint
43+
client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data)
44+
client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data)
45+
cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data)
46+
}
47+
48+
provider "helm" {
49+
repository_config_path = "${path.module}/.helm/repositories.yaml"
50+
repository_cache = "${path.module}/.helm"
51+
kubernetes {
52+
host = civo_kubernetes_cluster.kubefirst.api_endpoint
53+
client_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-certificate-data)
54+
client_key = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).users[0].user.client-key-data)
55+
cluster_ca_certificate = base64decode(yamldecode(civo_kubernetes_cluster.kubefirst.kubeconfig).clusters[0].cluster.certificate-authority-data)
56+
}
57+
}
58+
59+
resource "kubernetes_cluster_role_v1" "argocd_manager" {
60+
metadata {
61+
name = "argocd-manager-role"
62+
}
63+
64+
rule {
65+
api_groups = ["*"]
66+
resources = ["*"]
67+
verbs = ["*"]
68+
}
69+
rule {
70+
non_resource_urls = ["*"]
71+
verbs = ["*"]
72+
}
73+
}
74+
75+
76+
resource "kubernetes_cluster_role_binding_v1" "argocd_manager" {
77+
metadata {
78+
name = "argocd-manager-role-binding"
79+
}
80+
role_ref {
81+
api_group = "rbac.authorization.k8s.io"
82+
kind = "ClusterRole"
83+
name = kubernetes_cluster_role_v1.argocd_manager.metadata.0.name
84+
}
85+
subject {
86+
kind = "ServiceAccount"
87+
name = kubernetes_service_account_v1.argocd_manager.metadata.0.name
88+
namespace = "kube-system"
89+
}
90+
}
91+
92+
resource "kubernetes_service_account_v1" "argocd_manager" {
93+
metadata {
94+
name = "argocd-manager"
95+
namespace = "kube-system"
96+
}
97+
secret {
98+
name = "argocd-manager-token"
99+
}
100+
}
101+
102+
resource "kubernetes_secret_v1" "argocd_manager" {
103+
metadata {
104+
name = "argocd-manager-token"
105+
namespace = "kube-system"
106+
annotations = {
107+
"kubernetes.io/service-account.name" = "argocd-manager"
108+
}
109+
}
110+
type = "kubernetes.io/service-account-token"
111+
depends_on = [kubernetes_service_account_v1.argocd_manager]
112+
}
113+
114+
resource "kubernetes_namespace_v1" "external_dns" {
115+
metadata {
116+
name = "external-dns"
117+
}
118+
}
119+
120+
data "vault_generic_secret" "external_dns" {
121+
path = "secret/external-dns"
122+
}
123+
124+
resource "kubernetes_secret_v1" "external_dns" {
125+
metadata {
126+
name = "external-dns-secrets"
127+
namespace = kubernetes_namespace_v1.external_dns.metadata.0.name
128+
}
129+
data = {
130+
token = data.vault_generic_secret.external_dns.data["token"]
131+
}
132+
type = "Opaque"
133+
}
134+
135+
136+
resource "kubernetes_namespace_v1" "external_secrets_operator" {
137+
metadata {
138+
name = "external-secrets-operator"
139+
}
140+
}
141+
142+
resource "kubernetes_namespace_v1" "environment" {
143+
metadata {
144+
name = var.cluster_name
145+
}
146+
}
147+
148+
data "vault_generic_secret" "docker_config" {
149+
path = "secret/dockerconfigjson"
150+
}
151+
152+
resource "kubernetes_secret_v1" "image_pull" {
153+
metadata {
154+
name = "docker-config"
155+
namespace = kubernetes_namespace_v1.environment.metadata.0.name
156+
}
157+
158+
data = {
159+
".dockerconfigjson" = data.vault_generic_secret.docker_config.data["dockerconfig"]
160+
}
161+
162+
type = "kubernetes.io/dockerconfigjson"
163+
}
164+
165+
data "vault_generic_secret" "external_secrets_operator" {
166+
path = "secret/atlantis"
167+
}
168+
169+
resource "kubernetes_secret_v1" "external_secrets_operator_environment" {
170+
metadata {
171+
name = "${var.cluster_name}-cluster-vault-bootstrap"
172+
namespace = kubernetes_namespace_v1.environment.metadata.0.name
173+
}
174+
data = {
175+
vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"]
176+
}
177+
type = "Opaque"
178+
}
179+
180+
resource "kubernetes_secret_v1" "external_secrets_operator" {
181+
metadata {
182+
name = "${var.cluster_name}-cluster-vault-bootstrap"
183+
namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name
184+
}
185+
data = {
186+
vault-token = data.vault_generic_secret.external_secrets_operator.data["VAULT_TOKEN"]
187+
}
188+
type = "Opaque"
189+
}
190+
191+
resource "kubernetes_service_account_v1" "external_secrets" {
192+
metadata {
193+
name = "external-secrets"
194+
namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name
195+
}
196+
secret {
197+
name = "external-secrets-token"
198+
}
199+
}
200+
201+
resource "kubernetes_secret_v1" "external_secrets" {
202+
metadata {
203+
name = "external-secrets-token"
204+
namespace = kubernetes_namespace_v1.external_secrets_operator.metadata.0.name
205+
annotations = {
206+
"kubernetes.io/service-account.name" = "external-secrets"
207+
}
208+
}
209+
type = "kubernetes.io/service-account-token"
210+
depends_on = [kubernetes_service_account_v1.external_secrets]
211+
}
212+
213+
resource "kubernetes_config_map" "kubefirst_cm" {
214+
metadata {
215+
name = "kubefirst-cm"
216+
namespace = "kube-system"
217+
}
218+
219+
data = {
220+
mgmt_cluster_id = var.mgmt_cluster_id
221+
}
222+
}

‎civo-github/terraform/civo/modules/civo-cluster/output.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "kubeconfig" {
2+
value = civo_kubernetes_cluster.kubefirst.kubeconfig
3+
}
4+
5+
output "api_endpoint" {
6+
value = civo_kubernetes_cluster.kubefirst.api_endpoint
7+
}

‎civo-github/terraform/civo/modules/civo-cluster/provider.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
terraform {
2+
required_providers {
3+
civo = {
4+
source = "civo/civo"
5+
version = "~> 1.1.0"
6+
}
7+
}
8+
}

‎civo-github/terraform/civo/modules/civo-cluster/variables.tf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
variable "cluster_name" {
2+
type = string
3+
}
4+
5+
variable "cluster_region" {
6+
type = string
7+
}
8+
9+
variable "environment" {
10+
type = string
11+
}
12+
13+
variable "node_count" {
14+
type = number
15+
}
16+
17+
variable "node_type" {
18+
type = string
19+
}
20+
21+
variable "cluster_type" {
22+
type = string
23+
description = "type of cluster talos/k3s"
24+
}
25+
26+
variable "labels" {
27+
type = map(string)
28+
}
29+
30+
variable "mgmt_cluster_id" {
31+
type = string
32+
}

0 commit comments

Comments
 (0)