Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(rancher): AWS - Variable to adjust security group ingress cidr #246

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

feat(rancher): AWS - Variable to adjust security group ingress cidr #246

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9febd3a
feat(rancher): AWS - Variable to adjust security group ingress cidr
wombelix Nov 5, 2024
289682f
feat(rancher): AWS - Split-horizon DNS setup to make rancher reachabl…
wombelix Nov 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 40 additions & 8 deletions rancher/aws/infra.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,17 +67,21 @@ resource "aws_route_table_association" "rancher_route_table_association" {
route_table_id = aws_route_table.rancher_route_table.id
}

# Security group to allow all traffic
resource "aws_security_group" "rancher_sg_allowall" {
name = "${var.prefix}-rancher-allowall"
description = "Rancher quickstart - allow all traffic"
# Security group to allow ingress and egress traffic
resource "aws_security_group" "rancher_security_group" {
# Adds unique suffix to the SG name, required by lifecycle policy
name_prefix = "${var.prefix}-rancher-security-group"
description = "Rancher quickstart - allow traffic from ${var.security_group_ingress_cidr}"
vpc_id = aws_vpc.rancher_vpc.id

ingress {
from_port = "0"
to_port = "0"
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
cidr_blocks = [
var.security_group_ingress_cidr
]
self = true
}

egress {
Expand All @@ -90,6 +94,11 @@ resource "aws_security_group" "rancher_sg_allowall" {
tags = {
Creator = "rancher-quickstart"
}

# Allows changes on existing SG without dependency violation
lifecycle {
create_before_destroy = true
}
}

# AWS EC2 instance for creating a single node RKE cluster and installing the Rancher server
Expand All @@ -101,7 +110,7 @@ resource "aws_instance" "rancher_server" {
instance_type = var.instance_type

key_name = aws_key_pair.quickstart_key_pair.key_name
vpc_security_group_ids = [aws_security_group.rancher_sg_allowall.id]
vpc_security_group_ids = [aws_security_group.rancher_security_group.id]
subnet_id = aws_subnet.rancher_subnet.id
associate_public_ip_address = true

Expand Down Expand Up @@ -130,6 +139,28 @@ resource "aws_instance" "rancher_server" {
}
}

# Split-horizon DNS setup to make rancher reachable through private ip inside vpc
resource "aws_route53_zone" "rancher_route53_private" {
name = "sslip.io"
comment = "${var.prefix}-rancher-route53"

vpc {
vpc_id = aws_vpc.rancher_vpc.id
}

tags = {
Name = "${var.prefix}-rancher-route53"
Creator = "rancher-quickstart"
}
}
resource "aws_route53_record" "rancher_sslip_private" {
zone_id = aws_route53_zone.rancher_route53_private.zone_id
name = join(".", ["rancher", aws_instance.rancher_server.public_ip, "sslip.io"])
type = "A"
ttl = 300
records = [aws_instance.rancher_server.private_ip]
}

# Rancher resources
module "rancher_common" {
source = "../rancher-common"
Expand All @@ -155,13 +186,14 @@ module "rancher_common" {
# AWS EC2 instance for creating a single node workload cluster
resource "aws_instance" "quickstart_node" {
depends_on = [
aws_route_table_association.rancher_route_table_association
aws_route_table_association.rancher_route_table_association,
aws_route53_record.rancher_sslip_private
]
ami = data.aws_ami.sles.id
instance_type = var.instance_type

key_name = aws_key_pair.quickstart_key_pair.key_name
vpc_security_group_ids = [aws_security_group.rancher_sg_allowall.id]
vpc_security_group_ids = [aws_security_group.rancher_security_group.id]
subnet_id = aws_subnet.rancher_subnet.id
associate_public_ip_address = true

Expand Down
5 changes: 4 additions & 1 deletion rancher/aws/terraform.tfvars.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,4 +42,7 @@ rancher_version = "2.7.9"
windows_instance_type = "t3a.large"

# Kubernetes version to use for managed workload cluster
workload_kubernetes_version = "v1.24.14+rke2r1"
workload_kubernetes_version = "v1.24.14+rke2r1"

# CIDR that is allowed to access the Rancher server and workload cluster, default: 0.0.0.0/0
security_group_ingress_cidr = "0.0.0.0/0"
6 changes: 6 additions & 0 deletions rancher/aws/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,12 @@ variable "add_windows_node" {
default = false
}

variable "security_group_ingress_cidr" {
type = string
description = "CIDR that is allowed to access the Rancher server and workload cluster, default: 0.0.0.0/0"
default = "0.0.0.0/0"
}

# Local variables used to reduce repetition
locals {
node_username = "ec2-user"
Expand Down
2 changes: 1 addition & 1 deletion rancher/aws/windows.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ resource "aws_instance" "quickstart_node_win" {
instance_type = var.windows_instance_type

key_name = aws_key_pair.quickstart_key_pair.key_name
vpc_security_group_ids = [aws_security_group.rancher_sg_allowall.id]
vpc_security_group_ids = [aws_security_group.rancher_security_group.id]
subnet_id = aws_subnet.rancher_subnet.id
associate_public_ip_address = true
get_password_data = true
Expand Down
3 changes: 2 additions & 1 deletion rancher/rancher-common/k3s.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,9 @@

resource "ssh_resource" "install_k3s" {
host = var.node_public_ip
# Advertise kube apiserver on internal ip (advertise-address), allow access in addition through public ip (tls-san)
commands = [
"bash -c 'curl https://get.k3s.io | INSTALL_K3S_EXEC=\"server --node-external-ip ${var.node_public_ip} --node-ip ${var.node_internal_ip}\" INSTALL_K3S_VERSION=${var.rancher_kubernetes_version} sh -'"
"bash -c 'curl https://get.k3s.io | INSTALL_K3S_EXEC=\"server --node-external-ip ${var.node_public_ip} --node-ip ${var.node_internal_ip} --advertise-address ${var.node_internal_ip} --tls-san ${var.node_public_ip}\" INSTALL_K3S_VERSION=${var.rancher_kubernetes_version} sh -'"
]
user = var.node_username
private_key = var.ssh_private_key_pem
Expand Down