matrix/matrix-ops
3
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Expose ingress externaly and remove external kube api endpoint

Browse source
This commit is contained in:
Magnus Andersson 2024-06-04 13:53:57 +02:00
parent 0d594247b4
commit fffa63b827
Signed by: mandersson
GPG key ID: 19CB2C58E1F19B16
4 changed files with 38 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
IaC-prod/nodes.tf
View file

@ -12,7 +12,8 @@ resource "openstack_networking_port_v2" "kubecport" {
security_group_ids = [ security_group_ids = [
data.openstack_networking_secgroup_v2.sshfromjumphosts.id, data.openstack_networking_secgroup_v2.sshfromjumphosts.id,
data.openstack_networking_secgroup_v2.allegress.id, data.openstack_networking_secgroup_v2.allegress.id,
resource.openstack_networking_secgroup_v2.microk8s.id resource.openstack_networking_secgroup_v2.microk8s.id,
resource.openstack_networking_secgroup_v2.https.id
] ]
admin_state_up = "true" admin_state_up = "true"
} }
@ -34,7 +35,8 @@ resource "openstack_compute_instance_v2" "controller-nodes" {
security_groups = [ security_groups = [
data.openstack_networking_secgroup_v2.sshfromjumphosts.name, data.openstack_networking_secgroup_v2.sshfromjumphosts.name,
data.openstack_networking_secgroup_v2.allegress.name, data.openstack_networking_secgroup_v2.allegress.name,
resource.openstack_networking_secgroup_v2.microk8s.name resource.openstack_networking_secgroup_v2.microk8s.name,
resource.openstack_networking_secgroup_v2.https.name
] ]
block_device { block_device {
uuid = resource.openstack_blockstorage_volume_v3.kubecvolumeboot[count.index].id uuid = resource.openstack_blockstorage_volume_v3.kubecvolumeboot[count.index].id

33
IaC-prod/securitygroups.tf
View file

@ -13,25 +13,24 @@ resource "openstack_networking_secgroup_v2" "microk8s" {
} }
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule1" { resource "openstack_networking_secgroup_rule_v2" "microk8s_rule1" {
#We never know where Richard is, so allow from all of the known internet
direction = "ingress" direction = "ingress"
ethertype = "IPv4" ethertype = "IPv4"
protocol = "tcp" protocol = "tcp"
port_range_min = 16443 port_range_min = 16443
port_range_max = 16443 port_range_max = 16443
remote_ip_prefix = "0.0.0.0/0" remote_group_id = openstack_networking_secgroup_v2.microk8s.id
security_group_id = openstack_networking_secgroup_v2.microk8s.id security_group_id = openstack_networking_secgroup_v2.microk8s.id
} }
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule2" { resource "openstack_networking_secgroup_rule_v2" "microk8s_rule2" {
#We never know where Richard is, so allow from all of the known internet
direction = "ingress" direction = "ingress"
ethertype = "IPv6" ethertype = "IPv6"
protocol = "tcp" protocol = "tcp"
port_range_min = 16443 port_range_min = 16443
port_range_max = 16443 port_range_max = 16443
remote_ip_prefix = "::/0" remote_group_id = openstack_networking_secgroup_v2.microk8s.id
security_group_id = openstack_networking_secgroup_v2.microk8s.id security_group_id = openstack_networking_secgroup_v2.microk8s.id
} }
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule3" { resource "openstack_networking_secgroup_rule_v2" "microk8s_rule3" {
direction = "ingress" direction = "ingress"
ethertype = "IPv4" ethertype = "IPv4"
@ -177,21 +176,19 @@ resource "openstack_networking_secgroup_rule_v2" "microk8s_rule18" {
remote_group_id = openstack_networking_secgroup_v2.microk8s.id remote_group_id = openstack_networking_secgroup_v2.microk8s.id
security_group_id = openstack_networking_secgroup_v2.microk8s.id security_group_id = openstack_networking_secgroup_v2.microk8s.id
} }
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule19" {
resource "openstack_networking_secgroup_v2" "https" {
name = "https"
description = "Allow https to ingress controller"
}
resource "openstack_networking_secgroup_rule_v2" "https_rule1" {
# External traffic
direction = "ingress" direction = "ingress"
ethertype = "IPv4" ethertype = "IPv4"
protocol = "tcp" protocol = "tcp"
port_range_min = 16443 port_range_min = 443
port_range_max = 16443 port_range_max = 443
remote_group_id = openstack_networking_secgroup_v2.microk8s.id remote_ip_prefix = "0.0.0.0/0"
security_group_id = openstack_networking_secgroup_v2.microk8s.id security_group_id = openstack_networking_secgroup_v2.https.id
}
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule20" {
direction = "ingress"
ethertype = "IPv6"
protocol = "tcp"
port_range_min = 16443
port_range_max = 16443
remote_group_id = openstack_networking_secgroup_v2.microk8s.id
security_group_id = openstack_networking_secgroup_v2.microk8s.id
} }

6
IaC-test/nodes.tf
View file

@ -12,7 +12,8 @@ resource "openstack_networking_port_v2" "kubecport" {
security_group_ids = [ security_group_ids = [
data.openstack_networking_secgroup_v2.sshfromjumphosts.id, data.openstack_networking_secgroup_v2.sshfromjumphosts.id,
data.openstack_networking_secgroup_v2.allegress.id, data.openstack_networking_secgroup_v2.allegress.id,
resource.openstack_networking_secgroup_v2.microk8s.id resource.openstack_networking_secgroup_v2.microk8s.id,
resource.openstack_networking_secgroup_v2.https.id
] ]
admin_state_up = "true" admin_state_up = "true"
} }
@ -34,7 +35,8 @@ resource "openstack_compute_instance_v2" "controller-nodes" {
security_groups = [ security_groups = [
data.openstack_networking_secgroup_v2.sshfromjumphosts.name, data.openstack_networking_secgroup_v2.sshfromjumphosts.name,
data.openstack_networking_secgroup_v2.allegress.name, data.openstack_networking_secgroup_v2.allegress.name,
resource.openstack_networking_secgroup_v2.microk8s.name resource.openstack_networking_secgroup_v2.microk8s.name,
resource.openstack_networking_secgroup_v2.https.name
] ]
block_device { block_device {
uuid = resource.openstack_blockstorage_volume_v3.kubecvolumeboot[count.index].id uuid = resource.openstack_blockstorage_volume_v3.kubecvolumeboot[count.index].id

33
IaC-test/securitygroups.tf
View file

@ -13,25 +13,24 @@ resource "openstack_networking_secgroup_v2" "microk8s" {
} }
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule1" { resource "openstack_networking_secgroup_rule_v2" "microk8s_rule1" {
#We never know where Richard is, so allow from all of the known internet
direction = "ingress" direction = "ingress"
ethertype = "IPv4" ethertype = "IPv4"
protocol = "tcp" protocol = "tcp"
port_range_min = 16443 port_range_min = 16443
port_range_max = 16443 port_range_max = 16443
remote_ip_prefix = "0.0.0.0/0" remote_group_id = openstack_networking_secgroup_v2.microk8s.id
security_group_id = openstack_networking_secgroup_v2.microk8s.id security_group_id = openstack_networking_secgroup_v2.microk8s.id
} }
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule2" { resource "openstack_networking_secgroup_rule_v2" "microk8s_rule2" {
#We never know where Richard is, so allow from all of the known internet
direction = "ingress" direction = "ingress"
ethertype = "IPv6" ethertype = "IPv6"
protocol = "tcp" protocol = "tcp"
port_range_min = 16443 port_range_min = 16443
port_range_max = 16443 port_range_max = 16443
remote_ip_prefix = "::/0" remote_group_id = openstack_networking_secgroup_v2.microk8s.id
security_group_id = openstack_networking_secgroup_v2.microk8s.id security_group_id = openstack_networking_secgroup_v2.microk8s.id
} }
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule3" { resource "openstack_networking_secgroup_rule_v2" "microk8s_rule3" {
direction = "ingress" direction = "ingress"
ethertype = "IPv4" ethertype = "IPv4"
@ -177,21 +176,19 @@ resource "openstack_networking_secgroup_rule_v2" "microk8s_rule18" {
remote_group_id = openstack_networking_secgroup_v2.microk8s.id remote_group_id = openstack_networking_secgroup_v2.microk8s.id
security_group_id = openstack_networking_secgroup_v2.microk8s.id security_group_id = openstack_networking_secgroup_v2.microk8s.id
} }
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule19" {
resource "openstack_networking_secgroup_v2" "https" {
name = "https"
description = "Allow https to ingress controller"
}
resource "openstack_networking_secgroup_rule_v2" "https_rule1" {
# External traffic
direction = "ingress" direction = "ingress"
ethertype = "IPv4" ethertype = "IPv4"
protocol = "tcp" protocol = "tcp"
port_range_min = 16443 port_range_min = 443
port_range_max = 16443 port_range_max = 443
remote_group_id = openstack_networking_secgroup_v2.microk8s.id remote_ip_prefix = "0.0.0.0/0"
security_group_id = openstack_networking_secgroup_v2.microk8s.id security_group_id = openstack_networking_secgroup_v2.https.id
}
resource "openstack_networking_secgroup_rule_v2" "microk8s_rule20" {
direction = "ingress"
ethertype = "IPv6"
protocol = "tcp"
port_range_min = 16443
port_range_max = 16443
remote_group_id = openstack_networking_secgroup_v2.microk8s.id
security_group_id = openstack_networking_secgroup_v2.microk8s.id
} }