Un Talos européen de qualité - Part III - Infra réseau

1
locals {
2
  cluster_name    = "ohmytalos-dev"
3
  internal_domain = "dev.ohmytalos.com"
4
}

1
module "kube_network" {
2
  source = "../../modules/kube/network"
3

4
  pod_ipv4_cidr   = "10.42.0.0/16"
5
  internal_domain = local.internal_domain
6

7
  hcloud_token   = var.hcloud_token
8
  hcloud_network = local.cluster_name
9
}

1
variable "hcloud_token" {
2
  type      = string
3
  sensitive = true
4
}

# ...

export TF_VAR_hcloud_token=$(bw_field password hcloud_token)

1
variable "pod_ipv4_cidr" {
2
  description = "The CIDR for the pod network"
3
  type        = string
4
}
5

6
variable "internal_domain" {
7
  description = "The internal domain name to use for the private network"
8
  type        = string
9
}
10

11
variable "hcloud_token" {
12
  description = "The Hetzner Cloud API token"
13
  type        = string
14
  sensitive   = true
15
}
16

17
variable "hcloud_network" {
18
  description = "The ID or name of the main hetzner network of this cluster"
19
  type        = string
20
}

1
resource "helm_release" "cilium" {
2
  repository = "https://helm.cilium.io"
3
  chart      = "cilium"
4
  version    = "1.18.6"
5

6
  name      = "cilium"
7
  namespace = "kube-system"
8

9
  max_history = 2
10

11
  set = [
12
    {
13
      name  = "ipam.mode"
14
      value = "kubernetes"
15
    },
16
    {
17
      name  = "routingMode"
18
      value = "native"
19
    },
20
    {
21
      name  = "ipv4NativeRoutingCIDR"
22
      value = var.pod_ipv4_cidr
23
    },
24
    {
25
      name  = "kubeProxyReplacement"
26
      value = "true"
27
    },
28
    {
29
      name  = "loadBalancer.acceleration"
30
      value = "best-effort"
31
    },
32
    {
33
      name  = "encryption.enabled"
34
      value = "true"
35
    },
36
    {
37
      name  = "encryption.type"
38
      value = "wireguard"
39
    },
40
    {
41
      name  = "securityContext.capabilities.ciliumAgent"
42
      value = "{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}"
43
    },
44
    {
45
      name  = "securityContext.capabilities.cleanCiliumState"
46
      value = "{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}"
47
    },
48
    {
49
      name  = "cgroup.autoMount.enabled"
50
      value = "false"
51
    },
52
    {
53
      name  = "cgroup.hostRoot"
54
      value = "/sys/fs/cgroup"
55
    },
56
    {
57
      name  = "k8sServiceHost"
58
      value = "127.0.0.1"
59
    },
60
    {
61
      name  = "k8sServicePort"
62
      value = 7445
63
    },
64
    {
65
      name  = "hubble.relay.enabled"
66
      value = "true"
67
    },
68
    {
69
      name  = "hubble.ui.enabled"
70
      value = "true"
71
    },
72
    {
73
      name  = "envoy.enabled"
74
      value = "false"
75
    },
76
    {
77
      name  = "prometheus.enabled"
78
      value = "true"
79
    },
80
    {
81
      name  = "prometheus.serviceMonitor.enabled"
82
      value = "true"
83
    },
84
    {
85
      name  = "dashboards.enabled"
86
      value = "true"
87
    },
88
    {
89
      name  = "operator.prometheus.enabled"
90
      value = "true"
91
    },
92
    {
93
      name  = "operator.prometheus.serviceMonitor.enabled"
94
      value = "true"
95
    },
96
    {
97
      name  = "operator.dashboards.enabled"
98
      value = "true"
99
    },
100
    {
101
      name  = "hubble.relay.prometheus.enabled"
102
      value = "true"
103
    },
104
    {
105
      name  = "hubble.relay.prometheus.serviceMonitor.enabled"
106
      value = "true"
107
    },
108
    {
109
      name  = "hubble.metrics.serviceMonitor.enabled"
110
      value = "true"
111
    },
112
    {
113
      name  = "hubble.metrics.dashboards.enabled"
114
      value = "true"
115
    }
116
  ]
117

118
  set_list = [
119
    {
120
      name = "hubble.metrics.enabled"
121
      value = [
122
        "dns:query;ignoreAAAA",
123
        "drop",
124
        "tcp",
125
        "flow",
126
        "icmp",
127
        "http"
128
      ]
129
    }
130
  ]
131
}
132

133
resource "kubernetes_manifest" "traefik_ingress_route_cilium" {
134
  manifest = {
135
    apiVersion = "traefik.io/v1alpha1"
136
    kind       = "IngressRoute"
137
    metadata = {
138
      name      = "hubble-ui"
139
      namespace = "kube-system"
140
    }
141
    spec = {
142
      entryPoints = ["internal"]
143
      routes = [
144
        {
145
          match = "Host(`hubble.${var.internal_domain}`)"
146
          kind  = "Rule"
147
          middlewares = [
148
            {
149
              name      = "internal-basic-auth"
150
              namespace = "traefik"
151
            }
152
          ]
153
          services = [
154
            {
155
              name = "hubble-ui"
156
              port = "http"
157
            }
158
          ]
159
        }
160
      ]
161
    }
162
  }
163
}

1
resource "kubernetes_secret_v1" "hcloud" {
2
  metadata {
3
    name      = "hcloud"
4
    namespace = "kube-system"
5
  }
6
  data = {
7
    token   = var.hcloud_token,
8
    network = var.hcloud_network
9
  }
10
}
11

12
resource "helm_release" "hccm" {
13
  repository = "https://charts.hetzner.cloud"
14
  chart      = "hcloud-cloud-controller-manager"
15
  version    = "1.29.2"
16

17
  name        = "hccm"
18
  namespace   = "kube-system"
19
  max_history = 2
20

21
  set = [
22
    {
23
      name  = "networking.enabled"
24
      value = "true"
25
    },
26
    {
27
      name  = "networking.clusterCIDR"
28
      value = var.pod_ipv4_cidr
29
    },
30
    {
31
      name  = "monitoring.enabled"
32
      value = "true"
33
    },
34
    {
35
      name  = "monitoring.podMonitor.enabled"
36
      value = "true"
37
    }
38
  ]
39

40
  depends_on = [
41
    kubernetes_secret_v1.hcloud,
42
    helm_release.cilium
43
  ]
44
}