Un Talos européen de qualité - Part IV - Infra stockage

1
locals {
2
  cluster_name    = "ohmytalos-dev"
3
  internal_domain = "dev.ohmytalos.com"
4
  s3_endpoint     = "https://s3.gra.io.cloud.ovh.net"
5
  s3_region       = "gra"
6
}

1
module "kube_storage" {
2
  source = "../../modules/kube/storage"
3

4
  internal_domain = local.internal_domain
5

6
  longhorn_crypto_key_value             = var.longhorn_crypto_key
7
  longhorn_backup_s3_endpoint           = "https://${local.s3_endpoint}"
8
  longhorn_backup_s3_access_key         = var.longhorn_backup_s3_username
9
  longhorn_backup_s3_secret_key         = var.longhorn_backup_s3_password
10
  longhorn_backup_s3_region             = local.s3_region
11
  longhorn_backup_s3_bucket             = local.cluster_name
12
  longhorn_default_local_replica_count  = 2
13
  longhorn_default_volume_replica_count = 2
14
  longhorn_default_taint_tolerations = [
15
    "node-role.kubernetes.io/storage:NoSchedule"
16
  ]
17
}

1
// ...
2

3
variable "longhorn_backup_s3_username" {
4
  type = string
5
}
6

7
variable "longhorn_backup_s3_password" {
8
  type      = string
9
  sensitive = true
10
}
11

12
variable "longhorn_crypto_key" {
13
  type      = string
14
  sensitive = true
15
}

# ...

export TF_VAR_longhorn_backup_s3_username=$(bw_field username longhorn_backup_s3)
export TF_VAR_longhorn_backup_s3_password=$(bw_field password longhorn_backup_s3)
export TF_VAR_longhorn_crypto_key=$(bw_field password longhorn_crypto_key)

1
variable "internal_domain" {
2
  description = "The internal domain name to use for the private network"
3
  type        = string
4
}
5

6
variable "longhorn_backup_s3_endpoint" {
7
  description = "The endpoint of the S3 compatible storage"
8
  type        = string
9
}
10

11
variable "longhorn_backup_s3_access_key" {
12
  description = "The access key for the S3 compatible storage"
13
  type        = string
14
}
15

16
variable "longhorn_backup_s3_secret_key" {
17
  description = "The secret key for the S3 compatible storage"
18
  type        = string
19
  sensitive   = true
20
}
21

22
variable "longhorn_backup_s3_region" {
23
  description = "The region of the S3 compatible storage"
24
  type        = string
25
}
26

27
variable "longhorn_backup_s3_bucket" {
28
  description = "The bucket of the S3 compatible storage"
29
  type        = string
30
}
31

32
variable "longhorn_default_local_replica_count" {
33
  description = "The default replica count for the local longhorn storage class and UI"
34
  type        = number
35
  default     = 3
36
}
37

38
variable "longhorn_default_volume_replica_count" {
39
  description = "The default replica count for the volume longhorn storage class and UI"
40
  type        = number
41
  default     = 3
42
}
43

44
variable "longhorn_default_taint_tolerations" {
45
  description = "The default taint tolerations for the longhorn components"
46
  type        = list(string)
47
}
48

49
variable "longhorn_crypto_key_value" {
50
  description = "The encryption key value for Longhorn volumes"
51
  type        = string
52
  sensitive   = true
53
}

1
resource "kubernetes_namespace_v1" "longhorn" {
2
  metadata {
3
    name = "longhorn-system"
4
    labels = {
5
      "pod-security.kubernetes.io/enforce" = "privileged"
6
    }
7
  }
8
}
9

10
resource "kubernetes_secret_v1" "backup_target_credential" {
11
  metadata {
12
    name      = "backup-target-credential"
13
    namespace = kubernetes_namespace_v1.longhorn.metadata[0].name
14
  }
15
  data = {
16
    AWS_ENDPOINTS         = var.longhorn_backup_s3_endpoint
17
    AWS_ACCESS_KEY_ID     = var.longhorn_backup_s3_access_key
18
    AWS_SECRET_ACCESS_KEY = var.longhorn_backup_s3_secret_key
19
    AWS_REGION            = var.longhorn_backup_s3_region
20
  }
21
  lifecycle {
22
    ignore_changes = [metadata[0].annotations]
23
  }
24
}
25

26
resource "kubernetes_secret_v1" "longhorn_crypto" {
27
  metadata {
28
    name      = "longhorn-crypto"
29
    namespace = kubernetes_namespace_v1.longhorn.metadata[0].name
30
  }
31
  data = {
32
    CRYPTO_KEY_VALUE : var.longhorn_crypto_key_value
33
    CRYPTO_KEY_PROVIDER : "secret"
34
    CRYPTO_KEY_CIPHER : "aes-xts-plain64"
35
    CRYPTO_KEY_HASH : "sha256"
36
    CRYPTO_KEY_SIZE : "256"
37
    CRYPTO_PBKDF : "argon2i"
38
  }
39
}
40

41
resource "helm_release" "longhorn" {
42
  repository = "https://charts.longhorn.io"
43
  chart      = "longhorn"
44
  version    = "1.10.1"
45

46
  name        = "longhorn"
47
  namespace   = kubernetes_namespace_v1.longhorn.metadata[0].name
48
  max_history = 2
49

50
  set = concat(
51
    [
52
      {
53
        name  = "metrics.serviceMonitor.enabled"
54
        value = "true"
55
      },
56
      {
57
        name  = "defaultBackupStore.backupTargetCredentialSecret"
58
        value = kubernetes_secret_v1.backup_target_credential.metadata[0].name
59
      },
60
      {
61
        name  = "defaultBackupStore.backupTarget"
62
        value = "s3://${var.longhorn_backup_s3_bucket}@${var.longhorn_backup_s3_region}/longhorn/"
63
      },
64
      {
65
        name  = "defaultSettings.createDefaultDiskLabeledNodes"
66
        value = "true"
67
      },
68
      {
69
        name  = "defaultSettings.defaultLonghornStaticStorageClass"
70
        value = kubernetes_storage_class_v1.longhorn_crypto.metadata[0].name
71
      },
72
      {
73
        name  = "defaultSettings.taintToleration"
74
        value = join(";", var.longhorn_default_taint_tolerations)
75
      }
76
    ],
77
    [
78
      for i, toleration in var.longhorn_default_taint_tolerations : {
79
        name  = "longhornManager.tolerations[${i}].key"
80
        value = split(":", toleration)[0]
81
      }
82
    ],
83
    [
84
      for i, toleration in var.longhorn_default_taint_tolerations : {
85
        name  = "longhornManager.tolerations[${i}].effect"
86
        value = split(":", toleration)[1]
87
      }
88
    ]
89
  )
90
}
91

92
resource "kubernetes_manifest" "traefik_ingress_route_longhorn" {
93
  manifest = {
94
    apiVersion = "traefik.io/v1alpha1"
95
    kind       = "IngressRoute"
96
    metadata = {
97
      name      = "longhorn"
98
      namespace = kubernetes_namespace_v1.longhorn.metadata[0].name
99
    }
100
    spec = {
101
      entryPoints = ["internal"]
102
      routes = [
103
        {
104
          match = "Host(`longhorn.${var.internal_domain}`)"
105
          kind  = "Rule"
106
          middlewares = [
107
            {
108
              name      = "internal-basic-auth"
109
              namespace = "traefik"
110
            }
111
          ]
112
          services = [
113
            {
114
              name = "longhorn-frontend"
115
              port = "http"
116
            }
117
          ]
118
        }
119
      ]
120
    }
121
  }
122
}
123

124
resource "kubernetes_storage_class_v1" "longhorn_crypto" {
125
  metadata {
126
    name = "longhorn-crypto"
127
  }
128
  storage_provisioner = "driver.longhorn.io"
129
  parameters = merge(
130
    {
131
      dataEngine       = "v1"
132
      dataLocality     = "best-effort"
133
      fsType           = "ext4"
134
      numberOfReplicas = var.longhorn_default_local_replica_count
135
      diskSelector     = "local"
136
      encrypted        = "true"
137
    },
138
    merge(
139
      [
140
        for type in [
141
          "provisioner",
142
          "node-publish",
143
          "node-stage",
144
          "node-expand"
145
        ] :
146
        {
147
          "csi.storage.k8s.io/${type}-secret-name"      = kubernetes_secret_v1.longhorn_crypto.metadata[0].name
148
          "csi.storage.k8s.io/${type}-secret-namespace" = kubernetes_secret_v1.longhorn_crypto.metadata[0].namespace
149
        }
150
      ]...
151
    )
152
  )
153
}
154

155
resource "kubernetes_storage_class_v1" "longhorn_crypto_local" {
156
  metadata {
157
    name = "longhorn-crypto-local"
158
  }
159
  storage_provisioner = "driver.longhorn.io"
160
  parameters = merge(
161
    kubernetes_storage_class_v1.longhorn_crypto.parameters,
162
    {
163
      dataLocality     = "strict-local"
164
      numberOfReplicas = "1"
165
    }
166
  )
167
}
168

169
resource "kubernetes_storage_class_v1" "longhorn_crypto_volume" {
170
  metadata {
171
    name = "longhorn-crypto-volume"
172
  }
173
  storage_provisioner = "driver.longhorn.io"
174
  parameters = merge(
175
    kubernetes_storage_class_v1.longhorn_crypto.parameters,
176
    {
177
      numberOfReplicas = var.longhorn_default_volume_replica_count
178
      diskSelector     = "volume"
179
    },
180
  )
181
}