From c9d36908e2c9a5ab235745e5b5f047e9f63ed647 Mon Sep 17 00:00:00 2001 From: Robin Mordasiewicz Date: Fri, 2 Aug 2024 09:51:25 -0400 Subject: [PATCH] adding init --- README.md | 2 + .../flannel/HelmRepository.yaml | 6 +-- .../fortiweb-ingress/kustomization.yaml | 2 +- terraform/cloud-init/fortiweb.conf | 2 +- terraform/hub-network.tf | 9 ++-- terraform/hub-nva.tf | 1 + terraform/spoke-k8s_cluster.tf | 51 +++++++++++++++---- terraform/spoke-network.tf | 32 +++++++----- terraform/terraform.auto.tfvars | 13 +++-- terraform/variables.tf | 8 +-- 10 files changed, 83 insertions(+), 43 deletions(-) diff --git a/README.md b/README.md index 5c4e665c..643c6036 100644 --- a/README.md +++ b/README.md @@ -29,3 +29,5 @@ gh repo edit \ ```quote your infrastructure will mirror the understanding, competence and goals of the people building it, and contain their nuanced areas of understanding in more detail than areas outside their interest of confidence realms. ``` + +https://azure.github.io/application-gateway-kubernetes-ingress/ diff --git a/manifests/infrastructure/flannel/HelmRepository.yaml b/manifests/infrastructure/flannel/HelmRepository.yaml index ad06534a..9235b518 100644 --- a/manifests/infrastructure/flannel/HelmRepository.yaml +++ b/manifests/infrastructure/flannel/HelmRepository.yaml @@ -1,6 +1,6 @@ - --- - apiVersion: source.toolkit.fluxcd.io/v1beta2 - kind: HelmRepository +--- +apiVersion: source.toolkit.fluxcd.io/v1beta2 +kind: HelmRepository metadata: name: flannel-repo namespace: cluster-config diff --git a/manifests/infrastructure/fortiweb-ingress/kustomization.yaml b/manifests/infrastructure/fortiweb-ingress/kustomization.yaml index fa0e343b..1b5b81f9 100644 --- a/manifests/infrastructure/fortiweb-ingress/kustomization.yaml +++ b/manifests/infrastructure/fortiweb-ingress/kustomization.yaml @@ -4,4 +4,4 @@ kind: Kustomization resources: - HelmRepository.yaml - HelmRelease.yaml - - namespace.yaml + diff --git a/terraform/cloud-init/fortiweb.conf b/terraform/cloud-init/fortiweb.conf index 432836d3..4c5b949e 100644 --- a/terraform/cloud-init/fortiweb.conf +++ b/terraform/cloud-init/fortiweb.conf @@ -82,7 +82,7 @@ config global next edit "kubernetes_nodes" set type ip-netmask - set ip-netmask 10.1.1.0/24 + set ip-netmask ${VAR-spoke-aks-network} next end config system firewall service diff --git a/terraform/hub-network.tf b/terraform/hub-network.tf index 6ab5a51f..43416043 100644 --- a/terraform/hub-network.tf +++ b/terraform/hub-network.tf @@ -107,8 +107,10 @@ resource "azurerm_network_security_group" "hub-internal_network_security_group" protocol = "Icmp" source_port_range = "*" destination_port_range = "*" - source_address_prefix = var.spoke-linux-server-ip - destination_address_prefix = var.spoke-check-internet-up-ip + #source_address_prefix = var.spoke-linux-server-ip + source_address_prefix = "*" + #destination_address_prefix = var.spoke-check-internet-up-ip + destination_address_prefix = "*" } security_rule { name = "outbound-http_rule" @@ -119,7 +121,8 @@ resource "azurerm_network_security_group" "hub-internal_network_security_group" source_port_range = "*" destination_port_ranges = ["80", "81"] source_address_prefix = "*" - destination_address_prefix = var.spoke-linux-server-ip + #destination_address_prefix = var.spoke-linux-server-ip + destination_address_prefix = "*" } } diff --git a/terraform/hub-nva.tf b/terraform/hub-nva.tf index 9fb9447d..92931c09 100644 --- a/terraform/hub-nva.tf +++ b/terraform/hub-nva.tf @@ -88,6 +88,7 @@ resource "azurerm_linux_virtual_machine" "hub-nva_virtual_machine" { VAR-fwb_license_fortiflex = "" VAR-spoke-linux-server-ollama-port = var.spoke-linux-server-ollama-port VAR-spoke-linux-server-ollama-webui-port = var.spoke-linux-server-ollama-webui-port + VAR-spoke-aks-network = var.spoke-aks-subnet_prefix } ) ) diff --git a/terraform/spoke-k8s_cluster.tf b/terraform/spoke-k8s_cluster.tf index 37e720a1..c7c62087 100644 --- a/terraform/spoke-k8s_cluster.tf +++ b/terraform/spoke-k8s_cluster.tf @@ -43,11 +43,11 @@ resource "azurerm_kubernetes_cluster" "kubernetes_cluster" { oidc_issuer_enabled = true workload_identity_enabled = true - api_server_access_profile { - authorized_ip_ranges = [ - "${chomp(data.http.myip.response_body)}/32" - ] - } + #api_server_access_profile { + # authorized_ip_ranges = [ + # "${chomp(data.http.myip.response_body)}/32" + # ] + #} oms_agent { log_analytics_workspace_id = azurerm_log_analytics_workspace.log_analytics.id } @@ -59,17 +59,19 @@ resource "azurerm_kubernetes_cluster" "kubernetes_cluster" { os_sku = "AzureLinux" max_pods = "50" vnet_subnet_id = azurerm_subnet.spoke_subnet.id - #vnet_subnet_id = azurerm_subnet.spoke_subnet.id upgrade_settings { max_surge = "10%" } } network_profile { - network_plugin = "none" + #network_plugin = "azure" + network_plugin = "kubenet" + #outbound_type = "loadBalancer" #network_policy = "azure" - #load_balancer_sku = "standard" - #service_cidr = var.spoke-k8s_service_cidr - #dns_service_ip = var.spoke-ks8_dns_service_ip + load_balancer_sku = "standard" + #service_cidr = var.spoke-aks-subnet_prefix + #dns_service_ip = var.spoke-aks_dns_service_ip + #pod_cidr = "10.244.0.0/16" } identity { @@ -93,7 +95,6 @@ resource "azurerm_kubernetes_cluster_node_pool" "node-pool" { os_disk_size_gb = "256" max_pods = "50" zones = ["1"] - #vnet_subnet_id = azurerm_subnet.spoke_subnet.id } resource "azurerm_kubernetes_cluster_extension" "flux_extension" { @@ -130,6 +131,14 @@ resource "null_resource" "secret" { interpreter = ["bash", "-c"] command = <<-EOF kubectl apply -f - <