From 1a38a9df88c05c13c87b8e82b9bad783d668ef7f Mon Sep 17 00:00:00 2001 From: rguichard Date: Fri, 27 Jul 2018 14:57:29 +0200 Subject: [PATCH] add security groups for traffic to 30000-32767/tcp This will make NodePort services work out of the box --- contrib/terraform/openstack/modules/compute/main.tf | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/contrib/terraform/openstack/modules/compute/main.tf b/contrib/terraform/openstack/modules/compute/main.tf index 940049aa9..370b88879 100644 --- a/contrib/terraform/openstack/modules/compute/main.tf +++ b/contrib/terraform/openstack/modules/compute/main.tf @@ -59,6 +59,17 @@ resource "openstack_compute_secgroup_v2" "k8s" { self = true } } +resource "openstack_compute_secgroup_v2" "worker" { + name = "${var.cluster_name}-k8s-worker" + description = "${var.cluster_name} - Kubernetes worker nodes" + + rule { + ip_protocol = "tcp" + from_port = "30000" + to_port = "32767" + cidr = "0.0.0.0/0" + } +} resource "openstack_compute_instance_v2" "bastion" { name = "${var.cluster_name}-bastion-${count.index+1}" @@ -226,6 +237,7 @@ resource "openstack_compute_instance_v2" "k8s_node" { security_groups = ["${openstack_compute_secgroup_v2.k8s.name}", "${openstack_compute_secgroup_v2.bastion.name}", + "${openstack_compute_secgroup_v2.worker.name}", "default", ] @@ -253,6 +265,7 @@ resource "openstack_compute_instance_v2" "k8s_node_no_floating_ip" { } security_groups = ["${openstack_compute_secgroup_v2.k8s.name}", + "${openstack_compute_secgroup_v2.worker.name}", "default", ]