kubespray/contrib/terraform/upcloud

Kubernetes on UpCloud with Terraform

Provision a Kubernetes cluster on UpCloud using Terraform and Kubespray

Overview

The setup looks like following

   Kubernetes cluster
+--------------------------+
|      +--------------+    |
|      | +--------------+  |
| -->  | |              |  |
|      | | Master/etcd  |  |
|      | | node(s)      |  |
|      +-+              |  |
|        +--------------+  |
|              ^           |
|              |           |
|              v           |
|      +--------------+    |
|      | +--------------+  |
| -->  | |              |  |
|      | |    Worker    |  |
|      | |    node(s)   |  |
|      +-+              |  |
|        +--------------+  |
+--------------------------+

The nodes uses a private network for node to node communication and a public interface for all external communication.

Requirements

• Terraform 0.13.0 or newer

Quickstart

NOTE: Assumes you are at the root of the kubespray repo.

For authentication in your cluster you can use the environment variables.

export TF_VAR_UPCLOUD_USERNAME=username
export TF_VAR_UPCLOUD_PASSWORD=password

To allow API access to your UpCloud account, you need to allow API connections by visiting Account-page in your UpCloud Hub.

Copy the cluster configuration file.

CLUSTER=my-upcloud-cluster
cp -r inventory/sample inventory/$CLUSTER
cp contrib/terraform/upcloud/cluster-settings.tfvars inventory/$CLUSTER/
export ANSIBLE_CONFIG=ansible.cfg
cd inventory/$CLUSTER

Edit cluster-settings.tfvars to match your requirement.

Run Terraform to create the infrastructure.

terraform init ../../contrib/terraform/upcloud
terraform apply --var-file cluster-settings.tfvars \
    -state=tfstate-$CLUSTER.tfstate \
     ../../contrib/terraform/upcloud/

You should now have a inventory file named inventory.ini that you can use with kubespray. You can use the inventory file with kubespray to set up a cluster.

It is a good idea to check that you have basic SSH connectivity to the nodes. You can do that by:

ansible -i inventory.ini -m ping all

You can setup Kubernetes with kubespray using the generated inventory:

ansible-playbook -i inventory.ini ../../cluster.yml -b -v

Teardown

You can teardown your infrastructure using the following Terraform command:

terraform destroy --var-file cluster-settings.tfvars \
      -state=tfstate-$CLUSTER.tfstate \
      ../../contrib/terraform/upcloud/

Variables

• prefix: Prefix to add to all resources, if set to "" don't set any prefix
• template_name: The name or UUID of a base image
• username: a user to access the nodes, defaults to "ubuntu"
• private_network_cidr: CIDR to use for the private network, defaults to "172.16.0.0/24"
• ssh_public_keys: List of public SSH keys to install on all machines
• zone: The zone where to run the cluster
• machines: Machines to provision. Key of this object will be used as the name of the machine
  • node_type: The role of this node (master|worker)
  • plan: Preconfigured cpu/mem plan to use (disables cpu and mem attributes below)
  • cpu: number of cpu cores
  • mem: memory size in MB
  • disk_size: The size of the storage in GB
  • additional_disks: Additional disks to attach to the node.
    • size: The size of the additional disk in GB
    • tier: The tier of disk to use (maxiops is the only one you can choose atm)
• firewall_enabled: Enable firewall rules
• firewall_default_deny_in: Set the firewall to deny inbound traffic by default. Automatically adds UpCloud DNS server and NTP port allowlisting.
• firewall_default_deny_out: Set the firewall to deny outbound traffic by default.
• master_allowed_remote_ips: List of IP ranges that should be allowed to access API of masters
  • start_address: Start of address range to allow
  • end_address: End of address range to allow
• k8s_allowed_remote_ips: List of IP ranges that should be allowed SSH access to all nodes
  • start_address: Start of address range to allow
  • end_address: End of address range to allow
• master_allowed_ports: List of port ranges that should be allowed to access the masters
  • protocol: Protocol (tcp|udp|icmp)
  • port_range_min: Start of port range to allow
  • port_range_max: End of port range to allow
  • start_address: Start of address range to allow
  • end_address: End of address range to allow
• worker_allowed_ports: List of port ranges that should be allowed to access the workers
  • protocol: Protocol (tcp|udp|icmp)
  • port_range_min: Start of port range to allow
  • port_range_max: End of port range to allow
  • start_address: Start of address range to allow
  • end_address: End of address range to allow
• loadbalancer_enabled: Enable managed load balancer
• loadbalancer_plan: Plan to use for load balancer (development|production-small)
• loadbalancers: Ports to load balance and which machines to forward to. Key of this object will be used as the name of the load balancer frontends/backends
  • port: Port to load balance.
  • target_port: Port to the backend servers.
  • backend_servers: List of servers that traffic to the port should be forwarded to.
• server_groups: Group servers together
  • servers: The servers that should be included in the group.
  • anti_affinity: If anti-affinity should be enabled, try to spread the VMs out on separate nodes.