Skip to content

Commit 45090b4

Browse files
committed
modularization of the oke node pool
Signed-off-by: junior <junior@users.noreply.github.com>
1 parent f419284 commit 45090b4

File tree

10 files changed

+439
-143
lines changed

10 files changed

+439
-143
lines changed

module-oke.tf

Lines changed: 100 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,34 @@
22
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
33
#
44

5+
module "vault" {
6+
source = "./modules/oci-vault-kms"
7+
8+
providers = {
9+
oci = oci
10+
oci.home_region = oci.home_region
11+
}
12+
13+
# Oracle Cloud Infrastructure Tenancy and Compartment OCID
14+
tenancy_ocid = var.tenancy_ocid
15+
16+
# App Details
17+
app_details = local.app_details
18+
19+
# Encryption (OCI Vault/Key Management/KMS)
20+
use_encryption_from_oci_vault = var.use_encryption_from_oci_vault
21+
create_new_encryption_key = var.create_new_encryption_key
22+
existent_encryption_key_id = var.existent_encryption_key_id
23+
24+
# OKE Cluster Details
25+
oke_cluster_compartment_ocid = local.oke_compartment_ocid
26+
27+
## Create Dynamic group and Policies for OCI Vault (Key Management/KMS)
28+
create_dynamic_group_for_nodes_in_compartment = var.create_dynamic_group_for_nodes_in_compartment
29+
create_compartment_policies = var.create_compartment_policies
30+
create_vault_policies_for_group = var.create_vault_policies_for_group
31+
}
32+
533
module "oke" {
634
source = "./modules/oke"
735

@@ -12,19 +40,18 @@ module "oke" {
1240

1341
# Oracle Cloud Infrastructure Tenancy and Compartment OCID
1442
tenancy_ocid = var.tenancy_ocid
15-
compartment_ocid = var.compartment_ocid
43+
compartment_ocid = local.oke_compartment_ocid
1644
region = var.region
1745

18-
# OKE Cluster
19-
app_name = var.app_name
20-
app_deployment_environment = var.app_deployment_environment
21-
app_deployment_type = var.app_deployment_type
46+
# App Details
47+
app_details = local.app_details
2248

49+
# OKE Cluster
2350
## create_new_oke_cluster
2451
create_new_oke_cluster = var.create_new_oke_cluster
2552
existent_oke_cluster_id = var.existent_oke_cluster_id
26-
create_new_compartment_for_oke = var.create_new_compartment_for_oke
27-
oke_compartment_description = var.oke_compartment_description
53+
# create_new_compartment_for_oke = var.create_new_compartment_for_oke
54+
# oke_compartment_description = var.oke_compartment_description
2855

2956
## Cluster Workers visibility
3057
cluster_workers_visibility = var.cluster_workers_visibility
@@ -40,26 +67,56 @@ module "oke" {
4067
create_compartment_policies = var.create_compartment_policies
4168

4269
## Encryption (OCI Vault/Key Management/KMS)
43-
use_encryption_from_oci_vault = var.use_encryption_from_oci_vault
44-
create_new_encryption_key = var.create_new_encryption_key
45-
existent_encryption_key_id = var.existent_encryption_key_id
70+
oci_vault_key_id_oke_secrets = module.vault.oci_vault_key_id
71+
oci_vault_key_id_oke_image_policy = module.vault.oci_vault_key_id
72+
# use_encryption_from_oci_vault = var.use_encryption_from_oci_vault
73+
# create_new_encryption_key = var.create_new_encryption_key
74+
# existent_encryption_key_id = var.existent_encryption_key_id
4675

4776
## Enable Cluster Autoscaler
4877
cluster_autoscaler_enabled = var.cluster_autoscaler_enabled
4978
# cluster_autoscaler_min_nodes = var.cluster_autoscaler_min_nodes
5079
# cluster_autoscaler_max_nodes = var.cluster_autoscaler_max_nodes
5180
# existent_oke_nodepool_id_for_autoscaler = var.existent_oke_nodepool_id_for_autoscaler
5281

53-
## OKE Worker Nodes (Compute)
54-
num_pool_workers = var.cluster_autoscaler_enabled ? var.cluster_autoscaler_min_nodes : var.num_pool_workers
82+
# ## OKE Worker Nodes (Compute)
83+
# num_pool_workers = var.cluster_autoscaler_enabled ? var.cluster_autoscaler_min_nodes : var.num_pool_workers
84+
# node_pool_shape = var.node_pool_instance_shape.instanceShape
85+
# node_pool_node_shape_config_ocpus = var.node_pool_instance_shape.ocpus
86+
# node_pool_node_shape_config_memory_in_gbs = var.node_pool_instance_shape.memory
87+
# generate_public_ssh_key = var.generate_public_ssh_key
88+
# public_ssh_key = var.public_ssh_key
89+
}
90+
91+
module "oke_node_pool" {
92+
source = "./modules/oke-node-pool"
93+
94+
# App Details
95+
app_details = local.app_details
96+
97+
# Oracle Cloud Infrastructure Tenancy and Compartment OCID
98+
tenancy_ocid = var.tenancy_ocid
99+
100+
# OKE Cluster Details
101+
oke_cluster_ocid = module.oke.oke_cluster_ocid
102+
oke_cluster_compartment_ocid = local.oke_compartment_ocid
103+
104+
# OKE Worker Nodes (Compute)
105+
num_pool_workers = var.num_pool_workers
55106
node_pool_shape = var.node_pool_instance_shape.instanceShape
56107
node_pool_node_shape_config_ocpus = var.node_pool_instance_shape.ocpus
57108
node_pool_node_shape_config_memory_in_gbs = var.node_pool_instance_shape.memory
58109
generate_public_ssh_key = var.generate_public_ssh_key
59110
public_ssh_key = var.public_ssh_key
111+
112+
# OKE Network Details
113+
oke_vcn_nodes_subnet_ocid = module.oke.oke_vcn_nodes_subnet_ocid
114+
115+
# Encryption (OCI Vault/Key Management/KMS)
116+
oci_vault_key_id_oke_node_boot_volume = module.vault.oci_vault_key_id
60117
}
61118

62-
module "oke-cluster-autoscaler" {
119+
module "oke_cluster_autoscaler" {
63120
source = "./modules/oke-cluster-autoscaler"
64121

65122
# Oracle Cloud Infrastructure Tenancy and Compartment OCID
@@ -77,7 +134,7 @@ module "oke-cluster-autoscaler" {
77134
## Nodes Kubernetes Version
78135
k8s_version = var.k8s_version
79136

80-
depends_on = [module.oke]
137+
depends_on = [module.oke, module.oke_node_pool]
81138
}
82139

83140
## OKE Cluster Details
@@ -242,13 +299,40 @@ variable "create_compartment_policies" {
242299
description = "Creates policies that will reside on the compartment. e.g.: Policies to support Cluster Autoscaler, OCI Logging datasource on Grafana"
243300
}
244301

302+
resource "random_string" "deploy_id" {
303+
length = 4
304+
special = false
305+
}
306+
307+
resource "oci_identity_compartment" "oke_compartment" {
308+
compartment_id = var.compartment_ocid
309+
name = "${local.app_details.app_name_normalized}-${local.deploy_id}"
310+
description = "${var.app_name} ${var.oke_compartment_description} (Deployment ${local.deploy_id})"
311+
enable_delete = true
312+
313+
count = var.create_new_compartment_for_oke ? 1 : 0
314+
}
315+
316+
# Locals
317+
locals {
318+
deploy_id = random_string.deploy_id.result
319+
oke_compartment_ocid = var.create_new_compartment_for_oke ? oci_identity_compartment.oke_compartment.0.id : var.compartment_ocid
320+
app_details = {
321+
"app_name" = var.app_name
322+
"app_name_normalized" = substr(replace(lower(var.app_name), " ", "-"), 0, 6)
323+
"app_deployment_environment" = var.app_deployment_environment
324+
"app_deployment_type" = var.app_deployment_type
325+
"app_deployment_id" = local.deploy_id
326+
}
327+
}
328+
245329
# OKE Outputs
246330

247331
output "comments" {
248332
value = module.oke.comments
249333
}
250334
output "deploy_id" {
251-
value = module.oke.deploy_id
335+
value = local.deploy_id
252336
}
253337
output "deployed_oke_kubernetes_version" {
254338
value = module.oke.deployed_oke_kubernetes_version
@@ -271,7 +355,7 @@ output "dev" {
271355
# Use of this resource for production deployments is not recommended.
272356
# Instead, generate a private key file outside of Terraform and distribute it securely to the system where Terraform will be run.
273357
output "generated_private_key_pem" {
274-
value = module.oke.generated_private_key_pem
358+
value = module.oke_node_pool.generated_private_key_pem
275359
sensitive = true
276360
}
277361

modules/oke-node-pool/datasources.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
# Gets supported Kubernetes versions for node pools
6+
data "oci_containerengine_node_pool_option" "node_pool" {
7+
node_pool_option_id = "all"
8+
}
9+
10+
# Gets a list of supported images based on the shape, operating_system and operating_system_version provided
11+
data "oci_core_images" "node_pool_images" {
12+
compartment_id = var.oke_cluster_compartment_ocid
13+
operating_system = var.image_operating_system
14+
operating_system_version = var.image_operating_system_version
15+
shape = var.node_pool_shape
16+
sort_by = "TIMECREATED"
17+
sort_order = "DESC"
18+
}
19+
20+
# Gets a list of Availability Domains
21+
data "oci_identity_availability_domains" "ADs" {
22+
compartment_id = var.tenancy_ocid
23+
}

modules/oke-node-pool/main.tf

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
resource "oci_containerengine_node_pool" "oke_node_pool" {
6+
cluster_id = var.oke_cluster_ocid
7+
compartment_id = var.oke_cluster_compartment_ocid
8+
kubernetes_version = (var.k8s_version == "Latest") ? local.node_pool_k8s_latest_version : var.k8s_version
9+
name = var.node_pool_name
10+
node_shape = var.node_pool_shape
11+
ssh_public_key = var.generate_public_ssh_key ? tls_private_key.oke_worker_node_ssh_key.public_key_openssh : var.public_ssh_key
12+
freeform_tags = local.freeform_deployment_tags
13+
14+
node_config_details {
15+
dynamic "placement_configs" {
16+
for_each = data.oci_identity_availability_domains.ADs.availability_domains
17+
18+
content {
19+
availability_domain = placement_configs.value.name
20+
subnet_id = var.oke_vcn_nodes_subnet_ocid
21+
}
22+
}
23+
node_pool_pod_network_option_details {
24+
cni_type = "FLANNEL_OVERLAY"
25+
}
26+
# nsg_ids = []
27+
size = var.num_pool_workers
28+
kms_key_id = var.oci_vault_key_id_oke_node_boot_volume ? var.oci_vault_key_id_oke_node_boot_volume : null
29+
freeform_tags = local.freeform_deployment_tags
30+
}
31+
32+
dynamic "node_shape_config" {
33+
for_each = local.is_flexible_node_shape ? [1] : []
34+
content {
35+
ocpus = var.node_pool_node_shape_config_ocpus
36+
memory_in_gbs = var.node_pool_node_shape_config_memory_in_gbs
37+
}
38+
}
39+
40+
node_source_details {
41+
source_type = "IMAGE"
42+
image_id = lookup(data.oci_core_images.node_pool_images.images[0], "id")
43+
boot_volume_size_in_gbs = var.node_pool_boot_volume_size_in_gbs
44+
}
45+
# node_eviction_node_pool_settings {
46+
# eviction_grace_duration = "PT1H"
47+
# is_force_delete_after_grace_duration = false
48+
# }
49+
# node_metadata = {}
50+
51+
initial_node_labels {
52+
key = "name"
53+
value = var.node_pool_name
54+
}
55+
56+
# count = var.create_new_oke_cluster ? 1 : 0
57+
}
58+
59+
locals {
60+
# Checks if is using Flexible Compute Shapes
61+
is_flexible_node_shape = contains(split(".", var.node_pool_shape), "Flex")
62+
63+
# Gets the latest Kubernetes version supported by the node pool
64+
node_pool_k8s_latest_version = reverse(sort(data.oci_containerengine_node_pool_option.node_pool.kubernetes_versions))[0]
65+
}
66+
67+
# Generate ssh keys to access Worker Nodes, if generate_public_ssh_key=true, applies to the pool
68+
resource "tls_private_key" "oke_worker_node_ssh_key" {
69+
algorithm = "RSA"
70+
rsa_bits = 2048
71+
}

modules/oke-node-pool/outputs.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
### Important Security Notice ###
6+
# The private key generated by this resource will be stored unencrypted in your Terraform state file.
7+
# Use of this resource for production deployments is not recommended.
8+
# Instead, generate a private key file outside of Terraform and distribute it securely to the system where Terraform will be run.
9+
output "generated_private_key_pem" {
10+
value = var.generate_public_ssh_key ? tls_private_key.oke_worker_node_ssh_key.private_key_pem : "No Keys Auto Generated"
11+
sensitive = true
12+
}

modules/oke-node-pool/providers.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
terraform {
6+
required_version = ">= 1.1"
7+
required_providers {
8+
oci = {
9+
source = "oracle/oci"
10+
version = "~> 4"
11+
# https://registry.terraform.io/providers/oracle/oci/
12+
}
13+
local = {
14+
source = "hashicorp/local"
15+
version = "~> 2"
16+
# https://registry.terraform.io/providers/hashicorp/local/
17+
}
18+
}
19+
}

0 commit comments

Comments
 (0)