https://github.com/blankdots/rke2-terraform-libvirt

RKE2 Terraform libvirt instalelr
https://github.com/blankdots/rke2-terraform-libvirt

libvirt-provider rke2 terraform

Last synced: about 2 months ago
JSON representation

RKE2 Terraform libvirt instalelr

• Host: GitHub
• URL: https://github.com/blankdots/rke2-terraform-libvirt
• Owner: blankdots
• License: mit
• Created: 2023-01-31T10:59:08.000Z (almost 2 years ago)
• Default Branch: main
• Last Pushed: 2024-10-21T12:58:28.000Z (2 months ago)
• Last Synced: 2024-10-21T20:16:06.522Z (2 months ago)
• Topics: libvirt-provider, rke2, terraform
• Language: HCL
• Homepage:
• Size: 99.6 KB
• Stars: 1
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE
  • Security: SECURITY.md

Awesome Lists containing this project

README

        
# rke2-terraform-libvirt

[![Lint](https://github.com/blankdots/rke2-terraform-libvirt/actions/workflows/tflint.yml/badge.svg)](https://github.com/blankdots/rke2-terraform-libvirt/actions/workflows/tflint.yml)

[![Scripts linter](https://github.com/blankdots/rke2-terraform-libvirt/actions/workflows/shellcheck.yml/badge.svg)](https://github.com/blankdots/rke2-terraform-libvirt/actions/workflows/shellcheck.yml)

[![tfsec](https://github.com/blankdots/rke2-terraform-libvirt/actions/workflows/tfsec.yml/badge.svg)](https://github.com/blankdots/rke2-terraform-libvirt/actions/workflows/tfsec.yml)

A repository that creates a RKE2 kubernetes cluster using Terraform.

Out of the box it comes configured with:

- pre-checks all the requirements are met for the setup to run;

- checks kubernetes API is running and nodes are available after apply;

- generating ssh key for `kubernetes` user, to be used to connect to the VMs (instead of password login);

    - makes use of ssh-agent to load key;

    - key is password protected and generated once;

- generating tf.vars file based on template in file `terraform-template.json`;

- exports kubernetes config file to `k8s.yaml` in root folder;

- kubernetes rke2 additions:

    - system-upgrade controller, to be able to run plans from https://docs.rke2.io/upgrade/automated_upgrade/#configure-plans ;

    - custom audit policy to have more precise logging;

    - wireguard added and configured;

    - `automountServiceAccountToken` set to false, by default;

    - iptables configured to restrict traffic between nodes on specific ports. Configuration is persistent on reboot;

    - (optional) mirror for docker hub with username and password can be configured by adding to the `terraform-template.json`:

        ```json

        "registry_mirror": "mirror.example.com",

        "registry_mirror_user": "example",

        "registry_mirror_pass": "example"

        ```

## Usage

### Creating kuberentes cluster

```bash

# generate keys and load terraform modules

make init

# create plan based on template (need to run once)

make plan

# apply configuration

make apply

```

On `make init` new ssh keys are generated only if they don't exist, and the password is generated once. If the keys want to be reused and the key has been removed from the ssh-agent, `export SSH_PASS=` needs to be used for the `make init` to know how to add the keys to the ssh-agent.

### Destroy kubernetes cluster

```bash

# destroy cluster

make destroy

```

## License

MIT License

Code adapted from from https://github.com/hoeghh/rke2-terraform/ which is licensed under MIT License