Merge pull request #368 from kbst/scaleway-nat

Default Scaleway to private nodes and NAT

Author: pst

DEVIATIONS.md

@@ -57,8 +57,6 @@ When a divergence is resolved, remove its entry from this file.
 
 > **Divergence — `google/cluster`:** Required File Layout — `provider.tf` contains the data source `data.google_client_config.default`, which is used by both `kubeconfig.tf` and the kubernetes provider alias block in the same file; per the data source placement rule, a data source used by multiple resources belongs in `data_sources.tf`, not co-located with a provider block. Planned resolution: move the data source to `data_sources.tf`.
 
-> **Divergence — `scaleway/cluster`:** Networking — nodes are assigned public IPs by default (`public_ip_disabled` defaults to `false` in `node_pool.tf`), violating the rule that nodes MUST be configured with private IPs only by default. Planned resolution: flip the default to `true` and add any additional resources that need to be created; if these additioanl resources are only required in one or the other case make them conditional.
-
 > **Divergence — `scaleway/cluster/node-pool`:** Tagging and Labelling — the node-pool module exposes no configuration attribute for Kubernetes node labels; node labels can only be approximated by encoding them as Scaleway tag strings, with no guarantee that they are applied to the Kubernetes node object's `.metadata.labels`, violating the rule that node labels MUST be applied to both the cloud API and the Kubernetes node object. Planned resolution: add a dedicated node label attribute once the Scaleway provider exposes first-class Kubernetes node label support.
 
 > **Divergence — `scaleway/cluster`:** Cluster API Authentication — `scaleway_k8s_cluster.current.kubeconfig[0].token` is a long-lived static admin token issued by the cluster resource; Scaleway does not expose a control to disable static credential issuance on the cluster resource, so this cannot currently be resolved, but it diverges from the rule that static long-lived credentials must be disabled where the provider exposes such a control. Planned resolution: revisit when the Scaleway provider exposes a control to disable static token issuance.

scaleway/cluster/network.tf

@@ -22,3 +22,49 @@ resource "scaleway_vpc_private_network" "current" {
     }
   }
 }
+
+# When nodes have public IPs disabled (the default), a Public Gateway is
+# required in each node zone so that private nodes can reach the internet
+# through NAT (masquerade). One gateway per zone is created conditionally.
+locals {
+  # The set of zones that need a gateway: non-empty only when public IPs are
+  # disabled on the default node pool.  Extra node pools share the same
+  # private network and therefore benefit from the same gateways automatically.
+  gateway_zones = try(coalesce(local.cfg.default_node_pool.public_ip_disabled, null), true) ? toset(coalesce(local.cfg.default_node_pool.zones, [])) : toset([])
+}
+
+resource "scaleway_vpc_public_gateway_ip" "current" {
+  for_each = local.gateway_zones
+
+  project_id = local.cfg.project_id
+  zone       = each.value
+
+  tags = concat(module.cluster_metadata.tags, try(coalesce(local.cfg.extra_tags, null), []))
+}
+
+resource "scaleway_vpc_public_gateway" "current" {
+  for_each = local.gateway_zones
+
+  name       = "${module.cluster_metadata.name}-${each.value}"
+  project_id = local.cfg.project_id
+  zone       = each.value
+
+  type  = try(coalesce(local.cfg.public_gateway_type, null), "VPC-GW-S")
+  ip_id = scaleway_vpc_public_gateway_ip.current[each.value].id
+
+  tags = concat(module.cluster_metadata.tags, try(coalesce(local.cfg.extra_tags, null), []))
+}
+
+resource "scaleway_vpc_gateway_network" "current" {
+  for_each = local.gateway_zones
+
+  gateway_id         = scaleway_vpc_public_gateway.current[each.value].id
+  private_network_id = scaleway_vpc_private_network.current.id
+  zone               = each.value
+
+  enable_masquerade = true
+
+  ipam_config {
+    push_default_route = true
+  }
+}

scaleway/cluster/node-pool/main.tf

@@ -39,7 +39,7 @@ resource "scaleway_k8s_pool" "current" {
   root_volume_type       = local.cfg.root_volume_type
   root_volume_size_in_gb = local.cfg.root_volume_size_in_gb
 
-  public_ip_disabled = try(coalesce(local.cfg.public_ip_disabled, null), false)
+  public_ip_disabled = try(coalesce(local.cfg.public_ip_disabled, null), true)
 
   wait_for_pool_ready = try(coalesce(local.cfg.wait_for_pool_ready, null), true)
 

scaleway/cluster/node_pool.tf

@@ -20,7 +20,7 @@ module "node_pool" {
       root_volume_type       = try(local.cfg.default_node_pool.root_volume_type, null)
       root_volume_size_in_gb = try(local.cfg.default_node_pool.root_volume_size_in_gb, null)
 
-      public_ip_disabled = try(coalesce(local.cfg.default_node_pool.public_ip_disabled, null), false)
+      public_ip_disabled = try(coalesce(local.cfg.default_node_pool.public_ip_disabled, null), true)
 
       upgrade_policy = try(local.cfg.default_node_pool.upgrade_policy, null)
 
@@ -31,4 +31,10 @@ module "node_pool" {
     }
   }
   configuration_base_key = terraform.workspace
+
+  # Scaleway rejects public_ip_disabled = true on a pool unless a Public
+  # Gateway is already attached to the private network and advertising a
+  # default route. Wait for all gateway networks to be fully operational
+  # before creating or updating any node pool.
+  depends_on = [scaleway_vpc_gateway_network.current]
 }

scaleway/cluster/variables.tf

@@ -46,6 +46,11 @@ variable "configuration" {
     # Private network
     private_network_subnet = optional(string)
 
+    # Public Gateway — only provisioned when public_ip_disabled is true (the default).
+    # Sets the gateway type for all per-zone public gateways created for NAT egress.
+    # Run `scw vpc public-gateway list-types` to see available types.
+    public_gateway_type = optional(string)
+
     # Extra tags added to all cloud resources in addition to the metadata tags
     extra_tags = optional(list(string))
 

tests/scw_zero_cluster.tf

@@ -7,16 +7,16 @@ module "scw_zero" {
       name_prefix = "kbstacctest"
       base_domain = "infra.serverwolken.de"
 
-      region = "fr-par"
+      region = "nl-ams"
 
-      cluster_version = "1.32"
+      cluster_version = "1.34"
       cni             = "cilium"
 
       delete_additional_resources = false
 
       default_node_pool = {
-        node_type   = "GP1-XS"
-        zones       = ["fr-par-1", "fr-par-2", "fr-par-3"]
+        node_type   = "PLAY2-MICRO"
+        zones       = ["nl-ams-1", "nl-ams-2", "nl-ams-3"]
         size        = 1
         min_size    = 1
         max_size    = 2

tests/scw_zero_node_pools.tf

@@ -9,8 +9,8 @@ module "scw_zero_node_pool" {
     apps = {
       name = "test1"
 
-      node_type   = "GP1-XS"
-      zones       = ["fr-par-1", "fr-par-2", "fr-par-3"]
+      node_type   = "PLAY2-MICRO"
+      zones       = ["nl-ams-1", "nl-ams-2", "nl-ams-3"]
       size        = 1
       min_size    = 1
       max_size    = 2