terraform-rancher2-aws/examples/downstream/main.tf at 16d046e3545c9cc3abe284e6512eb7c34bc8713e · matttrach/terraform-rancher2-aws · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
provider "aws" {
  default_tags {
    tags = {
      Id    = local.identifier
      Owner = local.owner
    }
  }
  region = local.aws_region
}

provider "acme" {
  server_url = "${local.acme_server_url}/directory"
}

provider "github" {}
provider "kubernetes" {} # make sure you set the env variable KUBE_CONFIG_PATH to local_file_path (file_path variable)
provider "helm" {}       # make sure you set the env variable KUBE_CONFIG_PATH to local_file_path (file_path variable)

provider "rancher2" {
  api_url   = "https://${local.domain}.${local.zone}"
  token_key = module.rancher.admin_token
  timeout   = "300s"
}

locals {
  identifier            = var.identifier
  example               = "downstream"
  project_name          = "tf-${substr(md5(join("-", [local.example, local.identifier])), 0, 5)}"
  username              = local.project_name
  domain                = local.project_name
  zone                  = var.zone
  key_name              = var.key_name
  key                   = var.key
  owner                 = var.owner
  rke2_version          = var.rke2_version
  local_file_path       = var.file_path
  runner_ip             = chomp(data.http.myip.response_body) # "runner" is the server running Terraform
  rancher_version       = var.rancher_version
  cert_manager_version  = "1.16.3" #"1.13.1"
  os                    = "sle-micro-61"
  aws_access_key_id     = var.aws_access_key_id
  aws_secret_access_key = var.aws_secret_access_key
  aws_region            = var.aws_region
  aws_session_token     = var.aws_session_token
  aws_instance_type     = "m5.large"
  node_count            = 3
  email                 = (var.email != "" ? var.email : "${local.identifier}@${local.zone}")
  acme_server_url       = "https://acme-v02.api.letsencrypt.org"
}

data "http" "myip" {
  url = "https://ipinfo.io/ip"
}

module "rancher" {
  source = "../../"
  # project
  identifier                   = local.identifier
  owner                        = local.owner
  project_name                 = local.project_name
  domain                       = local.domain
  zone                         = local.zone
  skip_project_cert_generation = true
  # access
  key_name = local.key_name
  key      = local.key
  username = local.username
  admin_ip = local.runner_ip
  # rke2
  rke2_version    = local.rke2_version
  local_file_path = local.local_file_path
  install_method  = "rpm" # rpm only for now, need to figure out local helm chart installs otherwise
  cni             = "canal"
  node_configuration = {
    "rancher" = {
      type            = "all-in-one"
      size            = "large"
      os              = local.os
      indirect_access = true
      initial         = true
    }
  }
  # rancher
  rancher_version        = local.rancher_version
  cert_manager_version   = local.cert_manager_version
  configure_cert_manager = true
  cert_manager_configuration = {
    aws_access_key_id     = local.aws_access_key_id
    aws_secret_access_key = local.aws_secret_access_key
    aws_session_token     = local.aws_session_token
    aws_region            = local.aws_region
    acme_email            = local.email
    acme_server_url       = local.acme_server_url
  }
}

module "rke2_image" {
  source              = "rancher/server/aws"
  version             = "v1.4.0"
  server_use_strategy = "skip"
  image_use_strategy  = "find"
  image_type          = local.os # this is not required to match Rancher, it just seemed easier in this example
}

# you can add this one multiple times, or use a loop to deploy multiple clusters
module "downstream" {
  depends_on = [
    module.rancher,
    module.rke2_image,
  ]
  source = "./modules/downstream"
  # general
  name       = "tf-all-in-one-config"
  identifier = local.identifier
  owner      = local.owner
  # aws access
  aws_access_key_id     = local.aws_access_key_id
  aws_secret_access_key = local.aws_secret_access_key
  aws_session_token     = trimspace(chomp(local.aws_session_token))
  aws_region            = local.aws_region
  aws_region_letter = replace(
    module.rancher.subnets[keys(module.rancher.subnets)[0]].availability_zone,
    local.aws_region,
    ""
  )
  # aws project info
  vpc_id                        = module.rancher.vpc.id
  security_group_id             = module.rancher.security_group.id
  load_balancer_security_groups = module.rancher.load_balancer_security_groups
  subnet_id                     = module.rancher.subnets[keys(module.rancher.subnets)[0]].id
  # node info
  aws_instance_type = local.aws_instance_type
  ami_id            = module.rke2_image.image.id
  ami_ssh_user      = module.rke2_image.image.user
  ami_admin_group   = module.rke2_image.image.admin_group
  node_count        = local.node_count
  direct_node_access = {
    runner_ip       = local.runner_ip
    ssh_access_key  = local.key
    ssh_access_user = local.project_name
  }
  # rke2 info
  rke2_version = local.rke2_version
}