terraform-hcloud-talos/manifest_cilium.tf at main · monostream/terraform-hcloud-talos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
data "helm_template" "cilium_default" {
  count     = var.deploy_cilium && var.cilium_values == null ? 1 : 0
  name      = "cilium"
  namespace = "kube-system"

  repository   = "https://helm.cilium.io"
  chart        = "cilium"
  version      = var.cilium_version
  kube_version = var.kubernetes_version

  set = concat([
    {
      name  = "operator.replicas"
      value = local.control_plane_count > 1 ? 2 : 1
    },
    {
      name  = "ipam.mode"
      value = "kubernetes"
    },
    {
      name  = "routingMode"
      value = "native"
    },
    {
      name  = "ipv4NativeRoutingCIDR"
      value = local.pod_ipv4_cidr
    },
    {
      name  = "kubeProxyReplacement"
      value = "true"
    },
    {
      name  = "bpf.masquerade"
      value = "false"
    },
    {
      // tailscale does not support XDP and therefore native fails. with best-effort we can fallthrough without failing!
      // see more: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/#loadbalancer-nodeport-xdp-acceleration
      name  = "loadBalancer.acceleration"
      value = var.tailscale.enabled ? "best-effort" : "native"
    },
    {
      name  = "encryption.enabled"
      value = var.cilium_enable_encryption ? "true" : "false"
    },
    {
      name  = "encryption.type"
      value = "wireguard"
    },
    {
      name  = "securityContext.capabilities.ciliumAgent"
      value = "{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}"
    },
    {
      name  = "securityContext.capabilities.cleanCiliumState"
      value = "{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}"
    },
    {
      name  = "cgroup.autoMount.enabled"
      value = "false"
    },
    {
      name  = "cgroup.hostRoot"
      value = "/sys/fs/cgroup"
    },
    {
      name  = "k8sServiceHost"
      value = "127.0.0.1"
    },
    {
      name  = "k8sServicePort"
      value = local.api_port_kube_prism
    },
    {
      name  = "hubble.enabled"
      value = "false"
    },
    {
      name  = "prometheus.serviceMonitor.enabled"
      value = var.cilium_enable_service_monitors ? "true" : "false"
    },
    {
      name  = "prometheus.serviceMonitor.trustCRDsExist"
      value = var.cilium_enable_service_monitors ? "true" : "false"
    },
    {
      name  = "operator.prometheus.serviceMonitor.enabled"
      value = var.cilium_enable_service_monitors ? "true" : "false"
    },
    ],
  )

}

data "helm_template" "cilium_from_values" {
  count     = var.deploy_cilium && var.cilium_values != null ? 1 : 0
  name      = "cilium"
  namespace = "kube-system"

  repository   = "https://helm.cilium.io"
  chart        = "cilium"
  version      = var.cilium_version
  kube_version = var.kubernetes_version
  values       = var.cilium_values
}

data "kubectl_file_documents" "cilium" {
  count = var.deploy_cilium ? 1 : 0
  content = coalesce(
    can(data.helm_template.cilium_from_values[0].manifest) ? data.helm_template.cilium_from_values[0].manifest : null,
    can(data.helm_template.cilium_default[0].manifest) ? data.helm_template.cilium_default[0].manifest : null
  )
}

resource "kubectl_manifest" "apply_cilium" {
  for_each   = var.deploy_cilium ? data.kubectl_file_documents.cilium[0].manifests : {}
  yaml_body  = each.value
  apply_only = true
  depends_on = [data.http.talos_health]
}


data "helm_template" "prometheus_operator_crds" {
  count        = var.deploy_prometheus_operator_crds ? 1 : 0
  chart        = "prometheus-operator-crds"
  name         = "prometheus-operator-crds"
  repository   = "https://prometheus-community.github.io/helm-charts"
  version      = var.prometheus_operator_crds_version
  kube_version = var.kubernetes_version
}

data "kubectl_file_documents" "prometheus_operator_crds" {
  count   = var.deploy_prometheus_operator_crds ? 1 : 0
  content = data.helm_template.prometheus_operator_crds[0].manifest
}

resource "kubectl_manifest" "apply_prometheus_operator_crds" {
  for_each          = var.deploy_prometheus_operator_crds ? data.kubectl_file_documents.prometheus_operator_crds[0].manifests : {}
  yaml_body         = each.value
  server_side_apply = true
  apply_only        = true
  depends_on        = [data.http.talos_health]
}