Skip to content

Commit 2c7037a

Browse files
hyderhyder
authored
feat: added stern, update istio-mc examples module (#967)
* feat: added stern, update istio-mc examples module Signed-off-by: Ali <[email protected]> * chore: formatting of istio examples fix: set default install_stern value to false Signed-off-by: Ali <[email protected]> --------- Signed-off-by: Ali <[email protected]>
1 parent 1cf9a74 commit 2c7037a

File tree

12 files changed

+133
-66
lines changed

12 files changed

+133
-66
lines changed

‎examples/istio-mc/c1.tf

Lines changed: 41 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
module "c1" {
55

66
source = "oracle-terraform-modules/oke/oci"
7-
version = "5.1.1"
7+
version = "5.2.2"
88

99
count = lookup(lookup(var.clusters, "c1"), "enabled") ? 1 : 0
1010

1111
home_region = lookup(local.regions, var.home_region)
12-
13-
region = lookup(local.regions, lookup(lookup(var.clusters, "c1"), "region"))
12+
13+
region = lookup(local.regions, lookup(lookup(var.clusters, "c1"), "region"))
1414

1515
tenancy_id = var.tenancy_id
1616

@@ -23,7 +23,7 @@ module "c1" {
2323

2424
# networking
2525
create_drg = var.oke_control_plane == "private" ? true : false
26-
drg_display_name = "c1"
26+
drg_display_name = "c1-drg"
2727

2828
remote_peering_connections = var.oke_control_plane == "private" ? {
2929
for k, v in var.clusters : "rpc-to-${k}" => {} if k != "c1"
@@ -51,7 +51,6 @@ module "c1" {
5151
int_lb = { newbits = 11, netnum = 16, dns_label = "ilb" }
5252
pub_lb = { newbits = 11, netnum = 17, dns_label = "plb" }
5353
workers = { newbits = 2, netnum = 1, dns_label = "workers" }
54-
pods = { newbits = 2, netnum = 2, dns_label = "pods" }
5554
}
5655

5756
# bastion host
@@ -78,32 +77,54 @@ module "c1" {
7877

7978

8079
# node pools
81-
allow_worker_ssh_access = true
82-
kubeproxy_mode = "iptables"
83-
worker_pool_mode = "node-pool"
84-
worker_pools = var.nodepools
85-
worker_cloud_init = local.worker_cloud_init
86-
worker_image_type = "oke"
80+
allow_worker_ssh_access = true
81+
kubeproxy_mode = "iptables"
82+
worker_pool_mode = "node-pool"
83+
worker_pools = var.nodepools
84+
worker_cloud_init = local.worker_cloud_init
85+
worker_image_type = "oke"
8786

8887
# oke load balancers
8988
load_balancers = "both"
9089
preferred_load_balancer = "public"
9190

92-
allow_rules_internal_lb = {
91+
allow_rules_internal_lb = merge({
9392
for p in local.service_mesh_ports :
94-
95-
format("Allow ingress to port %v", p) => {
96-
protocol = local.tcp_protocol, port = p, source = lookup(lookup(var.clusters, "c2"), "vcn"), source_type = local.rule_type_cidr,
93+
format("Allow ingress to port %v from cluster c2 for Istio", p) => {
94+
protocol = local.tcp_protocol, port = p, source = lookup(lookup(var.clusters, "c2"), "vcn"),
95+
source_type = local.rule_type_cidr,
9796
}
98-
}
99-
100-
allow_rules_public_lb = {
97+
},
98+
{
99+
for c in var.clusters : format("Allow TCP ingress from cluster %v for Cilium clustermesh", lookup(c, "name")) => {
100+
protocol = local.tcp_protocol, port = 2379, source = lookup(c, "vcn"), source_type = local.rule_type_cidr,
101+
} if lookup(c, "name") != "c1"
102+
},
103+
{
104+
for c in var.clusters :
105+
format("Allow UDP ingress from cluster %v for cross-cluster DNS lookup via NLB for Coherence WKA", lookup(c, "name"))
106+
=> {
107+
protocol = local.udp_protocol, port = 53, source = lookup(c, "vcn"), source_type = local.rule_type_cidr,
108+
} if lookup(c, "name") != "c1"
109+
},
110+
)
111+
112+
allow_rules_public_lb = merge({
101113
for p in local.public_lb_allowed_ports :
102-
103114
format("Allow ingress to port %v", p) => {
104115
protocol = local.tcp_protocol, port = p, source = "0.0.0.0/0", source_type = local.rule_type_cidr,
105116
}
106-
}
117+
},
118+
)
119+
120+
allow_rules_workers = merge(
121+
{
122+
for c in var.clusters :
123+
format("Allow UDP ingress to workers from cluster %v for default VXLAN", lookup(c, "name")) => {
124+
protocol = local.udp_protocol, port = 8472, source = lookup(c, "vcn"), source_type = local.rule_type_cidr,
125+
} if lookup(c, "name") != "c1"
126+
},
127+
)
107128

108129
user_id = var.user_id
109130

‎examples/istio-mc/c2.tf

Lines changed: 39 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
module "c2" {
55

66
source = "oracle-terraform-modules/oke/oci"
7-
version = "5.1.1"
7+
version = "5.2.2"
88

99
count = lookup(lookup(var.clusters, "c2"), "enabled") ? 1 : 0
1010

1111
home_region = lookup(local.regions, var.home_region)
12-
13-
region = lookup(local.regions, lookup(lookup(var.clusters, "c2"), "region"))
12+
13+
region = lookup(local.regions, lookup(lookup(var.clusters, "c2"), "region"))
1414

1515
tenancy_id = var.tenancy_id
1616

@@ -49,7 +49,6 @@ module "c2" {
4949
int_lb = { newbits = 11, netnum = 16, dns_label = "ilb" }
5050
pub_lb = { newbits = 11, netnum = 17, dns_label = "plb" }
5151
workers = { newbits = 2, netnum = 1, dns_label = "workers" }
52-
pods = { newbits = 2, netnum = 2, dns_label = "pods" }
5352
}
5453

5554
# bastion host
@@ -76,32 +75,53 @@ module "c2" {
7675

7776

7877
# node pools
79-
kubeproxy_mode = "iptables"
80-
worker_pool_mode = "node-pool"
81-
worker_pools = var.nodepools
82-
worker_cloud_init = local.worker_cloud_init
83-
worker_image_type = "oke"
78+
kubeproxy_mode = "iptables"
79+
worker_pool_mode = "node-pool"
80+
worker_pools = var.nodepools
81+
worker_cloud_init = local.worker_cloud_init
82+
worker_image_type = "oke"
8483

8584
# oke load balancers
8685
load_balancers = "both"
8786
preferred_load_balancer = "public"
8887

89-
allow_rules_internal_lb = {
88+
allow_rules_internal_lb = merge({
9089
for p in local.service_mesh_ports :
91-
92-
format("Allow ingress to port %v", p) => {
93-
protocol = local.tcp_protocol, port = p, source = lookup(lookup(var.clusters, "c1"), "vcn"), source_type = local.rule_type_cidr,
90+
format("Allow ingress to port %v from cluster c1", p) => {
91+
protocol = local.tcp_protocol, port = p, source = lookup(lookup(var.clusters, "c1"), "vcn"),
92+
source_type = local.rule_type_cidr,
9493
}
95-
}
96-
97-
allow_rules_public_lb = {
98-
94+
},
95+
{
96+
for c in var.clusters : format("Allow TCP ingress from cluster %v for Cilium clustermesh", lookup(c, "name")) => {
97+
protocol = local.tcp_protocol, port = 2379, source = lookup(c, "vcn"), source_type = local.rule_type_cidr,
98+
} if lookup(c, "name") != "c2"
99+
},
100+
{
101+
for c in var.clusters :
102+
format("Allow UDP ingress from cluster %v for cross-cluster DNS lookup via NLB for Coherence WKA", lookup(c, "name"))
103+
=> {
104+
protocol = local.udp_protocol, port = 53, source = lookup(c, "vcn"), source_type = local.rule_type_cidr,
105+
} if lookup(c, "name") != "c2"
106+
},
107+
)
108+
109+
allow_rules_public_lb = merge({
99110
for p in local.public_lb_allowed_ports :
100-
101111
format("Allow ingress to port %v", p) => {
102112
protocol = local.tcp_protocol, port = p, source = "0.0.0.0/0", source_type = local.rule_type_cidr,
103113
}
104-
}
114+
},
115+
)
116+
117+
allow_rules_workers = merge(
118+
{
119+
for c in var.clusters :
120+
format("Allow UDP ingress to workers from cluster %v for default VXLAN", lookup(c, "name")) => {
121+
protocol = local.udp_protocol, port = 8472, source = lookup(c, "vcn"), source_type = local.rule_type_cidr
122+
} if lookup(c, "name") != "c2"
123+
},
124+
)
105125

106126
user_id = var.user_id
107127

‎examples/istio-mc/istio.tf

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,27 @@
22
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
33

44
locals {
5-
istio_c1 = templatefile("${path.module}/resources/istio.template.yaml",
6-
{
7-
mesh_id = var.istio_mesh_id
8-
cluster = "c1"
9-
mesh_network = "c1"
10-
pub_nsg_id = one(element([module.c1[*].pub_lb_nsg_id], 0))
11-
int_lb_subnet_id = one(element([module.c1[*].int_lb_subnet_id], 0))
12-
int_nsg_id = one(element([module.c1[*].int_lb_nsg_id], 0))
13-
}
14-
)
5+
istio_c1 = templatefile("${path.module}/resources/istio.template.yaml",
6+
{
7+
mesh_id = var.istio_mesh_id
8+
cluster = "c1"
9+
mesh_network = "c1"
10+
pub_nsg_id = one(element([module.c1[*].pub_lb_nsg_id], 0))
11+
int_lb_subnet_id = one(element([module.c1[*].int_lb_subnet_id], 0))
12+
int_nsg_id = one(element([module.c1[*].int_lb_nsg_id], 0))
13+
}
14+
)
1515

16-
istio_c2 = templatefile("${path.module}/resources/istio.template.yaml",
17-
{
18-
mesh_id = var.istio_mesh_id
19-
cluster = "c2"
20-
mesh_network = "c2"
21-
pub_nsg_id = one(element([module.c2[*].pub_lb_nsg_id], 0))
22-
int_lb_subnet_id = one(element([module.c2[*].int_lb_subnet_id], 0))
23-
int_nsg_id = one(element([module.c2[*].int_lb_nsg_id], 0))
24-
}
25-
)
16+
istio_c2 = templatefile("${path.module}/resources/istio.template.yaml",
17+
{
18+
mesh_id = var.istio_mesh_id
19+
cluster = "c2"
20+
mesh_network = "c2"
21+
pub_nsg_id = one(element([module.c2[*].pub_lb_nsg_id], 0))
22+
int_lb_subnet_id = one(element([module.c2[*].int_lb_subnet_id], 0))
23+
int_nsg_id = one(element([module.c2[*].int_lb_nsg_id], 0))
24+
}
25+
)
2626
}
2727

2828
resource "null_resource" "istio" {

‎examples/istio-mc/locals.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ locals {
2020
bastion_ip = one(element([module.c1[*].bastion_public_ip], 0))
2121

2222
operator_ip = one(element([module.c1[*].operator_private_ip], 0))
23-
23+
2424
# TODO: check when is 15021 required for public
2525
public_lb_allowed_ports = [80, 443, 15021]
2626

‎examples/istio-mc/outputs.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@
33

44
output "ssh_to_operator" {
55
description = "convenient command to ssh to the Admin operator host"
6-
value = one(element([module.c1[*].ssh_to_operator],0))
6+
value = one(element([module.c1[*].ssh_to_operator], 0))
77
}

‎examples/istio-mc/providers.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
provider "oci" {
55
fingerprint = var.api_fingerprint
66
private_key_path = var.api_private_key_path
7-
region = lookup(local.regions,var.home_region)
7+
region = lookup(local.regions, var.home_region)
88
tenancy_ocid = var.tenancy_id
99
user_ocid = var.user_id
1010
alias = "home"
@@ -14,7 +14,7 @@ provider "oci" {
1414
provider "oci" {
1515
fingerprint = var.api_fingerprint
1616
private_key_path = var.api_private_key_path
17-
region = lookup(local.regions,lookup(lookup(var.clusters,"c1"),"region"))
17+
region = lookup(local.regions, lookup(lookup(var.clusters, "c1"), "region"))
1818
tenancy_ocid = var.tenancy_id
1919
user_ocid = var.user_id
2020
alias = "c1"
@@ -24,7 +24,7 @@ provider "oci" {
2424
provider "oci" {
2525
fingerprint = var.api_fingerprint
2626
private_key_path = var.api_private_key_path
27-
region = lookup(local.regions,lookup(lookup(var.clusters,"c2"),"region"))
27+
region = lookup(local.regions, lookup(lookup(var.clusters, "c2"), "region"))
2828
tenancy_ocid = var.tenancy_id
2929
user_ocid = var.user_id
3030
alias = "c2"

‎examples/istio-mc/terraform.tfvars.example

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# provider
1+
# provider
22
api_fingerprint = ""
33

44
api_private_key_path = "~/.oci/oci_rsa.pem"

‎examples/istio-mc/variables.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ variable "clusters" {
6161
}
6262

6363
variable "kubernetes_version" {
64-
default = "v1.28.2"
64+
default = "v1.30.1"
6565
description = "The version of Kubernetes to use."
6666
type = string
6767
}

‎module-operator.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ module "operator" {
6464
install_k9s = var.operator_install_k9s
6565
install_kubectx = var.operator_install_kubectx
6666
install_kubectl_from_repo = var.operator_install_kubectl_from_repo
67+
install_stern = var.operator_install_stern
6768
kubeconfig = yamlencode(local.kubeconfig_private)
6869
kubernetes_version = var.kubernetes_version
6970
nsg_ids = compact(flatten([var.operator_nsg_ids, try(module.network.operator_nsg_id, null)]))

‎modules/operator/cloudinit.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ data "cloudinit_config" "operator" {
3232
"git",
3333
"jq",
3434
"python3-oci-cli",
35+
"golang",
3536
var.install_helm ? "helm" : null,
3637
var.install_istioctl ? "istio-istioctl" : null,
3738
var.install_kubectl_from_repo ? "kubectl": null,
@@ -193,6 +194,23 @@ data "cloudinit_config" "operator" {
193194
}
194195
}
195196

197+
# stern installation
198+
dynamic "part" {
199+
for_each = var.install_kubectx ? [1] : []
200+
content {
201+
content_type = "text/cloud-config"
202+
content = jsonencode({
203+
runcmd = [
204+
"go install github.com/stern/[email protected]",
205+
"mv $HOME/go/bin/stern /usr/local/bin/",
206+
"ln -s /usr/local/bin/stern /usr/bin/stern"
207+
]
208+
})
209+
filename = "20-stern.yml"
210+
merge_type = local.default_cloud_init_merge_type
211+
}
212+
}
213+
196214
# Write user bashrc to filesystem
197215
part {
198216
content_type = "text/cloud-config"

‎modules/operator/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ variable "install_kubectl_from_repo" {
2323
default = true
2424
}
2525
variable "install_kubectx" { type = bool }
26+
variable "install_stern" { type = bool }
2627
variable "kubeconfig" { type = string }
2728
variable "kubernetes_version" { type = string }
2829
variable "nsg_ids" { type = list(string) }

‎variables-operator.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,12 @@ variable "operator_install_kubectx" {
8989
type = bool
9090
}
9191

92+
variable "operator_install_stern" {
93+
default = false
94+
description = "Whether to install stern on the created operator host. NOTE: Provided only as a convenience and not supported by or sourced from Oracle - use at your own risk."
95+
type = bool
96+
}
97+
9298
variable "operator_shape" {
9399
default = {
94100
shape = "VM.Standard.E4.Flex",

0 commit comments

Comments
 (0)