GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → coreos → terraform-azurerm-kubernetes

coreos / terraform-azurerm-kubernetes

Licence: Apache-2.0 license
Install a Kubernetes cluster the CoreOS Tectonic Way: HA, self-hosted, RBAC, etcd Operator, and more

Programming Languages

HCL
1544 projects
Makefile
30231 projects

Labels

kubernetesazureterraformcoreosterraform-modulestectonic

Projects that are alternatives of or similar to terraform-azurerm-kubernetes

terranetes
Terraform boilerplate for production-grade Kubernetes clusters on AWS (optionally includes kube-system components, OpenVPN, an ingress controller, monitoring services...)
Stars: ✭ 15 (-31.82%)
Mutual labels:  coreos, terraform-modules
terraform-aws-efs-backup
Terraform module designed to easily backup EFS filesystems to S3 using DataPipeline
Stars: ✭ 40 (+81.82%)
Mutual labels:  terraform-modules
terraform-aws-logs
Creates and configures an S3 bucket for storing AWS logs.
Stars: ✭ 69 (+213.64%)
Mutual labels:  terraform-modules
terraform-aws-s3-anti-virus
Creates and configures Anti-Virus Scanning of S3 Buckets.
Stars: ✭ 31 (+40.91%)
Mutual labels:  terraform-modules
terraform-aws-iam-system-user
Terraform Module to Provision a Basic IAM System User Suitable for CI/CD Systems (E.g. TravisCI, CircleCI)
Stars: ✭ 71 (+222.73%)
Mutual labels:  terraform-modules
terraform-aws-vpc
A Terraform module to create an Amazon Web Services (AWS) Virtual Private Cloud (VPC).
Stars: ✭ 24 (+9.09%)
Mutual labels:  terraform-modules
terraform-modules
Reusable Terraform modules
Stars: ✭ 12 (-45.45%)
Mutual labels:  terraform-modules
terraform-azurerm-compute
Terraform Azure RM Compute Module
Stars: ✭ 133 (+504.55%)
Mutual labels:  terraform-modules
terraform-aws-cloudtrail
Creates and configures AWS CloudTrail
Stars: ✭ 40 (+81.82%)
Mutual labels:  terraform-modules
docker
CoreOS Docker，让你更便捷、系统化的使用Docker管理你的服务
Stars: ✭ 366 (+1563.64%)
Mutual labels:  coreos
terraform-digitalocean-kubernetes
A terraform module for managing and creating a Kubernetes cluster on digital ocean
Stars: ✭ 11 (-50%)
Mutual labels:  terraform-modules
terraform-aws-minikube
Terraform module for single node Kubernetes instance bootstrapped using kubeadm
Stars: ✭ 58 (+163.64%)
Mutual labels:  terraform-modules
terraform-aws-redis-elasticache
A Terraform module to create an Amazon Web Services (AWS) Redis ElastiCache cluster.
Stars: ✭ 33 (+50%)
Mutual labels:  terraform-modules
terraform-aws-enforce-mfa
A terraform module to enforce MFA for AWS groups and users
Stars: ✭ 24 (+9.09%)
Mutual labels:  terraform-modules
terraform-codedeploy
Terraform module to add codedeploy
Stars: ✭ 29 (+31.82%)
Mutual labels:  terraform-modules
terraform-aws-lambda-function
A Terraform module for deploying and managing Lambda functions on Amazon Web Services (AWS). https://aws.amazon.com/lambda/
Stars: ✭ 37 (+68.18%)
Mutual labels:  terraform-modules
k8s-ldap
Kubernetes - LDAP authentication with Dex
Stars: ✭ 59 (+168.18%)
Mutual labels:  coreos
terraform-modules
Terraform Modules by Peak
Stars: ✭ 16 (-27.27%)
Mutual labels:  terraform-modules
terraform-oci-vcn
A reusable and extensible Terraform module that provisions a VCN on Oracle Cloud Infrastructure
Stars: ✭ 22 (+0%)
Mutual labels:  terraform-modules
terraform-aws-route53-cluster-zone
Terraform module to easily define consistent cluster domains on Route53 (e.g. `prod.ourcompany.com`)
Stars: ✭ 42 (+90.91%)
Mutual labels:  terraform-modules
View All Similar Projects ➔

Install Tectonic on Azure with Terraform

This module deploys a Tectonic Kubernetes cluster on Azure using Terraform. Tectonic is an enterprise-ready distribution of Kubernetes including automatic updates, monitoring and alerting, integration with common authentication regimes, and a graphical console for managing clusters in a web browser.

This module can deploy either a complete Tectonic cluster, requiring a Tectonic license, or a "stock" Kubernetes cluster without Tectonic features.

The Azure platform templates generally adhere to the standards defined by the project conventions and generic platform requirements. This document clarifies the implementation details specific to the Azure platform.

Prerequisites

DNS

Two methods of providing DNS for the Tectonic installation are supported:

Azure-provided DNS

This is Azure's default DNS implementation. For more information, see the Azure DNS overview.

To use Azure-provided DNS, tectonic_base_domain must be set to ""(empty string).

DNS delegation and custom zones via Azure DNS

To configure a custom domain and the associated records in an Azure DNS zone (e.g., ${cluster_name}.foo.bar):

  • The custom domain must be specified using tectonic_base_domain
  • The domain must be publicly discoverable. The Tectonic installer uses the created record to access the cluster and complete configuration. See the Microsoft Azure documentation for instructions on how to delegate a domain to Azure DNS.
  • An Azure DNS zone matching the chosen tectonic_base_domain must be created prior to running the installer. The full resource ID of the DNS zone must then be referenced in tectonic_azure_external_dns_zone_id

Tectonic Account

Register for a Tectonic Account, free for up to 10 nodes. The cluster license and pull secret are required during installation.

Azure CLI

The Azure CLI is required to generate Azure credentials.

ssh-agent

The next step in preparing the environment for installation is to add the key to be used for logging in to each cluster node during initialization to the local ssh-agent.

Adding a key to ssh-agent

Ensure ssh-agent is running by listing the known keys:

$ ssh-add -L

Add the SSH private key that will be used for the deployment to ssh-agent:

$ ssh-add ~/.ssh/id_rsa

Verify that the SSH key identity is available to the ssh-agent:

$ ssh-add -L

Reference the absolute path of the public component of the SSH key in the tectonic_azure_ssh_key variable.

Without this, terraform is not able to SSH copy the assets and start bootkube. Also, ensure the SSH known_hosts file doesn't have old records for the API DNS name, because key fingerprints will not match.

Configuring the deployment

Get Terraform's Azure modules and providers

Get the modules and providers for the Azure platform that Terraform will use to create cluster resources:

$ terraform init
Downloading modules...
Get: git::https://github.com/coreos/tectonic-installer.git?ref=1d75718d96c7bdec04d5ffb8a72fa059b1fcb79a
Get: git::https://github.com/coreos/tectonic-installer.git?ref=1d75718d96c7bdec04d5ffb8a72fa059b1fcb79a
Get: git::https://github.com/coreos/tectonic-installer.git?ref=1d75718d96c7bdec04d5ffb8a72fa059b1fcb79a
...


Initializing provider plugins...
- Downloading plugin for provider "template"...
- Downloading plugin for provider "azurerm"...
- Downloading plugin for provider "null"...
- Downloading plugin for provider "ignition"...
...

Generate credentials with Azure CLI

Execute az login to obtain an authentication token. See the Azure CLI docs for more information. Once logged in, note the id field of the output from the az login command. This is a simple way to retrieve the Subscription ID for the Azure account.

Add Active Directory Service Principal role assignment

Next, add a new Active Directory (AD) Service Principal (SP) role assignment to grant Terraform access to Azure:

$ az ad sp create-for-rbac -n "http://tectonic" --role contributor
Retrying role assignment creation: 1/24
Retrying role assignment creation: 2/24
{
 "appId": "generated-app-id",
 "displayName": "azure-cli-2017-01-01",
 "name": "http://tectonic-coreos",
 "password": "generated-pass",
 "tenant": "generated-tenant"
}

Export the following environment variables with values obtained from the output of the role assignment. As noted above, ARM_SUBSCRIPTION_ID is the id of the Azure account returned by az login.

# id field in az login output
$ export ARM_SUBSCRIPTION_ID=abc-123-456
# appID field in az ad output
$ export ARM_CLIENT_ID=generated-app-id
# password field in az ad output
$ export ARM_CLIENT_SECRET=generated-pass
# tenant field in az ad output
$ export ARM_TENANT_ID=generated-tenant

With the environment set, it's time to specify the deployment details for the cluster.

Customize the deployment

Customizations to the base installation are made to the Terraform variables for each deployment. Examples of the this module's variables are provided in the file examples/kubernetes.tf.

Edit the variables with the Azure account details, domain name, and Tectonic license. To install a basic Kubernetes cluster without Tectonic features, set the tectonic_vanilla_k8s key to true and omit the Tectonic license.

View all of the Azure specific options and the common Tectonic variables.

Key values for basic Azure deployment

These are the basic values that must be adjusted for each deployment on Azure. See the details of each value in the comments in the examples/kubernetes.tf file.

  • tectonic_admin_email - For the initial Console login
  • tectonic_admin_password_hash - Use [bcrypt-tool][bcrypt-tool] to encrypt password
  • tectonic_azure_client_secret - As in ARM_CLIENT_SECRET above
  • tectonic_azure_ssh_key - Full path to the public key part of the key added to ssh-agent above
  • tectonic_azure_location - e.g., centralus
  • tectonic_base_domain - The DNS domain or subdomain delegated to an Azure DNS zone above
  • tectonic_azure_external_dns_zone_id - Value of id in az network dns zone list output
  • tectonic_cluster_name - The name to give the cluster
  • tectonic_license_path - Full path to tectonic-license.txt file downloaded from Tectonic account
  • tectonic_pull_secret_path - Full path to config.json container pull secret file downloaded from Tectonic account

Deploy the cluster

Check the plan before deploying:

$ terraform plan

Next, deploy the cluster:

$ terraform apply

This should run for a short time.

Access the cluster

When terraform apply is complete, access Tectonic Console in a web browser at the URL formed by concatenating the cluster name and the domain name configured in the Terraform variables.

CLI cluster operations with kubectl

Cluster credentials are written beneath the generated/ directory, including any generated CA certificate and a kubeconfig. Use the kubeconfig file to access the cluster with the kubectl CLI tool. This is the only method of access for a Kubernetes cluster installed without Tectonic features:

$ export KUBECONFIG=generated/auth/kubeconfig
$ kubectl cluster-info

Delete the cluster

Deleting a cluster will remove only the infrastructure elements created by Terraform. For example, an existing DNS resource group is not removed.

To delete the cluster, run the terraform destroy command:

$ terraform destroy
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].