![\"\"](\"https:\/\/artem.services\/wp-content\/uploads\/2018\/10\/terraform.png\")
<\/p>\n<\/p>\n
Terraform<\/strong> configuration example that creates Kubernetes<\/strong> cluster (Bare Metal) on AWS EC2<\/strong>.<\/span> Creates Ingress<\/strong> with NodePort<\/strong>.<\/span> IP<\/strong> addresses Ingress nodes.<\/span><\/p>\n This template creates the following EC2<\/strong> instances:<\/span><\/span><\/p>\n <\/p>\n <\/p>\n\n
variables.tf<\/h4>\n
\r\nvariable "REGION" {\r\n default = "us-east-1"\r\n}\r\n\r\nvariable "PROJECT_NAME" {\r\n default = "artem_k8s"\r\n}\r\n\r\nvariable "SSH_USER" { \r\n default = "ubuntu"\r\n}\r\n\r\nvariable "SSH_KEY_NAME" { \r\n default = "artem.gatchenko"\r\n}\r\n\r\nvariable "SSH_KEY_PATH" { \r\n default = "\/home\/artem\/.ssh\/id_rsa"\r\n}\r\n\r\nvariable "VPC_SUBNET" { \r\n default = "192.168.1.0\/24"\r\n}\r\n\r\nvariable "INSTANCE_TYPE" {\r\n default = "t2.micro"\r\n}\r\n\r\nvariable "WORKER_NUMBER" {\r\n default = "2"\r\n}\r\n<\/pre>\n<\/h4>\n
main.tf<\/h4>\n
\r\nprovider "aws" {\r\n region = "us-east-1"\r\n}\r\n\r\nprovider "aws" {\r\n alias = "vpc"\r\n region = "${var.REGION}"\r\n}\r\n<\/pre>\nvpc.tf<\/h4>\n
\r\n\/\/ CREATE VPC\r\nresource "aws_vpc" "vpc" {\r\n cidr_block = "${var.VPC_SUBNET}"\r\n enable_dns_hostnames = "true"\r\n enable_dns_support = "true"\r\n\r\n tags {\r\n Name = "${var.PROJECT_NAME}"\r\n }\r\n}\r\n\r\n\/\/ CREATE GATEWAY\r\nresource "aws_internet_gateway" "vpc" {\r\n vpc_id = "${aws_vpc.vpc.id}"\r\n\r\n tags {\r\n Name = "${var.PROJECT_NAME}"\r\n }\r\n}\r\n\r\n\/\/ CREATE ROUTE TABLE\r\nresource "aws_route_table" "vpc" {\r\n vpc_id = "${aws_vpc.vpc.id}"\r\n route {\r\n cidr_block = "0.0.0.0\/0"\r\n gateway_id = "${aws_internet_gateway.vpc.id}"\r\n }\r\n\r\n tags {\r\n Name = "${var.PROJECT_NAME}"\r\n }\r\n}\r\n\r\n\/\/ CREATE SUBNET\r\nresource "aws_subnet" "vpc" {\r\n vpc_id = "${aws_vpc.vpc.id}"\r\n cidr_block = "${var.VPC_SUBNET}"\r\n\r\n map_public_ip_on_launch = "true"\r\n\r\n tags {\r\n Name = "${var.PROJECT_NAME}"\r\n }\r\n}\r\n\r\nresource "aws_route_table_association" "vpc" {\r\n subnet_id = "${aws_subnet.vpc.id}"\r\n route_table_id = "${aws_route_table.vpc.id}"\r\n}\r\n\r\n\/\/ CREATE SECURITY GROUP\r\nresource "aws_security_group" "vpc" {\r\n vpc_id = "${aws_vpc.vpc.id}"\r\n\r\n ingress {\r\n from_port = 22\r\n to_port = 22\r\n protocol = "tcp"\r\n cidr_blocks = ["0.0.0.0\/0"]\r\n description = "Allow input SSH"\r\n }\r\n\r\n ingress {\r\n from_port = 80\r\n to_port = 80\r\n protocol = "tcp"\r\n cidr_blocks = ["0.0.0.0\/0"]\r\n description = "Allow input HTTP"\r\n }\r\n\r\n ingress {\r\n from_port = 443\r\n to_port = 443\r\n protocol = "tcp"\r\n cidr_blocks = ["0.0.0.0\/0"]\r\n description = "Allow input HTTPS"\r\n }\r\n\r\n ingress {\r\n from_port = 0\r\n to_port = 0\r\n protocol = "-1"\r\n self = true\r\n description = "Allow triffic between instances in SG"\r\n }\r\n\r\n egress {\r\n from_port = 0\r\n to_port = 0\r\n protocol = "-1"\r\n cidr_blocks = ["0.0.0.0\/0"]\r\n description = "Allow all ouput traffic"\r\n }\r\n\r\n tags {\r\n Name = "${var.PROJECT_NAME}"\r\n Description = "${var.PROJECT_NAME}"\r\n }\r\n\r\n}\r\n<\/pre>\ninstance_master.tf<\/h4>\n
\r\n\/\/ CREATE INSTANCE FOR KUBERNETES MASTER\r\nresource "aws_instance" "master" {\r\n ami = "ami-0ac019f4fcb7cb7e6"\r\n instance_type = "${var.INSTANCE_TYPE}"\r\n key_name = "${var.SSH_KEY_NAME}"\r\n vpc_security_group_ids = ["${aws_security_group.vpc.id}"]\r\n subnet_id = "${aws_subnet.vpc.id}"\r\n associate_public_ip_address = true\r\n source_dest_check = false\r\n\r\n connection {\r\n type = "ssh"\r\n user = "${var.SSH_USER}"\r\n private_key = "${file("${var.SSH_KEY_PATH}")}"\r\n }\r\n\r\n provisioner "file" {\r\n source = "k8s.sh"\r\n destination = "\/tmp\/k8s.sh"\r\n }\r\n\r\n provisioner "file" {\r\n source = "ingress-nginx.yml"\r\n destination = "\/tmp\/ingress-nginx.yml"\r\n }\r\n\r\n provisioner "remote-exec" {\r\n inline = [\r\n "sudo chmod +x \/tmp\/k8s.sh",\r\n "sudo \/tmp\/k8s.sh",\r\n "sudo kubeadm init --apiserver-advertise-address=${aws_instance.master.private_ip} --pod-network-cidr=10.244.0.0\/16 --ignore-preflight-errors SystemVerification --ignore-preflight-errors NumCPU",\r\n "mkdir -p $HOME\/.kube",\r\n "sudo cp -i \/etc\/kubernetes\/admin.conf $HOME\/.kube\/config",\r\n "sudo chown $(id -u):$(id -g) $HOME\/.kube\/config",\r\n "echo 'source <(kubectl completion bash)' >> $HOME\/.bashrc",\r\n "kubectl apply -f https:\/\/raw.githubusercontent.com\/coreos\/flannel\/master\/Documentation\/kube-flannel.yml"\r\n ]\r\n }\r\n\r\n provisioner "local-exec" {\r\n command = "ssh -o StrictHostKeyChecking=no ubuntu@${aws_instance.master.public_ip} -i ${var.SSH_KEY_PATH} 'kubeadm token create --print-join-command' > token"\r\n }\r\n\r\n provisioner "local-exec" {\r\n command = "if [ -e ip_ingresses ]; then rm -rf ip_ingresses; fi"\r\n }\r\n\r\n tags {\r\n Name = "${var.PROJECT_NAME}_master"\r\n }\r\n\r\n}\r\n<\/pre>\ninstance_workers.tf<\/h4>\n
\r\n\/\/ CREATE INSTANCE FOR KUBERNETES WORKERS\r\nresource "aws_instance" "worker" {\r\n depends_on = ["aws_instance.master"]\r\n count = "${var.WORKER_NUMBER}"\r\n ami = "ami-0ac019f4fcb7cb7e6"\r\n instance_type = "${var.INSTANCE_TYPE}"\r\n key_name = "${var.SSH_KEY_NAME}"\r\n vpc_security_group_ids = ["${aws_security_group.vpc.id}"]\r\n subnet_id = "${aws_subnet.vpc.id}"\r\n associate_public_ip_address = true\r\n source_dest_check = false\r\n\r\n connection {\r\n type = "ssh"\r\n user = "${var.SSH_USER}"\r\n private_key = "${file("${var.SSH_KEY_PATH}")}"\r\n }\r\n\r\n provisioner "file" {\r\n source = "k8s.sh"\r\n destination = "\/tmp\/k8s.sh"\r\n }\r\n\r\n provisioner "file" {\r\n source = "token"\r\n destination = "\/tmp\/token"\r\n }\r\n\r\n provisioner "remote-exec" {\r\n inline = [\r\n "sleep 15",\r\n "sudo chmod +x \/tmp\/k8s.sh",\r\n "sudo \/tmp\/k8s.sh",\r\n "sudo `cat \/tmp\/token` --ignore-preflight-errors=SystemVerification"\r\n ]\r\n }\r\n\r\n tags {\r\n Name = "${var.PROJECT_NAME}_worker"\r\n }\r\n}\r\n<\/pre>\ninstance_ingresses.tf<\/h4>\n
\r\n\/\/ CREATE INSTANCE FOR KUBERNETES WORKERS\r\nresource "aws_instance" "ingress" {\r\n depends_on = ["aws_instance.master"]\r\n # depends_on = [\r\n # "aws_instance.master",\r\n # "aws_instance.ingress",\r\n # ]\r\n count = "2"\r\n ami = "ami-0ac019f4fcb7cb7e6"\r\n instance_type = "${var.INSTANCE_TYPE}"\r\n key_name = "${var.SSH_KEY_NAME}"\r\n vpc_security_group_ids = ["${aws_security_group.vpc.id}"]\r\n subnet_id = "${aws_subnet.vpc.id}"\r\n associate_public_ip_address = true\r\n source_dest_check = false\r\n\r\n connection {\r\n type = "ssh"\r\n user = "${var.SSH_USER}"\r\n private_key = "${file("${var.SSH_KEY_PATH}")}"\r\n }\r\n\r\n provisioner "local-exec" {\r\n command = "echo ${self.private_ip} >> ip_ingresses"\r\n }\r\n\r\n provisioner "file" {\r\n source = "k8s.sh"\r\n destination = "\/tmp\/k8s.sh"\r\n }\r\n\r\n provisioner "file" {\r\n source = "token"\r\n destination = "\/tmp\/token"\r\n }\r\n\r\n provisioner "remote-exec" {\r\n inline = [\r\n "sleep 15",\r\n "sudo chmod +x \/tmp\/k8s.sh",\r\n "sudo \/tmp\/k8s.sh",\r\n "sudo `cat \/tmp\/token` --ignore-preflight-errors=SystemVerification"\r\n ]\r\n }\r\n\r\n tags {\r\n Name = "${var.PROJECT_NAME}_ingress"\r\n }\r\n}\r\n<\/pre>\ningress.tf<\/h4>\n
\r\nresource "null_resource" "ingress" {\r\n\r\n triggers = {\r\n instance_id = "${aws_instance.master.id}"\r\n }\r\n\r\n connection {\r\n type = "ssh"\r\n user = "${var.SSH_USER}"\r\n host = "${aws_instance.master.public_ip}"\r\n agent = false\r\n private_key = "${file("${var.SSH_KEY_PATH}")}"\r\n }\r\n\r\n provisioner "file" {\r\n source = "ip_ingresses"\r\n destination = "\/tmp\/ip_ingresses"\r\n }\r\n\r\n provisioner "remote-exec" {\r\n inline = [\r\n "sleep 15",\r\n "kubectl apply -f https:\/\/raw.githubusercontent.com\/kubernetes\/ingress-nginx\/master\/deploy\/mandatory.yaml",\r\n "IP_INGRESS_1=`sed -n 1p \/tmp\/ip_ingresses`",\r\n "IP_INGRESS_2=`sed -n 2p \/tmp\/ip_ingresses`",\r\n "sed -i \\"s\/IP_INGRESS_1\/$IP_INGRESS_1\/g\\" \/tmp\/ingress-nginx.yml",\r\n "sed -i \\"s\/IP_INGRESS_2\/$IP_INGRESS_2\/g\\" \/tmp\/ingress-nginx.yml",\r\n "INGRESS_NAME_1=ip-$(cat \/tmp\/ip_ingresses | sed -n 1p | sed 's\/\\\\.\/-\/g')",\r\n "INGRESS_NAME_2=ip-$(cat \/tmp\/ip_ingresses | sed -n 2p | sed 's\/\\\\.\/-\/g')",\r\n "kubectl label node $INGRESS_NAME_1 node-role.kubernetes.io\/ingress=ingress",\r\n "kubectl label node $INGRESS_NAME_2 node-role.kubernetes.io\/ingress=ingress",\r\n "kubectl apply -f \/tmp\/ingress-nginx.yml"\r\n ]\r\n }\r\n depends_on = [\r\n "aws_instance.master",\r\n "aws_instance.ingress",\r\n ]\r\n}\r\n<\/pre>\ningress-nginx.yml<\/h4>\n
\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n name: ingress-nginx\r\n namespace: ingress-nginx\r\n labels:\r\n app.kubernetes.io\/name: ingress-nginx\r\n app.kubernetes.io\/part-of: ingress-nginx\r\nspec:\r\n type: NodePort\r\n ports:\r\n - name: http\r\n port: 80\r\n targetPort: 80\r\n protocol: TCP\r\n - name: https\r\n port: 443\r\n targetPort: 443\r\n protocol: TCP\r\n externalIPs:\r\n - IP_INGRESS_1\r\n - IP_INGRESS_2\r\n selector:\r\n app.kubernetes.io\/name: ingress-nginx\r\n app.kubernetes.io\/part-of: ingress-nginx\r\n<\/pre>\n
k8s.sh<\/h4>\n
\r\n#!\/bin\/bash\r\n\r\n# THIS SCRIPT FOR INSTALL K8S. SCRIPT FOR UBUNTU\r\n\r\n# INSTALL DOCKER\r\napt update\r\napt install -y apt-transport-https ca-certificates curl software-properties-common\r\n\r\ncurl -fsSL https:\/\/download.docker.com\/linux\/ubuntu\/gpg | apt-key add -\r\n\r\nadd-apt-repository "deb [arch=amd64] https:\/\/download.docker.com\/linux\/ubuntu $(lsb_release -cs) stable"\r\n\r\napt update\r\napt install -y docker-ce\r\n\r\nsystemctl enable docker\r\nsystemctl start docker\r\n\r\n# INSTALL KUBERNETES\r\n\r\ncurl -s https:\/\/packages.cloud.google.com\/apt\/doc\/apt-key.gpg | apt-key add -\r\n \r\ncat <<EOF >\/etc\/apt\/sources.list.d\/kubernetes.list\r\ndeb http:\/\/apt.kubernetes.io\/ kubernetes-xenial main\r\nEOF\r\n \r\napt update\r\napt install -y kubelet kubeadm kubectl\r\n\r\nsystemctl enable kubelet\r\nsystemctl start kubelet\r\n<\/pre>\n
output.tf<\/h4>\n
\r\noutput "aws-k8s-ingresses-ip" {\r\n value = "${aws_instance.ingress.*.public_ip}"\r\n}\r\n<\/pre>\n