InfraScience
/
infrastructure-as-code
22
0
Fork 2
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Try to add ICMP to the load balancer.

This commit is contained in:
Andrea Dell'Amico 2024-07-02 19:43:55 +02:00
parent dbdee08c44
commit 52df91d983
Signed by: andrea.dellamico
GPG Key ID: 147ABE6CEB9E20FF
3 changed files with 206 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
openstack-tf/garr-ct1/kubernetes-resources/octavia-for-k8s.tf
View File

@ -1,6 +1,35 @@
#
# Octavia
#
#
# Security group to open the ICMP traffic
#
resource "openstack_networking_secgroup_v2" "octavia_extra_traffic" {
name = "octavia_lb_extra_traffic"
delete_default_rules = "true"
description = "Traffic to the load balancer in addition to the listeners"
}
resource "openstack_networking_secgroup_rule_v2" "icmp_ingress_to_the_load_balancer" {
security_group_id = openstack_networking_secgroup_v2.octavia_extra_traffic.id
description = "Ingress ICMP traffic"
direction = "ingress"
ethertype = "IPv4"
protocol = "icmp"
remote_ip_prefix = "0.0.0.0/0"
}
resource "openstack_networking_secgroup_rule_v2" "ssh_ingress_to_the_load_balancer" {
security_group_id = openstack_networking_secgroup_v2.octavia_extra_traffic.id
description = "Ingress SSH traffic from the internal network"
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = data.terraform_remote_state.privnet_dns_router.outputs.main_private_subnet.cidr
}
# Kubernetes load balancer. L4, backed by Octavia
resource "openstack_lb_loadbalancer_v2" "k8s_lb" {
vip_subnet_id = data.terraform_remote_state.privnet_dns_router.outputs.main_private_subnet.id
@ -8,6 +37,7 @@ resource "openstack_lb_loadbalancer_v2" "k8s_lb" {
description = var.octavia_kubernetes_data.k8s_lb_description
# flavor_id = var.octavia_kubernetes_data.octavia_flavor_id
loadbalancer_provider = "amphora"
security_group_ids = [openstack_networking_secgroup_v2.octavia_extra_traffic.id]
}
# Allocate a floating IP

4
openstack-tf/garr-ct1/kubernetes-resources/outputs-kubernetes-resources.tf
View File

@ -7,3 +7,7 @@ output "k8s_workers" {
value = openstack_compute_instance_v2.docker_k8s_workers
sensitive = true
}
output "k8s_public_ip" {
value = openstack_networking_floatingip_v2.k8s_lb_ip.address
}

241
openstack-tf/garr-ct1/kubernetes-resources/terraform.tfstate
View File

@ -1,7 +1,7 @@
{
"version": 4,
"terraform_version": "1.7.5",
"serial": 65,
"serial": 75,
"lineage": "5e35471a-73d0-f06e-3330-68c34c548297",
"outputs": {
"k8s_controllers": {
@ -729,6 +729,10 @@
"value": "192.168.100.63",
"type": "string"
},
"k8s_public_ip": {
"value": "90.147.184.197",
"type": "string"
},
"k8s_workers": {
"value": [
{
@ -4176,20 +4180,20 @@
"schema_version": 0,
"attributes": {
"admin_state_up": true,
"allowed_cidrs": null,
"allowed_cidrs": [],
"connection_limit": -1,
"default_pool_id": "",
"default_pool_id": "6d48e0ec-1900-4250-a70a-791371e6adcf",
"default_tls_container_ref": "",
"description": "HTTP listener of the k8s ingress",
"id": "f59a27b4-4e12-4da5-ae0c-b5cc143746a2",
"insert_headers": null,
"insert_headers": {},
"loadbalancer_id": "493955cf-b5ae-4785-bb9a-ab29764c16a6",
"name": "k8s_http_listener",
"protocol": "TCP",
"protocol_port": 80,
"region": "garr-ct1",
"sni_container_refs": null,
"tags": null,
"sni_container_refs": [],
"tags": [],
"tenant_id": "a2de533851354b1f8d99ac6b6216d92e",
"timeout_client_data": 50000,
"timeout_member_connect": 5000,
@ -4201,7 +4205,8 @@
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDAsImRlbGV0ZSI6NjAwMDAwMDAwMDAwLCJ1cGRhdGUiOjYwMDAwMDAwMDAwMH19",
"dependencies": [
"data.terraform_remote_state.privnet_dns_router",
"openstack_lb_loadbalancer_v2.k8s_lb"
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
@ -4216,20 +4221,20 @@
"schema_version": 0,
"attributes": {
"admin_state_up": true,
"allowed_cidrs": null,
"allowed_cidrs": [],
"connection_limit": -1,
"default_pool_id": "",
"default_pool_id": "789f3d3d-af56-4680-be5e-6425830ce4d9",
"default_tls_container_ref": "",
"description": "HTTPS listener of the main k8s service",
"id": "6f3c298f-2539-4db8-9118-191759418e53",
"insert_headers": null,
"insert_headers": {},
"loadbalancer_id": "493955cf-b5ae-4785-bb9a-ab29764c16a6",
"name": "k8s_https_listener",
"protocol": "TCP",
"protocol_port": 443,
"region": "garr-ct1",
"sni_container_refs": null,
"tags": null,
"sni_container_refs": [],
"tags": [],
"tenant_id": "a2de533851354b1f8d99ac6b6216d92e",
"timeout_client_data": 50000,
"timeout_member_connect": 5000,
@ -4241,7 +4246,8 @@
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDAsImRlbGV0ZSI6NjAwMDAwMDAwMDAwLCJ1cGRhdGUiOjYwMDAwMDAwMDAwMH19",
"dependencies": [
"data.terraform_remote_state.privnet_dns_router",
"openstack_lb_loadbalancer_v2.k8s_lb"
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
@ -4264,9 +4270,9 @@
"name": "d4s-garr-ct1-k8s-lb-l4",
"region": "garr-ct1",
"security_group_ids": [
"d915a996-187e-408c-a576-fd3d6a2c8fc8"
"52eac31e-4899-48c9-8d7d-19562ae482fe"
],
"tags": null,
"tags": [],
"tenant_id": "a2de533851354b1f8d99ac6b6216d92e",
"timeouts": null,
"vip_address": "192.168.100.63",
@ -4277,7 +4283,8 @@
"sensitive_attributes": [],
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiY3JlYXRlIjo2MDAwMDAwMDAwMDAsImRlbGV0ZSI6MzAwMDAwMDAwMDAwLCJ1cGRhdGUiOjYwMDAwMDAwMDAwMH19",
"dependencies": [
"data.terraform_remote_state.privnet_dns_router"
"data.terraform_remote_state.privnet_dns_router",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
@ -4295,13 +4302,25 @@
"id": "6d48e0ec-1900-4250-a70a-791371e6adcf",
"member": [
{
"address": "192.168.100.98",
"address": "192.168.100.135",
"admin_state_up": true,
"backup": false,
"id": "85a3bde3-b0f5-4dca-b2d0-2c3dd7c0b01a",
"id": "ba63c42a-f22f-4d03-a0f7-0dc1361b8dce",
"monitor_address": "",
"monitor_port": 0,
"name": "k8s controller 03",
"name": "k8s controller 02",
"protocol_port": 80,
"subnet_id": "",
"weight": 1
},
{
"address": "192.168.100.93",
"admin_state_up": true,
"backup": false,
"id": "2964d285-0f2c-4237-a911-10098b5ce14e",
"monitor_address": "",
"monitor_port": 0,
"name": "k8s controller 01",
"protocol_port": 80,
"subnet_id": "",
"weight": 1
@ -4320,7 +4339,8 @@
"openstack_lb_listener_v2.k8s_http_listener",
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_lb_pool_v2.k8s_http_pool",
"openstack_networking_secgroup_v2.k8s_internal_traffic"
"openstack_networking_secgroup_v2.k8s_internal_traffic",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
},
{
@ -4330,13 +4350,25 @@
"id": "6d48e0ec-1900-4250-a70a-791371e6adcf",
"member": [
{
"address": "192.168.100.98",
"address": "192.168.100.135",
"admin_state_up": true,
"backup": false,
"id": "85a3bde3-b0f5-4dca-b2d0-2c3dd7c0b01a",
"id": "ba63c42a-f22f-4d03-a0f7-0dc1361b8dce",
"monitor_address": "",
"monitor_port": 0,
"name": "k8s controller 03",
"name": "k8s controller 02",
"protocol_port": 80,
"subnet_id": "",
"weight": 1
},
{
"address": "192.168.100.93",
"admin_state_up": true,
"backup": false,
"id": "2964d285-0f2c-4237-a911-10098b5ce14e",
"monitor_address": "",
"monitor_port": 0,
"name": "k8s controller 01",
"protocol_port": 80,
"subnet_id": "",
"weight": 1
@ -4355,7 +4387,8 @@
"openstack_lb_listener_v2.k8s_http_listener",
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_lb_pool_v2.k8s_http_pool",
"openstack_networking_secgroup_v2.k8s_internal_traffic"
"openstack_networking_secgroup_v2.k8s_internal_traffic",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
},
{
@ -4390,7 +4423,8 @@
"openstack_lb_listener_v2.k8s_http_listener",
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_lb_pool_v2.k8s_http_pool",
"openstack_networking_secgroup_v2.k8s_internal_traffic"
"openstack_networking_secgroup_v2.k8s_internal_traffic",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
@ -4407,28 +4441,16 @@
"attributes": {
"id": "789f3d3d-af56-4680-be5e-6425830ce4d9",
"member": [
{
"address": "192.168.100.135",
"admin_state_up": true,
"backup": false,
"id": "231d136c-5cf8-49c2-a648-36aeadcf8029",
"monitor_address": "",
"monitor_port": 0,
"name": "k8s controller 02",
"protocol_port": 443,
"subnet_id": "",
"weight": 1
},
{
"address": "192.168.100.93",
"admin_state_up": true,
"backup": false,
"backup": null,
"id": "19248b74-1925-4ee0-98f6-f8a0fc626ffa",
"monitor_address": "",
"monitor_port": 0,
"monitor_address": null,
"monitor_port": null,
"name": "k8s controller 01",
"protocol_port": 443,
"subnet_id": "",
"subnet_id": null,
"weight": 1
}
],
@ -4445,7 +4467,8 @@
"openstack_lb_listener_v2.k8s_https_listener",
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_lb_pool_v2.k8s_https_pool",
"openstack_networking_secgroup_v2.k8s_internal_traffic"
"openstack_networking_secgroup_v2.k8s_internal_traffic",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
},
{
@ -4457,25 +4480,13 @@
{
"address": "192.168.100.135",
"admin_state_up": true,
"backup": false,
"backup": null,
"id": "231d136c-5cf8-49c2-a648-36aeadcf8029",
"monitor_address": "",
"monitor_port": 0,
"monitor_address": null,
"monitor_port": null,
"name": "k8s controller 02",
"protocol_port": 443,
"subnet_id": "",
"weight": 1
},
{
"address": "192.168.100.93",
"admin_state_up": true,
"backup": false,
"id": "19248b74-1925-4ee0-98f6-f8a0fc626ffa",
"monitor_address": "",
"monitor_port": 0,
"name": "k8s controller 01",
"protocol_port": 443,
"subnet_id": "",
"subnet_id": null,
"weight": 1
}
],
@ -4492,7 +4503,8 @@
"openstack_lb_listener_v2.k8s_https_listener",
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_lb_pool_v2.k8s_https_pool",
"openstack_networking_secgroup_v2.k8s_internal_traffic"
"openstack_networking_secgroup_v2.k8s_internal_traffic",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
},
{
@ -4505,7 +4517,7 @@
"address": "192.168.100.135",
"admin_state_up": true,
"backup": false,
"id": "231d136c-5cf8-49c2-a648-36aeadcf8029",
"id": "862027ca-3b3b-48ea-941f-84f9e16187be",
"monitor_address": "",
"monitor_port": 0,
"name": "k8s controller 02",
@ -4514,13 +4526,13 @@
"weight": 1
},
{
"address": "192.168.100.93",
"address": "192.168.100.98",
"admin_state_up": true,
"backup": false,
"id": "19248b74-1925-4ee0-98f6-f8a0fc626ffa",
"id": "6b541e27-2cb6-429d-b7e0-b88d35f83edd",
"monitor_address": "",
"monitor_port": 0,
"name": "k8s controller 01",
"name": "k8s controller 03",
"protocol_port": 443,
"subnet_id": "",
"weight": 1
@ -4539,7 +4551,8 @@
"openstack_lb_listener_v2.k8s_https_listener",
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_lb_pool_v2.k8s_https_pool",
"openstack_networking_secgroup_v2.k8s_internal_traffic"
"openstack_networking_secgroup_v2.k8s_internal_traffic",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
@ -4576,7 +4589,8 @@
"dependencies": [
"data.terraform_remote_state.privnet_dns_router",
"openstack_lb_listener_v2.k8s_http_listener",
"openstack_lb_loadbalancer_v2.k8s_lb"
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
@ -4613,7 +4627,8 @@
"dependencies": [
"data.terraform_remote_state.privnet_dns_router",
"openstack_lb_listener_v2.k8s_https_listener",
"openstack_lb_loadbalancer_v2.k8s_lb"
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
@ -4638,7 +4653,8 @@
"dependencies": [
"data.terraform_remote_state.privnet_dns_router",
"openstack_lb_loadbalancer_v2.k8s_lb",
"openstack_networking_floatingip_v2.k8s_lb_ip"
"openstack_networking_floatingip_v2.k8s_lb_ip",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
@ -4657,10 +4673,10 @@
"description": "L4 balancer that serves the D4Science Kubernetes at GARR-CT1",
"dns_domain": "",
"dns_name": "",
"fixed_ip": "",
"fixed_ip": "192.168.100.63",
"id": "a32b3ed6-fcc4-4539-860b-2494d8ec739b",
"pool": "floating-ip",
"port_id": "",
"port_id": "cae97b71-7238-4474-b9ac-e2258871ade9",
"region": "garr-ct1",
"subnet_id": null,
"subnet_ids": null,
@ -4741,6 +4757,37 @@
}
]
},
{
"mode": "managed",
"type": "openstack_networking_secgroup_rule_v2",
"name": "icmp_ingress_to_the_load_balancer",
"provider": "provider[\"registry.terraform.io/terraform-provider-openstack/openstack\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"description": "Ingress ICMP traffic",
"direction": "ingress",
"ethertype": "IPv4",
"id": "d33833df-d42a-4a0a-bd58-35db6ac03e45",
"port_range_max": 0,
"port_range_min": 0,
"protocol": "icmp",
"region": "garr-ct1",
"remote_group_id": "",
"remote_ip_prefix": "0.0.0.0/0",
"security_group_id": "52eac31e-4899-48c9-8d7d-19562ae482fe",
"tenant_id": "a2de533851354b1f8d99ac6b6216d92e",
"timeouts": null
},
"sensitive_attributes": [],
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiZGVsZXRlIjo2MDAwMDAwMDAwMDB9fQ==",
"dependencies": [
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
},
{
"mode": "managed",
"type": "openstack_networking_secgroup_rule_v2",
@ -4805,6 +4852,38 @@
}
]
},
{
"mode": "managed",
"type": "openstack_networking_secgroup_rule_v2",
"name": "ssh_ingress_to_the_load_balancer",
"provider": "provider[\"registry.terraform.io/terraform-provider-openstack/openstack\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"description": "Ingress SSH traffic from the internal network",
"direction": "ingress",
"ethertype": "IPv4",
"id": "c491130e-a080-4b1e-8898-75fefe52011a",
"port_range_max": 22,
"port_range_min": 22,
"protocol": "tcp",
"region": "garr-ct1",
"remote_group_id": "",
"remote_ip_prefix": "192.168.100.0/24",
"security_group_id": "52eac31e-4899-48c9-8d7d-19562ae482fe",
"tenant_id": "a2de533851354b1f8d99ac6b6216d92e",
"timeouts": null
},
"sensitive_attributes": [],
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiZGVsZXRlIjo2MDAwMDAwMDAwMDB9fQ==",
"dependencies": [
"data.terraform_remote_state.privnet_dns_router",
"openstack_networking_secgroup_v2.octavia_extra_traffic"
]
}
]
},
{
"mode": "managed",
"type": "openstack_networking_secgroup_v2",
@ -4828,6 +4907,30 @@
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiZGVsZXRlIjo2MDAwMDAwMDAwMDB9fQ=="
}
]
},
{
"mode": "managed",
"type": "openstack_networking_secgroup_v2",
"name": "octavia_extra_traffic",
"provider": "provider[\"registry.terraform.io/terraform-provider-openstack/openstack\"]",
"instances": [
{
"schema_version": 0,
"attributes": {
"all_tags": [],
"delete_default_rules": true,
"description": "Traffic to the load balancer in addition to the listeners",
"id": "52eac31e-4899-48c9-8d7d-19562ae482fe",
"name": "octavia_lb_extra_traffic",
"region": "garr-ct1",
"tags": null,
"tenant_id": "a2de533851354b1f8d99ac6b6216d92e",
"timeouts": null
},
"sensitive_attributes": [],
"private": "eyJlMmJmYjczMC1lY2FhLTExZTYtOGY4OC0zNDM2M2JjN2M0YzAiOnsiZGVsZXRlIjo2MDAwMDAwMDAwMDB9fQ=="
}
]
}
],
"check_results": null