InfraScience
/
infrastructure-as-code
23
0
Fork 2
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Cleanup: prepare for modules.

This commit is contained in:
Andrea Dell'Amico 2023-11-30 19:48:49 +01:00
parent b915cbb949
commit dc6f15bedf
Signed by: andrea.dellamico
GPG Key ID: 147ABE6CEB9E20FF
53 changed files with 976 additions and 4074 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
openstack-tf/common_setups/35-prometheus.tf
View File

@ -9,7 +9,7 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.prometheus_server_data.flavor
key_pair = module.ssh_settings.ssh_key_name
security_groups = [var.default_security_group_name,openstack_networking_secgroup_v2.restricted_web.name,openstack_networking_secgroup_v2.prometheus_access_from_grafana.name]
security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.restricted_web.name, openstack_networking_secgroup_v2.prometheus_access_from_grafana.name]
block_device {
uuid = var.ubuntu_2204.uuid
source_type = "image"
@ -23,7 +23,7 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
name = var.main_private_network.name
fixed_ip_v4 = var.basic_services_ip.prometheus
}
user_data = "${file("${var.ubuntu2204_data_file}")}"
user_data = file("${var.ubuntu2204_data_file}")
}
resource "openstack_compute_volume_attach_v2" "prometheus_data_attach_vol" {

0
openstack-tf/d4s-preprod/basic-infrastructure-modularized/.terraform.lock.hcl → openstack-tf/d4s-dev/basic-infrastructure/.terraform.lock.hcl
View File

1
openstack-tf/d4s-dev/basic-infrastructure/15-security-groups.tf
View File

@ -1 +0,0 @@
../../common_setups/15-security-groups.tf

1
openstack-tf/d4s-dev/basic-infrastructure/20-octavia.tf
View File

@ -1 +0,0 @@
../../common_setups/20-octavia.tf

1
openstack-tf/d4s-dev/basic-infrastructure/25-ssh-jump-proxy.tf
View File

@ -1 +0,0 @@
../../common_setups/25-ssh-jump-proxy.tf

1
openstack-tf/d4s-dev/basic-infrastructure/30-internal-ca.tf
View File

@ -1 +0,0 @@
../../common_setups/30-internal-ca.tf

1
openstack-tf/d4s-dev/basic-infrastructure/35-prometheus.tf
View File

@ -1 +0,0 @@
../../common_setups/35-prometheus.tf

1
openstack-tf/d4s-dev/basic-infrastructure/40-postgresql.tf
View File

@ -1 +0,0 @@
../../common_setups/40-postgresql.tf

1
openstack-tf/d4s-dev/basic-infrastructure/45-haproxy.tf
View File

@ -1 +0,0 @@
../../common_setups/45-haproxy.tf

0
openstack-tf/d4s-dev/basic-infrastructure/DO-NOT-USE Normal file
View File

1
openstack-tf/d4s-dev/basic-infrastructure/docker-swarm.tf
View File

@ -1 +0,0 @@
../../modules/docker_swarm/docker-swarm.tf

11
openstack-tf/d4s-dev/basic-infrastructure/main.tf
View File

@ -1,3 +1,5 @@
echo "Do not use"
# Define required providers
terraform {
required_version = ">= 0.14.0"
@ -17,10 +19,7 @@ data "terraform_remote_state" "privnet_dns_router" {
}
}
# module "variables" {
# source = "../variables"
# }
module "d4science_infra_setup" {
source = "../../modules/d4science_infra_setup"
}
# module "basic_setup" {
# source = "../../modules/basic_setup"
# }

1
openstack-tf/d4s-dev/basic-infrastructure/swarm-variables.tf
View File

@ -1 +0,0 @@
../../modules/docker_swarm/swarm-variables.tf

1
openstack-tf/d4s-dev/basic-infrastructure/variables-dev.tf
View File

@ -1 +0,0 @@
../variables/variables-dev.tf

1
openstack-tf/d4s-dev/basic-infrastructure/variables.tf
View File

@ -1 +0,0 @@
../../modules/common_variables/variables.tf

0
openstack-tf/d4s-dev/project-setup/DO-NOT-USE Normal file
View File

1
openstack-tf/d4s-dev/project-setup/main.tf
View File

@ -1,3 +1,4 @@
echo "Do not use."
# Define required providers
terraform {
required_version = ">= 0.14.0"

11
openstack-tf/d4s-preprod/basic-infrastructure-modularized/README.md
View File

@ -1,11 +0,0 @@
# Main services
* Load balancer as a service (openstack), L4.
> * Main HAPROXY load balancer
* Two VMs as HAPROXY L7 instances for the main services. The dataminers will be also served by this load balancer.
* A shell server, with floating IP address, that will be used as a proxy to reach all the other VMs.
* A internal CA service.
* A Prometheus instance.
* A PostgreSQL server instance, with a dedicated network

22
openstack-tf/d4s-preprod/basic-infrastructure-modularized/main.tf
View File

@ -1,22 +0,0 @@
# Define required providers
terraform {
required_version = ">= 0.14.0"
required_providers {
openstack = {
source = "terraform-provider-openstack/openstack"
version = "~> 1.53.0"
}
}
}
data "terraform_remote_state" "privnet_dns_router" {
backend = "local"
config = {
path = "../project-setup/terraform.tfstate"
}
}
module "d4science_infra_setup" {
source = "../../modules/d4science_infra_setup"
}

3
openstack-tf/d4s-preprod/basic-infrastructure-modularized/provider.tf
View File

@ -1,3 +0,0 @@
provider "openstack" {
cloud = "d4s-pre"
}

3053
openstack-tf/d4s-preprod/basic-infrastructure-modularized/terraform.tfstate
View File

File diff suppressed because it is too large Load Diff

1
openstack-tf/d4s-production/basic-infrastructure/15-security-groups.tf
View File

@ -1 +0,0 @@
../../common_setups/15-security-groups.tf

1
openstack-tf/d4s-production/basic-infrastructure/20-octavia.tf
View File

@ -1 +0,0 @@
../../common_setups/20-octavia.tf

1
openstack-tf/d4s-production/basic-infrastructure/25-ssh-jump-proxy.tf
View File

@ -1 +0,0 @@
../../common_setups/25-ssh-jump-proxy.tf

1
openstack-tf/d4s-production/basic-infrastructure/30-internal-ca.tf
View File

@ -1 +0,0 @@
../../common_setups/30-internal-ca.tf

1
openstack-tf/d4s-production/basic-infrastructure/35-prometheus.tf
View File

@ -1 +0,0 @@
../../common_setups/35-prometheus.tf

1
openstack-tf/d4s-production/basic-infrastructure/40-postgresql.tf
View File

@ -1 +0,0 @@
../../common_setups/40-postgresql.tf

1
openstack-tf/d4s-production/basic-infrastructure/45-haproxy.tf
View File

@ -1 +0,0 @@
../../common_setups/45-haproxy.tf

1
openstack-tf/d4s-production/basic-infrastructure/haproxy.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/haproxy.tf

1
openstack-tf/d4s-production/basic-infrastructure/internal-ca.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/internal-ca.tf

1
openstack-tf/d4s-production/basic-infrastructure/octavia.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/octavia.tf

1
openstack-tf/d4s-production/basic-infrastructure/postgresql.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/postgresql.tf

2
openstack-tf/d4s-production/basic-infrastructure/production-basic-infrastructure.auto.tfvars
View File

@ -1,7 +1,7 @@
default_security_group_name = "default_for_all"
shared_postgresql_server_data = {
name ="shared-postgresql-server"
name = "shared-postgresql-server"
flavor = "m1.large"
vol_data_name = "shared-postgresql-data"
vol_data_size = "300"

1
openstack-tf/d4s-production/basic-infrastructure/prometheus.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/prometheus.tf

2
openstack-tf/d4s-production/basic-infrastructure/provider.tf
View File

@ -1,6 +1,6 @@
# Define required providers
terraform {
required_version = ">= 0.14.0"
required_version = ">= 0.14.0"
required_providers {
openstack = {
source = "terraform-provider-openstack/openstack"

1
openstack-tf/d4s-production/basic-infrastructure/security-groups.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/security-groups.tf

1
openstack-tf/d4s-production/basic-infrastructure/ssh-jump-proxy.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/ssh-jump-proxy.tf

34
openstack-tf/modules/d4science_infra_setup/haproxy.tf
View File

@ -28,7 +28,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_1_peer" {
protocol = "tcp"
port_range_min = 10000
port_range_max = 10000
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_2_peer" {
@ -39,7 +39,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_2_peer" {
protocol = "tcp"
port_range_min = 10000
port_range_max = 10000
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_80" {
@ -50,7 +50,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_80" {
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_1
remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_1
}
resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_443" {
@ -61,7 +61,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_443" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_1
remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_1
}
resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_8080" {
@ -72,7 +72,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_8080" {
protocol = "tcp"
port_range_min = 8080
port_range_max = 8080
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_1
remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_1
}
resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_80" {
@ -83,7 +83,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_80" {
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_2
remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_2
}
resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_443" {
@ -94,7 +94,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_443" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_2
remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_2
}
resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_8080" {
@ -105,23 +105,23 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_8080" {
protocol = "tcp"
port_range_min = 8080
port_range_max = 8080
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_2
remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_2
}
# Instance
resource "openstack_compute_instance_v2" "main_haproxy_l7" {
count = module.common_variables.haproxy_l7_data.vm_count
name = format("%s-%02d", module.common_variables.haproxy_l7_data.name, count.index+1)
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.haproxy_l7_data.flavor
count = var.haproxy_l7_data.vm_count
name = format("%s-%02d", var.haproxy_l7_data.name, count.index + 1)
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.haproxy_l7_data.flavor
key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name,openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.name]
security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.name]
scheduler_hints {
group = openstack_compute_servergroup_v2.main_haproxy_l7.id
}
block_device {
uuid = module.common_variables.ubuntu_2204.uuid
uuid = var.ubuntu_2204.uuid
source_type = "image"
volume_size = 10
boot_index = 0
@ -130,9 +130,9 @@ resource "openstack_compute_instance_v2" "main_haproxy_l7" {
}
network {
name = module.common_variables.main_private_network.name
fixed_ip_v4 = module.common_variables.main_haproxy_l7_ip.*[count.index]
name = var.main_private_network.name
fixed_ip_v4 = var.main_haproxy_l7_ip.* [count.index]
}
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}"
user_data = file("${var.ubuntu2204_data_file}")
}

16
openstack-tf/modules/d4science_infra_setup/internal-ca.tf
View File

@ -1,11 +1,11 @@
resource "openstack_compute_instance_v2" "internal_ca" {
name = module.common_variables.internal_ca_data.name
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.internal_ca_data.flavor
name = var.internal_ca_data.name
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.internal_ca_data.flavor
key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name]
security_groups = [var.default_security_group_name]
block_device {
uuid = module.common_variables.ubuntu_2204.uuid
uuid = var.ubuntu_2204.uuid
source_type = "image"
volume_size = 10
boot_index = 0
@ -14,8 +14,8 @@ resource "openstack_compute_instance_v2" "internal_ca" {
}
network {
name = module.common_variables.main_private_network.name
fixed_ip_v4 = module.common_variables.basic_services_ip.ca
name = var.main_private_network.name
fixed_ip_v4 = var.basic_services_ip.ca
}
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}"
user_data = file("${var.ubuntu2204_data_file}")
}

34
openstack-tf/modules/d4science_infra_setup/octavia.tf
View File

@ -1,20 +1,20 @@
# Main load balancer. L4, backed by Octavia
resource "openstack_lb_loadbalancer_v2" "main_lb" {
vip_subnet_id = module.common_variables.main_private_subnet_id
name = module.common_variables.octavia_information.main_lb_name
description = module.common_variables.octavia_information.main_lb_description
flavor_id = module.common_variables.octavia_information.octavia_flavor_id
vip_address = module.common_variables.basic_services_ip.octavia_main
vip_subnet_id = var.main_private_subnet_id
name = var.octavia_information.main_lb_name
description = var.octavia_information.main_lb_description
flavor_id = var.octavia_information.octavia_flavor_id
vip_address = var.basic_services_ip.octavia_main
loadbalancer_provider = "amphora"
}
# Allocate a floating IP
resource "openstack_networking_floatingip_v2" "main_lb_ip" {
pool = module.common_variables.floating_ip_pools.main_public_ip_pool
pool = var.floating_ip_pools.main_public_ip_pool
# The DNS association does not work because of a bug in the OpenStack API
# dns_name = "main-lb"
# dns_domain = module.common_variables.dns_zone.zone_name
description = module.common_variables.octavia_information.main_lb_description
# dns_domain = var.dns_zone.zone_name
description = var.octavia_information.main_lb_description
}
resource "openstack_networking_floatingip_associate_v2" "main_lb" {
@ -23,11 +23,11 @@ resource "openstack_networking_floatingip_associate_v2" "main_lb" {
}
locals {
recordset_name = "${module.common_variables.octavia_information.main_lb_hostname}.${module.common_variables.dns_zone.zone_name}"
recordset_name = "${var.octavia_information.main_lb_hostname}.${var.dns_zone.zone_name}"
}
resource "openstack_dns_recordset_v2" "main_lb_dns_recordset" {
zone_id = module.common_variables.dns_zone_id
zone_id = var.dns_zone_id
name = local.recordset_name
description = "Public IP address of the main load balancer"
ttl = 8600
@ -42,7 +42,7 @@ resource "openstack_lb_listener_v2" "main_haproxy_stats_listener" {
protocol_port = 8880
description = "Listener for the stats of the main HAPROXY instances"
name = "main_haproxy_stats_listener"
allowed_cidrs = [module.common_variables.ssh_sources.d4s_vpn_1_cidr,module.common_variables.ssh_sources.d4s_vpn_2_cidr,module.common_variables.ssh_sources.s2i2s_vpn_1_cidr,module.common_variables.ssh_sources.s2i2s_vpn_2_cidr]
allowed_cidrs = [var.ssh_sources.d4s_vpn_1_cidr, var.ssh_sources.d4s_vpn_2_cidr, var.ssh_sources.s2i2s_vpn_1_cidr, var.ssh_sources.s2i2s_vpn_2_cidr]
}
@ -61,12 +61,12 @@ resource "openstack_lb_members_v2" "main_haproxy_stats_pool_members" {
pool_id = openstack_lb_pool_v2.main_haproxy_stats_pool.id
member {
name = "haproxy l7 1"
address = module.common_variables.basic_services_ip.haproxy_l7_1
address = var.basic_services_ip.haproxy_l7_1
protocol_port = 8880
}
member {
name = "haproxy l7 2"
address = module.common_variables.basic_services_ip.haproxy_l7_2
address = var.basic_services_ip.haproxy_l7_2
protocol_port = 8880
}
}
@ -107,12 +107,12 @@ resource "openstack_lb_members_v2" "main_haproxy_http_pool_members" {
pool_id = openstack_lb_pool_v2.main_haproxy_http_pool.id
member {
name = "haproxy l7 1"
address = module.common_variables.basic_services_ip.haproxy_l7_1
address = var.basic_services_ip.haproxy_l7_1
protocol_port = 80
}
member {
name = "haproxy l7 2"
address = module.common_variables.basic_services_ip.haproxy_l7_2
address = var.basic_services_ip.haproxy_l7_2
protocol_port = 80
}
}
@ -156,12 +156,12 @@ resource "openstack_lb_members_v2" "main_haproxy_https_pool_members" {
pool_id = openstack_lb_pool_v2.main_haproxy_https_pool.id
member {
name = "haproxy l7 1"
address = module.common_variables.basic_services_ip.haproxy_l7_1
address = var.basic_services_ip.haproxy_l7_1
protocol_port = 443
}
member {
name = "haproxy l7 2"
address = module.common_variables.basic_services_ip.haproxy_l7_2
address = var.basic_services_ip.haproxy_l7_2
protocol_port = 443
}
}

1
openstack-tf/modules/d4science_infra_setup/outputs.tf Symbolic link
View File

@ -0,0 +1 @@
../common_variables/outputs.tf

44
openstack-tf/modules/d4science_infra_setup/postgresql.tf
View File

@ -1,15 +1,15 @@
# PostgreSQL shared server
# Network
resource "openstack_networking_network_v2" "shared_postgresql_net" {
name = module.common_variables.shared_postgresql_server_data.network_name
name = var.shared_postgresql_server_data.network_name
admin_state_up = "true"
external = "false"
description = module.common_variables.shared_postgresql_server_data.network_description
dns_domain = module.common_variables.dns_zone.zone_name
mtu = module.common_variables.mtu_size
description = var.shared_postgresql_server_data.network_description
dns_domain = var.dns_zone.zone_name
mtu = var.mtu_size
port_security_enabled = true
shared = false
region = module.common_variables.main_region
region = var.main_region
}
# Subnet
@ -17,14 +17,14 @@ resource "openstack_networking_subnet_v2" "shared_postgresql_subnet" {
name = "shared-postgresql-subnet"
description = "subnet used to connect to the shared PostgreSQL service"
network_id = openstack_networking_network_v2.shared_postgresql_net.id
cidr = module.common_variables.shared_postgresql_server_data.network_cidr
dns_nameservers = module.common_variables.resolvers_ip
cidr = var.shared_postgresql_server_data.network_cidr
dns_nameservers = var.resolvers_ip
ip_version = 4
enable_dhcp = true
no_gateway = true
allocation_pool {
start = module.common_variables.shared_postgresql_server_data.allocation_pool_start
end = module.common_variables.shared_postgresql_server_data.allocation_pool_end
start = var.shared_postgresql_server_data.allocation_pool_start
end = var.shared_postgresql_server_data.allocation_pool_end
}
}
@ -43,24 +43,24 @@ resource "openstack_networking_secgroup_rule_v2" "shared_postgresql_access_from_
protocol = "tcp"
port_range_min = 5432
port_range_max = 5432
remote_ip_prefix = module.common_variables.shared_postgresql_server_data.network_cidr
remote_ip_prefix = var.shared_postgresql_server_data.network_cidr
}
# Block device
resource "openstack_blockstorage_volume_v3" "shared_postgresql_data_vol" {
name = module.common_variables.shared_postgresql_server_data.vol_data_name
size = module.common_variables.shared_postgresql_server_data.vol_data_size
name = var.shared_postgresql_server_data.vol_data_name
size = var.shared_postgresql_server_data.vol_data_size
}
# Instance
resource "openstack_compute_instance_v2" "shared_postgresql_server" {
name = module.common_variables.shared_postgresql_server_data.name
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.shared_postgresql_server_data.flavor
name = var.shared_postgresql_server_data.name
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.shared_postgresql_server_data.flavor
key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name,openstack_networking_secgroup_v2.shared_postgresql_access.name]
security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.shared_postgresql_access.name]
block_device {
uuid = module.common_variables.ubuntu_2204.uuid
uuid = var.ubuntu_2204.uuid
source_type = "image"
volume_size = 10
boot_index = 0
@ -69,19 +69,19 @@ resource "openstack_compute_instance_v2" "shared_postgresql_server" {
}
network {
name = module.common_variables.main_private_network.name
name = var.main_private_network.name
}
network {
name = module.common_variables.shared_postgresql_server_data.network_name
fixed_ip_v4 = module.common_variables.shared_postgresql_server_data.server_ip
name = var.shared_postgresql_server_data.network_name
fixed_ip_v4 = var.shared_postgresql_server_data.server_ip
}
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}"
user_data = file("${var.ubuntu2204_data_file}")
}
resource "openstack_compute_volume_attach_v2" "shared_postgresql_data_attach_vol" {
instance_id = openstack_compute_instance_v2.shared_postgresql_server.id
volume_id = openstack_blockstorage_volume_v3.shared_postgresql_data_vol.id
device = module.common_variables.shared_postgresql_server_data.vol_data_device
device = var.shared_postgresql_server_data.vol_data_device
depends_on = [openstack_compute_instance_v2.shared_postgresql_server]
}

32
openstack-tf/modules/d4science_infra_setup/prometheus.tf
View File

@ -1,17 +1,17 @@
# Promertheus server. A floating IP is required
resource "openstack_blockstorage_volume_v3" "prometheus_data_vol" {
name = module.common_variables.prometheus_server_data.vol_data_name
size = module.common_variables.prometheus_server_data.vol_data_size
name = var.prometheus_server_data.vol_data_name
size = var.prometheus_server_data.vol_data_size
}
resource "openstack_compute_instance_v2" "prometheus_server" {
name = module.common_variables.prometheus_server_data.name
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.prometheus_server_data.flavor
name = var.prometheus_server_data.name
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.prometheus_server_data.flavor
key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name,openstack_networking_secgroup_v2.restricted_web.name,openstack_networking_secgroup_v2.prometheus_access_from_grafana.name]
security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.restricted_web.name, openstack_networking_secgroup_v2.prometheus_access_from_grafana.name]
block_device {
uuid = module.common_variables.ubuntu_2204.uuid
uuid = var.ubuntu_2204.uuid
source_type = "image"
volume_size = 10
boot_index = 0
@ -20,21 +20,21 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
}
network {
name = module.common_variables.main_private_network.name
fixed_ip_v4 = module.common_variables.basic_services_ip.prometheus
name = var.main_private_network.name
fixed_ip_v4 = var.basic_services_ip.prometheus
}
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}"
user_data = file("${var.ubuntu2204_data_file}")
}
resource "openstack_compute_volume_attach_v2" "prometheus_data_attach_vol" {
instance_id = openstack_compute_instance_v2.prometheus_server.id
volume_id = openstack_blockstorage_volume_v3.prometheus_data_vol.id
device = module.common_variables.prometheus_server_data.vol_data_device
device = var.prometheus_server_data.vol_data_device
}
# Floating IP and DNS record
resource "openstack_networking_floatingip_v2" "prometheus_server_ip" {
pool = module.common_variables.floating_ip_pools.main_public_ip_pool
pool = var.floating_ip_pools.main_public_ip_pool
# The DNS association does not work because of a bug in the OpenStack API
description = "Prometheus server"
}
@ -45,12 +45,12 @@ resource "openstack_compute_floatingip_associate_v2" "prometheus_server" {
}
locals {
prometheus_recordset_name = "${module.common_variables.prometheus_server_data.name}.${module.common_variables.dns_zone.zone_name}"
alertmanager_recordset_name = "alertmanager.${module.common_variables.dns_zone.zone_name}"
prometheus_recordset_name = "${var.prometheus_server_data.name}.${var.dns_zone.zone_name}"
alertmanager_recordset_name = "alertmanager.${var.dns_zone.zone_name}"
}
resource "openstack_dns_recordset_v2" "prometheus_server_recordset" {
zone_id = module.common_variables.dns_zone_id
zone_id = var.dns_zone_id
name = local.prometheus_recordset_name
description = "Public IP address of the Prometheus server"
ttl = 8600
@ -59,7 +59,7 @@ resource "openstack_dns_recordset_v2" "prometheus_server_recordset" {
}
resource "openstack_dns_recordset_v2" "alertmanager_server_recordset" {
zone_id = module.common_variables.dns_zone_id
zone_id = var.dns_zone_id
name = local.alertmanager_recordset_name
description = "Prometheus alertmanager"
ttl = 8600

52
openstack-tf/modules/d4science_infra_setup/security-groups.tf
View File

@ -1,7 +1,7 @@
#
# This is the security group that should be added to every instance
resource "openstack_networking_secgroup_v2" "default" {
name = module.common_variables.default_security_group_name
name = var.default_security_group_name
delete_default_rules = "true"
description = "Default security group with rules for ssh access via jump proxy, prometheus scraping"
}
@ -29,7 +29,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-jump-proxy" {
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = module.common_variables.basic_services_ip.ssh_jump_cidr
remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
}
resource "openstack_networking_secgroup_rule_v2" "prometheus-node" {
@ -40,7 +40,7 @@ resource "openstack_networking_secgroup_rule_v2" "prometheus-node" {
protocol = "tcp"
port_range_min = 9100
port_range_max = 9100
remote_ip_prefix = module.common_variables.basic_services_ip.prometheus_cidr
remote_ip_prefix = var.basic_services_ip.prometheus_cidr
}
#
@ -59,7 +59,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-1" {
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.s2i2s_vpn_1_cidr
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-2" {
@ -70,7 +70,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-2" {
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.s2i2s_vpn_2_cidr
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-1" {
@ -81,7 +81,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-1" {
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.d4s_vpn_1_cidr
remote_ip_prefix = var.ssh_sources.d4s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-2" {
@ -92,7 +92,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-2" {
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.d4s_vpn_2_cidr
remote_ip_prefix = var.ssh_sources.d4s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-shell-d4s" {
@ -103,7 +103,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-shell-d4s" {
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.shell_d4s_cidr
remote_ip_prefix = var.ssh_sources.shell_d4s_cidr
}
resource "openstack_networking_secgroup_rule_v2" "ssh-infrascience-net" {
@ -114,7 +114,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-infrascience-net" {
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.infrascience_net_cidr
remote_ip_prefix = var.ssh_sources.infrascience_net_cidr
}
# Debug via tunnel from the jump proxy node
@ -132,7 +132,7 @@ resource "openstack_networking_secgroup_rule_v2" "shell_8100" {
protocol = "tcp"
port_range_min = 8100
port_range_max = 8100
remote_ip_prefix = module.common_variables.basic_services_ip.ssh_jump_cidr
remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
}
resource "openstack_networking_secgroup_rule_v2" "shell_80" {
@ -143,7 +143,7 @@ resource "openstack_networking_secgroup_rule_v2" "shell_80" {
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = module.common_variables.basic_services_ip.ssh_jump_cidr
remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
}
resource "openstack_networking_secgroup_rule_v2" "shell_443" {
@ -154,7 +154,7 @@ resource "openstack_networking_secgroup_rule_v2" "shell_443" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.basic_services_ip.ssh_jump_cidr
remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
}
# Traffic from the main HAPROXY load balancers
@ -173,7 +173,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-80" {
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-80" {
@ -184,7 +184,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-80" {
protocol = "tcp"
port_range_min = 80
port_range_max = 80
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-443" {
@ -195,7 +195,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-443" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-443" {
@ -206,7 +206,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-443" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8080" {
@ -217,7 +217,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8080" {
protocol = "tcp"
port_range_min = 8080
port_range_max = 8080
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8080" {
@ -228,7 +228,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8080" {
protocol = "tcp"
port_range_min = 8080
port_range_max = 8080
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8888" {
@ -239,7 +239,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8888" {
protocol = "tcp"
port_range_min = 8888
port_range_max = 8888
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8888" {
@ -250,7 +250,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8888" {
protocol = "tcp"
port_range_min = 8888
port_range_max = 8888
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr
remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
}
# Security group that exposes web services directly. A floating IP is required.
@ -308,7 +308,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_1" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.d4s_vpn_1_cidr
remote_ip_prefix = var.ssh_sources.d4s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_2" {
@ -319,7 +319,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_2" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.d4s_vpn_2_cidr
remote_ip_prefix = var.ssh_sources.d4s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_1" {
@ -330,7 +330,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_1" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.s2i2s_vpn_1_cidr
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_1_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_2" {
@ -341,7 +341,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_2" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.s2i2s_vpn_2_cidr
remote_ip_prefix = var.ssh_sources.s2i2s_vpn_2_cidr
}
resource "openstack_networking_secgroup_rule_v2" "https_from_shell_d4s" {
@ -352,7 +352,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_shell_d4s" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.shell_d4s_cidr
remote_ip_prefix = var.ssh_sources.shell_d4s_cidr
}
resource "openstack_networking_secgroup_v2" "prometheus_access_from_grafana" {
@ -369,5 +369,5 @@ resource "openstack_networking_secgroup_rule_v2" "grafana_d4s" {
protocol = "tcp"
port_range_min = 443
port_range_max = 443
remote_ip_prefix = module.common_variables.prometheus_server_data.public_grafana_server_cidr
remote_ip_prefix = var.prometheus_server_data.public_grafana_server_cidr
}

22
openstack-tf/modules/d4science_infra_setup/ssh-jump-proxy.tf
View File

@ -1,12 +1,12 @@
# VM used as jump proxy. A floating IP is required
resource "openstack_compute_instance_v2" "ssh_jump_proxy" {
name = module.common_variables.ssh_jump_proxy.name
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.ssh_jump_proxy.flavor
name = var.ssh_jump_proxy.name
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.ssh_jump_proxy.flavor
key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name,openstack_networking_secgroup_v2.access_to_the_jump_proxy.name]
security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.access_to_the_jump_proxy.name]
block_device {
uuid = module.common_variables.ubuntu_2204.uuid
uuid = var.ubuntu_2204.uuid
source_type = "image"
volume_size = 30
boot_index = 0
@ -15,15 +15,15 @@ resource "openstack_compute_instance_v2" "ssh_jump_proxy" {
}
network {
name = module.common_variables.main_private_network.name
fixed_ip_v4 = module.common_variables.basic_services_ip.ssh_jump
name = var.main_private_network.name
fixed_ip_v4 = var.basic_services_ip.ssh_jump
}
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}"
user_data = file("${var.ubuntu2204_data_file}")
}
# Floating IP and DNS record
resource "openstack_networking_floatingip_v2" "ssh_jump_proxy_ip" {
pool = module.common_variables.floating_ip_pools.main_public_ip_pool
pool = var.floating_ip_pools.main_public_ip_pool
# The DNS association does not work because of a bug in the OpenStack API
description = "SSH Proxy Jump Server"
}
@ -34,11 +34,11 @@ resource "openstack_compute_floatingip_associate_v2" "ssh_jump_proxy" {
}
locals {
ssh_recordset_name = "${module.common_variables.ssh_jump_proxy.name}.${module.common_variables.dns_zone.zone_name}"
ssh_recordset_name = "${var.ssh_jump_proxy.name}.${var.dns_zone.zone_name}"
}
resource "openstack_dns_recordset_v2" "ssh_jump_proxy_recordset" {
zone_id = module.common_variables.dns_zone_id
zone_id = var.dns_zone_id
name = local.ssh_recordset_name
description = "Public IP address of the SSH Proxy Jump server"
ttl = 8600

12
openstack-tf/modules/d4science_infra_setup/terraform-provider.tf
View File

@ -17,11 +17,11 @@ data "terraform_remote_state" "privnet_dns_router" {
}
}
module "common_variables" {
source = "../../modules/common_variables"
}
# module "common_variables" {
# source = "../../modules/common_variables"
# }
module "ssh_settings" {
source = "../../modules/ssh-key-ref"
}
# module "ssh_settings" {
# source = "../../modules/ssh-key-ref"
# }

1
openstack-tf/modules/d4science_infra_setup/variables.tf Symbolic link
View File

@ -0,0 +1 @@
../common_variables/variables.tf

26
openstack-tf/modules/docker_swarm/docker-swarm.tf
View File

@ -92,11 +92,11 @@ resource "openstack_networking_secgroup_rule_v2" "swarm_nfs_tcp" {
# Instance
resource "openstack_compute_instance_v2" "docker_swarm_managers" {
count = var.docker_swarm_data.mgr_count
name = format("%s-%02d", var.docker_swarm_data.mgr_name, count.index+1)
name = format("%s-%02d", var.docker_swarm_data.mgr_name, count.index + 1)
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.docker_swarm_data.mgr_flavor
key_pair = var.ssh_key_file.name
security_groups = [openstack_networking_secgroup_v2.default.name,openstack_networking_secgroup_v2.swarm_internal_traffic.name]
security_groups = [openstack_networking_secgroup_v2.default.name, openstack_networking_secgroup_v2.swarm_internal_traffic.name]
scheduler_hints {
group = openstack_compute_servergroup_v2.swarm_masters.id
}
@ -119,24 +119,24 @@ resource "openstack_compute_instance_v2" "docker_swarm_managers" {
network {
name = var.main_private_network.name
fixed_ip_v4 = var.swarm_managers_ip.*[count.index]
fixed_ip_v4 = var.swarm_managers_ip.* [count.index]
}
network {
name = var.swarm_nfs_private_network.network_name
}
user_data = "${file("${var.ubuntu2204_data_file}")}"
depends_on = [ openstack_networking_subnet_v2.swarm_nfs_subnet ]
user_data = file("${var.ubuntu2204_data_file}")
depends_on = [openstack_networking_subnet_v2.swarm_nfs_subnet]
}
# Swarm worker nodes
resource "openstack_compute_instance_v2" "docker_swarm_workers" {
count = var.docker_swarm_data.worker_count
name = format("%s-%02d", var.docker_swarm_data.worker_name, count.index+1)
name = format("%s-%02d", var.docker_swarm_data.worker_name, count.index + 1)
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.docker_swarm_data.worker_flavor
key_pair = var.ssh_key_file.name
security_groups = [openstack_networking_secgroup_v2.default.name,openstack_networking_secgroup_v2.swarm_internal_traffic.name]
security_groups = [openstack_networking_secgroup_v2.default.name, openstack_networking_secgroup_v2.swarm_internal_traffic.name]
scheduler_hints {
group = openstack_compute_servergroup_v2.swarm_workers.id
}
@ -164,8 +164,8 @@ resource "openstack_compute_instance_v2" "docker_swarm_workers" {
name = var.swarm_nfs_private_network.network_name
}
user_data = "${file("${var.ubuntu2204_data_file}")}"
depends_on = [ openstack_networking_subnet_v2.swarm_nfs_subnet ]
user_data = file("${var.ubuntu2204_data_file}")
depends_on = [openstack_networking_subnet_v2.swarm_nfs_subnet]
}
# NFS server
@ -181,7 +181,7 @@ resource "openstack_compute_instance_v2" "swarm_nfs_server" {
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.docker_swarm_data.nfs_server_flavor
key_pair = var.ssh_key_file.name
security_groups = [openstack_networking_secgroup_v2.default.name,openstack_networking_secgroup_v2.swarm_nfs_traffic.name]
security_groups = [openstack_networking_secgroup_v2.default.name, openstack_networking_secgroup_v2.swarm_nfs_traffic.name]
block_device {
uuid = var.ubuntu_2204.uuid
source_type = "image"
@ -199,8 +199,8 @@ resource "openstack_compute_instance_v2" "swarm_nfs_server" {
fixed_ip_v4 = var.swarm_nfs_private_network.server_ip
}
user_data = "${file("${var.ubuntu2204_data_file}")}"
depends_on = [ openstack_networking_subnet_v2.swarm_nfs_subnet ]
user_data = file("${var.ubuntu2204_data_file}")
depends_on = [openstack_networking_subnet_v2.swarm_nfs_subnet]
}
# Attach the additional volume
@ -298,7 +298,7 @@ resource "openstack_lb_listener_v2" "swarm_haproxy_stats_listener" {
protocol_port = 8880
description = "Listener for the stats of the Docker Swarm HAPROXY instances"
name = "swarm_haproxy_stats_listener"
allowed_cidrs = [var.ssh_sources.d4s_vpn_1_cidr,var.ssh_sources.d4s_vpn_2_cidr,var.ssh_sources.s2i2s_vpn_1_cidr,var.ssh_sources.s2i2s_vpn_2_cidr]
allowed_cidrs = [var.ssh_sources.d4s_vpn_1_cidr, var.ssh_sources.d4s_vpn_2_cidr, var.ssh_sources.s2i2s_vpn_1_cidr, var.ssh_sources.s2i2s_vpn_2_cidr]
}