mauro.mugnaini
/
infrastructure-as-code
forked from InfraScience/infrastructure-as-code
1
0
Fork 0
Code Pull Requests Activity

Cleanup: prepare for modules.

This commit is contained in:
Andrea Dell'Amico 2023-11-30 19:48:49 +01:00
parent b915cbb949
commit dc6f15bedf
Signed by untrusted user: andrea.dellamico
GPG Key ID: 147ABE6CEB9E20FF
53 changed files with 976 additions and 4074 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
openstack-tf/common_setups/35-prometheus.tf
View File

@ -9,7 +9,7 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.prometheus_server_data.flavor flavor_name = var.prometheus_server_data.flavor
key_pair = module.ssh_settings.ssh_key_name key_pair = module.ssh_settings.ssh_key_name
security_groups = [var.default_security_group_name,openstack_networking_secgroup_v2.restricted_web.name,openstack_networking_secgroup_v2.prometheus_access_from_grafana.name] security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.restricted_web.name, openstack_networking_secgroup_v2.prometheus_access_from_grafana.name]
block_device { block_device {
uuid = var.ubuntu_2204.uuid uuid = var.ubuntu_2204.uuid
source_type = "image" source_type = "image"
@ -23,7 +23,7 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
name = var.main_private_network.name name = var.main_private_network.name
fixed_ip_v4 = var.basic_services_ip.prometheus fixed_ip_v4 = var.basic_services_ip.prometheus
} }
user_data = "${file("${var.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
} }
resource "openstack_compute_volume_attach_v2" "prometheus_data_attach_vol" { resource "openstack_compute_volume_attach_v2" "prometheus_data_attach_vol" {

0
openstack-tf/d4s-preprod/basic-infrastructure-modularized/.terraform.lock.hcl → openstack-tf/d4s-dev/basic-infrastructure/.terraform.lock.hcl
View File

1
openstack-tf/d4s-dev/basic-infrastructure/15-security-groups.tf
View File

@ -1 +0,0 @@
../../common_setups/15-security-groups.tf

1
openstack-tf/d4s-dev/basic-infrastructure/20-octavia.tf
View File

@ -1 +0,0 @@
../../common_setups/20-octavia.tf

1
openstack-tf/d4s-dev/basic-infrastructure/25-ssh-jump-proxy.tf
View File

@ -1 +0,0 @@
../../common_setups/25-ssh-jump-proxy.tf

1
openstack-tf/d4s-dev/basic-infrastructure/30-internal-ca.tf
View File

@ -1 +0,0 @@
../../common_setups/30-internal-ca.tf

1
openstack-tf/d4s-dev/basic-infrastructure/35-prometheus.tf
View File

@ -1 +0,0 @@
../../common_setups/35-prometheus.tf

1
openstack-tf/d4s-dev/basic-infrastructure/40-postgresql.tf
View File

@ -1 +0,0 @@
../../common_setups/40-postgresql.tf

1
openstack-tf/d4s-dev/basic-infrastructure/45-haproxy.tf
View File

@ -1 +0,0 @@
../../common_setups/45-haproxy.tf

0
openstack-tf/d4s-dev/basic-infrastructure/DO-NOT-USE Normal file
View File

1
openstack-tf/d4s-dev/basic-infrastructure/docker-swarm.tf
View File

@ -1 +0,0 @@
../../modules/docker_swarm/docker-swarm.tf

11
openstack-tf/d4s-dev/basic-infrastructure/main.tf
View File

@ -1,3 +1,5 @@
echo "Do not use"
# Define required providers # Define required providers
terraform { terraform {
required_version = ">= 0.14.0" required_version = ">= 0.14.0"
@ -17,10 +19,7 @@ data "terraform_remote_state" "privnet_dns_router" {
} }
} }
# module "variables" { module "d4science_infra_setup" {
# source = "../variables" source = "../../modules/d4science_infra_setup"
# } }
# module "basic_setup" {
# source = "../../modules/basic_setup"
# }

1
openstack-tf/d4s-dev/basic-infrastructure/swarm-variables.tf
View File

@ -1 +0,0 @@
../../modules/docker_swarm/swarm-variables.tf

1
openstack-tf/d4s-dev/basic-infrastructure/variables-dev.tf
View File

@ -1 +0,0 @@
../variables/variables-dev.tf

1
openstack-tf/d4s-dev/basic-infrastructure/variables.tf
View File

@ -1 +0,0 @@
../../modules/common_variables/variables.tf

0
openstack-tf/d4s-dev/project-setup/DO-NOT-USE Normal file
View File

1
openstack-tf/d4s-dev/project-setup/main.tf
View File

@ -1,3 +1,4 @@
echo "Do not use."
# Define required providers # Define required providers
terraform { terraform {
required_version = ">= 0.14.0" required_version = ">= 0.14.0"

11
openstack-tf/d4s-preprod/basic-infrastructure-modularized/README.md
View File

@ -1,11 +0,0 @@
# Main services
* Load balancer as a service (openstack), L4.
> * Main HAPROXY load balancer
* Two VMs as HAPROXY L7 instances for the main services. The dataminers will be also served by this load balancer.
* A shell server, with floating IP address, that will be used as a proxy to reach all the other VMs.
* A internal CA service.
* A Prometheus instance.
* A PostgreSQL server instance, with a dedicated network

22
openstack-tf/d4s-preprod/basic-infrastructure-modularized/main.tf
View File

@ -1,22 +0,0 @@
# Define required providers
terraform {
required_version = ">= 0.14.0"
required_providers {
openstack = {
source = "terraform-provider-openstack/openstack"
version = "~> 1.53.0"
}
}
}
data "terraform_remote_state" "privnet_dns_router" {
backend = "local"
config = {
path = "../project-setup/terraform.tfstate"
}
}
module "d4science_infra_setup" {
source = "../../modules/d4science_infra_setup"
}

3
openstack-tf/d4s-preprod/basic-infrastructure-modularized/provider.tf
View File

@ -1,3 +0,0 @@
provider "openstack" {
cloud = "d4s-pre"
}

3053
openstack-tf/d4s-preprod/basic-infrastructure-modularized/terraform.tfstate
View File

File diff suppressed because it is too large Load Diff

1
openstack-tf/d4s-production/basic-infrastructure/15-security-groups.tf
View File

@ -1 +0,0 @@
../../common_setups/15-security-groups.tf

1
openstack-tf/d4s-production/basic-infrastructure/20-octavia.tf
View File

@ -1 +0,0 @@
../../common_setups/20-octavia.tf

1
openstack-tf/d4s-production/basic-infrastructure/25-ssh-jump-proxy.tf
View File

@ -1 +0,0 @@
../../common_setups/25-ssh-jump-proxy.tf

1
openstack-tf/d4s-production/basic-infrastructure/30-internal-ca.tf
View File

@ -1 +0,0 @@
../../common_setups/30-internal-ca.tf

1
openstack-tf/d4s-production/basic-infrastructure/35-prometheus.tf
View File

@ -1 +0,0 @@
../../common_setups/35-prometheus.tf

1
openstack-tf/d4s-production/basic-infrastructure/40-postgresql.tf
View File

@ -1 +0,0 @@
../../common_setups/40-postgresql.tf

1
openstack-tf/d4s-production/basic-infrastructure/45-haproxy.tf
View File

@ -1 +0,0 @@
../../common_setups/45-haproxy.tf

1
openstack-tf/d4s-production/basic-infrastructure/haproxy.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/haproxy.tf

1
openstack-tf/d4s-production/basic-infrastructure/internal-ca.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/internal-ca.tf

1
openstack-tf/d4s-production/basic-infrastructure/octavia.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/octavia.tf

1
openstack-tf/d4s-production/basic-infrastructure/postgresql.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/postgresql.tf

2
openstack-tf/d4s-production/basic-infrastructure/production-basic-infrastructure.auto.tfvars
View File

@ -1,7 +1,7 @@
default_security_group_name = "default_for_all" default_security_group_name = "default_for_all"
shared_postgresql_server_data = { shared_postgresql_server_data = {
name ="shared-postgresql-server" name = "shared-postgresql-server"
flavor = "m1.large" flavor = "m1.large"
vol_data_name = "shared-postgresql-data" vol_data_name = "shared-postgresql-data"
vol_data_size = "300" vol_data_size = "300"

1
openstack-tf/d4s-production/basic-infrastructure/prometheus.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/prometheus.tf

2
openstack-tf/d4s-production/basic-infrastructure/provider.tf
View File

@ -1,6 +1,6 @@
# Define required providers # Define required providers
terraform { terraform {
required_version = ">= 0.14.0" required_version = ">= 0.14.0"
required_providers { required_providers {
openstack = { openstack = {
source = "terraform-provider-openstack/openstack" source = "terraform-provider-openstack/openstack"

1
openstack-tf/d4s-production/basic-infrastructure/security-groups.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/security-groups.tf

1
openstack-tf/d4s-production/basic-infrastructure/ssh-jump-proxy.tf Symbolic link
View File

@ -0,0 +1 @@
../../modules/d4science_infra_setup/ssh-jump-proxy.tf

34
openstack-tf/modules/d4science_infra_setup/haproxy.tf
View File

@ -28,7 +28,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_1_peer" {
protocol = "tcp" protocol = "tcp"
port_range_min = 10000 port_range_min = 10000
port_range_max = 10000 port_range_max = 10000
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_2_peer" { resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_2_peer" {
@ -39,7 +39,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy_l7_2_peer" {
protocol = "tcp" protocol = "tcp"
port_range_min = 10000 port_range_min = 10000
port_range_max = 10000 port_range_max = 10000
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_80" { resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_80" {
@ -50,7 +50,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_80" {
protocol = "tcp" protocol = "tcp"
port_range_min = 80 port_range_min = 80
port_range_max = 80 port_range_max = 80
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_1 remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_1
} }
resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_443" { resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_443" {
@ -61,7 +61,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_443" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_1 remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_1
} }
resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_8080" { resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_8080" {
@ -72,7 +72,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_1_haproxy_l7_8080" {
protocol = "tcp" protocol = "tcp"
port_range_min = 8080 port_range_min = 8080
port_range_max = 8080 port_range_max = 8080
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_1 remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_1
} }
resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_80" { resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_80" {
@ -83,7 +83,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_80" {
protocol = "tcp" protocol = "tcp"
port_range_min = 80 port_range_min = 80
port_range_max = 80 port_range_max = 80
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_2 remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_2
} }
resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_443" { resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_443" {
@ -94,7 +94,7 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_443" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_2 remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_2
} }
resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_8080" { resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_8080" {
@ -105,23 +105,23 @@ resource "openstack_networking_secgroup_rule_v2" "lb3_2_haproxy_l7_8080" {
protocol = "tcp" protocol = "tcp"
port_range_min = 8080 port_range_min = 8080
port_range_max = 8080 port_range_max = 8080
remote_ip_prefix = module.common_variables.octavia_information.octavia_vrrp_ip_2 remote_ip_prefix = var.octavia_information.octavia_vrrp_ip_2
} }
# Instance # Instance
resource "openstack_compute_instance_v2" "main_haproxy_l7" { resource "openstack_compute_instance_v2" "main_haproxy_l7" {
count = module.common_variables.haproxy_l7_data.vm_count count = var.haproxy_l7_data.vm_count
name = format("%s-%02d", module.common_variables.haproxy_l7_data.name, count.index+1) name = format("%s-%02d", var.haproxy_l7_data.name, count.index + 1)
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.haproxy_l7_data.flavor flavor_name = var.haproxy_l7_data.flavor
key_pair = module.ssh_settings.ssh_key_name key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name,openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.name] security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.main_lb_to_haproxy_l7.name]
scheduler_hints { scheduler_hints {
group = openstack_compute_servergroup_v2.main_haproxy_l7.id group = openstack_compute_servergroup_v2.main_haproxy_l7.id
} }
block_device { block_device {
uuid = module.common_variables.ubuntu_2204.uuid uuid = var.ubuntu_2204.uuid
source_type = "image" source_type = "image"
volume_size = 10 volume_size = 10
boot_index = 0 boot_index = 0
@ -130,9 +130,9 @@ resource "openstack_compute_instance_v2" "main_haproxy_l7" {
} }
network { network {
name = module.common_variables.main_private_network.name name = var.main_private_network.name
fixed_ip_v4 = module.common_variables.main_haproxy_l7_ip.*[count.index] fixed_ip_v4 = var.main_haproxy_l7_ip.* [count.index]
} }
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
} }

16
openstack-tf/modules/d4science_infra_setup/internal-ca.tf
View File

@ -1,11 +1,11 @@
resource "openstack_compute_instance_v2" "internal_ca" { resource "openstack_compute_instance_v2" "internal_ca" {
name = module.common_variables.internal_ca_data.name name = var.internal_ca_data.name
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.internal_ca_data.flavor flavor_name = var.internal_ca_data.flavor
key_pair = module.ssh_settings.ssh_key_name key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name] security_groups = [var.default_security_group_name]
block_device { block_device {
uuid = module.common_variables.ubuntu_2204.uuid uuid = var.ubuntu_2204.uuid
source_type = "image" source_type = "image"
volume_size = 10 volume_size = 10
boot_index = 0 boot_index = 0
@ -14,8 +14,8 @@ resource "openstack_compute_instance_v2" "internal_ca" {
} }
network { network {
name = module.common_variables.main_private_network.name name = var.main_private_network.name
fixed_ip_v4 = module.common_variables.basic_services_ip.ca fixed_ip_v4 = var.basic_services_ip.ca
} }
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
} }

34
openstack-tf/modules/d4science_infra_setup/octavia.tf
View File

@ -1,20 +1,20 @@
# Main load balancer. L4, backed by Octavia # Main load balancer. L4, backed by Octavia
resource "openstack_lb_loadbalancer_v2" "main_lb" { resource "openstack_lb_loadbalancer_v2" "main_lb" {
vip_subnet_id = module.common_variables.main_private_subnet_id vip_subnet_id = var.main_private_subnet_id
name = module.common_variables.octavia_information.main_lb_name name = var.octavia_information.main_lb_name
description = module.common_variables.octavia_information.main_lb_description description = var.octavia_information.main_lb_description
flavor_id = module.common_variables.octavia_information.octavia_flavor_id flavor_id = var.octavia_information.octavia_flavor_id
vip_address = module.common_variables.basic_services_ip.octavia_main vip_address = var.basic_services_ip.octavia_main
loadbalancer_provider = "amphora" loadbalancer_provider = "amphora"
} }
# Allocate a floating IP # Allocate a floating IP
resource "openstack_networking_floatingip_v2" "main_lb_ip" { resource "openstack_networking_floatingip_v2" "main_lb_ip" {
pool = module.common_variables.floating_ip_pools.main_public_ip_pool pool = var.floating_ip_pools.main_public_ip_pool
# The DNS association does not work because of a bug in the OpenStack API # The DNS association does not work because of a bug in the OpenStack API
# dns_name = "main-lb" # dns_name = "main-lb"
# dns_domain = module.common_variables.dns_zone.zone_name # dns_domain = var.dns_zone.zone_name
description = module.common_variables.octavia_information.main_lb_description description = var.octavia_information.main_lb_description
} }
resource "openstack_networking_floatingip_associate_v2" "main_lb" { resource "openstack_networking_floatingip_associate_v2" "main_lb" {
@ -23,11 +23,11 @@ resource "openstack_networking_floatingip_associate_v2" "main_lb" {
} }
locals { locals {
recordset_name = "${module.common_variables.octavia_information.main_lb_hostname}.${module.common_variables.dns_zone.zone_name}" recordset_name = "${var.octavia_information.main_lb_hostname}.${var.dns_zone.zone_name}"
} }
resource "openstack_dns_recordset_v2" "main_lb_dns_recordset" { resource "openstack_dns_recordset_v2" "main_lb_dns_recordset" {
zone_id = module.common_variables.dns_zone_id zone_id = var.dns_zone_id
name = local.recordset_name name = local.recordset_name
description = "Public IP address of the main load balancer" description = "Public IP address of the main load balancer"
ttl = 8600 ttl = 8600
@ -42,7 +42,7 @@ resource "openstack_lb_listener_v2" "main_haproxy_stats_listener" {
protocol_port = 8880 protocol_port = 8880
description = "Listener for the stats of the main HAPROXY instances" description = "Listener for the stats of the main HAPROXY instances"
name = "main_haproxy_stats_listener" name = "main_haproxy_stats_listener"
allowed_cidrs = [module.common_variables.ssh_sources.d4s_vpn_1_cidr,module.common_variables.ssh_sources.d4s_vpn_2_cidr,module.common_variables.ssh_sources.s2i2s_vpn_1_cidr,module.common_variables.ssh_sources.s2i2s_vpn_2_cidr] allowed_cidrs = [var.ssh_sources.d4s_vpn_1_cidr, var.ssh_sources.d4s_vpn_2_cidr, var.ssh_sources.s2i2s_vpn_1_cidr, var.ssh_sources.s2i2s_vpn_2_cidr]
} }
@ -61,12 +61,12 @@ resource "openstack_lb_members_v2" "main_haproxy_stats_pool_members" {
pool_id = openstack_lb_pool_v2.main_haproxy_stats_pool.id pool_id = openstack_lb_pool_v2.main_haproxy_stats_pool.id
member { member {
name = "haproxy l7 1" name = "haproxy l7 1"
address = module.common_variables.basic_services_ip.haproxy_l7_1 address = var.basic_services_ip.haproxy_l7_1
protocol_port = 8880 protocol_port = 8880
} }
member { member {
name = "haproxy l7 2" name = "haproxy l7 2"
address = module.common_variables.basic_services_ip.haproxy_l7_2 address = var.basic_services_ip.haproxy_l7_2
protocol_port = 8880 protocol_port = 8880
} }
} }
@ -107,12 +107,12 @@ resource "openstack_lb_members_v2" "main_haproxy_http_pool_members" {
pool_id = openstack_lb_pool_v2.main_haproxy_http_pool.id pool_id = openstack_lb_pool_v2.main_haproxy_http_pool.id
member { member {
name = "haproxy l7 1" name = "haproxy l7 1"
address = module.common_variables.basic_services_ip.haproxy_l7_1 address = var.basic_services_ip.haproxy_l7_1
protocol_port = 80 protocol_port = 80
} }
member { member {
name = "haproxy l7 2" name = "haproxy l7 2"
address = module.common_variables.basic_services_ip.haproxy_l7_2 address = var.basic_services_ip.haproxy_l7_2
protocol_port = 80 protocol_port = 80
} }
} }
@ -156,12 +156,12 @@ resource "openstack_lb_members_v2" "main_haproxy_https_pool_members" {
pool_id = openstack_lb_pool_v2.main_haproxy_https_pool.id pool_id = openstack_lb_pool_v2.main_haproxy_https_pool.id
member { member {
name = "haproxy l7 1" name = "haproxy l7 1"
address = module.common_variables.basic_services_ip.haproxy_l7_1 address = var.basic_services_ip.haproxy_l7_1
protocol_port = 443 protocol_port = 443
} }
member { member {
name = "haproxy l7 2" name = "haproxy l7 2"
address = module.common_variables.basic_services_ip.haproxy_l7_2 address = var.basic_services_ip.haproxy_l7_2
protocol_port = 443 protocol_port = 443
} }
} }

1
openstack-tf/modules/d4science_infra_setup/outputs.tf Symbolic link
View File

@ -0,0 +1 @@
../common_variables/outputs.tf

44
openstack-tf/modules/d4science_infra_setup/postgresql.tf
View File

@ -1,15 +1,15 @@
# PostgreSQL shared server # PostgreSQL shared server
# Network # Network
resource "openstack_networking_network_v2" "shared_postgresql_net" { resource "openstack_networking_network_v2" "shared_postgresql_net" {
name = module.common_variables.shared_postgresql_server_data.network_name name = var.shared_postgresql_server_data.network_name
admin_state_up = "true" admin_state_up = "true"
external = "false" external = "false"
description = module.common_variables.shared_postgresql_server_data.network_description description = var.shared_postgresql_server_data.network_description
dns_domain = module.common_variables.dns_zone.zone_name dns_domain = var.dns_zone.zone_name
mtu = module.common_variables.mtu_size mtu = var.mtu_size
port_security_enabled = true port_security_enabled = true
shared = false shared = false
region = module.common_variables.main_region region = var.main_region
} }
# Subnet # Subnet
@ -17,14 +17,14 @@ resource "openstack_networking_subnet_v2" "shared_postgresql_subnet" {
name = "shared-postgresql-subnet" name = "shared-postgresql-subnet"
description = "subnet used to connect to the shared PostgreSQL service" description = "subnet used to connect to the shared PostgreSQL service"
network_id = openstack_networking_network_v2.shared_postgresql_net.id network_id = openstack_networking_network_v2.shared_postgresql_net.id
cidr = module.common_variables.shared_postgresql_server_data.network_cidr cidr = var.shared_postgresql_server_data.network_cidr
dns_nameservers = module.common_variables.resolvers_ip dns_nameservers = var.resolvers_ip
ip_version = 4 ip_version = 4
enable_dhcp = true enable_dhcp = true
no_gateway = true no_gateway = true
allocation_pool { allocation_pool {
start = module.common_variables.shared_postgresql_server_data.allocation_pool_start start = var.shared_postgresql_server_data.allocation_pool_start
end = module.common_variables.shared_postgresql_server_data.allocation_pool_end end = var.shared_postgresql_server_data.allocation_pool_end
} }
} }
@ -43,24 +43,24 @@ resource "openstack_networking_secgroup_rule_v2" "shared_postgresql_access_from_
protocol = "tcp" protocol = "tcp"
port_range_min = 5432 port_range_min = 5432
port_range_max = 5432 port_range_max = 5432
remote_ip_prefix = module.common_variables.shared_postgresql_server_data.network_cidr remote_ip_prefix = var.shared_postgresql_server_data.network_cidr
} }
# Block device # Block device
resource "openstack_blockstorage_volume_v3" "shared_postgresql_data_vol" { resource "openstack_blockstorage_volume_v3" "shared_postgresql_data_vol" {
name = module.common_variables.shared_postgresql_server_data.vol_data_name name = var.shared_postgresql_server_data.vol_data_name
size = module.common_variables.shared_postgresql_server_data.vol_data_size size = var.shared_postgresql_server_data.vol_data_size
} }
# Instance # Instance
resource "openstack_compute_instance_v2" "shared_postgresql_server" { resource "openstack_compute_instance_v2" "shared_postgresql_server" {
name = module.common_variables.shared_postgresql_server_data.name name = var.shared_postgresql_server_data.name
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.shared_postgresql_server_data.flavor flavor_name = var.shared_postgresql_server_data.flavor
key_pair = module.ssh_settings.ssh_key_name key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name,openstack_networking_secgroup_v2.shared_postgresql_access.name] security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.shared_postgresql_access.name]
block_device { block_device {
uuid = module.common_variables.ubuntu_2204.uuid uuid = var.ubuntu_2204.uuid
source_type = "image" source_type = "image"
volume_size = 10 volume_size = 10
boot_index = 0 boot_index = 0
@ -69,19 +69,19 @@ resource "openstack_compute_instance_v2" "shared_postgresql_server" {
} }
network { network {
name = module.common_variables.main_private_network.name name = var.main_private_network.name
} }
network { network {
name = module.common_variables.shared_postgresql_server_data.network_name name = var.shared_postgresql_server_data.network_name
fixed_ip_v4 = module.common_variables.shared_postgresql_server_data.server_ip fixed_ip_v4 = var.shared_postgresql_server_data.server_ip
} }
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
} }
resource "openstack_compute_volume_attach_v2" "shared_postgresql_data_attach_vol" { resource "openstack_compute_volume_attach_v2" "shared_postgresql_data_attach_vol" {
instance_id = openstack_compute_instance_v2.shared_postgresql_server.id instance_id = openstack_compute_instance_v2.shared_postgresql_server.id
volume_id = openstack_blockstorage_volume_v3.shared_postgresql_data_vol.id volume_id = openstack_blockstorage_volume_v3.shared_postgresql_data_vol.id
device = module.common_variables.shared_postgresql_server_data.vol_data_device device = var.shared_postgresql_server_data.vol_data_device
depends_on = [openstack_compute_instance_v2.shared_postgresql_server] depends_on = [openstack_compute_instance_v2.shared_postgresql_server]
} }

32
openstack-tf/modules/d4science_infra_setup/prometheus.tf
View File

@ -1,17 +1,17 @@
# Promertheus server. A floating IP is required # Promertheus server. A floating IP is required
resource "openstack_blockstorage_volume_v3" "prometheus_data_vol" { resource "openstack_blockstorage_volume_v3" "prometheus_data_vol" {
name = module.common_variables.prometheus_server_data.vol_data_name name = var.prometheus_server_data.vol_data_name
size = module.common_variables.prometheus_server_data.vol_data_size size = var.prometheus_server_data.vol_data_size
} }
resource "openstack_compute_instance_v2" "prometheus_server" { resource "openstack_compute_instance_v2" "prometheus_server" {
name = module.common_variables.prometheus_server_data.name name = var.prometheus_server_data.name
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.prometheus_server_data.flavor flavor_name = var.prometheus_server_data.flavor
key_pair = module.ssh_settings.ssh_key_name key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name,openstack_networking_secgroup_v2.restricted_web.name,openstack_networking_secgroup_v2.prometheus_access_from_grafana.name] security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.restricted_web.name, openstack_networking_secgroup_v2.prometheus_access_from_grafana.name]
block_device { block_device {
uuid = module.common_variables.ubuntu_2204.uuid uuid = var.ubuntu_2204.uuid
source_type = "image" source_type = "image"
volume_size = 10 volume_size = 10
boot_index = 0 boot_index = 0
@ -20,21 +20,21 @@ resource "openstack_compute_instance_v2" "prometheus_server" {
} }
network { network {
name = module.common_variables.main_private_network.name name = var.main_private_network.name
fixed_ip_v4 = module.common_variables.basic_services_ip.prometheus fixed_ip_v4 = var.basic_services_ip.prometheus
} }
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
} }
resource "openstack_compute_volume_attach_v2" "prometheus_data_attach_vol" { resource "openstack_compute_volume_attach_v2" "prometheus_data_attach_vol" {
instance_id = openstack_compute_instance_v2.prometheus_server.id instance_id = openstack_compute_instance_v2.prometheus_server.id
volume_id = openstack_blockstorage_volume_v3.prometheus_data_vol.id volume_id = openstack_blockstorage_volume_v3.prometheus_data_vol.id
device = module.common_variables.prometheus_server_data.vol_data_device device = var.prometheus_server_data.vol_data_device
} }
# Floating IP and DNS record # Floating IP and DNS record
resource "openstack_networking_floatingip_v2" "prometheus_server_ip" { resource "openstack_networking_floatingip_v2" "prometheus_server_ip" {
pool = module.common_variables.floating_ip_pools.main_public_ip_pool pool = var.floating_ip_pools.main_public_ip_pool
# The DNS association does not work because of a bug in the OpenStack API # The DNS association does not work because of a bug in the OpenStack API
description = "Prometheus server" description = "Prometheus server"
} }
@ -45,12 +45,12 @@ resource "openstack_compute_floatingip_associate_v2" "prometheus_server" {
} }
locals { locals {
prometheus_recordset_name = "${module.common_variables.prometheus_server_data.name}.${module.common_variables.dns_zone.zone_name}" prometheus_recordset_name = "${var.prometheus_server_data.name}.${var.dns_zone.zone_name}"
alertmanager_recordset_name = "alertmanager.${module.common_variables.dns_zone.zone_name}" alertmanager_recordset_name = "alertmanager.${var.dns_zone.zone_name}"
} }
resource "openstack_dns_recordset_v2" "prometheus_server_recordset" { resource "openstack_dns_recordset_v2" "prometheus_server_recordset" {
zone_id = module.common_variables.dns_zone_id zone_id = var.dns_zone_id
name = local.prometheus_recordset_name name = local.prometheus_recordset_name
description = "Public IP address of the Prometheus server" description = "Public IP address of the Prometheus server"
ttl = 8600 ttl = 8600
@ -59,7 +59,7 @@ resource "openstack_dns_recordset_v2" "prometheus_server_recordset" {
} }
resource "openstack_dns_recordset_v2" "alertmanager_server_recordset" { resource "openstack_dns_recordset_v2" "alertmanager_server_recordset" {
zone_id = module.common_variables.dns_zone_id zone_id = var.dns_zone_id
name = local.alertmanager_recordset_name name = local.alertmanager_recordset_name
description = "Prometheus alertmanager" description = "Prometheus alertmanager"
ttl = 8600 ttl = 8600

52
openstack-tf/modules/d4science_infra_setup/security-groups.tf
View File

@ -1,7 +1,7 @@
# #
# This is the security group that should be added to every instance # This is the security group that should be added to every instance
resource "openstack_networking_secgroup_v2" "default" { resource "openstack_networking_secgroup_v2" "default" {
name = module.common_variables.default_security_group_name name = var.default_security_group_name
delete_default_rules = "true" delete_default_rules = "true"
description = "Default security group with rules for ssh access via jump proxy, prometheus scraping" description = "Default security group with rules for ssh access via jump proxy, prometheus scraping"
} }
@ -29,7 +29,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-jump-proxy" {
protocol = "tcp" protocol = "tcp"
port_range_min = 22 port_range_min = 22
port_range_max = 22 port_range_max = 22
remote_ip_prefix = module.common_variables.basic_services_ip.ssh_jump_cidr remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "prometheus-node" { resource "openstack_networking_secgroup_rule_v2" "prometheus-node" {
@ -40,7 +40,7 @@ resource "openstack_networking_secgroup_rule_v2" "prometheus-node" {
protocol = "tcp" protocol = "tcp"
port_range_min = 9100 port_range_min = 9100
port_range_max = 9100 port_range_max = 9100
remote_ip_prefix = module.common_variables.basic_services_ip.prometheus_cidr remote_ip_prefix = var.basic_services_ip.prometheus_cidr
} }
# #
@ -59,7 +59,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-1" {
protocol = "tcp" protocol = "tcp"
port_range_min = 22 port_range_min = 22
port_range_max = 22 port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.s2i2s_vpn_1_cidr remote_ip_prefix = var.ssh_sources.s2i2s_vpn_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-2" { resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-2" {
@ -70,7 +70,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-s2i2s-vpn-2" {
protocol = "tcp" protocol = "tcp"
port_range_min = 22 port_range_min = 22
port_range_max = 22 port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.s2i2s_vpn_2_cidr remote_ip_prefix = var.ssh_sources.s2i2s_vpn_2_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-1" { resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-1" {
@ -81,7 +81,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-1" {
protocol = "tcp" protocol = "tcp"
port_range_min = 22 port_range_min = 22
port_range_max = 22 port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.d4s_vpn_1_cidr remote_ip_prefix = var.ssh_sources.d4s_vpn_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-2" { resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-2" {
@ -92,7 +92,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-d4s-vpn-2" {
protocol = "tcp" protocol = "tcp"
port_range_min = 22 port_range_min = 22
port_range_max = 22 port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.d4s_vpn_2_cidr remote_ip_prefix = var.ssh_sources.d4s_vpn_2_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "ssh-shell-d4s" { resource "openstack_networking_secgroup_rule_v2" "ssh-shell-d4s" {
@ -103,7 +103,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-shell-d4s" {
protocol = "tcp" protocol = "tcp"
port_range_min = 22 port_range_min = 22
port_range_max = 22 port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.shell_d4s_cidr remote_ip_prefix = var.ssh_sources.shell_d4s_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "ssh-infrascience-net" { resource "openstack_networking_secgroup_rule_v2" "ssh-infrascience-net" {
@ -114,7 +114,7 @@ resource "openstack_networking_secgroup_rule_v2" "ssh-infrascience-net" {
protocol = "tcp" protocol = "tcp"
port_range_min = 22 port_range_min = 22
port_range_max = 22 port_range_max = 22
remote_ip_prefix = module.common_variables.ssh_sources.infrascience_net_cidr remote_ip_prefix = var.ssh_sources.infrascience_net_cidr
} }
# Debug via tunnel from the jump proxy node # Debug via tunnel from the jump proxy node
@ -132,7 +132,7 @@ resource "openstack_networking_secgroup_rule_v2" "shell_8100" {
protocol = "tcp" protocol = "tcp"
port_range_min = 8100 port_range_min = 8100
port_range_max = 8100 port_range_max = 8100
remote_ip_prefix = module.common_variables.basic_services_ip.ssh_jump_cidr remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "shell_80" { resource "openstack_networking_secgroup_rule_v2" "shell_80" {
@ -143,7 +143,7 @@ resource "openstack_networking_secgroup_rule_v2" "shell_80" {
protocol = "tcp" protocol = "tcp"
port_range_min = 80 port_range_min = 80
port_range_max = 80 port_range_max = 80
remote_ip_prefix = module.common_variables.basic_services_ip.ssh_jump_cidr remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "shell_443" { resource "openstack_networking_secgroup_rule_v2" "shell_443" {
@ -154,7 +154,7 @@ resource "openstack_networking_secgroup_rule_v2" "shell_443" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.basic_services_ip.ssh_jump_cidr remote_ip_prefix = var.basic_services_ip.ssh_jump_cidr
} }
# Traffic from the main HAPROXY load balancers # Traffic from the main HAPROXY load balancers
@ -173,7 +173,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-80" {
protocol = "tcp" protocol = "tcp"
port_range_min = 80 port_range_min = 80
port_range_max = 80 port_range_max = 80
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-80" { resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-80" {
@ -184,7 +184,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-80" {
protocol = "tcp" protocol = "tcp"
port_range_min = 80 port_range_min = 80
port_range_max = 80 port_range_max = 80
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-443" { resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-443" {
@ -195,7 +195,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-443" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-443" { resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-443" {
@ -206,7 +206,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-443" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8080" { resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8080" {
@ -217,7 +217,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8080" {
protocol = "tcp" protocol = "tcp"
port_range_min = 8080 port_range_min = 8080
port_range_max = 8080 port_range_max = 8080
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8080" { resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8080" {
@ -228,7 +228,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8080" {
protocol = "tcp" protocol = "tcp"
port_range_min = 8080 port_range_min = 8080
port_range_max = 8080 port_range_max = 8080
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8888" { resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8888" {
@ -239,7 +239,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-1-8888" {
protocol = "tcp" protocol = "tcp"
port_range_min = 8888 port_range_min = 8888
port_range_max = 8888 port_range_max = 8888
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_1_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8888" { resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8888" {
@ -250,7 +250,7 @@ resource "openstack_networking_secgroup_rule_v2" "haproxy-l7-2-8888" {
protocol = "tcp" protocol = "tcp"
port_range_min = 8888 port_range_min = 8888
port_range_max = 8888 port_range_max = 8888
remote_ip_prefix = module.common_variables.basic_services_ip.haproxy_l7_2_cidr remote_ip_prefix = var.basic_services_ip.haproxy_l7_2_cidr
} }
# Security group that exposes web services directly. A floating IP is required. # Security group that exposes web services directly. A floating IP is required.
@ -308,7 +308,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_1" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.d4s_vpn_1_cidr remote_ip_prefix = var.ssh_sources.d4s_vpn_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_2" { resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_2" {
@ -319,7 +319,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_d4s_vpn_2" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.d4s_vpn_2_cidr remote_ip_prefix = var.ssh_sources.d4s_vpn_2_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_1" { resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_1" {
@ -330,7 +330,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_1" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.s2i2s_vpn_1_cidr remote_ip_prefix = var.ssh_sources.s2i2s_vpn_1_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_2" { resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_2" {
@ -341,7 +341,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_s2i2s_vpn_2" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.s2i2s_vpn_2_cidr remote_ip_prefix = var.ssh_sources.s2i2s_vpn_2_cidr
} }
resource "openstack_networking_secgroup_rule_v2" "https_from_shell_d4s" { resource "openstack_networking_secgroup_rule_v2" "https_from_shell_d4s" {
@ -352,7 +352,7 @@ resource "openstack_networking_secgroup_rule_v2" "https_from_shell_d4s" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.ssh_sources.shell_d4s_cidr remote_ip_prefix = var.ssh_sources.shell_d4s_cidr
} }
resource "openstack_networking_secgroup_v2" "prometheus_access_from_grafana" { resource "openstack_networking_secgroup_v2" "prometheus_access_from_grafana" {
@ -369,5 +369,5 @@ resource "openstack_networking_secgroup_rule_v2" "grafana_d4s" {
protocol = "tcp" protocol = "tcp"
port_range_min = 443 port_range_min = 443
port_range_max = 443 port_range_max = 443
remote_ip_prefix = module.common_variables.prometheus_server_data.public_grafana_server_cidr remote_ip_prefix = var.prometheus_server_data.public_grafana_server_cidr
} }

22
openstack-tf/modules/d4science_infra_setup/ssh-jump-proxy.tf
View File

@ -1,12 +1,12 @@
# VM used as jump proxy. A floating IP is required # VM used as jump proxy. A floating IP is required
resource "openstack_compute_instance_v2" "ssh_jump_proxy" { resource "openstack_compute_instance_v2" "ssh_jump_proxy" {
name = module.common_variables.ssh_jump_proxy.name name = var.ssh_jump_proxy.name
availability_zone_hints = module.common_variables.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = module.common_variables.ssh_jump_proxy.flavor flavor_name = var.ssh_jump_proxy.flavor
key_pair = module.ssh_settings.ssh_key_name key_pair = module.ssh_settings.ssh_key_name
security_groups = [module.common_variables.default_security_group_name,openstack_networking_secgroup_v2.access_to_the_jump_proxy.name] security_groups = [var.default_security_group_name, openstack_networking_secgroup_v2.access_to_the_jump_proxy.name]
block_device { block_device {
uuid = module.common_variables.ubuntu_2204.uuid uuid = var.ubuntu_2204.uuid
source_type = "image" source_type = "image"
volume_size = 30 volume_size = 30
boot_index = 0 boot_index = 0
@ -15,15 +15,15 @@ resource "openstack_compute_instance_v2" "ssh_jump_proxy" {
} }
network { network {
name = module.common_variables.main_private_network.name name = var.main_private_network.name
fixed_ip_v4 = module.common_variables.basic_services_ip.ssh_jump fixed_ip_v4 = var.basic_services_ip.ssh_jump
} }
user_data = "${file("${module.common_variables.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
} }
# Floating IP and DNS record # Floating IP and DNS record
resource "openstack_networking_floatingip_v2" "ssh_jump_proxy_ip" { resource "openstack_networking_floatingip_v2" "ssh_jump_proxy_ip" {
pool = module.common_variables.floating_ip_pools.main_public_ip_pool pool = var.floating_ip_pools.main_public_ip_pool
# The DNS association does not work because of a bug in the OpenStack API # The DNS association does not work because of a bug in the OpenStack API
description = "SSH Proxy Jump Server" description = "SSH Proxy Jump Server"
} }
@ -34,11 +34,11 @@ resource "openstack_compute_floatingip_associate_v2" "ssh_jump_proxy" {
} }
locals { locals {
ssh_recordset_name = "${module.common_variables.ssh_jump_proxy.name}.${module.common_variables.dns_zone.zone_name}" ssh_recordset_name = "${var.ssh_jump_proxy.name}.${var.dns_zone.zone_name}"
} }
resource "openstack_dns_recordset_v2" "ssh_jump_proxy_recordset" { resource "openstack_dns_recordset_v2" "ssh_jump_proxy_recordset" {
zone_id = module.common_variables.dns_zone_id zone_id = var.dns_zone_id
name = local.ssh_recordset_name name = local.ssh_recordset_name
description = "Public IP address of the SSH Proxy Jump server" description = "Public IP address of the SSH Proxy Jump server"
ttl = 8600 ttl = 8600

12
openstack-tf/modules/d4science_infra_setup/terraform-provider.tf
View File

@ -17,11 +17,11 @@ data "terraform_remote_state" "privnet_dns_router" {
} }
} }
module "common_variables" { # module "common_variables" {
source = "../../modules/common_variables" # source = "../../modules/common_variables"
} # }
module "ssh_settings" { # module "ssh_settings" {
source = "../../modules/ssh-key-ref" # source = "../../modules/ssh-key-ref"
} # }

1
openstack-tf/modules/d4science_infra_setup/variables.tf Symbolic link
View File

@ -0,0 +1 @@
../common_variables/variables.tf

26
openstack-tf/modules/docker_swarm/docker-swarm.tf
View File

@ -92,11 +92,11 @@ resource "openstack_networking_secgroup_rule_v2" "swarm_nfs_tcp" {
# Instance # Instance
resource "openstack_compute_instance_v2" "docker_swarm_managers" { resource "openstack_compute_instance_v2" "docker_swarm_managers" {
count = var.docker_swarm_data.mgr_count count = var.docker_swarm_data.mgr_count
name = format("%s-%02d", var.docker_swarm_data.mgr_name, count.index+1) name = format("%s-%02d", var.docker_swarm_data.mgr_name, count.index + 1)
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.docker_swarm_data.mgr_flavor flavor_name = var.docker_swarm_data.mgr_flavor
key_pair = var.ssh_key_file.name key_pair = var.ssh_key_file.name
security_groups = [openstack_networking_secgroup_v2.default.name,openstack_networking_secgroup_v2.swarm_internal_traffic.name] security_groups = [openstack_networking_secgroup_v2.default.name, openstack_networking_secgroup_v2.swarm_internal_traffic.name]
scheduler_hints { scheduler_hints {
group = openstack_compute_servergroup_v2.swarm_masters.id group = openstack_compute_servergroup_v2.swarm_masters.id
} }
@ -119,24 +119,24 @@ resource "openstack_compute_instance_v2" "docker_swarm_managers" {
network { network {
name = var.main_private_network.name name = var.main_private_network.name
fixed_ip_v4 = var.swarm_managers_ip.*[count.index] fixed_ip_v4 = var.swarm_managers_ip.* [count.index]
} }
network { network {
name = var.swarm_nfs_private_network.network_name name = var.swarm_nfs_private_network.network_name
} }
user_data = "${file("${var.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
depends_on = [ openstack_networking_subnet_v2.swarm_nfs_subnet ] depends_on = [openstack_networking_subnet_v2.swarm_nfs_subnet]
} }
# Swarm worker nodes # Swarm worker nodes
resource "openstack_compute_instance_v2" "docker_swarm_workers" { resource "openstack_compute_instance_v2" "docker_swarm_workers" {
count = var.docker_swarm_data.worker_count count = var.docker_swarm_data.worker_count
name = format("%s-%02d", var.docker_swarm_data.worker_name, count.index+1) name = format("%s-%02d", var.docker_swarm_data.worker_name, count.index + 1)
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.docker_swarm_data.worker_flavor flavor_name = var.docker_swarm_data.worker_flavor
key_pair = var.ssh_key_file.name key_pair = var.ssh_key_file.name
security_groups = [openstack_networking_secgroup_v2.default.name,openstack_networking_secgroup_v2.swarm_internal_traffic.name] security_groups = [openstack_networking_secgroup_v2.default.name, openstack_networking_secgroup_v2.swarm_internal_traffic.name]
scheduler_hints { scheduler_hints {
group = openstack_compute_servergroup_v2.swarm_workers.id group = openstack_compute_servergroup_v2.swarm_workers.id
} }
@ -164,8 +164,8 @@ resource "openstack_compute_instance_v2" "docker_swarm_workers" {
name = var.swarm_nfs_private_network.network_name name = var.swarm_nfs_private_network.network_name
} }
user_data = "${file("${var.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
depends_on = [ openstack_networking_subnet_v2.swarm_nfs_subnet ] depends_on = [openstack_networking_subnet_v2.swarm_nfs_subnet]
} }
# NFS server # NFS server
@ -181,7 +181,7 @@ resource "openstack_compute_instance_v2" "swarm_nfs_server" {
availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu availability_zone_hints = var.availability_zones_names.availability_zone_no_gpu
flavor_name = var.docker_swarm_data.nfs_server_flavor flavor_name = var.docker_swarm_data.nfs_server_flavor
key_pair = var.ssh_key_file.name key_pair = var.ssh_key_file.name
security_groups = [openstack_networking_secgroup_v2.default.name,openstack_networking_secgroup_v2.swarm_nfs_traffic.name] security_groups = [openstack_networking_secgroup_v2.default.name, openstack_networking_secgroup_v2.swarm_nfs_traffic.name]
block_device { block_device {
uuid = var.ubuntu_2204.uuid uuid = var.ubuntu_2204.uuid
source_type = "image" source_type = "image"
@ -199,8 +199,8 @@ resource "openstack_compute_instance_v2" "swarm_nfs_server" {
fixed_ip_v4 = var.swarm_nfs_private_network.server_ip fixed_ip_v4 = var.swarm_nfs_private_network.server_ip
} }
user_data = "${file("${var.ubuntu2204_data_file}")}" user_data = file("${var.ubuntu2204_data_file}")
depends_on = [ openstack_networking_subnet_v2.swarm_nfs_subnet ] depends_on = [openstack_networking_subnet_v2.swarm_nfs_subnet]
} }
# Attach the additional volume # Attach the additional volume
@ -298,7 +298,7 @@ resource "openstack_lb_listener_v2" "swarm_haproxy_stats_listener" {
protocol_port = 8880 protocol_port = 8880
description = "Listener for the stats of the Docker Swarm HAPROXY instances" description = "Listener for the stats of the Docker Swarm HAPROXY instances"
name = "swarm_haproxy_stats_listener" name = "swarm_haproxy_stats_listener"
allowed_cidrs = [var.ssh_sources.d4s_vpn_1_cidr,var.ssh_sources.d4s_vpn_2_cidr,var.ssh_sources.s2i2s_vpn_1_cidr,var.ssh_sources.s2i2s_vpn_2_cidr] allowed_cidrs = [var.ssh_sources.d4s_vpn_1_cidr, var.ssh_sources.d4s_vpn_2_cidr, var.ssh_sources.s2i2s_vpn_1_cidr, var.ssh_sources.s2i2s_vpn_2_cidr]
} }