From bea178174958845c1aba0a274efcd40c13d6a4b8 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Thu, 1 Dec 2016 12:51:03 -0800
Subject: [PATCH 1/4] Squashed commits: * includes changes from
 https://github.com/Capgemini/kubeform/pull/86 * Fix nested quotes for
 terraform 0.7.x * Use template_file as data resource for terraform 0.7.x *
 Convert etcd_discovery_url to null_resource

  In Terraform 0.7.x, template file data sources do not support the
  'provisioner' parameter. So instead, we must now use a null_resource to
  get the discovery URL.

  And, unfortunately, depending on a null_resource does not mean that you
  can read the file before it exists.

* separate out vpc_public_cidrs_list and move it next to dependent list of AZs
* aws_instance: fix subnet_id
* convert security_groups -> vpc_security_group_ids
* tag aws_vpc with org Name
* add empty etcd_discovery_url.txt
---
 docs/getting-started-guides/aws/public.md     |  2 +
 terraform/aws/elb/main.tf                     |  4 +-
 terraform/aws/iam/main.tf                     | 12 +--
 terraform/aws/private-cloud/bastion-server.tf |  6 +-
 .../aws/private-cloud/etcd_discovery_url.txt  |  1 -
 terraform/aws/private-cloud/main.tf           | 20 ++---
 terraform/aws/private-cloud/masters.tf        |  6 +-
 terraform/aws/private-cloud/workers.tf        |  6 +-
 terraform/aws/public-cloud/edge-routers.tf    | 16 ++--
 .../aws/public-cloud/etcd_discovery_url.txt   |  1 -
 terraform/aws/public-cloud/main.tf            | 79 +++++++++++--------
 terraform/aws/public-cloud/masters.tf         | 20 ++---
 terraform/aws/public-cloud/workers.tf         | 16 ++--
 13 files changed, 100 insertions(+), 89 deletions(-)
 delete mode 100644 terraform/aws/private-cloud/etcd_discovery_url.txt

diff --git a/docs/getting-started-guides/aws/public.md b/docs/getting-started-guides/aws/public.md
index 57c0ffa..69b2e34 100644
--- a/docs/getting-started-guides/aws/public.md
+++ b/docs/getting-started-guides/aws/public.md
@@ -59,6 +59,8 @@ for i in $(ls .terraform/modules/*/Makefile); do i=$(dirname $i); make -C $i; do
 ### Provision the cluster infrastructure
 
 ```
+cd /tmp/kubeform/terraform/aws/public-cloud
+terraform apply -target=null_resource.etcd_discovery_url
 terraform apply
 ```
 
diff --git a/terraform/aws/elb/main.tf b/terraform/aws/elb/main.tf
index d0c3c52..a3a83b1 100644
--- a/terraform/aws/elb/main.tf
+++ b/terraform/aws/elb/main.tf
@@ -1,7 +1,7 @@
 variable "elb_name" { default = "kube-master" }
 variable "health_check_target" { default = "HTTP:8080/healthz" }
-variable "instances" {}
-variable "subnets" {}
+variable "instances" { type = "list" }
+variable "subnets" { type = "list" }
 variable "security_groups" {}
 
 resource "aws_elb" "kube_master" {
diff --git a/terraform/aws/iam/main.tf b/terraform/aws/iam/main.tf
index 64079a2..84a9fe3 100644
--- a/terraform/aws/iam/main.tf
+++ b/terraform/aws/iam/main.tf
@@ -2,13 +2,13 @@
 resource "aws_iam_role" "master_role" {
   name               = "master_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/master-role.json\")}"
+  assume_role_policy = "${file("${path.module}/master-role.json")}"
 }
 
 resource "aws_iam_role_policy" "master_policy" {
   name   = "master_policy"
   role   = "${aws_iam_role.master_role.id}"
-  policy = "${file(\"${path.module}/master-policy.json\")}"
+  policy = "${file("${path.module}/master-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "master_profile" {
@@ -20,13 +20,13 @@ resource "aws_iam_instance_profile" "master_profile" {
 resource "aws_iam_role" "worker_role" {
   name               = "worker_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/worker-role.json\")}"
+  assume_role_policy = "${file("${path.module}/worker-role.json")}"
 }
 
 resource "aws_iam_role_policy" "worker_policy" {
   name   = "worker_policy"
   role   = "${aws_iam_role.worker_role.id}"
-  policy = "${file(\"${path.module}/worker-policy.json\")}"
+  policy = "${file("${path.module}/worker-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "worker_profile" {
@@ -38,13 +38,13 @@ resource "aws_iam_instance_profile" "worker_profile" {
 resource "aws_iam_role" "edge-router_role" {
   name               = "edge-router_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/edge-router-role.json\")}"
+  assume_role_policy = "${file("${path.module}/edge-router-role.json")}"
 }
 
 resource "aws_iam_role_policy" "edge-router_policy" {
   name   = "edge-router_policy"
   role   = "${aws_iam_role.edge-router_role.id}"
-  policy = "${file(\"${path.module}/edge-router-policy.json\")}"
+  policy = "${file("${path.module}/edge-router-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "edge-router_profile" {
diff --git a/terraform/aws/private-cloud/bastion-server.tf b/terraform/aws/private-cloud/bastion-server.tf
index 8a30e94..d672fa8 100644
--- a/terraform/aws/private-cloud/bastion-server.tf
+++ b/terraform/aws/private-cloud/bastion-server.tf
@@ -11,9 +11,9 @@ module "bastion_ami" {
   virttype = "${module.bastion_amitype.prefer_hvm}"
 }
 
-resource "template_file" "bastion_cloud_init" {
+data "template_file" "bastion_cloud_init" {
   template   = "bastion-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
@@ -31,7 +31,7 @@ resource "aws_instance" "bastion" {
   security_groups   = ["${module.sg-default.security_group_id}", "${aws_security_group.bastion.id}"]
   key_name          = "${module.aws-keypair.keypair_name}"
   source_dest_check = false
-  user_data         = "${template_file.bastion_cloud_init.rendered}"
+  user_data         = "${data.template_file.bastion_cloud_init.rendered}"
   tags = {
     Name = "kube-bastion"
     role = "bastion"
diff --git a/terraform/aws/private-cloud/etcd_discovery_url.txt b/terraform/aws/private-cloud/etcd_discovery_url.txt
deleted file mode 100644
index 8b13789..0000000
--- a/terraform/aws/private-cloud/etcd_discovery_url.txt
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/terraform/aws/private-cloud/main.tf b/terraform/aws/private-cloud/main.tf
index 26ff833..8678909 100644
--- a/terraform/aws/private-cloud/main.tf
+++ b/terraform/aws/private-cloud/main.tf
@@ -52,20 +52,20 @@ module "elb" {
   source = "../elb"
 
   security_groups = "${module.sg-default.security_group_id}"
-  instances       = "${join(\",\", aws_instance.worker.*.id)}"
+  instances       = "${join(",", aws_instance.worker.*.id)}"
   subnets         = "${module.vpc.public_subnets}"
 }
 
 # Generate an etcd URL for the cluster
-resource "template_file" "etcd_discovery_url" {
-  template = "/dev/null"
-  provisioner "local-exec" {
-    command = "curl https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
-  }
-  # This will regenerate the discovery URL if the cluster size changes, we include the bastion here
-  vars {
-    size = "${var.masters}"
-  }
+resource "null_resource" "etcd_discovery_url" {
+    provisioner "local-exec" {
+        command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
+    }
+
+    # This will regenerate the discovery URL if the cluster size changes
+    triggers {
+        size = "${var.masters}"
+    }
 }
 
 # outputs
diff --git a/terraform/aws/private-cloud/masters.tf b/terraform/aws/private-cloud/masters.tf
index 139e8d8..cffda24 100644
--- a/terraform/aws/private-cloud/masters.tf
+++ b/terraform/aws/private-cloud/masters.tf
@@ -10,9 +10,9 @@ module "master_ami" {
   virttype = "${module.master_amitype.prefer_hvm}"
 }
 
-resource "template_file" "master_cloud_init" {
+data "template_file" "master_cloud_init" {
   template   = "master-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
@@ -29,7 +29,7 @@ resource "aws_instance" "mmaster" {
   subnet_id         = "${element(split(",", module.vpc.private_subnets), count.index)}"
   security_groups   = ["${module.sg-default.security_group_id}"]
   depends_on        = ["aws_instance.bastion"]
-  user_data         = "${template_file.master_cloud_init.rendered}"
+  user_data         = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name = "kube-master-${count.index}"
     role = "masters"
diff --git a/terraform/aws/private-cloud/workers.tf b/terraform/aws/private-cloud/workers.tf
index 10e0a2d..f3b135e 100644
--- a/terraform/aws/private-cloud/workers.tf
+++ b/terraform/aws/private-cloud/workers.tf
@@ -10,9 +10,9 @@ module "worker_ami" {
   virttype = "${module.worker_amitype.prefer_hvm}"
 }
 
-resource "template_file" "worker_cloud_init" {
+data "template_file" "worker_cloud_init" {
   template   = "worker-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
@@ -33,7 +33,7 @@ resource "aws_instance" "worker" {
   subnet_id         = "${element(split(",", module.vpc.private_subnets), count.index)}"
   security_groups   = ["${module.sg-default.security_group_id}"]
   depends_on        = ["aws_instance.bastion", "aws_instance.master"]
-  user_data         = "${template_file.master_cloud_init.rendered}"
+  user_data         = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name = "kube-worker-${count.index}"
     role = "workers"
diff --git a/terraform/aws/public-cloud/edge-routers.tf b/terraform/aws/public-cloud/edge-routers.tf
index 3a539d6..46d8d19 100644
--- a/terraform/aws/public-cloud/edge-routers.tf
+++ b/terraform/aws/public-cloud/edge-routers.tf
@@ -10,16 +10,16 @@ module "edge-router_ami" {
   virttype = "${module.edge-router_amitype.prefer_hvm}"
 }
 
-resource "template_file" "edge-router_cloud_init" {
+data "template_file" "edge-router_cloud_init" {
   template   = "${file("worker-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 
@@ -29,11 +29,11 @@ resource "aws_instance" "edge-router" {
   iam_instance_profile = "${module.iam.edge-router_profile_name}"
   count                = "${var.edge-routers}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
   depends_on           = ["aws_instance.master"]
-  user_data            = "${template_file.edge-router_cloud_init.rendered}"
+  user_data            = "${data.template_file.edge-router_cloud_init.rendered}"
   tags = {
     Name   = "kube-edge-router-${count.index}"
     role   = "edge-routers"
diff --git a/terraform/aws/public-cloud/etcd_discovery_url.txt b/terraform/aws/public-cloud/etcd_discovery_url.txt
index 6fe5f6a..e69de29 100644
--- a/terraform/aws/public-cloud/etcd_discovery_url.txt
+++ b/terraform/aws/public-cloud/etcd_discovery_url.txt
@@ -1 +0,0 @@
-https://discovery.etcd.io/5a6cb41d2a91517447cb738d7e2cf898
\ No newline at end of file
diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index fd37141..c4bf846 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -2,7 +2,17 @@ variable "access_key" {}
 variable "secret_key" {}
 variable "organization" { default = "kubeform" }
 variable "region" { default = "eu-west-1" }
-variable "availability_zones" { default = "eu-west-1a,eu-west-1b,eu-west-1c" }
+
+# length(availability_zones) must == length(vpc_public_cidrs_list)
+variable "availability_zones" {
+    type = "list"
+    default = [ "eu-west-1a", "eu-west-1b", "eu-west-1c" ]
+}
+variable "vpc_public_cidrs_list" {
+    type = "list"
+    default = [ "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24" ]
+}
+
 variable "coreos_channel" { default = "alpha" }
 variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
 variable "masters" { default = "3" }
@@ -25,6 +35,9 @@ resource "aws_vpc" "default" {
   cidr_block           = "${var.vpc_cidr_block}"
   enable_dns_support   = true
   enable_dns_hostnames = true
+  tags {
+      Name = "${var.organization} VPC"
+  }
   lifecycle {
     create_before_destroy = true
   }
@@ -51,27 +64,27 @@ module "aws-keypair" {
 
 # certificates
 module "ca" {
-  source            = "github.com/Capgemini/tf_tls/ca"
+  source            = "github.com/tamsky/tf_tls/ca"
   organization      = "${var.organization}"
   ca_count          = "${var.masters + var.workers + var.edge-routers}"
-  deploy_ssh_hosts  = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  deploy_ssh_hosts  = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   ssh_user          = "core"
   ssh_private_key   = "${tls_private_key.ssh.private_key_pem}"
 }
 
 module "etcd_cert" {
-  source             = "github.com/Capgemini/tf_tls/etcd"
+  source             = "github.com/tamsky/tf_tls/etcd"
   ca_cert_pem        = "${module.ca.ca_cert_pem}"
   ca_private_key_pem = "${module.ca.ca_private_key_pem}"
 }
 
 module "kube_master_certs" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/master"
+  source                = "github.com/tamsky/tf_tls/kubernetes/master"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses          = "${concat(aws_instance.master.*.private_ip, aws_instance.master.*.public_ip)}"
-  dns_names             = "${compact(module.master_elb.elb_dns_name)}"
-  deploy_ssh_hosts      = "${compact(aws_instance.master.*.public_ip)}"
+  ip_addresses          = [ "${concat(aws_instance.master.*.private_ip, aws_instance.master.*.public_ip)}" ]
+  dns_names             = [ "${module.master_elb.elb_dns_name}" ]
+  deploy_ssh_hosts      = [ "${aws_instance.master.*.public_ip}" ]
   master_count          = "${var.masters}"
   validity_period_hours = "8760"
   early_renewal_hours   = "720"
@@ -80,11 +93,11 @@ module "kube_master_certs" {
 }
 
 module "kube_kubelet_certs" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/kubelet"
+  source                = "github.com/tamsky/tf_tls/kubernetes/kubelet"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses          = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses          = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   kubelet_count         = "${var.masters + var.workers + var.edge-routers}"
   validity_period_hours = "8760"
   early_renewal_hours   = "720"
@@ -93,35 +106,35 @@ module "kube_kubelet_certs" {
 }
 
 module "kube_admin_cert" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/admin"
+  source                = "github.com/tamsky/tf_tls/kubernetes/admin"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
   kubectl_server_ip     = "${module.master_elb.elb_dns_name}"
 }
 
 module "docker_daemon_certs" {
-  source                = "github.com/Capgemini/tf_tls/docker/daemon"
+  source                = "github.com/tamsky/tf_tls/docker/daemon"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses_list     = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses_list     = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   docker_daemon_count   = "${var.masters + var.workers + var.edge-routers}"
   private_key           = "${tls_private_key.ssh.private_key_pem}"
-  validity_period_hours = 8760
-  early_renewal_hours   = 720
+  validity_period_hours = "8760"
+  early_renewal_hours   = "720"
   user                  = "core"
 }
 
 module "docker_client_certs" {
-  source                = "github.com/Capgemini/tf_tls/docker/client"
+  source                = "github.com/tamsky/tf_tls/docker/client"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses_list     = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses_list     = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   docker_client_count   = "${var.masters + var.workers + var.edge-routers}"
   private_key           = "${tls_private_key.ssh.private_key_pem}"
-  validity_period_hours = 8760
-  early_renewal_hours   = 720
+  validity_period_hours = "8760"
+  early_renewal_hours   = "720"
   user                  = "core"
 }
 
@@ -134,10 +147,10 @@ module "igw" {
 
 # public subnets
 module "public_subnet" {
-  source = "github.com/terraform-community-modules/tf_aws_public_subnet?ref=b7659c06cba6a545b83f569bc73560b266e6c9c1"
+  source = "github.com/terraform-community-modules/tf_aws_public_subnet"
   name   = "public"
-  cidrs  = "10.0.1.0/24,10.0.2.0/24,10.0.3.0/24"
-  azs    = "${var.availability_zones}"
+  cidrs  = [ "${var.vpc_public_cidrs_list}" ]
+  azs    = [ "${var.availability_zones}" ]
   vpc_id = "${aws_vpc.default.id}"
   igw_id = "${module.igw.igw_id}"
 }
@@ -154,13 +167,11 @@ module "iam" {
 }
 
 # Generate an etcd URL for the cluster
-resource "template_file" "etcd_discovery_url" {
-  template = "${file("/dev/null")}"
-  provisioner "local-exec" {
-    command = "curl https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
-  }
-  # This will regenerate the discovery URL if the cluster size changes
-  vars {
-    size = "${var.masters}"
-  }
+resource "null_resource" "etcd_discovery_url" {
+    provisioner "local-exec" {
+        command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
+    }
+
+    # To change the cluster size of an existing live cluster, please read:
+    # https://coreos.com/etcd/docs/latest/etcd-live-cluster-reconfiguration.html
 }
diff --git a/terraform/aws/public-cloud/masters.tf b/terraform/aws/public-cloud/masters.tf
index 7f6668b..e2cb6f0 100644
--- a/terraform/aws/public-cloud/masters.tf
+++ b/terraform/aws/public-cloud/masters.tf
@@ -10,16 +10,16 @@ module "master_ami" {
   virttype = "${module.master_amitype.prefer_hvm}"
 }
 
-resource "template_file" "master_cloud_init" {
+data "template_file" "master_cloud_init" {
   template   = "${file("master-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 
@@ -29,10 +29,10 @@ resource "aws_instance" "master" {
   iam_instance_profile = "${module.iam.master_profile_name}"
   count                = "${var.masters}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
-  user_data            = "${template_file.master_cloud_init.rendered}"
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
+  user_data            = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name   = "kube-master-${count.index}"
     role   = "masters"
@@ -60,8 +60,8 @@ resource "aws_instance" "master" {
 module "master_elb" {
   source             = "../elb"
   security_groups    = "${module.sg-default.security_group_id}"
-  instances          = "${compact(aws_instance.master.*.id)}"
-  subnets            = "${compact(split(",", module.public_subnet.subnet_ids))}"
+  instances          = [ "${aws_instance.master.*.id}" ]
+  subnets            = [ "${module.public_subnet.subnet_ids}" ]
 }
 
 output "master_ips" {
diff --git a/terraform/aws/public-cloud/workers.tf b/terraform/aws/public-cloud/workers.tf
index 69eaeef..1cef81f 100644
--- a/terraform/aws/public-cloud/workers.tf
+++ b/terraform/aws/public-cloud/workers.tf
@@ -10,16 +10,16 @@ module "worker_ami" {
   virttype = "${module.worker_amitype.prefer_hvm}"
 }
 
-resource "template_file" "worker_cloud_init" {
+data "template_file" "worker_cloud_init" {
   template   = "${file("worker-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 
@@ -29,11 +29,11 @@ resource "aws_instance" "worker" {
   iam_instance_profile = "${module.iam.worker_profile_name}"
   count                = "${var.workers}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
   depends_on           = ["aws_instance.master"]
-  user_data            = "${template_file.worker_cloud_init.rendered}"
+  user_data            = "${data.template_file.worker_cloud_init.rendered}"
   tags = {
     Name   = "kube-worker-${count.index}"
     role   = "workers"

From 3367ab280fde42fed16125f162dccbc257d0d935 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Fri, 2 Dec 2016 09:23:14 -0800
Subject: [PATCH 2/4] update Requirements

---
 docs/getting-started-guides/aws/public.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/docs/getting-started-guides/aws/public.md b/docs/getting-started-guides/aws/public.md
index 69b2e34..b3c56ec 100644
--- a/docs/getting-started-guides/aws/public.md
+++ b/docs/getting-started-guides/aws/public.md
@@ -9,7 +9,7 @@ The cluster is provisioned in separate stages as follows:
 
 1. You need an AWS account. Visit [http://aws.amazon.com](http://aws.amazon.com) to get started
 2. You need an AWS [instance profile and role](http://docs.aws.amazon.com/IAM/latest/UserGuide/instance-profiles.html) with EC2 full access.
-3. You need to have installed and configured Terraform (>= 0.6.16 recommended). Visit [https://www.terraform.io/intro/getting-started/install.html](https://www.terraform.io/intro/getting-started/install.html) to get started.
+3. You need to have installed and configured Terraform (>= 0.7.11 required). Visit [https://www.terraform.io/intro/getting-started/install.html](https://www.terraform.io/intro/getting-started/install.html) to get started.
 4. You need to have [Python](https://www.python.org/) >= 2.7.5 installed along with [pip](https://pip.pypa.io/en/latest/installing.html).
 5. Kubectl installed in and your PATH:
 
@@ -59,7 +59,6 @@ for i in $(ls .terraform/modules/*/Makefile); do i=$(dirname $i); make -C $i; do
 ### Provision the cluster infrastructure
 
 ```
-cd /tmp/kubeform/terraform/aws/public-cloud
 terraform apply -target=null_resource.etcd_discovery_url
 terraform apply
 ```

From 244802218c377eba36e2c14d7e2395b7d561aeed Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Fri, 2 Dec 2016 16:54:49 -0800
Subject: [PATCH 3/4] remove manual step

---
 docs/getting-started-guides/aws/public.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docs/getting-started-guides/aws/public.md b/docs/getting-started-guides/aws/public.md
index b3c56ec..6ae5b45 100644
--- a/docs/getting-started-guides/aws/public.md
+++ b/docs/getting-started-guides/aws/public.md
@@ -59,7 +59,6 @@ for i in $(ls .terraform/modules/*/Makefile); do i=$(dirname $i); make -C $i; do
 ### Provision the cluster infrastructure
 
 ```
-terraform apply -target=null_resource.etcd_discovery_url
 terraform apply
 ```
 

From 40c0dd8f930478c59f7e0e52cdf269437243f809 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Mon, 5 Dec 2016 10:04:01 -0800
Subject: [PATCH 4/4] terraform/aws/private-cloud: changes for terraform-0.7.x,
 harmonize vs changes to public-cloud

---
 terraform/aws/private-cloud/bastion-server.tf |  2 +-
 .../aws/private-cloud/etcd_discovery_url.txt  |  0
 terraform/aws/private-cloud/main.tf           | 27 ++++++++++++-------
 terraform/aws/private-cloud/masters.tf        |  4 +--
 terraform/aws/private-cloud/vpc/main.tf       | 22 +++++++--------
 terraform/aws/private-cloud/workers.tf        |  2 +-
 6 files changed, 33 insertions(+), 24 deletions(-)
 create mode 100644 terraform/aws/private-cloud/etcd_discovery_url.txt

diff --git a/terraform/aws/private-cloud/bastion-server.tf b/terraform/aws/private-cloud/bastion-server.tf
index d672fa8..5192b77 100644
--- a/terraform/aws/private-cloud/bastion-server.tf
+++ b/terraform/aws/private-cloud/bastion-server.tf
@@ -12,7 +12,7 @@ module "bastion_ami" {
 }
 
 data "template_file" "bastion_cloud_init" {
-  template   = "bastion-cloud-config.yml.tpl"
+  template   = "${file("bastion-cloud-config.yml.tpl")}"
   depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
diff --git a/terraform/aws/private-cloud/etcd_discovery_url.txt b/terraform/aws/private-cloud/etcd_discovery_url.txt
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/aws/private-cloud/main.tf b/terraform/aws/private-cloud/main.tf
index 8678909..a294d89 100644
--- a/terraform/aws/private-cloud/main.tf
+++ b/terraform/aws/private-cloud/main.tf
@@ -3,8 +3,19 @@ variable "secret_key" {}
 variable "public_key_file" { default = "~/.ssh/id_rsa_aws.pub" }
 variable "private_key_file" { default = "~/.ssh/id_rsa_aws.pem" }
 variable "region" { default = "eu-west-1" }
-variable "availability_zones" { default = "eu-west-1a,eu-west-1b,eu-west-1c" }
+variable "availability_zones" {
+    type = "list"
+    default = [ "eu-west-1a", "eu-west-1b", "eu-west-1c" ]
+}
 variable "vpc_cidr_block" { default = "10.0.0.0/16" }
+variable "vpc_private_subnets_list" {
+    type = "list"
+    default = [ "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24" ]
+}
+variable "vpc_public_subnets_list" {
+    type = "list"
+    default = [ "10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24" ]
+}
 variable "coreos_channel" { default = "stable" }
 variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
 variable "masters" { default = "3" }
@@ -27,18 +38,18 @@ module "vpc" {
   name                = "default"
 
   cidr                = "${var.vpc_cidr_block}"
-  private_subnets     = "10.0.1.0/24,10.0.2.0/24,10.0.3.0/24"
-  public_subnets      = "10.0.101.0/24,10.0.102.0/24,10.0.103.0/24"
+  private_subnets     = [ "${var.vpc_private_subnets_list}" ]
+  public_subnets      = [ "${var.vpc_public_subnets_list}" ]
   bastion_instance_id = "${aws_instance.bastion.id}"
 
-  azs                 = "${var.availability_zones}"
+  azs                 = [ "${var.availability_zones}" ]
 }
 
 # ssh keypair for instances
 module "aws-keypair" {
   source = "../keypair"
 
-  public_key_filename = "${var.public_key_file}"
+  public_key = "${file("${var.public_key_file}")}"
 }
 
 # security group to allow all traffic in and out of the instances in the VPC
@@ -62,10 +73,8 @@ resource "null_resource" "etcd_discovery_url" {
         command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
     }
 
-    # This will regenerate the discovery URL if the cluster size changes
-    triggers {
-        size = "${var.masters}"
-    }
+    # To change the cluster size of an existing live cluster, please read:
+    # https://coreos.com/etcd/docs/latest/etcd-live-cluster-reconfiguration.html
 }
 
 # outputs
diff --git a/terraform/aws/private-cloud/masters.tf b/terraform/aws/private-cloud/masters.tf
index cffda24..6d4d986 100644
--- a/terraform/aws/private-cloud/masters.tf
+++ b/terraform/aws/private-cloud/masters.tf
@@ -11,7 +11,7 @@ module "master_ami" {
 }
 
 data "template_file" "master_cloud_init" {
-  template   = "master-cloud-config.yml.tpl"
+  template   = "${file("master-cloud-config.yml.tpl")}"
   depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
@@ -20,7 +20,7 @@ data "template_file" "master_cloud_init" {
   }
 }
 
-resource "aws_instance" "mmaster" {
+resource "aws_instance" "master" {
   instance_type     = "${var.master_instance_type}"
   ami               = "${module.master_ami.ami_id}"
   count             = "${var.masters}"
diff --git a/terraform/aws/private-cloud/vpc/main.tf b/terraform/aws/private-cloud/vpc/main.tf
index 47bf1f6..57e98e3 100644
--- a/terraform/aws/private-cloud/vpc/main.tf
+++ b/terraform/aws/private-cloud/vpc/main.tf
@@ -1,9 +1,9 @@
 variable "name" { }
 variable "cidr" { }
-variable "public_subnets" { default = "" }
-variable "private_subnets" { default = "" }
+variable "public_subnets" { default = [] }
+variable "private_subnets" { default = [] }
 variable "bastion_instance_id" { }
-variable "azs" { }
+variable "azs" { type="list" }
 variable "enable_dns_hostnames" {
   description = "should be true if you want to use private DNS within the VPC"
   default = false
@@ -51,9 +51,9 @@ resource "aws_route_table" "private" {
 
 resource "aws_subnet" "private" {
   vpc_id            = "${aws_vpc.mod.id}"
-  cidr_block        = "${element(split(",", var.private_subnets), count.index)}"
-  availability_zone = "${element(split(",", var.azs), count.index)}"
-  count             = "${length(compact(split(",", var.private_subnets)))}"
+  cidr_block        = "${element(var.private_subnets, count.index)}"
+  availability_zone = "${element(var.azs, count.index)}"
+  count             = "${length(var.private_subnets)}"
   tags {
     Name = "${var.name}-private"
   }
@@ -61,9 +61,9 @@ resource "aws_subnet" "private" {
 
 resource "aws_subnet" "public" {
   vpc_id            = "${aws_vpc.mod.id}"
-  cidr_block        = "${element(split(",", var.public_subnets), count.index)}"
-  availability_zone = "${element(split(",", var.azs), count.index)}"
-  count             = "${length(compact(split(",", var.public_subnets)))}"
+  cidr_block        = "${element(var.public_subnets, count.index)}"
+  availability_zone = "${element(var.azs, count.index)}"
+  count             = "${length(var.public_subnets)}"
   tags {
     Name = "${var.name}-public"
   }
@@ -72,13 +72,13 @@ resource "aws_subnet" "public" {
 }
 
 resource "aws_route_table_association" "private" {
-  count          = "${length(compact(split(",", var.private_subnets)))}"
+  count          = "${length(var.private_subnets)}"
   subnet_id      = "${element(aws_subnet.private.*.id, count.index)}"
   route_table_id = "${aws_route_table.private.id}"
 }
 
 resource "aws_route_table_association" "public" {
-  count          = "${length(compact(split(",", var.public_subnets)))}"
+  count          = "${length(var.public_subnets)}"
   subnet_id      = "${element(aws_subnet.public.*.id, count.index)}"
   route_table_id = "${aws_route_table.public.id}"
 }
diff --git a/terraform/aws/private-cloud/workers.tf b/terraform/aws/private-cloud/workers.tf
index f3b135e..0dd73e5 100644
--- a/terraform/aws/private-cloud/workers.tf
+++ b/terraform/aws/private-cloud/workers.tf
@@ -11,7 +11,7 @@ module "worker_ami" {
 }
 
 data "template_file" "worker_cloud_init" {
-  template   = "worker-cloud-config.yml.tpl"
+  template   = "${file("worker-cloud-config.yml.tpl")}"
   depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"