From 248c310c76cdc210a75316fc2ebbc9664099790e Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Tue, 15 Nov 2016 19:03:32 -0800 Subject: [PATCH 01/11] update for terraform-0.7.x --- kubernetes/master/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubernetes/master/main.tf b/kubernetes/master/main.tf index cfc0f17..698c2f8 100644 --- a/kubernetes/master/main.tf +++ b/kubernetes/master/main.tf @@ -1,6 +1,6 @@ variable "ca_cert_pem" {} variable "ca_private_key_pem" {} -variable "ip_addresses" {} +variable "ip_addresses" { type = "list" } variable "dns_names" { default = "" } # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh From b62b241ca4423d0630f4c3bd59af0f08e080c16e Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Tue, 15 Nov 2016 19:04:23 -0800 Subject: [PATCH 02/11] update for terraform-0.7.x --- kubernetes/master/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubernetes/master/main.tf b/kubernetes/master/main.tf index 698c2f8..f601b2b 100644 --- a/kubernetes/master/main.tf +++ b/kubernetes/master/main.tf @@ -4,7 +4,7 @@ variable "ip_addresses" { type = "list" } variable "dns_names" { default = "" } # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh -variable "deploy_ssh_hosts" {} +variable "deploy_ssh_hosts" { type = "list" } variable "master_count" {} variable "kube_service_ip" { default = "10.3.0.1" } variable "validity_period_hours" { default = "8760" } From f0e82256048e732d9f2f71b36f2f09bb446a1a06 Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Tue, 15 Nov 2016 19:05:38 -0800 Subject: [PATCH 03/11] update for terraform-0.7.x --- docker/daemon/main.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/daemon/main.tf b/docker/daemon/main.tf index 306fd7d..780fad0 100644 --- a/docker/daemon/main.tf +++ b/docker/daemon/main.tf @@ -1,9 +1,9 @@ variable "ca_cert_pem" {} variable "ca_private_key_pem" {} -variable "ip_addresses_list" {} +variable "ip_addresses_list" { type = "list" } # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh -variable "deploy_ssh_hosts" {} +variable "deploy_ssh_hosts" { type = "list" } variable "dns_names_list" { default = "kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local" } variable "docker_daemon_count" {} variable "private_key" {} From 4709eb8dbedc0976ffbff8bc1c1ab0ea536d22ea Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Tue, 15 Nov 2016 19:06:08 -0800 Subject: [PATCH 04/11] update for terraform 0.7.x --- docker/client/main.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/client/main.tf b/docker/client/main.tf index 20daa44..bb74d24 100644 --- a/docker/client/main.tf +++ b/docker/client/main.tf @@ -1,9 +1,9 @@ variable "ca_cert_pem" {} variable "ca_private_key_pem" {} -variable "ip_addresses_list" {} +variable "ip_addresses_list" { type = "list" } # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh -variable "deploy_ssh_hosts" {} +variable "deploy_ssh_hosts" { type = "list" } variable "dns_names_list" { default = "*.*.cluster.internal,*.ec2.internal" } variable "docker_client_count" {} variable "private_key" {} From 7c3aa3722e536c11096b610400dd6da4741cf5b0 Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Tue, 15 Nov 2016 19:06:59 -0800 Subject: [PATCH 05/11] update for terraform 0.7.x --- ca/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ca/main.tf b/ca/main.tf index 877b4fb..efb8056 100644 --- a/ca/main.tf +++ b/ca/main.tf @@ -6,7 +6,7 @@ variable "is_ca_certificate" { default = true } variable "ca_count" {} # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh -variable "deploy_ssh_hosts" {} +variable "deploy_ssh_hosts" { type = "list" } variable "common_name" { default = "kube-ca" } variable "target_folder" { default = "/etc/kubernetes/ssl"} variable "user" { default = "core" } From 5bf6fee5e46f14dedb157e290a95656385ff9041 Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Tue, 15 Nov 2016 19:08:39 -0800 Subject: [PATCH 06/11] update for terraform 0.7.x --- kubernetes/kubelet/main.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kubernetes/kubelet/main.tf b/kubernetes/kubelet/main.tf index 1282275..91a328d 100644 --- a/kubernetes/kubelet/main.tf +++ b/kubernetes/kubelet/main.tf @@ -1,9 +1,9 @@ variable "ca_cert_pem" {} variable "ca_private_key_pem" {} -variable "ip_addresses" {} +variable "ip_addresses" { type = "list" } # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh -variable "deploy_ssh_hosts" {} +variable "deploy_ssh_hosts" { type = "list" } variable "kubelet_count" { default = "1" } variable "validity_period_hours" { default = "8760" } variable "early_renewal_hours" { default = "720" } From 2bcb4802c3a50393934f2eddadecd29b334a775d Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Tue, 15 Nov 2016 22:44:36 -0800 Subject: [PATCH 07/11] update triggers->ip_addresses for terraform 0.7 testing --- kubernetes/master/deploy.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubernetes/master/deploy.tf b/kubernetes/master/deploy.tf index 490e7c9..6ebb383 100644 --- a/kubernetes/master/deploy.tf +++ b/kubernetes/master/deploy.tf @@ -8,7 +8,7 @@ resource "null_resource" "configure-master-certs" { validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" dns_names = "${var.dns_names}" - ip_addresses = "${var.ip_addresses}" + ip_addresses = [ "${var.ip_addresses}" ] } connection { From f3ddd5c98cc72f76a05b68801c50f5bb30932dd9 Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Tue, 15 Nov 2016 23:24:01 -0800 Subject: [PATCH 08/11] try removing list values from triggers --- docker/client/deploy.tf | 4 ++-- docker/daemon/deploy.tf | 4 ++-- kubernetes/kubelet/deploy.tf | 2 +- kubernetes/master/deploy.tf | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docker/client/deploy.tf b/docker/client/deploy.tf index c665c9f..14bf452 100644 --- a/docker/client/deploy.tf +++ b/docker/client/deploy.tf @@ -8,8 +8,8 @@ resource "null_resource" "configure-docker-client-certs" { docker_client_certs_pem = "${element(tls_locally_signed_cert.docker_client.*.cert_pem, count.index)}" validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" - ip_addresses_list = "${var.ip_addresses_list}" - dns_names_list = "${var.dns_names_list}" +# ip_addresses_list = "${var.ip_addresses_list}" +# dns_names_list = "${var.dns_names_list}" } connection { diff --git a/docker/daemon/deploy.tf b/docker/daemon/deploy.tf index ea11996..f5d17cd 100644 --- a/docker/daemon/deploy.tf +++ b/docker/daemon/deploy.tf @@ -8,8 +8,8 @@ resource "null_resource" "configure-docker-dameon-certs" { docker_daemon_certs_pem = "${element(tls_locally_signed_cert.docker_daemon.*.cert_pem, count.index)}" validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" - ip_addresses_list = "${var.ip_addresses_list}" - dns_names_list = "${var.dns_names_list}" +# ip_addresses_list = "${var.ip_addresses_list}" +# dns_names_list = "${var.dns_names_list}" } connection { diff --git a/kubernetes/kubelet/deploy.tf b/kubernetes/kubelet/deploy.tf index 5927fac..976cb03 100644 --- a/kubernetes/kubelet/deploy.tf +++ b/kubernetes/kubelet/deploy.tf @@ -8,7 +8,7 @@ resource "null_resource" "configure-kubelet-certs" { kubelet_certs_pem = "${element(tls_locally_signed_cert.kubelet.*.cert_pem, count.index)}" validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" - ip_addresses = "${var.ip_addresses}" +# ip_addresses = "${var.ip_addresses}" } connection { diff --git a/kubernetes/master/deploy.tf b/kubernetes/master/deploy.tf index 6ebb383..e6e5ba1 100644 --- a/kubernetes/master/deploy.tf +++ b/kubernetes/master/deploy.tf @@ -7,8 +7,8 @@ resource "null_resource" "configure-master-certs" { master_certs_pem = "${element(tls_locally_signed_cert.master.*.cert_pem, count.index)}" validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" - dns_names = "${var.dns_names}" - ip_addresses = [ "${var.ip_addresses}" ] +# dns_names = "${var.dns_names}" +# ip_addresses = [ "${var.ip_addresses}" ] } connection { From 66ffb87e840f7dc84435d8e5c144c07244ec5470 Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Wed, 16 Nov 2016 15:12:39 -0800 Subject: [PATCH 09/11] copy changes from https://github.com/Capgemini/tf_tls/pull/38 --- ca/deploy.tf | 1 + docker/client/deploy.tf | 1 + docker/client/main.tf | 7 +++++-- docker/daemon/deploy.tf | 5 +++-- docker/daemon/main.tf | 11 +++++++++-- kubernetes/kubelet/deploy.tf | 3 ++- kubernetes/master/deploy.tf | 4 ++-- kubernetes/master/main.tf | 29 ++++++++++++++++++++++++----- 8 files changed, 47 insertions(+), 14 deletions(-) diff --git a/ca/deploy.tf b/ca/deploy.tf index 0225729..fc75744 100644 --- a/ca/deploy.tf +++ b/ca/deploy.tf @@ -8,6 +8,7 @@ resource "null_resource" "deploy-ca-certs" { early_renewal_hours = "${var.early_renewal_hours}" common_name = "${var.common_name}" organization = "${var.organization}" + deploy_ssh_hosts = "${join(",",var.deploy_ssh_hosts)}" } connection { diff --git a/docker/client/deploy.tf b/docker/client/deploy.tf index 14bf452..36c0697 100644 --- a/docker/client/deploy.tf +++ b/docker/client/deploy.tf @@ -10,6 +10,7 @@ resource "null_resource" "configure-docker-client-certs" { early_renewal_hours = "${var.early_renewal_hours}" # ip_addresses_list = "${var.ip_addresses_list}" # dns_names_list = "${var.dns_names_list}" +# deploy_ssh_hosts = "${join(",",var.deploy_ssh_hosts)}" } connection { diff --git a/docker/client/main.tf b/docker/client/main.tf index bb74d24..8f96670 100644 --- a/docker/client/main.tf +++ b/docker/client/main.tf @@ -4,7 +4,10 @@ variable "ip_addresses_list" { type = "list" } # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh variable "deploy_ssh_hosts" { type = "list" } -variable "dns_names_list" { default = "*.*.cluster.internal,*.ec2.internal" } +variable "dns_names_list" { + type = "list" + default = [ "*.*.cluster.internal", "*.ec2.internal" ] +} variable "docker_client_count" {} variable "private_key" {} variable "validity_period_hours" {} @@ -25,7 +28,7 @@ resource "tls_cert_request" "docker_client" { common_name = "docker_client_${count.index}" } - dns_names = ["${split(",", var.dns_names_list)}"] + dns_names = ["${var.dns_names_list}"] ip_addresses = ["${element(var.ip_addresses_list, count.index)}"] } diff --git a/docker/daemon/deploy.tf b/docker/daemon/deploy.tf index f5d17cd..6e1b9fc 100644 --- a/docker/daemon/deploy.tf +++ b/docker/daemon/deploy.tf @@ -8,8 +8,9 @@ resource "null_resource" "configure-docker-dameon-certs" { docker_daemon_certs_pem = "${element(tls_locally_signed_cert.docker_daemon.*.cert_pem, count.index)}" validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" -# ip_addresses_list = "${var.ip_addresses_list}" -# dns_names_list = "${var.dns_names_list}" + ip_addresses_list = "${join(",",var.ip_addresses_list)}" + dns_names_list = "${join(",",var.dns_names_list)}" + deploy_ssh_hosts = "${join(",",var.deploy_ssh_hosts)}" } connection { diff --git a/docker/daemon/main.tf b/docker/daemon/main.tf index 780fad0..d22eb63 100644 --- a/docker/daemon/main.tf +++ b/docker/daemon/main.tf @@ -4,7 +4,14 @@ variable "ip_addresses_list" { type = "list" } # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh variable "deploy_ssh_hosts" { type = "list" } -variable "dns_names_list" { default = "kubernetes,kubernetes.default,kubernetes.default.svc,kubernetes.default.svc.cluster.local" } +variable "dns_names_list" { + type = "list" + default = [ + "kubernetes,kubernetes.default", + "kubernetes.default.svc", + "kubernetes.default.svc.cluster.local" + ] +} variable "docker_daemon_count" {} variable "private_key" {} variable "validity_period_hours" { default = 8760 } @@ -25,7 +32,7 @@ resource "tls_cert_request" "docker_daemon" { common_name = "docker_daemon" } - dns_names = ["${split(",", var.dns_names_list)}"] + dns_names = ["${var.dns_names_list}"] ip_addresses = [ "127.0.0.1", "${element(var.ip_addresses_list, count.index)}" diff --git a/kubernetes/kubelet/deploy.tf b/kubernetes/kubelet/deploy.tf index 976cb03..bc56eda 100644 --- a/kubernetes/kubelet/deploy.tf +++ b/kubernetes/kubelet/deploy.tf @@ -8,7 +8,8 @@ resource "null_resource" "configure-kubelet-certs" { kubelet_certs_pem = "${element(tls_locally_signed_cert.kubelet.*.cert_pem, count.index)}" validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" -# ip_addresses = "${var.ip_addresses}" + ip_addresses = "${join(",",var.ip_addresses)}" + deploy_ssh_hosts = "${join(",",var.deploy_ssh_hosts)}" } connection { diff --git a/kubernetes/master/deploy.tf b/kubernetes/master/deploy.tf index e6e5ba1..6cd2497 100644 --- a/kubernetes/master/deploy.tf +++ b/kubernetes/master/deploy.tf @@ -7,8 +7,8 @@ resource "null_resource" "configure-master-certs" { master_certs_pem = "${element(tls_locally_signed_cert.master.*.cert_pem, count.index)}" validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" -# dns_names = "${var.dns_names}" -# ip_addresses = [ "${var.ip_addresses}" ] + dns_names = "${join(",",var.dns_names)}" + ip_addresses = "${join(",",var.ip_addresses)}" } connection { diff --git a/kubernetes/master/main.tf b/kubernetes/master/main.tf index f601b2b..780ff65 100644 --- a/kubernetes/master/main.tf +++ b/kubernetes/master/main.tf @@ -1,12 +1,31 @@ variable "ca_cert_pem" {} variable "ca_private_key_pem" {} -variable "ip_addresses" { type = "list" } -variable "dns_names" { default = "" } # supports if you have a public/private ip and you want to set the private ip # for internal cert but use the public_ip to connect via ssh -variable "deploy_ssh_hosts" { type = "list" } +variable "deploy_ssh_hosts" { + type = "list" +} +variable "ip_addresses" { + type = "list" +} +variable "kube_service_ip" { + type = "list" + default = "10.3.0.1" +} +variable "dns_names" { + type = "list" +} +variable "default_dns_names" { + type = "list" + default = [ + "kubernetes", + "kubernetes.default", + "kubernetes.default.svc", + "kubernetes.default.svc.cluster.local" + ] +} + variable "master_count" {} -variable "kube_service_ip" { default = "10.3.0.1" } variable "validity_period_hours" { default = "8760" } variable "early_renewal_hours" { default = "720" } variable "ssh_user" { default = "core" } @@ -26,7 +45,7 @@ resource "tls_cert_request" "master" { common_name = "kube-master" } - dns_names = ["${compact(var.dns_names)}", "kubernetes", "kubernetes.default", "kubernetes.default.svc", "kubernetes.default.svc.cluster.local"] + dns_names = ["${concat(var.dns_names, var.default_dns_names)}"] ip_addresses = ["${concat(var.kube_service_ip, var.ip_addresses)}"] } From afe0f82d41f03ce8c5315fb886f7d87e902ec6ea Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Wed, 16 Nov 2016 15:15:39 -0800 Subject: [PATCH 10/11] uncomment, fix one more --- docker/client/deploy.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/client/deploy.tf b/docker/client/deploy.tf index 36c0697..c08f3b5 100644 --- a/docker/client/deploy.tf +++ b/docker/client/deploy.tf @@ -8,9 +8,9 @@ resource "null_resource" "configure-docker-client-certs" { docker_client_certs_pem = "${element(tls_locally_signed_cert.docker_client.*.cert_pem, count.index)}" validity_period_hours = "${var.validity_period_hours}" early_renewal_hours = "${var.early_renewal_hours}" -# ip_addresses_list = "${var.ip_addresses_list}" -# dns_names_list = "${var.dns_names_list}" -# deploy_ssh_hosts = "${join(",",var.deploy_ssh_hosts)}" + ip_addresses_list = "${join(",",var.ip_addresses_list)}" + dns_names_list = "${join(",",var.dns_names_list)}" + deploy_ssh_hosts = "${join(",",var.deploy_ssh_hosts)}" } connection { From 5b745baa56d089ec66361e9ae975ef5a8aab4553 Mon Sep 17 00:00:00 2001 From: Marc Tamsky Date: Wed, 16 Nov 2016 15:28:21 -0800 Subject: [PATCH 11/11] default value should be a list --- kubernetes/master/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubernetes/master/main.tf b/kubernetes/master/main.tf index 780ff65..366bd48 100644 --- a/kubernetes/master/main.tf +++ b/kubernetes/master/main.tf @@ -10,7 +10,7 @@ variable "ip_addresses" { } variable "kube_service_ip" { type = "list" - default = "10.3.0.1" + default = [ "10.3.0.1" ] } variable "dns_names" { type = "list"