Story Crater Bot
c6493f14ae
Consolidate three separate Forgejo Actions (argocd-sync, security-scan, validate-k8s) into single cluster-ci workflow for cleaner CI/CD pipeline with proper job sequencing and reduced auth overhead. Add Terraform configuration for Talos cluster machine configs: - Provider setup for Talos - Centralized variables for CP and worker configs - Template-based config generation for controlplane.yaml and worker-*.yaml - Sensitive data separated in terraform.tfvars (gitignored) - Local state tracking for infrastructure
127 lines
5.7 KiB
Terraform
127 lines
5.7 KiB
Terraform
# Generate Talos machine configurations
|
|
|
|
locals {
|
|
pod_cidr = var.cluster_config.pod_subnets[0]
|
|
service_cidr = var.cluster_config.service_subnets[0]
|
|
controlplane_ip = var.cluster_config.controlplane_ip
|
|
cluster_dns_ip = "10.96.0.10"
|
|
kubelet_image = "ghcr.io/siderolabs/kubelet:${var.kubernetes_version}"
|
|
kube_apiserver_img = "registry.k8s.io/kube-apiserver:${var.kubernetes_version}"
|
|
controller_mgr_img = "registry.k8s.io/kube-controller-manager:${var.kubernetes_version}"
|
|
kube_proxy_img = "registry.k8s.io/kube-proxy:${var.kubernetes_version}"
|
|
scheduler_img = "registry.k8s.io/kube-scheduler:${var.kubernetes_version}"
|
|
|
|
factory_image = "factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:${var.talos_version}"
|
|
}
|
|
|
|
# Control plane machine configuration
|
|
resource "local_file" "controlplane_config" {
|
|
filename = "${path.module}/../cluster-config/controlplane.yaml"
|
|
|
|
content = templatefile("${path.module}/templates/controlplane.tftpl", {
|
|
version = "v1alpha1"
|
|
hostname = var.controlplane_config.hostname
|
|
token = var.machine_token
|
|
ca_crt = var.machine_ca_crt
|
|
ca_key = var.machine_ca_key
|
|
lan_ip = var.controlplane_config.lan_ip
|
|
lan_subnet = var.controlplane_config.lan_subnet
|
|
lan_gateway = var.controlplane_config.lan_gateway
|
|
wg0_ip = var.controlplane_config.wg0_ip
|
|
wg0_subnet = var.controlplane_config.wg0_subnet
|
|
wg0_port = var.controlplane_config.wg0_port
|
|
wg0_private_key = var.controlplane_config.wg0_private_key
|
|
wg0_peers = var.controlplane_config.wg0_peers
|
|
wg1_ip = var.controlplane_config.wg1_ip
|
|
wg1_subnet = var.controlplane_config.wg1_subnet
|
|
wg1_port = var.controlplane_config.wg1_port
|
|
wg1_private_key = var.controlplane_config.wg1_private_key
|
|
wg1_peers = var.controlplane_config.wg1_peers
|
|
kubelet_image = local.kubelet_image
|
|
cluster_dns_ip = local.cluster_dns_ip
|
|
install_disk = var.controlplane_config.install_disk
|
|
factory_image = local.factory_image
|
|
longhorn_disks = var.controlplane_config.longhorn_disks
|
|
dns_servers = var.cluster_config.dns_servers
|
|
forgejo_registry_ip = var.forgejo_registry_ip
|
|
forgejo_hostname = var.forgejo_hostname
|
|
|
|
# Cluster config
|
|
cluster_id = var.cluster_id
|
|
cluster_secret = var.cluster_secret
|
|
controlplane_ip = local.controlplane_ip
|
|
cluster_name = var.cluster_name
|
|
pod_subnets = var.cluster_config.pod_subnets
|
|
service_subnets = var.cluster_config.service_subnets
|
|
dns_domain = var.cluster_config.dns_domain
|
|
bootstrap_token = var.bootstrap_token
|
|
|
|
# Kubernetes certs
|
|
kubernetes_ca_crt = var.kubernetes_ca_crt
|
|
kubernetes_ca_key = var.kubernetes_ca_key
|
|
etcd_ca_crt = var.etcd_ca_crt
|
|
etcd_ca_key = var.etcd_ca_key
|
|
aggregator_ca_crt = var.aggregator_ca_crt
|
|
aggregator_ca_key = var.aggregator_ca_key
|
|
service_account_key = var.service_account_key
|
|
secretbox_encryption_secret = var.secretbox_encryption_secret
|
|
|
|
# Component images
|
|
kube_apiserver_img = local.kube_apiserver_img
|
|
controller_mgr_img = local.controller_mgr_img
|
|
kube_proxy_img = local.kube_proxy_img
|
|
scheduler_img = local.scheduler_img
|
|
})
|
|
}
|
|
|
|
# Worker machine configurations
|
|
resource "local_file" "worker_configs" {
|
|
for_each = var.worker_configs
|
|
|
|
filename = "${path.module}/../cluster-config/${each.key}.yaml"
|
|
|
|
content = templatefile("${path.module}/templates/worker.tftpl", {
|
|
version = "v1alpha1"
|
|
hostname = each.value.hostname
|
|
token = var.machine_token
|
|
ca_crt = var.machine_ca_crt
|
|
lan_ip = each.value.lan_ip
|
|
lan_subnet = each.value.lan_subnet
|
|
lan_gateway = each.value.lan_gateway
|
|
kubelet_image = local.kubelet_image
|
|
cluster_dns_ip = local.cluster_dns_ip
|
|
install_disk = each.value.install_disk
|
|
factory_image = local.factory_image
|
|
node_labels = each.value.node_labels
|
|
|
|
# Cluster config
|
|
cluster_id = var.cluster_id
|
|
cluster_secret = var.cluster_secret
|
|
controlplane_ip = local.controlplane_ip
|
|
cluster_name = var.cluster_name
|
|
pod_subnets = var.cluster_config.pod_subnets
|
|
service_subnets = var.cluster_config.service_subnets
|
|
dns_domain = var.cluster_config.dns_domain
|
|
bootstrap_token = var.bootstrap_token
|
|
|
|
# Kubernetes certs
|
|
kubernetes_ca_crt = var.kubernetes_ca_crt
|
|
|
|
# Component images
|
|
kube_proxy_img = local.kube_proxy_img
|
|
})
|
|
}
|
|
|
|
# Output paths for reference
|
|
output "controlplane_config_path" {
|
|
value = local_file.controlplane_config.filename
|
|
description = "Path to generated controlplane config"
|
|
}
|
|
|
|
output "worker_config_paths" {
|
|
value = {
|
|
for k, v in local_file.worker_configs : k => v.filename
|
|
}
|
|
description = "Paths to generated worker configs"
|
|
}
|