RKE2 sur OpenStack¶

# rke2/main.tf

terraform {
  required_providers {
    openstack = {
      source  = "terraform-provider-openstack/openstack"
      version = "~> 1.54"
    }
  }
}

variable "cluster_name" {
  default = "rke2-cluster"
}

variable "server_count" {
  default = 3
}

variable "agent_count" {
  default = 3
}

variable "server_flavor" {
  default = "m1.large"
}

variable "agent_flavor" {
  default = "m1.medium"
}

variable "image_name" {
  default = "ubuntu-22.04"
}

variable "network_id" {}
variable "subnet_id" {}
variable "external_network" {
  default = "external"
}

# Token RKE2
resource "random_password" "rke2_token" {
  length  = 64
  special = false
}

# Security group
resource "openstack_networking_secgroup_v2" "rke2" {
  name        = "${var.cluster_name}-sg"
  description = "Security group for RKE2"
}

# Règles de sécurité
locals {
  sg_rules = [
    { port = 22, desc = "SSH" },
    { port = 6443, desc = "Kubernetes API" },
    { port = 9345, desc = "RKE2 supervisor" },
    { port = 80, desc = "HTTP" },
    { port = 443, desc = "HTTPS" },
  ]
}

resource "openstack_networking_secgroup_rule_v2" "rules" {
  for_each          = { for r in local.sg_rules : r.port => r }
  security_group_id = openstack_networking_secgroup_v2.rke2.id
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = each.value.port
  port_range_max    = each.value.port
  remote_ip_prefix  = "0.0.0.0/0"
}

# Communication interne cluster
resource "openstack_networking_secgroup_rule_v2" "internal" {
  security_group_id = openstack_networking_secgroup_v2.rke2.id
  direction         = "ingress"
  ethertype         = "IPv4"
  remote_group_id   = openstack_networking_secgroup_v2.rke2.id
}

# Keypair
resource "openstack_compute_keypair_v2" "rke2" {
  name       = "${var.cluster_name}-keypair"
  public_key = file("~/.ssh/id_rsa.pub")
}

# Load Balancer pour HA
resource "openstack_lb_loadbalancer_v2" "rke2" {
  name          = "${var.cluster_name}-lb"
  vip_subnet_id = var.subnet_id
}

resource "openstack_networking_floatingip_v2" "lb" {
  pool = var.external_network
}

resource "openstack_networking_floatingip_associate_v2" "lb" {
  floating_ip = openstack_networking_floatingip_v2.lb.address
  port_id     = openstack_lb_loadbalancer_v2.rke2.vip_port_id
}

# Listener et pool pour API (6443)
resource "openstack_lb_listener_v2" "api" {
  name            = "${var.cluster_name}-api"
  protocol        = "TCP"
  protocol_port   = 6443
  loadbalancer_id = openstack_lb_loadbalancer_v2.rke2.id
}

resource "openstack_lb_pool_v2" "api" {
  name        = "${var.cluster_name}-api-pool"
  protocol    = "TCP"
  lb_method   = "ROUND_ROBIN"
  listener_id = openstack_lb_listener_v2.api.id
}

# Listener et pool pour supervisor (9345)
resource "openstack_lb_listener_v2" "supervisor" {
  name            = "${var.cluster_name}-supervisor"
  protocol        = "TCP"
  protocol_port   = 9345
  loadbalancer_id = openstack_lb_loadbalancer_v2.rke2.id
}

resource "openstack_lb_pool_v2" "supervisor" {
  name        = "${var.cluster_name}-supervisor-pool"
  protocol    = "TCP"
  lb_method   = "ROUND_ROBIN"
  listener_id = openstack_lb_listener_v2.supervisor.id
}

# RKE2 Servers
resource "openstack_compute_instance_v2" "server" {
  count           = var.server_count
  name            = "${var.cluster_name}-server-${count.index}"
  flavor_name     = var.server_flavor
  image_name      = var.image_name
  key_pair        = openstack_compute_keypair_v2.rke2.name
  security_groups = [openstack_networking_secgroup_v2.rke2.name]

  network {
    uuid = var.network_id
  }

  user_data = templatefile("${path.module}/cloud-init-server.yaml", {
    rke2_token    = random_password.rke2_token.result
    cluster_init  = count.index == 0
    lb_address    = openstack_networking_floatingip_v2.lb.address
    node_name     = "${var.cluster_name}-server-${count.index}"
    server_index  = count.index
  })
}

# Membres du pool LB
resource "openstack_lb_member_v2" "api" {
  count         = var.server_count
  pool_id       = openstack_lb_pool_v2.api.id
  address       = openstack_compute_instance_v2.server[count.index].access_ip_v4
  protocol_port = 6443
  subnet_id     = var.subnet_id
}

resource "openstack_lb_member_v2" "supervisor" {
  count         = var.server_count
  pool_id       = openstack_lb_pool_v2.supervisor.id
  address       = openstack_compute_instance_v2.server[count.index].access_ip_v4
  protocol_port = 9345
  subnet_id     = var.subnet_id
}

# RKE2 Agents
resource "openstack_compute_instance_v2" "agent" {
  count           = var.agent_count
  name            = "${var.cluster_name}-agent-${count.index}"
  flavor_name     = var.agent_flavor
  image_name      = var.image_name
  key_pair        = openstack_compute_keypair_v2.rke2.name
  security_groups = [openstack_networking_secgroup_v2.rke2.name]

  depends_on = [openstack_compute_instance_v2.server]

  network {
    uuid = var.network_id
  }

  user_data = templatefile("${path.module}/cloud-init-agent.yaml", {
    rke2_token = random_password.rke2_token.result
    lb_address = openstack_networking_floatingip_v2.lb.address
    node_name  = "${var.cluster_name}-agent-${count.index}"
  })
}

output "lb_address" {
  value = openstack_networking_floatingip_v2.lb.address
}

output "kubeconfig_command" {
  value = "ssh ubuntu@${openstack_compute_instance_v2.server[0].access_ip_v4} 'sudo cat /etc/rancher/rke2/rke2.yaml' | sed 's/127.0.0.1/${openstack_networking_floatingip_v2.lb.address}/g' > ~/.kube/rke2-config"
}