Skip to content

Commit 2bffa89

Browse files
BobyMCbobsBobyMCbobs
committed
feat: add terraform for oci oke
terraform to provision an OKE cluster on OCI
1 parent 50a1137 commit 2bffa89

6 files changed

Lines changed: 282 additions & 0 deletions

File tree

‎terraform/oci-oke-cluster/data.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
data "oci_identity_compartment" "this" {
2+
id = var.compartment_ocid
3+
}
4+
5+
data "oci_identity_availability_domains" "availability_domains" {
6+
#Required
7+
compartment_id = var.tenancy_ocid
8+
}

‎terraform/oci-oke-cluster/locals.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
locals {
2+
common_labels = {
3+
"TalosCluster" = var.cluster_name
4+
}
5+
}

‎terraform/oci-oke-cluster/main.tf‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
resource "oci_containerengine_cluster" "cluster" {
2+
#Required
3+
compartment_id = var.compartment_ocid
4+
kubernetes_version = var.cluster_kubernetes_version
5+
name = var.cluster_name
6+
vcn_id = oci_core_vcn.vcn.id
7+
8+
endpoint_config {
9+
10+
#Optional
11+
is_public_ip_enabled = true
12+
nsg_ids = [oci_core_network_security_group.network_security_group.id]
13+
subnet_id = oci_core_subnet.subnet.id
14+
}
15+
options {
16+
17+
#Optional
18+
add_ons {
19+
20+
#Optional
21+
is_kubernetes_dashboard_enabled = false
22+
is_tiller_enabled = false
23+
}
24+
admission_controller_options {
25+
26+
#Optional
27+
is_pod_security_policy_enabled = false
28+
}
29+
kubernetes_network_config {
30+
31+
#Optional
32+
pods_cidr = var.pod_subnet_block
33+
services_cidr = var.service_subnet_block
34+
}
35+
persistent_volume_config {
36+
37+
#Optional
38+
freeform_tags = local.common_labels
39+
}
40+
service_lb_config {
41+
42+
#Optional
43+
freeform_tags = local.common_labels
44+
}
45+
service_lb_subnet_ids = [oci_core_subnet.subnet.id]
46+
}
47+
type = "ENHANCED_CLUSTER"
48+
}
49+
50+
resource "oci_containerengine_node_pool" "node_pool" {
51+
#Required
52+
cluster_id = oci_containerengine_cluster.cluster.id
53+
compartment_id = var.compartment_ocid
54+
name = "${var.cluster_name}-primary"
55+
node_shape = var.node_shape
56+
57+
#Optional
58+
freeform_tags = local.common_labels
59+
kubernetes_version = var.cluster_kubernetes_version
60+
node_config_details {
61+
#Required
62+
placement_configs {
63+
#Required
64+
availability_domain = data.oci_identity_availability_domains.availability_domains.availability_domains[0].name
65+
subnet_id = oci_core_subnet.subnet.id
66+
67+
}
68+
size = var.node_pool_count
69+
70+
freeform_tags = local.common_labels
71+
nsg_ids = [oci_core_network_security_group.network_security_group.id]
72+
}
73+
# node_image_name = oci_core_image.test_image.name
74+
# node_metadata = var.node_pool_node_metadata
75+
node_shape_config {
76+
77+
#Optional
78+
memory_in_gbs = var.node_memory_in_gbs
79+
ocpus = var.node_ocpus
80+
}
81+
# node_source_details {
82+
# #Required
83+
# image_id = oci_core_image.test_image.id
84+
# source_type = var.node_pool_node_source_details_source_type
85+
86+
# #Optional
87+
# boot_volume_size_in_gbs = var.node_pool_node_source_details_boot_volume_size_in_gbs
88+
# }
89+
}

‎terraform/oci-oke-cluster/network.tf‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
resource "oci_core_vcn" "vcn" {
2+
#Required
3+
compartment_id = var.compartment_ocid
4+
5+
#Optional
6+
cidr_blocks = var.cidr_blocks
7+
display_name = "${var.cluster_name}-vcn"
8+
freeform_tags = local.common_labels
9+
is_ipv6enabled = true
10+
}
11+
resource "oci_core_subnet" "subnet" {
12+
#Required
13+
cidr_block = var.subnet_block
14+
compartment_id = var.compartment_ocid
15+
vcn_id = oci_core_vcn.vcn.id
16+
prohibit_internet_ingress = false
17+
prohibit_public_ip_on_vnic = false
18+
availability_domain = var.instance_availability_domain == null ? data.oci_identity_availability_domains.availability_domains.availability_domains[0].name : var.instance_availability_domain
19+
20+
#Optional
21+
display_name = "${var.cluster_name}-subnet"
22+
freeform_tags = local.common_labels
23+
security_list_ids = [oci_core_security_list.security_list.id]
24+
route_table_id = oci_core_route_table.route_table.id
25+
}
26+
resource "oci_core_route_table" "route_table" {
27+
#Required
28+
compartment_id = var.compartment_ocid
29+
vcn_id = oci_core_vcn.vcn.id
30+
31+
#Optional
32+
display_name = "${var.cluster_name}-route-table"
33+
freeform_tags = local.common_labels
34+
route_rules {
35+
#Required
36+
network_entity_id = oci_core_internet_gateway.internet_gateway.id
37+
38+
#Optional
39+
destination_type = "CIDR_BLOCK"
40+
destination = "0.0.0.0/0"
41+
}
42+
}
43+
44+
resource "oci_core_internet_gateway" "internet_gateway" {
45+
#Required
46+
compartment_id = var.compartment_ocid
47+
vcn_id = oci_core_vcn.vcn.id
48+
49+
#Optional
50+
enabled = true
51+
display_name = "${var.cluster_name}-internet-gateway"
52+
freeform_tags = local.common_labels
53+
}
54+
55+
resource "oci_core_network_security_group" "network_security_group" {
56+
#Required
57+
compartment_id = var.compartment_ocid
58+
vcn_id = oci_core_vcn.vcn.id
59+
60+
#Optional
61+
display_name = "${var.cluster_name}-security-group"
62+
freeform_tags = local.common_labels
63+
}
64+
resource "oci_core_network_security_group_security_rule" "allow_all" {
65+
network_security_group_id = oci_core_network_security_group.network_security_group.id
66+
destination_type = "CIDR_BLOCK"
67+
destination = "0.0.0.0/0"
68+
protocol = "all"
69+
direction = "EGRESS"
70+
stateless = false
71+
}
72+
73+
resource "oci_core_security_list" "security_list" {
74+
#Required
75+
compartment_id = var.compartment_ocid
76+
vcn_id = oci_core_vcn.vcn.id
77+
78+
#Optional
79+
display_name = "${var.cluster_name}-security-list"
80+
egress_security_rules {
81+
#Required
82+
destination = "0.0.0.0/0"
83+
protocol = "all"
84+
85+
stateless = true
86+
}
87+
freeform_tags = local.common_labels
88+
ingress_security_rules {
89+
#Required
90+
source = "0.0.0.0/0"
91+
protocol = "all"
92+
93+
stateless = true
94+
}
95+
}

‎terraform/oci-oke-cluster/variables.tf‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
variable "compartment_ocid" {
2+
sensitive = true
3+
}
4+
variable "tenancy_ocid" {
5+
sensitive = true
6+
}
7+
variable "user_ocid" {
8+
sensitive = true
9+
}
10+
variable "fingerprint" {
11+
sensitive = true
12+
}
13+
variable "private_key_path" {
14+
default = "~/.oci/oci_main_terraform.pem"
15+
sensitive = true
16+
}
17+
variable "instance_availability_domain" {
18+
default = null
19+
}
20+
variable "region" {
21+
description = "the OCI region where resources will be created"
22+
type = string
23+
default = null
24+
}
25+
variable "cluster_name" {
26+
type = string
27+
default = "cncfoke"
28+
}
29+
variable "cluster_kubernetes_version" {
30+
type = string
31+
default = "v1.30.1"
32+
}
33+
variable "cidr_blocks" {
34+
type = set(string)
35+
default = ["10.0.0.0/16"]
36+
}
37+
variable "subnet_block" {
38+
type = string
39+
default = "10.0.0.0/24"
40+
}
41+
variable "pod_subnet_block" {
42+
type = string
43+
default = "10.32.0.0/12"
44+
}
45+
variable "service_subnet_block" {
46+
type = string
47+
default = "10.200.0.0/21"
48+
}
49+
variable "node_subnet_block" {
50+
type = string
51+
default = "192.168.0.0/16"
52+
}
53+
variable "node_shape" {
54+
type = string
55+
default = "VM.Standard.A1.Flex"
56+
}
57+
variable "node_memory_in_gbs" {
58+
type = number
59+
default = 128
60+
}
61+
variable "node_ocpus" {
62+
type = number
63+
default = 8
64+
}
65+
variable "node_pool_count" {
66+
type = number
67+
default = 3
68+
}

‎terraform/oci-oke-cluster/versions.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
terraform {
2+
required_providers {
3+
oci = {
4+
source = "oracle/oci"
5+
version = "6.7.0" # TODO include version in project root providers
6+
}
7+
}
8+
required_version = ">= 1.2"
9+
}
10+
11+
provider "oci" {
12+
tenancy_ocid = var.tenancy_ocid
13+
user_ocid = var.user_ocid
14+
private_key_path = var.private_key_path
15+
fingerprint = var.fingerprint
16+
region = var.region
17+
}

0 commit comments

Comments
 (0)