Skip to content

Commit 02f941c

Browse files
AymenSegniAymenSegni
authored
Merge pull request #1 from AymenSegni/develop
Develop
2 parents fa8b22f + 8d49a57 commit 02f941c

File tree

5 files changed

+247
-1
lines changed

5 files changed

+247
-1
lines changed

‎README.md‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,64 @@
11
# deploy-linkerd-terraform-helm
2+
23
Deploy Linkerd2 using Terraform Helm Provider.
3-
Linkerd: Ultra light, ultra simple, ultra powerful. Linkerd adds security, observability, and reliability to Kubernetes, without the complexity. CNCF-hosted and 100% open source.
4+
Linkerd: Ultra light, ultra simple and ultra powerfu service mesh
5+
Linkerd adds security, observability, and reliability to Kubernetes, without the complexity. CNCF-hosted and 100% open source.
6+
7+
## Terraform Linkerd Module
8+
9+
This module handles Linkerd creation and configuration HA mode and Trusted Anhcor Certificate.
10+
The resources creation that this module will create/trigger are:
11+
- Create a Linkerd control plan with the provided addons
12+
- Setting High-Availability on demande for production cluster using a file values-ha.yaml that overrides some default values as to set things up under a high-availability scenario, analogous to the `--ha` option in linkerd install. Values such as higher number of replicas, higher memory/cpu limits and affinities are specified in that file.
13+
- Create trusted Anchor identity certificate using the ECDSA P-256 algorithm
14+
15+
## Compatibility
16+
17+
This module is meant for use with Terraform 0.12. If you haven't
18+
[upgraded][terraform-0.12-upgrade] and need a Terraform
19+
0.11.x-compatible version of this module, the last released version
20+
intended for Terraform 0.11.x is [3.0.0].
21+
22+
## Usage
23+
24+
There are multiple usage examples but simple usage is as follows:
25+
26+
```hcl
27+
28+
# kubernetes and Helm provider must be explicitly specified like the following.
29+
30+
// aks cluster
31+
32+
data "azurerm_kubernetes_cluster" "dev_aks_cluster" {
33+
name = "dev"
34+
resource_group_name = "aks_dev_resource_group"
35+
}
36+
37+
// Helm provider
38+
39+
provider "helm" {
40+
kubernetes {
41+
host = data.azurerm_kubernetes_cluster.dev_aks_cluster.kube_admin_config.0.host
42+
client_certificate = base64decode(data.azurerm_kubernetes_cluster.dev_aks_cluster.kube_admin_config.0.client_certificate)
43+
client_key = base64decode(data.azurerm_kubernetes_cluster.dev_aks_cluster.kube_admin_config.0.client_key)
44+
cluster_ca_certificate = base64decode(data.azurerm_kubernetes_cluster.dev_aks_cluster.kube_admin_config.0.cluster_ca_certificate)
45+
}
46+
alias = "aks-dev"
47+
}
48+
49+
// Deploy Linkerd on DEV cluster with disabling HA Mode
50+
51+
module "dev_linkerd" {
52+
source = "AymenSegni/deploy-linkerd-terraform-hel"
53+
enable_linkerd_ha = false
54+
providers = {
55+
helm = helm.aks-dev
56+
}
57+
}
58+
```
59+
Then perform the following commands on the root folder:
60+
61+
- `terraform init` to get the plugins
62+
- `terraform plan` to see the infrastructure plan
63+
- `terraform apply` to apply the infrastructure build
64+
- `terraform destroy` to destroy the built infrastructure

‎anchor-cert.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
// Create trusted Anchor Certificate
2+
3+
resource "tls_private_key" "trustanchor_key" {
4+
algorithm = "ECDSA"
5+
ecdsa_curve = "P256"
6+
}
7+
8+
resource "tls_self_signed_cert" "trustanchor_cert" {
9+
key_algorithm = tls_private_key.trustanchor_key.algorithm
10+
private_key_pem = tls_private_key.trustanchor_key.private_key_pem
11+
validity_period_hours = 87600
12+
is_ca_certificate = true
13+
14+
subject {
15+
common_name = "identity.linkerd.cluster.local"
16+
}
17+
18+
allowed_uses = [
19+
"crl_signing",
20+
"cert_signing",
21+
"server_auth",
22+
"client_auth"
23+
]
24+
}
25+
26+
resource "tls_private_key" "issuer_key" {
27+
algorithm = "ECDSA"
28+
ecdsa_curve = "P256"
29+
}
30+
31+
resource "tls_cert_request" "issuer_req" {
32+
key_algorithm = tls_private_key.issuer_key.algorithm
33+
private_key_pem = tls_private_key.issuer_key.private_key_pem
34+
35+
subject {
36+
common_name = "identity.linkerd.cluster.local"
37+
}
38+
}
39+
40+
resource "tls_locally_signed_cert" "issuer_cert" {
41+
cert_request_pem = tls_cert_request.issuer_req.cert_request_pem
42+
ca_key_algorithm = tls_private_key.trustanchor_key.algorithm
43+
ca_private_key_pem = tls_private_key.trustanchor_key.private_key_pem
44+
ca_cert_pem = tls_self_signed_cert.trustanchor_cert.cert_pem
45+
validity_period_hours = 8760
46+
is_ca_certificate = true
47+
48+
allowed_uses = [
49+
"crl_signing",
50+
"cert_signing",
51+
"server_auth",
52+
"client_auth"
53+
]
54+
}

‎install.tf‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
// Enable HA Mode
2+
3+
resource "helm_release" "linkerd_ha" {
4+
count = var.enable_linkerd_ha == true ? 1 : 0
5+
name = "linkerd"
6+
repository = "https://helm.linkerd.io/stable"
7+
chart = "linkerd2"
8+
values = [
9+
file("${path.module}/values-ha.yaml")
10+
]
11+
set_sensitive {
12+
name = "global.identityTrustAnchorsPEM"
13+
value = tls_self_signed_cert.trustanchor_cert.cert_pem
14+
}
15+
16+
set_sensitive {
17+
name = "identity.issuer.crtExpiry"
18+
value = tls_locally_signed_cert.issuer_cert.validity_end_time
19+
}
20+
21+
set_sensitive {
22+
name = "identity.issuer.tls.crtPEM"
23+
value = tls_locally_signed_cert.issuer_cert.cert_pem
24+
}
25+
26+
set_sensitive {
27+
name = "identity.issuer.tls.keyPEM"
28+
value = tls_private_key.issuer_key.private_key_pem
29+
}
30+
}
31+
32+
// Disable HA Mode
33+
34+
resource "helm_release" "linkerd_dev" {
35+
count = var.enable_linkerd_ha == false ? 1 : 0
36+
name = "linkerd"
37+
repository = "https://helm.linkerd.io/stable"
38+
chart = "linkerd2"
39+
set_sensitive {
40+
name = "global.identityTrustAnchorsPEM"
41+
value = tls_self_signed_cert.trustanchor_cert.cert_pem
42+
}
43+
44+
set_sensitive {
45+
name = "identity.issuer.crtExpiry"
46+
value = tls_locally_signed_cert.issuer_cert.validity_end_time
47+
}
48+
49+
set_sensitive {
50+
name = "identity.issuer.tls.crtPEM"
51+
value = tls_locally_signed_cert.issuer_cert.cert_pem
52+
}
53+
54+
set_sensitive {
55+
name = "identity.issuer.tls.keyPEM"
56+
value = tls_private_key.issuer_key.private_key_pem
57+
}
58+
}

‎values-ha.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# This values.yaml file contains the values needed to enable HA mode.
2+
# Usage:
3+
# helm install -f values.yaml -f values-ha.yaml
4+
5+
enablePodAntiAffinity: true
6+
7+
global:
8+
# proxy configuration
9+
proxy:
10+
resources:
11+
cpu:
12+
limit: "1"
13+
request: 100m
14+
memory:
15+
limit: 250Mi
16+
request: 20Mi
17+
18+
# controller configuration
19+
controllerReplicas: 3
20+
controllerResources: &controller_resources
21+
cpu: &controller_resources_cpu
22+
limit: "1"
23+
request: 100m
24+
memory:
25+
limit: 250Mi
26+
request: 50Mi
27+
destinationResources: *controller_resources
28+
publicAPIResources: *controller_resources
29+
30+
# identity configuration
31+
identityResources:
32+
cpu: *controller_resources_cpu
33+
memory:
34+
limit: 250Mi
35+
request: 10Mi
36+
37+
# grafana configuration
38+
grafana:
39+
resources:
40+
cpu: *controller_resources_cpu
41+
memory:
42+
limit: 1024Mi
43+
request: 50Mi
44+
45+
# heartbeat configuration
46+
heartbeatResources: *controller_resources
47+
48+
# prometheus configuration
49+
prometheusResources:
50+
cpu:
51+
limit: "1"
52+
request: 300m
53+
memory:
54+
limit: 4096Mi
55+
request: 300Mi
56+
57+
# proxy injector configuration
58+
proxyInjectorResources: *controller_resources
59+
webhookFailurePolicy: Fail
60+
61+
# service profile validator configuration
62+
spValidatorResources: *controller_resources
63+
64+
# tap configuration
65+
tapResources: *controller_resources
66+
67+
# web configuration
68+
webResources: *controller_resources

‎variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
variable "enable_linkerd_ha" {
2+
description = "Enable Linkerd HA Mode for production cluster if true"
3+
type = bool
4+
default = false
5+
}

0 commit comments

Comments
 (0)