contrib/terraform/exoscale: Rework SSH public keys (#7242)

* contrib/terraform/exoscale: Rework SSH public keys

Exoscale has a few limitations with `exoscale_ssh_keypair` resources.
Creating several clusters with these scripts may lead to an error like:

```
Error: API error ParamError 431 (InvalidParameterValueException 4350): The key pair "lj-sc-ssh-key" already has this fingerprint
```

This patch reworks handling of SSH public keys. Specifically, we rely on
the more cloud-agnostic way of configuring SSH public keys via
`cloud-init`.

* contrib/terraform/exoscale: terraform fmt

* contrib/terraform/exoscale: Add terraform validate

* contrib/terraform/exoscale: Inline public SSH keys

The Terraform scripts need to install some SSH key, so that Kubespray
(i.e., the "Ansible part") can take over. Initially, we pointed the
Terraform scripts to `~/.ssh/id_rsa.pub`. This proved to be suboptimal:
Operators sharing responbility for a cluster risk unnecessarily replacing resources.

Therefore, it has been determined that it's best to inline the public
SSH keys. The chosen variable `ssh_public_keys` provides some uniformity
with `contrib/azurerm`.

* Fix Terraform Exoscale test

* Fix Terraform 0.14 test
This commit is contained in:
Cristian Klein
2021-02-03 16:32:28 +01:00
committed by GitHub
parent 88bee6c68e
commit b77460ec34
11 changed files with 161 additions and 75 deletions

View File

@@ -1,13 +1,13 @@
variable zone {
variable "zone" {
description = "The zone where to run the cluster"
}
variable prefix {
variable "prefix" {
description = "Prefix for resource names"
default = "default"
}
variable machines {
variable "machines" {
description = "Cluster machines"
type = map(object({
node_type = string
@@ -21,24 +21,24 @@ variable machines {
}))
}
variable ssh_pub_key {
description = "Path to public SSH key file which is injected into the VMs."
type = string
variable "ssh_public_keys" {
description = "List of public SSH keys which are injected into the VMs."
type = list(string)
}
variable ssh_whitelist {
variable "ssh_whitelist" {
description = "List of IP ranges (CIDR) to whitelist for ssh"
type = list(string)
type = list(string)
}
variable api_server_whitelist {
variable "api_server_whitelist" {
description = "List of IP ranges (CIDR) to whitelist for kubernetes api server"
type = list(string)
type = list(string)
}
variable nodeport_whitelist {
variable "nodeport_whitelist" {
description = "List of IP ranges (CIDR) to whitelist for kubernetes nodeports"
type = list(string)
type = list(string)
}
variable "inventory_file" {