hetzner-k3s 0.5.0 → 0.5.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.rubocop.yml +121 -0
- data/Dockerfile +4 -1
- data/Gemfile +5 -3
- data/Gemfile.lock +24 -3
- data/README.md +6 -3
- data/Rakefile +5 -3
- data/bin/build.sh +3 -3
- data/bin/{console → console.sh} +3 -3
- data/bin/{setup → setup.sh} +0 -0
- data/hetzner-k3s.gemspec +25 -21
- data/lib/hetzner/infra/client.rb +17 -15
- data/lib/hetzner/infra/firewall.rb +92 -90
- data/lib/hetzner/infra/load_balancer.rb +62 -59
- data/lib/hetzner/infra/network.rb +31 -30
- data/lib/hetzner/infra/placement_group.rb +25 -21
- data/lib/hetzner/infra/server.rb +34 -33
- data/lib/hetzner/infra/ssh_key.rb +34 -35
- data/lib/hetzner/infra.rb +5 -1
- data/lib/hetzner/k3s/cli.rb +279 -268
- data/lib/hetzner/k3s/cluster.rb +447 -406
- data/lib/hetzner/k3s/version.rb +3 -1
- data/lib/hetzner/utils.rb +42 -38
- data/lib/hetzner.rb +2 -0
- metadata +26 -10
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: c236d440e3e99f656c62b8ced99ac899199e435ca41e9675c4adeb326a87c5d8
|
4
|
+
data.tar.gz: fd8da58d3c4cc3b54018c1ff261f8606391e8f524b974660fc5984fcd10397f7
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 8ebe7779e0f79ec500c1e0d230212cd568ef62e94a3dd2d936214f03f48baf8fc937a683b7bf4478b66a3dc0a7b02ee001a6fe3e542ad401f0add4ee27a68b03
|
7
|
+
data.tar.gz: dae117d8d1e3babf392814baf372009d1558113673a4968b7526a0a4e3a06b8eea034edaa11452047286721efc2a37af3e8214f2dbeafde73d864493feae5626
|
data/.rubocop.yml
ADDED
@@ -0,0 +1,121 @@
|
|
1
|
+
Gemspec/DateAssignment: # new in 1.10
|
2
|
+
Enabled: true
|
3
|
+
Gemspec/RequireMFA: # new in 1.23
|
4
|
+
Enabled: true
|
5
|
+
Layout/LineEndStringConcatenationIndentation: # new in 1.18
|
6
|
+
Enabled: true
|
7
|
+
Layout/SpaceBeforeBrackets: # new in 1.7
|
8
|
+
Enabled: true
|
9
|
+
Lint/AmbiguousAssignment: # new in 1.7
|
10
|
+
Enabled: true
|
11
|
+
Lint/AmbiguousOperatorPrecedence: # new in 1.21
|
12
|
+
Enabled: true
|
13
|
+
Lint/AmbiguousRange: # new in 1.19
|
14
|
+
Enabled: true
|
15
|
+
Lint/DeprecatedConstants: # new in 1.8
|
16
|
+
Enabled: true
|
17
|
+
Lint/DuplicateBranch: # new in 1.3
|
18
|
+
Enabled: true
|
19
|
+
Lint/DuplicateRegexpCharacterClassElement: # new in 1.1
|
20
|
+
Enabled: true
|
21
|
+
Lint/EmptyBlock: # new in 1.1
|
22
|
+
Enabled: true
|
23
|
+
Lint/EmptyClass: # new in 1.3
|
24
|
+
Enabled: true
|
25
|
+
Lint/EmptyInPattern: # new in 1.16
|
26
|
+
Enabled: true
|
27
|
+
Lint/IncompatibleIoSelectWithFiberScheduler: # new in 1.21
|
28
|
+
Enabled: true
|
29
|
+
Lint/LambdaWithoutLiteralBlock: # new in 1.8
|
30
|
+
Enabled: true
|
31
|
+
Lint/NoReturnInBeginEndBlocks: # new in 1.2
|
32
|
+
Enabled: true
|
33
|
+
Lint/NumberedParameterAssignment: # new in 1.9
|
34
|
+
Enabled: true
|
35
|
+
Lint/OrAssignmentToConstant: # new in 1.9
|
36
|
+
Enabled: true
|
37
|
+
Lint/RedundantDirGlobSort: # new in 1.8
|
38
|
+
Enabled: true
|
39
|
+
Lint/RequireRelativeSelfPath: # new in 1.22
|
40
|
+
Enabled: true
|
41
|
+
Lint/SymbolConversion: # new in 1.9
|
42
|
+
Enabled: true
|
43
|
+
Lint/ToEnumArguments: # new in 1.1
|
44
|
+
Enabled: true
|
45
|
+
Lint/TripleQuotes: # new in 1.9
|
46
|
+
Enabled: true
|
47
|
+
Lint/UnexpectedBlockArity: # new in 1.5
|
48
|
+
Enabled: true
|
49
|
+
Lint/UnmodifiedReduceAccumulator: # new in 1.1
|
50
|
+
Enabled: true
|
51
|
+
Lint/UselessRuby2Keywords: # new in 1.23
|
52
|
+
Enabled: true
|
53
|
+
Naming/BlockForwarding: # new in 1.24
|
54
|
+
Enabled: true
|
55
|
+
Security/IoMethods: # new in 1.22
|
56
|
+
Enabled: true
|
57
|
+
Style/ArgumentsForwarding: # new in 1.1
|
58
|
+
Enabled: true
|
59
|
+
Style/CollectionCompact: # new in 1.2
|
60
|
+
Enabled: true
|
61
|
+
Style/DocumentDynamicEvalDefinition: # new in 1.1
|
62
|
+
Enabled: true
|
63
|
+
Style/EndlessMethod: # new in 1.8
|
64
|
+
Enabled: true
|
65
|
+
Style/FileRead: # new in 1.24
|
66
|
+
Enabled: true
|
67
|
+
Style/FileWrite: # new in 1.24
|
68
|
+
Enabled: true
|
69
|
+
Style/HashConversion: # new in 1.10
|
70
|
+
Enabled: true
|
71
|
+
Style/HashExcept: # new in 1.7
|
72
|
+
Enabled: true
|
73
|
+
Style/IfWithBooleanLiteralBranches: # new in 1.9
|
74
|
+
Enabled: true
|
75
|
+
Style/InPatternThen: # new in 1.16
|
76
|
+
Enabled: true
|
77
|
+
Style/MapToHash: # new in 1.24
|
78
|
+
Enabled: true
|
79
|
+
Style/MultilineInPatternThen: # new in 1.16
|
80
|
+
Enabled: true
|
81
|
+
Style/NegatedIfElseCondition: # new in 1.2
|
82
|
+
Enabled: true
|
83
|
+
Style/NilLambda: # new in 1.3
|
84
|
+
Enabled: true
|
85
|
+
Style/NumberedParameters: # new in 1.22
|
86
|
+
Enabled: true
|
87
|
+
Style/NumberedParametersLimit: # new in 1.22
|
88
|
+
Enabled: true
|
89
|
+
Style/OpenStructUse: # new in 1.23
|
90
|
+
Enabled: true
|
91
|
+
Style/QuotedSymbols: # new in 1.16
|
92
|
+
Enabled: true
|
93
|
+
Style/RedundantArgument: # new in 1.4
|
94
|
+
Enabled: true
|
95
|
+
Style/RedundantSelfAssignmentBranch: # new in 1.19
|
96
|
+
Enabled: true
|
97
|
+
Style/SelectByRegexp: # new in 1.22
|
98
|
+
Enabled: true
|
99
|
+
Style/StringChars: # new in 1.12
|
100
|
+
Enabled: true
|
101
|
+
Style/SwapValues: # new in 1.1
|
102
|
+
Enabled: true
|
103
|
+
Style/Documentation:
|
104
|
+
Enabled: false
|
105
|
+
Metrics/MethodLength:
|
106
|
+
Enabled: false
|
107
|
+
Metrics/AbcSize:
|
108
|
+
Enabled: false
|
109
|
+
Metrics/CyclomaticComplexity:
|
110
|
+
Enabled: false
|
111
|
+
Metrics/ClassLength:
|
112
|
+
Enabled: false
|
113
|
+
Layout/LineLength:
|
114
|
+
Enabled: false
|
115
|
+
Metrics/PerceivedComplexity:
|
116
|
+
Enabled: false
|
117
|
+
Metrics/ParameterLists:
|
118
|
+
Max: 10
|
119
|
+
Style/FrozenStringLiteralComment:
|
120
|
+
Exclude:
|
121
|
+
- exe/hetzner-k3s
|
data/Dockerfile
CHANGED
@@ -1,7 +1,10 @@
|
|
1
1
|
FROM ruby:3.1.0-alpine
|
2
2
|
|
3
3
|
RUN apk update --no-cache \
|
4
|
-
&& apk add build-base git openssh-client
|
4
|
+
&& apk add build-base git openssh-client curl bash
|
5
|
+
|
6
|
+
RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
|
7
|
+
&& install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
|
5
8
|
|
6
9
|
COPY . .
|
7
10
|
|
data/Gemfile
CHANGED
data/Gemfile.lock
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
PATH
|
2
2
|
remote: .
|
3
3
|
specs:
|
4
|
-
hetzner-k3s (0.
|
4
|
+
hetzner-k3s (0.5.0)
|
5
5
|
bcrypt_pbkdf
|
6
6
|
ed25519
|
7
7
|
http
|
@@ -15,12 +15,13 @@ GEM
|
|
15
15
|
specs:
|
16
16
|
addressable (2.8.0)
|
17
17
|
public_suffix (>= 2.0.2, < 5.0)
|
18
|
+
ast (2.4.2)
|
18
19
|
bcrypt_pbkdf (1.1.0)
|
19
20
|
diff-lcs (1.4.4)
|
20
21
|
domain_name (0.5.20190701)
|
21
22
|
unf (>= 0.0.5, < 1.0.0)
|
22
|
-
ed25519 (1.
|
23
|
-
ffi (1.15.
|
23
|
+
ed25519 (1.3.0)
|
24
|
+
ffi (1.15.5)
|
24
25
|
ffi-compiler (1.0.1)
|
25
26
|
ffi (>= 1.0.0)
|
26
27
|
rake
|
@@ -35,8 +36,14 @@ GEM
|
|
35
36
|
http-parser (1.2.3)
|
36
37
|
ffi-compiler (>= 1.0, < 2.0)
|
37
38
|
net-ssh (6.1.0)
|
39
|
+
parallel (1.21.0)
|
40
|
+
parser (3.1.0.0)
|
41
|
+
ast (~> 2.4.1)
|
38
42
|
public_suffix (4.0.6)
|
43
|
+
rainbow (3.1.1)
|
39
44
|
rake (12.3.3)
|
45
|
+
regexp_parser (2.2.0)
|
46
|
+
rexml (3.2.5)
|
40
47
|
rspec (3.10.0)
|
41
48
|
rspec-core (~> 3.10.0)
|
42
49
|
rspec-expectations (~> 3.10.0)
|
@@ -50,12 +57,25 @@ GEM
|
|
50
57
|
diff-lcs (>= 1.2.0, < 2.0)
|
51
58
|
rspec-support (~> 3.10.0)
|
52
59
|
rspec-support (3.10.2)
|
60
|
+
rubocop (1.25.1)
|
61
|
+
parallel (~> 1.10)
|
62
|
+
parser (>= 3.1.0.0)
|
63
|
+
rainbow (>= 2.2.2, < 4.0)
|
64
|
+
regexp_parser (>= 1.8, < 3.0)
|
65
|
+
rexml
|
66
|
+
rubocop-ast (>= 1.15.1, < 2.0)
|
67
|
+
ruby-progressbar (~> 1.7)
|
68
|
+
unicode-display_width (>= 1.4.0, < 3.0)
|
69
|
+
rubocop-ast (1.15.1)
|
70
|
+
parser (>= 3.0.1.1)
|
71
|
+
ruby-progressbar (1.11.0)
|
53
72
|
sshkey (2.0.0)
|
54
73
|
subprocess (1.5.5)
|
55
74
|
thor (1.2.1)
|
56
75
|
unf (0.1.4)
|
57
76
|
unf_ext
|
58
77
|
unf_ext (0.0.8)
|
78
|
+
unicode-display_width (2.1.0)
|
59
79
|
|
60
80
|
PLATFORMS
|
61
81
|
ruby
|
@@ -64,6 +84,7 @@ DEPENDENCIES
|
|
64
84
|
hetzner-k3s!
|
65
85
|
rake (~> 12.0)
|
66
86
|
rspec (~> 3.0)
|
87
|
+
rubocop
|
67
88
|
|
68
89
|
BUNDLED WITH
|
69
90
|
2.3.4
|
data/README.md
CHANGED
@@ -25,7 +25,7 @@ All that is needed to use this tool is
|
|
25
25
|
|
26
26
|
## Installation
|
27
27
|
|
28
|
-
Once you have the Ruby runtime up and running (2.7.2 or newer
|
28
|
+
Once you have the Ruby runtime up and running (2.7.2 or newer), you just need to install the gem:
|
29
29
|
|
30
30
|
```bash
|
31
31
|
gem install hetzner-k3s
|
@@ -38,7 +38,7 @@ This will install the `hetzner-k3s` executable in your PATH.
|
|
38
38
|
Alternatively, if you don't want to set up a Ruby runtime but have Docker installed, you can use a container. Run the following from inside the directory where you have the config file for the cluster (described in the next section):
|
39
39
|
|
40
40
|
```bash
|
41
|
-
docker run --rm -it -v ${PWD}:/cluster -v ${HOME}/.ssh:/tmp/.ssh vitobotta/hetzner-k3s:v0.5.
|
41
|
+
docker run --rm -it -v ${PWD}:/cluster -v ${HOME}/.ssh:/tmp/.ssh vitobotta/hetzner-k3s:v0.5.1 create-cluster --config-file /cluster/test.yaml
|
42
42
|
```
|
43
43
|
|
44
44
|
Replace `test.yaml` with the name of your config file.
|
@@ -77,7 +77,7 @@ enable_ipsec_encryption: true
|
|
77
77
|
|
78
78
|
It should hopefully be self explanatory; you can run `hetzner-k3s releases` to see a list of the available releases from the most recent to the oldest available.
|
79
79
|
|
80
|
-
If you are using Docker, then set `kubeconfig_path` to `/cluster/kubeconfig` so that the kubeconfig is created in the same directory where your config file is.
|
80
|
+
If you are using Docker, then set `kubeconfig_path` to `/cluster/kubeconfig` so that the kubeconfig is created in the same directory where your config file is. Also set the config file path to `/cluster/<filename>`.
|
81
81
|
|
82
82
|
If you don't want to specify the Hetzner token in the config file (for example if you want to use the tool with CI), then you can use the `HCLOUD_TOKEN` environment variable instead, which has predecence.
|
83
83
|
|
@@ -257,6 +257,9 @@ I recommend that you create a separate Hetzner project for each cluster, because
|
|
257
257
|
|
258
258
|
## changelog
|
259
259
|
|
260
|
+
- 0.5.1
|
261
|
+
- Each node pool gets its own placement group. This is to minimize issues due to the max 10 nodes limitation for a single node group. A validation has also been added to limit pools to 10 nodes each because of this.
|
262
|
+
|
260
263
|
- 0.5.0
|
261
264
|
- Allow installing additional packages when creating the servers
|
262
265
|
- Allow enabling ipsec encryption
|
data/Rakefile
CHANGED
data/bin/build.sh
CHANGED
@@ -6,9 +6,9 @@ set -e
|
|
6
6
|
|
7
7
|
IMAGE="vitobotta/hetzner-k3s"
|
8
8
|
|
9
|
-
docker build -t ${IMAGE}:v0.5.
|
9
|
+
docker build -t ${IMAGE}:v0.5.1 \
|
10
10
|
--platform=linux/amd64 \
|
11
|
-
--cache-from ${IMAGE}:v0.
|
11
|
+
--cache-from ${IMAGE}:v0.5.0 \
|
12
12
|
--build-arg BUILDKIT_INLINE_CACHE=1 .
|
13
13
|
|
14
|
-
docker push vitobotta/hetzner-k3s:v0.5.
|
14
|
+
docker push vitobotta/hetzner-k3s:v0.5.1
|
data/bin/{console → console.sh}
RENAMED
@@ -1,7 +1,7 @@
|
|
1
1
|
#!/usr/bin/env ruby
|
2
2
|
|
3
|
-
require
|
4
|
-
require
|
3
|
+
require 'bundler/setup'
|
4
|
+
require 'k3s'
|
5
5
|
|
6
6
|
# You can add fixtures and/or initialization code here to make experimenting
|
7
7
|
# with your gem easier. You can also use a different console, if you like.
|
@@ -10,5 +10,5 @@ require "k3s"
|
|
10
10
|
# require "pry"
|
11
11
|
# Pry.start
|
12
12
|
|
13
|
-
require
|
13
|
+
require 'irb'
|
14
14
|
IRB.start(__FILE__)
|
data/bin/{setup → setup.sh}
RENAMED
File without changes
|
data/hetzner-k3s.gemspec
CHANGED
@@ -1,37 +1,41 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
require_relative 'lib/hetzner/k3s/version'
|
2
4
|
|
3
5
|
Gem::Specification.new do |spec|
|
4
|
-
spec.name =
|
6
|
+
spec.name = 'hetzner-k3s'
|
5
7
|
spec.version = Hetzner::K3s::VERSION
|
6
|
-
spec.authors = [
|
7
|
-
spec.email = [
|
8
|
+
spec.authors = ['Vito Botta']
|
9
|
+
spec.email = ['vito@botta.me']
|
8
10
|
|
9
|
-
spec.summary =
|
10
|
-
spec.description =
|
11
|
-
spec.homepage =
|
12
|
-
spec.license =
|
13
|
-
spec.required_ruby_version = Gem::Requirement.new(
|
11
|
+
spec.summary = 'A CLI to create a Kubernetes cluster in Hetzner Cloud very quickly using k3s.'
|
12
|
+
spec.description = 'A CLI to create a Kubernetes cluster in Hetzner Cloud very quickly using k3s.'
|
13
|
+
spec.homepage = 'https://github.com/vitobotta/hetzner-k3s'
|
14
|
+
spec.license = 'MIT'
|
15
|
+
spec.required_ruby_version = Gem::Requirement.new('>= 3.1.0')
|
14
16
|
|
15
17
|
# spec.metadata["allowed_push_host"] = "TODO: Set to 'http://mygemserver.com'"
|
16
18
|
|
17
|
-
spec.metadata[
|
18
|
-
spec.metadata[
|
19
|
-
spec.metadata[
|
19
|
+
spec.metadata['homepage_uri'] = spec.homepage
|
20
|
+
spec.metadata['source_code_uri'] = 'https://github.com/vitobotta/hetzner-k3s'
|
21
|
+
spec.metadata['changelog_uri'] = 'https://github.com/vitobotta/hetzner-k3s'
|
20
22
|
|
21
|
-
spec.add_dependency
|
22
|
-
spec.add_dependency
|
23
|
-
spec.add_dependency
|
24
|
-
spec.add_dependency
|
25
|
-
spec.add_dependency
|
26
|
-
spec.add_dependency
|
27
|
-
spec.add_dependency
|
23
|
+
spec.add_dependency 'bcrypt_pbkdf'
|
24
|
+
spec.add_dependency 'ed25519'
|
25
|
+
spec.add_dependency 'http'
|
26
|
+
spec.add_dependency 'net-ssh'
|
27
|
+
spec.add_dependency 'sshkey'
|
28
|
+
spec.add_dependency 'subprocess'
|
29
|
+
spec.add_dependency 'thor'
|
30
|
+
spec.add_development_dependency 'rubocop'
|
28
31
|
|
29
32
|
# Specify which files should be added to the gem when it is released.
|
30
33
|
# The `git ls-files -z` loads the files in the RubyGem that have been added into git.
|
31
|
-
spec.files
|
34
|
+
spec.files = Dir.chdir(File.expand_path(__dir__)) do
|
32
35
|
`git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
33
36
|
end
|
34
|
-
spec.bindir =
|
37
|
+
spec.bindir = 'exe'
|
35
38
|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
|
36
|
-
spec.require_paths = [
|
39
|
+
spec.require_paths = ['lib']
|
40
|
+
spec.metadata['rubygems_mfa_required'] = 'true'
|
37
41
|
end
|
data/lib/hetzner/infra/client.rb
CHANGED
@@ -1,6 +1,8 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module Hetzner
|
2
4
|
class Client
|
3
|
-
BASE_URI =
|
5
|
+
BASE_URI = 'https://api.hetzner.cloud/v1'
|
4
6
|
|
5
7
|
attr_reader :token
|
6
8
|
|
@@ -22,27 +24,27 @@ module Hetzner
|
|
22
24
|
|
23
25
|
def delete(path, id)
|
24
26
|
make_request do
|
25
|
-
HTTP.headers(headers).delete(BASE_URI
|
27
|
+
HTTP.headers(headers).delete("#{BASE_URI}#{path}/#{id}")
|
26
28
|
end
|
27
29
|
end
|
28
30
|
|
29
31
|
private
|
30
32
|
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
|
33
|
+
def headers
|
34
|
+
{
|
35
|
+
Authorization: "Bearer #{@token}",
|
36
|
+
'Content-Type': 'application/json'
|
37
|
+
}
|
38
|
+
end
|
37
39
|
|
38
|
-
|
39
|
-
|
40
|
+
def make_request(&block)
|
41
|
+
retries ||= 0
|
40
42
|
|
41
|
-
|
42
|
-
|
43
|
-
end
|
44
|
-
rescue Timeout::Error
|
45
|
-
retry if (retries += 1) < 3
|
43
|
+
Timeout.timeout(30) do
|
44
|
+
block.call
|
46
45
|
end
|
46
|
+
rescue Timeout::Error
|
47
|
+
retry if (retries += 1) < 3
|
48
|
+
end
|
47
49
|
end
|
48
50
|
end
|
@@ -1,3 +1,5 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module Hetzner
|
2
4
|
class Firewall
|
3
5
|
def initialize(hetzner_client:, cluster_name:)
|
@@ -5,38 +7,39 @@ module Hetzner
|
|
5
7
|
@cluster_name = cluster_name
|
6
8
|
end
|
7
9
|
|
8
|
-
def create(
|
9
|
-
@
|
10
|
+
def create(high_availability:, networks:)
|
11
|
+
@high_availability = high_availability
|
10
12
|
@networks = networks
|
11
13
|
puts
|
12
14
|
|
13
|
-
if firewall = find_firewall
|
14
|
-
puts
|
15
|
+
if (firewall = find_firewall)
|
16
|
+
puts 'Firewall already exists, skipping.'
|
15
17
|
puts
|
16
|
-
return firewall[
|
18
|
+
return firewall['id']
|
17
19
|
end
|
18
20
|
|
19
|
-
puts
|
21
|
+
puts 'Creating firewall...'
|
20
22
|
|
21
|
-
response = hetzner_client.post(
|
22
|
-
puts
|
23
|
+
response = hetzner_client.post('/firewalls', create_firewall_config).body
|
24
|
+
puts '...firewall created.'
|
23
25
|
puts
|
24
26
|
|
25
|
-
JSON.parse(response)[
|
27
|
+
JSON.parse(response)['firewall']['id']
|
26
28
|
end
|
27
29
|
|
28
30
|
def delete(servers)
|
29
|
-
if firewall = find_firewall
|
30
|
-
puts
|
31
|
+
if (firewall = find_firewall)
|
32
|
+
puts 'Deleting firewall...'
|
31
33
|
|
32
34
|
servers.each do |server|
|
33
|
-
hetzner_client.post("/firewalls/#{firewall[
|
35
|
+
hetzner_client.post("/firewalls/#{firewall['id']}/actions/remove_from_resources",
|
36
|
+
remove_targets_config(server['id']))
|
34
37
|
end
|
35
38
|
|
36
|
-
hetzner_client.delete(
|
37
|
-
puts
|
39
|
+
hetzner_client.delete('/firewalls', firewall['id'])
|
40
|
+
puts '...firewall deleted.'
|
38
41
|
else
|
39
|
-
puts
|
42
|
+
puts 'Firewall no longer exists, skipping.'
|
40
43
|
end
|
41
44
|
|
42
45
|
puts
|
@@ -44,87 +47,86 @@ module Hetzner
|
|
44
47
|
|
45
48
|
private
|
46
49
|
|
47
|
-
|
48
|
-
|
49
|
-
def create_firewall_config
|
50
|
-
rules = [
|
51
|
-
{
|
52
|
-
"description": "Allow port 22 (SSH)",
|
53
|
-
"direction": "in",
|
54
|
-
"protocol": "tcp",
|
55
|
-
"port": "22",
|
56
|
-
"source_ips": networks,
|
57
|
-
"destination_ips": []
|
58
|
-
},
|
59
|
-
{
|
60
|
-
"description": "Allow ICMP (ping)",
|
61
|
-
"direction": "in",
|
62
|
-
"protocol": "icmp",
|
63
|
-
"port": nil,
|
64
|
-
"source_ips": [
|
65
|
-
"0.0.0.0/0",
|
66
|
-
"::/0"
|
67
|
-
],
|
68
|
-
"destination_ips": []
|
69
|
-
},
|
70
|
-
{
|
71
|
-
"description": "Allow all TCP traffic between nodes on the private network",
|
72
|
-
"direction": "in",
|
73
|
-
"protocol": "tcp",
|
74
|
-
"port": "any",
|
75
|
-
"source_ips": [
|
76
|
-
"10.0.0.0/16"
|
77
|
-
],
|
78
|
-
"destination_ips": []
|
79
|
-
},
|
80
|
-
{
|
81
|
-
"description": "Allow all UDP traffic between nodes on the private network",
|
82
|
-
"direction": "in",
|
83
|
-
"protocol": "udp",
|
84
|
-
"port": "any",
|
85
|
-
"source_ips": [
|
86
|
-
"10.0.0.0/16"
|
87
|
-
],
|
88
|
-
"destination_ips": []
|
89
|
-
}
|
90
|
-
]
|
91
|
-
|
92
|
-
unless ha
|
93
|
-
rules << {
|
94
|
-
"description": "Allow port 6443 (Kubernetes API server)",
|
95
|
-
"direction": "in",
|
96
|
-
"protocol": "tcp",
|
97
|
-
"port": "6443",
|
98
|
-
"source_ips": [
|
99
|
-
"0.0.0.0/0",
|
100
|
-
"::/0"
|
101
|
-
],
|
102
|
-
"destination_ips": []
|
103
|
-
}
|
104
|
-
end
|
50
|
+
attr_reader :hetzner_client, :cluster_name, :firewall, :high_availability, :networks
|
105
51
|
|
52
|
+
def create_firewall_config
|
53
|
+
rules = [
|
106
54
|
{
|
107
|
-
|
108
|
-
|
109
|
-
|
110
|
-
|
111
|
-
|
112
|
-
|
55
|
+
description: 'Allow port 22 (SSH)',
|
56
|
+
direction: 'in',
|
57
|
+
protocol: 'tcp',
|
58
|
+
port: '22',
|
59
|
+
source_ips: networks,
|
60
|
+
destination_ips: []
|
61
|
+
},
|
62
|
+
{
|
63
|
+
description: 'Allow ICMP (ping)',
|
64
|
+
direction: 'in',
|
65
|
+
protocol: 'icmp',
|
66
|
+
port: nil,
|
67
|
+
source_ips: [
|
68
|
+
'0.0.0.0/0',
|
69
|
+
'::/0'
|
70
|
+
],
|
71
|
+
destination_ips: []
|
72
|
+
},
|
73
|
+
{
|
74
|
+
description: 'Allow all TCP traffic between nodes on the private network',
|
75
|
+
direction: 'in',
|
76
|
+
protocol: 'tcp',
|
77
|
+
port: 'any',
|
78
|
+
source_ips: [
|
79
|
+
'10.0.0.0/16'
|
80
|
+
],
|
81
|
+
destination_ips: []
|
82
|
+
},
|
113
83
|
{
|
114
|
-
|
115
|
-
|
116
|
-
|
117
|
-
|
118
|
-
|
119
|
-
|
120
|
-
|
121
|
-
]
|
84
|
+
description: 'Allow all UDP traffic between nodes on the private network',
|
85
|
+
direction: 'in',
|
86
|
+
protocol: 'udp',
|
87
|
+
port: 'any',
|
88
|
+
source_ips: [
|
89
|
+
'10.0.0.0/16'
|
90
|
+
],
|
91
|
+
destination_ips: []
|
92
|
+
}
|
93
|
+
]
|
94
|
+
|
95
|
+
unless high_availability
|
96
|
+
rules << {
|
97
|
+
description: 'Allow port 6443 (Kubernetes API server)',
|
98
|
+
direction: 'in',
|
99
|
+
protocol: 'tcp',
|
100
|
+
port: '6443',
|
101
|
+
source_ips: [
|
102
|
+
'0.0.0.0/0',
|
103
|
+
'::/0'
|
104
|
+
],
|
105
|
+
destination_ips: []
|
122
106
|
}
|
123
107
|
end
|
124
108
|
|
125
|
-
|
126
|
-
|
127
|
-
|
109
|
+
{
|
110
|
+
name: cluster_name,
|
111
|
+
rules:
|
112
|
+
}
|
113
|
+
end
|
128
114
|
|
115
|
+
def remove_targets_config(server_id)
|
116
|
+
{
|
117
|
+
remove_from: [
|
118
|
+
{
|
119
|
+
server: {
|
120
|
+
id: server_id
|
121
|
+
},
|
122
|
+
type: 'server'
|
123
|
+
}
|
124
|
+
]
|
125
|
+
}
|
126
|
+
end
|
127
|
+
|
128
|
+
def find_firewall
|
129
|
+
hetzner_client.get('/firewalls')['firewalls'].detect { |firewall| firewall['name'] == cluster_name }
|
130
|
+
end
|
129
131
|
end
|
130
132
|
end
|