cluster-builder 0.3.0__py3-none-any.whl → 0.3.1__py3-none-any.whl

cluster_builder/templates/aws/main.tf

@@ -7,48 +7,28 @@ variable "master_ip" {
 }
 variable "ami" {}
 variable "instance_type" {}
+variable "ssh_user" {}
+variable "ssh_private_key_path" {}
 variable "ssh_key_name" {}
 variable "k3s_token" {}
-variable "cloud" {
-  default = null
-}
+variable "cloud" {}
 variable "ha" {
-  default = null
+  default = false
 }
-
-# main.tf
-resource "aws_instance" "k3s_node" {
-  ami                    = var.ami
-  instance_type          = var.instance_type
-  key_name               = var.ssh_key_name
-
-  vpc_security_group_ids = [
-    aws_security_group.k3s_sg.id
-  ]
-
-  user_data = templatefile(
-    "${path.module}/${var.k3s_role}_user_data.sh.tpl",
-    {
-      ha            = var.ha,
-      k3s_token     = var.k3s_token,
-      master_ip     = var.master_ip,
-      cluster_name  = var.cluster_name
-    }
-  )
-
-  tags = {
-    Name        = "${var.cluster_name}-${var.resource_name}"
-    ClusterName = var.cluster_name
-    Role        = var.k3s_role
-  }
+variable "security_group_id" {
+  default = ""
+}
+variable "tcp_ports" {
+  default = []
+}
+variable "udp_ports" {
+  default = []
 }
 
-resource "aws_security_group" "k3s_sg" {
-  name        = "${var.k3s_role}-${var.cluster_name}-${var.resource_name}"
-  description = "Security group for K3s node in cluster ${var.cluster_name}"
-
-  dynamic "ingress" {
-    for_each = toset([
+#main.tf
+locals {
+  ingress_rules = var.security_group_id == "" ? concat(
+    [
       { from = 2379, to = 2380, proto = "tcp", desc = "etcd communication", roles = ["master", "ha"] },
       { from = 6443, to = 6443, proto = "tcp", desc = "K3s API server", roles = ["master", "ha", "worker"] },
       { from = 8472, to = 8472, proto = "udp", desc = "VXLAN for Flannel", roles = ["master", "ha", "worker"] },
@@ -61,15 +41,34 @@ resource "aws_security_group" "k3s_sg" {
       { from = 443, to = 443, proto = "tcp", desc = "HTTPS access", roles = ["master", "ha", "worker"] },
       { from = 53, to = 53, proto = "udp", desc = "DNS for CoreDNS", roles = ["master", "ha", "worker"] },
       { from = 5432, to = 5432, proto = "tcp", desc = "PostgreSQL access", roles = ["master"] }
-    ])
-    content {
-      from_port   = ingress.value.from
-      to_port     = ingress.value.to
-      protocol    = ingress.value.proto
-      cidr_blocks = ["0.0.0.0/0"]
-      description = ingress.value.desc
-    }
+    ],
+    [
+      for port in var.tcp_ports : {
+        from = port, to = port, proto = "tcp", desc = "Custom TCP rule for port ${port}", roles = ["master", "ha", "worker"]
+      }
+    ],
+    [
+      for port in var.udp_ports : {
+        from = port, to = port, proto = "udp", desc = "Custom UDP rule for port ${port}", roles = ["master", "ha", "worker"]
+      }
+    ]
+  ) : []
+}
+resource "aws_security_group" "k3s_sg" {
+  count       = var.security_group_id == "" ? 1 : 0
+  name        = "${var.k3s_role}-${var.cluster_name}-${var.resource_name}"
+  description = "Security group for K3s node in cluster ${var.cluster_name}"
+
+  dynamic "ingress" {
+  for_each = { for idx, rule in local.ingress_rules : idx => rule if contains(rule.roles, var.k3s_role) }
+  content {
+    from_port   = ingress.value.from
+    to_port     = ingress.value.to
+    protocol    = ingress.value.proto
+    cidr_blocks = ["0.0.0.0/0"]
+    description = ingress.value.desc
   }
+}
 
   egress {
     from_port   = 0
@@ -83,11 +82,75 @@ resource "aws_security_group" "k3s_sg" {
   }
 }
 
+resource "aws_instance" "k3s_node" {
+  ami                    = var.ami
+  instance_type          = var.instance_type
+  key_name               = var.ssh_key_name
+
+  # Use the provided security group ID if available or the one created by the security group resource.
+  vpc_security_group_ids = var.security_group_id != "" ? [var.security_group_id] : [aws_security_group.k3s_sg[0].id]
+
+  tags = {
+    Name        = "${var.cluster_name}-${var.resource_name}"
+    ClusterName = var.cluster_name
+    Role        = var.k3s_role
+  }
+
+  # Upload the rendered user data script to the VM
+  provisioner "file" {
+    content = templatefile("${path.module}/${var.k3s_role}_user_data.sh.tpl", {
+      ha           = var.ha,
+      k3s_token    = var.k3s_token,
+      master_ip    = var.master_ip,
+      cluster_name = var.cluster_name,
+      public_ip  = self.public_ip,
+      node_name = "${var.cluster_name}-${var.resource_name}"
+    })
+    destination = "/tmp/k3s_user_data.sh"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "rm -f ~/.ssh/known_hosts",
+      "echo 'Executing remote provisioning script on ${var.k3s_role} node'",
+      "chmod +x /tmp/k3s_user_data.sh",
+      "sudo /tmp/k3s_user_data.sh"
+    ]
+  }
+
+  connection {
+    type        = "ssh"
+    user        = var.ssh_user
+    private_key = file(var.ssh_private_key_path)
+    host        = self.public_ip
+  }
+}
+
 # outputs.tf
 output "cluster_name" {
-  value = var.k3s_role == "master" ? var.cluster_name : null
+  value = var.cluster_name
 }
 
 output "master_ip" {
-  value = var.k3s_role == "master" ? aws_instance.k3s_node.public_ip : null
+  value = var.k3s_role == "master" ? aws_instance.k3s_node.public_ip : var.master_ip
+}
+
+output "worker_ip" {
+  value = var.k3s_role == "worker" ? aws_instance.k3s_node.public_ip : null
 }
+
+output "ha_ip" {
+  value = var.k3s_role == "ha" ? aws_instance.k3s_node.public_ip : null
+}
+
+output "k3s_token" {
+  value = var.k3s_token
+}
+
+output "instance_status" {
+  value = aws_instance.k3s_node.id
+}
+
+output "node_name" {
+  value = aws_instance.k3s_node.tags["Name"]
+}

cluster_builder/templates/copy_manifest.tf

@@ -0,0 +1,36 @@
+# main.tf
+
+variable "manifest_folder" {}
+variable "ssh_private_key_path" {}
+variable "master_ip" {}
+variable "ssh_user" {}
+
+resource "null_resource" "copy_manifests" {
+  connection {
+    type        = "ssh"
+    user        = var.ssh_user
+    private_key = file(var.ssh_private_key_path)
+    host        = var.master_ip
+  }
+
+  # Ensure the manifests folder exists on the remote host
+  provisioner "remote-exec" {
+    inline = [
+      "mkdir -p /home/${var.ssh_user}/manifests",
+      "sudo chmod 755 /home/${var.ssh_user}/manifests"
+    ]
+  }
+
+  # Copy the manifests
+  provisioner "file" {
+    source      = var.manifest_folder
+    destination = "/home/${var.ssh_user}"
+  }
+
+  # Apply manifests using K3s kubeconfig
+  provisioner "remote-exec" {
+    inline = [
+    "sudo -E KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl apply -R -f /home/ubuntu/manifests/"
+  ]
+  }
+}

cluster_builder/templates/edge/main.tf

@@ -0,0 +1,98 @@
+# variables.tf
+variable "cluster_name" {}
+variable "edge_device_ip" {}
+variable "k3s_token" {}
+variable "cloud" {
+  default = "edge"
+}
+variable "k3s_role" {}
+variable "resource_name" {}
+variable "ssh_auth_method" {}
+variable "ssh_user" {}
+variable "ssh_password" {
+  sensitive = true
+  default = null
+}
+variable "ssh_private_key" {
+}
+variable "master_ip" {
+  default = null
+}
+variable "ha" {
+  default = false
+}
+
+#main.tf
+data "template_file" "user_data" {
+  template = file("${path.module}/${var.k3s_role}_user_data.sh.tpl")
+  vars = {
+    k3s_token = var.k3s_token
+    ha        = var.ha
+    public_ip = var.edge_device_ip
+    master_ip = var.master_ip
+    node_name = "${var.cluster_name}-${var.resource_name}"
+  }
+}
+
+resource "local_file" "rendered_user_data" {
+  content  = data.template_file.user_data.rendered
+  filename = "${path.module}/${var.k3s_role}_user_data.sh"
+}
+
+resource "null_resource" "deploy_k3s_edge" {
+  connection {
+    type        = "ssh"
+    user        = var.ssh_user
+    host        = var.edge_device_ip
+    password    = var.ssh_auth_method == "password" ? var.ssh_password : null
+    private_key = var.ssh_auth_method == "key" ? file(var.ssh_private_key) : null
+  }
+
+   provisioner "file" {
+    source      = "${path.module}/${var.k3s_role}_user_data.sh"
+    destination = "/tmp/edge_user_data.sh"
+   }
+
+   provisioner "remote-exec" {
+    inline = [
+      "rm -f ~/.ssh/known_hosts",
+      "echo 'Executing remote provisioning script on ${var.k3s_role} node'",
+      "chmod +x /tmp/edge_user_data.sh",
+      "sudo /tmp/edge_user_data.sh"
+    ]
+  }
+
+  triggers = {
+    Name          = "K3s-${var.k3s_role}-${var.cluster_name}-${var.resource_name}"
+    cluster_name  = var.cluster_name
+    role          = var.k3s_role
+    resource_name = var.resource_name
+    edge_ip       = var.edge_device_ip
+  }
+  depends_on = [local_file.rendered_user_data]
+}
+
+# outputs.tf
+output "cluster_name" {
+  value = var.cluster_name
+}
+
+output "master_ip" {
+  value = var.k3s_role == "master" ? var.edge_device_ip : var.master_ip
+}
+
+output "worker_ip" {
+  value = var.k3s_role == "worker" ? var.edge_device_ip : null
+}
+
+output "ha_ip" {
+  value = var.k3s_role == "ha" ? var.edge_device_ip : null
+}
+
+output "k3s_token" {
+  value = var.k3s_token
+}
+
+output "node_name" {
+  value = "${var.cluster_name}-${var.resource_name}"
+}

cluster_builder/templates/ha_user_data.sh.tpl

@@ -1,2 +1,33 @@
 #!/bin/bash
-curl -sfL https://get.k3s.io | K3S_TOKEN=${k3s_token} sh -s - server --server https://${master_ip}:6443
+set -euo pipefail
+
+LOG_FILE="/var/log/k3s_server_install.log"
+exec > >(tee -a "$LOG_FILE") 2>&1
+echo "=== K3s HA Server Install Script Started at $(date) ==="
+
+# Function to log messages with timestamp
+log_message() {
+    echo "$(date) - $1"
+}
+
+# Check if K3s server is already running
+if systemctl is-active --quiet k3s; then
+    log_message "K3s is already running. Skipping installation."
+    exit 0
+fi
+
+# Install K3s HA server and join the cluster
+log_message "Installing K3s HA Server and joining the cluster..."
+if ! curl -sfL https://get.k3s.io | K3S_TOKEN="${k3s_token}" sh -s - server \
+    --server "https://${master_ip}:6443" \
+    --node-external-ip="${public_ip}" \
+    --node-name="${node_name}" \
+    --flannel-backend=wireguard-native \
+    --flannel-external-ip; then
+    log_message "ERROR: K3s server installation failed!"
+    exit 1
+else
+    log_message "K3s server installation succeeded."
+fi
+
+log_message "=== Script completed at $(date) ==="

cluster_builder/templates/master_user_data.sh.tpl

@@ -1,6 +1,37 @@
 #!/bin/bash
-%{ if ha }
-curl -sfL https://get.k3s.io | K3S_TOKEN=${k3s_token} sh -s - server --cluster-init
-%{ else }
-curl -sfL https://get.k3s.io | K3S_TOKEN=${k3s_token} sh -s - server
-%{ endif }
+set -euo pipefail
+
+LOG_FILE="/var/log/k3s_server_install.log"
+exec > >(tee -a "$LOG_FILE") 2>&1
+echo "=== K3s Server Install Script Started at $(date) ==="
+
+# Function to log messages with timestamp
+log_message() {
+    echo "$(date) - $1"
+}
+
+# Trap errors and print a message
+trap 'log_message "ERROR: Script failed at line $LINENO with exit code $?."' ERR
+
+# Check if K3s server is already running
+if systemctl is-active --quiet k3s; then
+    log_message "K3s is already running. Skipping installation."
+else
+    log_message "K3s is not running. Proceeding with installation..."
+
+    # Use the provided public IP
+    log_message "Using provided public IP: ${public_ip}"
+
+    # Templated installation based on HA configuration
+    if [[ "${ha}" == "true" ]]; then
+        log_message "Installing in HA mode using cluster-init..."
+        curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--cluster-init --node-external-ip=${public_ip} --node-name="${node_name}" --flannel-backend=wireguard-native --flannel-external-ip" K3S_TOKEN="${k3s_token}" sh -s - server
+    else
+        log_message "Installing in single-server mode..."
+        curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-external-ip=${public_ip} --node-name="${node_name}" --flannel-backend=wireguard-native --flannel-external-ip" K3S_TOKEN="${k3s_token}" sh -s - server
+    fi
+
+    log_message "K3s installation completed successfully."
+fi
+
+log_message "=== Script completed at $(date) ==="

cluster_builder/templates/openstack/main.tf

@@ -0,0 +1,218 @@
+# variables.tf
+variable "cluster_name" {}
+variable "resource_name" {}
+variable "k3s_role" {}
+variable "master_ip" {
+  default = null
+}
+variable "volume_size" {}
+variable "openstack_image_id" {}
+variable "openstack_flavor_id" {}
+variable "ssh_user" {}
+variable "ssh_private_key_path" {}
+variable "ssh_key_name" {}
+variable "k3s_token" {}
+variable "cloud" {}
+variable "ha" {
+  default = false
+}
+
+variable "floating_ip_pool" {}
+variable "network_id" {}
+variable "use_block_device" {
+  default = false
+}
+variable "security_group_id" {
+  default = ""
+}
+variable "tcp_ports" {
+  default = []
+}
+variable "udp_ports" {
+  default = []
+}
+
+# main.tf
+# Block storage for each node role
+resource "openstack_blockstorage_volume_v3" "root_volume" {
+  count       = var.use_block_device ? 1 : 0  # Only create the volume if block device is required
+  name        = "${var.cluster_name}-${var.resource_name}-volume"
+  size        = var.volume_size
+  image_id    = var.openstack_image_id
+}
+
+# Defining the port to use while instance creation
+resource "openstack_networking_port_v2" "port_1" {
+  network_id = var.network_id
+}
+
+# Security group rules
+locals {
+  ingress_rules = var.security_group_id == "" ? concat(
+    [
+    { from = 2379, to = 2380, proto = "tcp", desc = "etcd communication", roles = ["master", "ha"] },
+    { from = 6443, to = 6443, proto = "tcp", desc = "K3s API server", roles = ["master", "ha", "worker"] },
+    { from = 8472, to = 8472, proto = "udp", desc = "VXLAN for Flannel", roles = ["master", "ha", "worker"] },
+    { from = 10250, to = 10250, proto = "tcp", desc = "Kubelet metrics", roles = ["master", "ha", "worker"] },
+    { from = 51820, to = 51820, proto = "udp", desc = "Wireguard IPv4", roles = ["master", "ha", "worker"] },
+    { from = 51821, to = 51821, proto = "udp", desc = "Wireguard IPv6", roles = ["master", "ha", "worker"] },
+    { from = 5001, to = 5001, proto = "tcp", desc = "Embedded registry", roles = ["master", "ha"] },
+    { from = 22, to = 22, proto = "tcp", desc = "SSH access", roles = ["master", "ha", "worker"] },
+    { from = 80, to = 80, proto = "tcp", desc = "HTTP access", roles = ["master", "ha", "worker"] },
+    { from = 443, to = 443, proto = "tcp", desc = "HTTPS access", roles = ["master", "ha", "worker"] },
+    { from = 53, to = 53, proto = "udp", desc = "DNS for CoreDNS", roles = ["master", "ha", "worker"] },
+    { from = 5432, to = 5432, proto = "tcp", desc = "PostgreSQL access", roles = ["master"] }
+  ],
+    [
+      for port in var.tcp_ports : {
+        from = port, to = port, proto = "tcp", desc = "Custom TCP rule for port ${port}", roles = ["master", "ha", "worker"]
+      }
+    ],
+    [
+      for port in var.udp_ports : {
+        from = port, to = port, proto = "udp", desc = "Custom UDP rule for port ${port}", roles = ["master", "ha", "worker"]
+      }
+    ]
+  ) : []
+}
+
+# Security Group Resource
+resource "openstack_networking_secgroup_v2" "k3s_sg" {
+  count       = var.security_group_id == "" ? 1 : 0  # Only create if no SG ID is provided
+  name        = "${var.cluster_name}-${var.resource_name}-sg"
+  description = "Security group for ${var.k3s_role} in cluster ${var.cluster_name}"
+}
+
+# Security Group Rule Resource
+resource "openstack_networking_secgroup_rule_v2" "k3s_sg_rules" {
+  # Only create rules if the security group is created (not passed)
+  for_each = var.security_group_id == "" ? {
+    for idx, rule in local.ingress_rules : 
+    "${rule.from}-${rule.to}-${rule.proto}-${rule.desc}" => rule
+  } : {}
+
+  security_group_id = openstack_networking_secgroup_v2.k3s_sg[0].id  # Use index 0 since only 1 security group is created when count > 0
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  port_range_min    = each.value.from
+  port_range_max    = each.value.to
+  protocol          = each.value.proto
+  remote_ip_prefix  = "0.0.0.0/0"
+  description       = each.value.desc
+}
+
+
+resource "openstack_networking_port_secgroup_associate_v2" "port_2" {
+  port_id = openstack_networking_port_v2.port_1.id
+  enforce = true
+  # Use the provided security group ID if available, otherwise use the generated security group
+  security_group_ids = var.security_group_id != "" ? [var.security_group_id] : [openstack_networking_secgroup_v2.k3s_sg[0].id]
+}
+
+# Compute instance for each role
+resource "openstack_compute_instance_v2" "k3s_node" {
+  depends_on = [openstack_networking_port_v2.port_1] 
+
+  name             = "${var.cluster_name}-${var.resource_name}"
+  flavor_name      = var.openstack_flavor_id
+  key_pair         = var.ssh_key_name
+ # Only add the image_id if block device is NOT used
+  image_id = var.use_block_device ? null : var.openstack_image_id
+
+  # Conditional block_device for boot volume
+  dynamic "block_device" {
+    for_each = var.use_block_device ? [1] : []  # Include block_device only if use_block_device is true
+    content {
+      uuid                  = openstack_blockstorage_volume_v3.root_volume[0].id
+      source_type           = "volume"
+      destination_type      = "volume"
+      boot_index            = 0
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = openstack_networking_port_v2.port_1.id
+  }
+
+  tags = [
+    "${var.cluster_name}-${var.resource_name}",
+    "ClusterName=${var.cluster_name}",
+    "Role=${var.k3s_role}"
+  ]
+}
+
+resource "openstack_networking_floatingip_v2" "floatip_1" {
+  pool = var.floating_ip_pool
+}
+
+resource "openstack_networking_floatingip_associate_v2" "fip_association" {
+  floating_ip = openstack_networking_floatingip_v2.floatip_1.address
+  port_id     = openstack_networking_port_v2.port_1.id
+
+  depends_on = [
+    openstack_compute_instance_v2.k3s_node  # Ensure the instance is created first
+  ]
+}
+
+# Provisioning via SSH
+resource "null_resource" "k3s_provision" {
+  depends_on = [openstack_networking_floatingip_v2.floatip_1]
+
+  provisioner "file" {
+    content = templatefile("${path.module}/${var.k3s_role}_user_data.sh.tpl", {
+      ha           = var.ha,
+      k3s_token    = var.k3s_token,
+      master_ip    = var.master_ip,
+      cluster_name = var.cluster_name,
+      public_ip    = openstack_networking_floatingip_v2.floatip_1.address,
+      node_name    = "${var.cluster_name}-${var.resource_name}"
+    })
+    destination = "/tmp/k3s_user_data.sh"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "rm -f ~/.ssh/known_hosts",
+      "echo 'Executing remote provisioning script on ${var.k3s_role} node'",
+      "chmod +x /tmp/k3s_user_data.sh",
+      "sudo /tmp/k3s_user_data.sh"
+    ]
+  }
+
+  connection {
+    type        = "ssh"
+    user        = var.ssh_user
+    private_key = file(var.ssh_private_key_path)
+    host        = openstack_networking_floatingip_v2.floatip_1.address
+  }
+}
+
+# outputs.tf
+output "cluster_name" {
+  value = var.cluster_name
+}
+
+output "master_ip" {
+  value = var.k3s_role == "master" ? openstack_networking_floatingip_v2.floatip_1.address : var.master_ip
+}
+
+output "worker_ip" {
+  value = var.k3s_role == "worker" ? openstack_networking_floatingip_v2.floatip_1.address : null
+}
+
+output "ha_ip" {
+  value = var.k3s_role == "ha" ? openstack_networking_floatingip_v2.floatip_1.address : null
+}
+
+output "k3s_token" {
+  value = var.k3s_token
+}
+
+output "instance_power_state" {
+  value = openstack_compute_instance_v2.k3s_node.power_state
+}
+
+output "node_name" {
+  value = openstack_compute_instance_v2.k3s_node.name
+}

cluster_builder/templates/openstack_provider.tf

@@ -0,0 +1,70 @@
+variable "openstack_auth_method" {
+  description = "Auth method: 'appcreds' or 'userpass'"
+  type        = string
+  default     = "appcreds"
+}
+
+variable "openstack_auth_url" {
+  description = "Openstack secret key"
+  type        = string
+}
+
+variable "openstack_region" {
+  description = "Openstack region for resources"
+  type        = string
+}
+
+# AppCred variables
+variable "openstack_application_credential_id" {
+  description = "Openstack application application credential id"
+  type        = string
+  sensitive   = true
+  default = ""
+}
+
+variable "openstack_application_credential_secret" {
+  description = "Openstack application credential secret"
+  type        = string
+  sensitive   = true
+  default = ""
+}
+
+# Username/password variables
+variable "openstack_user_name" {
+  description = "Username for OpenStack (if not using appcred)"
+  type        = string
+  default = ""
+}
+
+variable "openstack_password" {
+  description = "Password for OpenStack user"
+  type        = string
+  sensitive   = true
+  default = ""
+}
+
+variable "openstack_project_id" {
+  description = "Project ID to use with OpenStack"
+  type        = string
+  default = ""
+}
+
+variable "openstack_user_domain_name" {
+  description = "User domain name"
+  type        = string
+  default = ""
+}
+
+# Dynamic provider config (manually switching fields)
+provider "openstack" {
+  auth_url = var.openstack_auth_url
+  region   = var.openstack_region
+
+  application_credential_id     = var.openstack_auth_method == "appcreds" ? var.openstack_application_credential_id : null
+  application_credential_secret = var.openstack_auth_method == "appcreds" ? var.openstack_application_credential_secret : null
+
+  user_name        = var.openstack_auth_method == "userpass" ? var.openstack_user_name : null
+  password         = var.openstack_auth_method == "userpass" ? var.openstack_password : null
+  tenant_id       = var.openstack_auth_method == "userpass" ? var.openstack_project_id : null
+  user_domain_name = var.openstack_auth_method == "userpass" ? var.openstack_user_domain_name : null
+}