mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-08-03 12:36:09 -04:00
terraform-provider: implement constellation_cluster
resource (#2691)
* terraform: move module to legacy-directory * constellation-lib: refactor service account marshalling * terraform-provider: normalize Azure image URIs * constellation-lib: refactor Kubeconfig endpoint rewriting * terraform-provider: add conversion functions for AWS and GCP * terraform-provider: implement `constellation_cluster` resource * terraform-provider: refactor conversion * terraform-provider: implement image and k8s upgrades * terraform-provider: fix linter checks * terraform-provider: refactor to bundle init & upgrade method * constellation-lib: rewrite Kubeconfig endpoint in init * terraform-provider: bind logger and dialer constructors to struct * terraform-provider: move applier to function pointer * terraform-provider: gcp conversion fixes Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * terraform-provider: fix Azure UAMI input * terraform-provider: rename Kubeconfig variable * terraform-provider: tidy * terraform-provider: regenerate docs * constellation-lib: provide Kubeconfig in testing initserver --------- Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
This commit is contained in:
parent
767bac4766
commit
60fc73e0e7
40 changed files with 1469 additions and 323 deletions
|
@ -10,7 +10,32 @@ description: |-
|
|||
|
||||
Resource for a Constellation cluster.
|
||||
|
||||
## Example Usage
|
||||
|
||||
```terraform
|
||||
// Not up-to-date
|
||||
|
||||
data "constellation_attestation" "foo" {} # Fill accordingly for the CSP and attestation variant
|
||||
|
||||
data "constellation_image" "bar" {} # Fill accordingly for the CSP
|
||||
|
||||
resource "constellation_cluster" "aws_example" {
|
||||
csp = "aws"
|
||||
name = "constell"
|
||||
uid = "deadbeef"
|
||||
constellation_microservice_version = "vx.y.z"
|
||||
image = data.constellation_image.bar.image
|
||||
attestation = data.constellation_attestation.foo.attestation
|
||||
init_secret = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
|
||||
master_secret = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
|
||||
master_secret_salt = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
|
||||
out_of_cluster_endpoint = "123.123.123.123"
|
||||
network_config = {
|
||||
ip_cidr_node = "192.168.176.0/20"
|
||||
ip_cidr_service = "10.96.0.0/12"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
<!-- schema generated by tfplugindocs -->
|
||||
## Schema
|
||||
|
@ -18,19 +43,27 @@ Resource for a Constellation cluster.
|
|||
### Required
|
||||
|
||||
- `attestation` (Attributes) Attestation comprises the measurements and SEV-SNP specific parameters. (see [below for nested schema](#nestedatt--attestation))
|
||||
- `init_secret` (String) The init secret to use for the cluster.
|
||||
- `master_secret` (String) The master secret to use for the cluster.
|
||||
- `csp` (String) The Cloud Service Provider (CSP) the cluster should run on.
|
||||
- `image_reference` (String) Constellation OS image reference to use in the CSP specific reference format. Use the [`constellation_image`](../data-sources/image.md) data source to find the correct image reference for your CSP.
|
||||
- `image_version` (String) Constellation OS image version to use in the CSP specific reference format. Use the [`constellation_image`](../data-sources/image.md) data source to find the correct image version for your CSP.
|
||||
- `init_secret` (String) Secret used for initialization of the cluster.
|
||||
- `master_secret` (String) Hex-encoded 32-byte master secret for the cluster.
|
||||
- `master_secret_salt` (String) Hex-encoded 32-byte master secret salt for the cluster.
|
||||
- `measurement_salt` (String) Hex-encoded 32-byte measurement salt for the cluster.
|
||||
- `name` (String) Name used in the cluster's named resources / cluster name.
|
||||
- `network_config` (Attributes) Configuration for the cluster's network. (see [below for nested schema](#nestedatt--network_config))
|
||||
- `out_of_cluster_endpoint` (String) The endpoint of the cluster. Typically, this is the public IP of a loadbalancer.
|
||||
- `uid` (String) The UID of the cluster.
|
||||
|
||||
### Optional
|
||||
|
||||
- `constellation_microservices_version` (String) The Constellation microservices version to use for the cluster.
|
||||
- `azure` (Attributes) Azure-specific configuration. (see [below for nested schema](#nestedatt--azure))
|
||||
- `constellation_microservice_version` (String) The version of Constellation's microservices used within the cluster. When not set, the provider default version is used.
|
||||
- `extra_api_server_cert_sans` (List of String) List of additional Subject Alternative Names (SANs) for the API server certificate.
|
||||
- `extra_microservices` (Attributes) Extra microservice settings. (see [below for nested schema](#nestedatt--extra_microservices))
|
||||
- `image` (String) The Constellation OS image to use in the CSP specific reference format. Use the `constellation_image` data source to find the correct image for your CSP.
|
||||
- `init_endpoint` (String) The endpoint to use for cluster initialization. This is the endpoint of the node running the bootstrapper.
|
||||
- `kubernetes_api_endpoint` (String) The endpoint to use for the Kubernetes API.
|
||||
- `kubernetes_version` (String) The Kubernetes version to use for the cluster. When not set, the latest default version ("v1.27.8") will be used. The supported versions are [v1.26.11 v1.27.8 v1.28.4].
|
||||
- `name` (String) Name used in the cluster's named resources / cluster name.
|
||||
- `gcp` (Attributes) GCP-specific configuration. (see [below for nested schema](#nestedatt--gcp))
|
||||
- `in_cluster_endpoint` (String) The endpoint of the cluster. When not set, the out-of-cluster endpoint is used.
|
||||
- `kubernetes_version` (String) The Kubernetes version to use for the cluster. When not set, version v1.27.8 is used. The supported versions are [v1.26.11 v1.27.8 v1.28.4].
|
||||
|
||||
### Read-Only
|
||||
|
||||
|
@ -79,9 +112,46 @@ Optional:
|
|||
|
||||
|
||||
|
||||
<a id="nestedatt--extra_microservices"></a>
|
||||
### Nested Schema for `extra_microservices`
|
||||
<a id="nestedatt--network_config"></a>
|
||||
### Nested Schema for `network_config`
|
||||
|
||||
Required:
|
||||
|
||||
- `ip_cidr_node` (String) CIDR range of the cluster's node network.
|
||||
- `ip_cidr_service` (String) CIDR range of the cluster's service network.
|
||||
|
||||
Optional:
|
||||
|
||||
- `csi_driver` (Boolean) Enable the CSI driver microservice.
|
||||
- `ip_cidr_pod` (String) CIDR range of the cluster's pod network. Only required for clusters running on GCP.
|
||||
|
||||
|
||||
<a id="nestedatt--azure"></a>
|
||||
### Nested Schema for `azure`
|
||||
|
||||
Required:
|
||||
|
||||
- `load_balancer_name` (String) Name of the Azure load balancer used by the cluster.
|
||||
- `location` (String) Azure Location of the cluster.
|
||||
- `network_security_group_name` (String) Name of the Azure network security group used for the cluster.
|
||||
- `resource_group` (String) Name of the Azure resource group the cluster resides in.
|
||||
- `subscription_id` (String) ID of the Azure subscription the cluster resides in.
|
||||
- `tenant_id` (String) Tenant ID of the Azure account.
|
||||
- `uami_client_id` (String) Client ID of the User assigned managed identity (UAMI) used within the cluster.
|
||||
- `uami_resource_id` (String) Resource ID of the User assigned managed identity (UAMI) used within the cluster.
|
||||
|
||||
|
||||
<a id="nestedatt--extra_microservices"></a>
|
||||
### Nested Schema for `extra_microservices`
|
||||
|
||||
Required:
|
||||
|
||||
- `csi_driver` (Boolean) Enable Constellation's [encrypted CSI driver](https://docs.edgeless.systems/constellation/workflows/storage).
|
||||
|
||||
|
||||
<a id="nestedatt--gcp"></a>
|
||||
### Nested Schema for `gcp`
|
||||
|
||||
Required:
|
||||
|
||||
- `project_id` (String) ID of the GCP project the cluster resides in.
|
||||
- `service_account_key` (String) Base64-encoded private key JSON object of the service account used within the cluster.
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue