Skip to content

Commit 23f77f6

Browse files
Kaano1Kaano1
committed
Start Project
0 parents  commit 23f77f6

8 files changed

+329
-0
lines changed

‎Makefile

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
TERRAFORM = terraform
2+
3+
PREPARE = $(TERRAFORM) init
4+
APPLY = $(TERRAFORM) apply
5+
UPDATE = $(PREPARE) -upgrade
6+
DESTROY = $(TERRAFORM) destroy
7+
8+
all: start
9+
10+
start:
11+
$(PREPARE) && $(APPLY) -auto-approve && terraform output instance_ids > ansible/inventory.ini
12+
13+
update:
14+
$(UPDATE) && $(APPLY) -auto-approve
15+
16+
stop:
17+
$(DESTROY) -auto-approve
18+
19+
ansible:
20+
cd ansible/ && ansible-playbook -i inventory.ini main.yml --private-key /home/kaan/myComputer.pem
21+
22+
re: stop start
23+
24+
.PHONY: all start stop output update update-apply re ansible

‎ansible/inventory.ini

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
[email protected] ansible_user=ubuntu

‎ansible/main.yml

+125
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
- name: Set up Kubernetes
3+
hosts: all
4+
become: true
5+
tasks:
6+
7+
# Disable swap on all the Nodes
8+
9+
- name: 1. Disable Swap for kubeadm to work properly
10+
ansible.builtin.shell:
11+
cmd: swapoff -a && sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
12+
13+
#Enable IpTables Bridge traffic on all the Nodes
14+
15+
- name: 2. Added overlay & br_netfilter to /etc/modules-load.d/k8s.conf # this file ensures these modules are loaded automatically every time the system boots
16+
ansible.builtin.copy:
17+
dest: /etc/modules-load.d/k8s.conf
18+
content: |
19+
overlay
20+
br_netfilter
21+
owner: root
22+
group: root
23+
mode: '0644'
24+
25+
- name: 3. Used modprobe for immediantly loading overlay and br_netfilter in running linux kernel # loading kernel modules
26+
ansible.builtin.shell:
27+
cmd: sudo modprobe overlay && sudo modprobe br_netfilter
28+
29+
- name: 4. Set iptables setting
30+
ansible.builtin.shell:
31+
cmd: cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
32+
net.bridge.bridge-nf-call-iptables = 1
33+
net.bridge.bridge-nf-call-ip6tables = 1
34+
net.ipv4.ip_forward = 1
35+
EOF
36+
# net.bridge.bridge-nf-call-iptables = ensures that traffic passing through a linux bridge is processed by iptables rules. This is essantial for kubernetes policies
37+
# net.bridge.bridge-nf-call-ip6tables = Similar to the previoes setting but for ip6 traffic
38+
# net.ipv4.ip_forward = allows the system to forward ipv4 packages between network interfaces.
39+
40+
- name: 5. Apply sysctl params without reboot
41+
ansible.builtin.shell:
42+
cmd: sysctl --system
43+
44+
# Install CRI-O Runtime On All The Nodes
45+
46+
47+
- name: 8.2 Download software-properties-common, gpg, curl, apt-transport-https, ca-certificates
48+
ansible.builtin.shell:
49+
cmd: sudo apt-get update -y && sudo apt-get install -y software-properties-common gpg curl apt-transport-https ca-certificates
50+
ignore_errors: true
51+
52+
- name: 8.3.1 Check if cri-o-apt-keyring.gpg exists
53+
ansible.builtin.stat:
54+
path: /etc/apt/keyrings/cri-o-apt-keyring.gpg
55+
register: cri_o_apt_keyring
56+
57+
- name: 8.3 Download the CRI-O GPG key and save it to a keyring
58+
ansible.builtin.shell:
59+
cmd: curl -fsSL https://pkgs.k8s.io/addons:/cri-o:/prerelease:/main/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/cri-o-apt-keyring.gpg
60+
when: not cri_o_apt_keyring.stat.exists
61+
62+
- name: 8.4 Add the CRI-O repository to APT sources list
63+
ansible.builtin.shell:
64+
cmd: echo "deb [signed-by=/etc/apt/keyrings/cri-o-apt-keyring.gpg] https://pkgs.k8s.io/addons:/cri-o:/prerelease:/main/deb/ /" | tee /etc/apt/sources.list.d/cri-o.list
65+
66+
67+
# GPG (GNU Privacy Guard), are cryptographic keys used to sign packages. By adding the GPG key for the repository, you ensure that your system can trust the packages coming from that repository.
68+
69+
- name: 9. Download cri-o
70+
ansible.builtin.shell:
71+
cmd: sudo apt-get update -y && sudo apt-get install -y cri-o
72+
ignore_errors: true
73+
74+
75+
- name: 10. Reload the systemd configurations and enable cri-o.
76+
ansible.builtin.shell:
77+
cmd: sudo systemctl daemon-reload && sudo systemctl enable crio --now && sudo systemctl start crio.service
78+
79+
# Install Kubeadm & Kubelet & Kubectl
80+
81+
- name: 11. Establish /etc/apt/keyrings and set Kubernetes_version
82+
ansible.builtin.shell:
83+
cmd: KUBERNETES_VERSION=1.30 && sudo mkdir -p /etc/apt/keyrings
84+
85+
- name: 11. Download the GPG key for Kubernetes componants download
86+
ansible.builtin.shell:
87+
cmd: curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
88+
89+
- name: 11.x
90+
ansible.builtin.shell:
91+
cmd: echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list
92+
93+
- name: 11.2 update
94+
ansible.builtin.shell:
95+
cmd: sudo apt-get update -y
96+
ignore_errors: true
97+
98+
# /usr/share/keyrings/kubernetes-archive-keyring.gpg = It's a system-wide location typically used for storing trusted keys for package management.
99+
# https://dl.k8s.io/apt/doc/apt-key.gpg = The Kubernetes APT repository is a software repository where Kubernetes packages (such as kubelet, kubeadm and kubectl) are stored for installation on systems using the APT package management system (such as Debian and Ubuntu)
100+
101+
- name: 12.x
102+
ansible.builtin.shell:
103+
cmd: apt-cache madison kubeadm | tac
104+
105+
- name: 13. Download kubelet kubeadm kubectl
106+
ansible.builtin.shell:
107+
cmd: sudo apt-get install -y kubelet kubeadm kubectl
108+
109+
- name: 14. apt-mark hold prevents updates kubelet, kubectl and kubeadm # if we didn't prevent it, so it can be dangerous for stability
110+
ansible.builtin.shell:
111+
cmd: sudo apt-mark hold kubelet kubeadm kubectl
112+
113+
- name: 15. Downlaod jq for local_ip
114+
ansible.builtin.shell:
115+
sudo apt-get install -y jq
116+
117+
- name: 16. Take the local IP address of the 'eth1' network interface
118+
ansible.builtin.shell:
119+
cmd: |
120+
local_ip="$(ip --json a s | jq -r '.[] | if .ifname == "eth1" then .addr_info[] | if .family == "inet" then .local else empty end else empty end')"
121+
cat > /etc/default/kubelet << EOF
122+
KUBELET_EXTRA_ARGS=--node-ip=$local_ip
123+
EOF
124+
125+

‎ec2-instance.tf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
resource "aws_instance" "master_node" {
2+
ami = "ami-08eb150f611ca277f"
3+
vpc_security_group_ids = [aws_security_group.control_plane.id]
4+
subnet_id = aws_subnet.subnet_public_ip.id
5+
instance_type = "t3.medium"
6+
key_name = "myComputer"
7+
8+
tags = {
9+
Name = "master_node"
10+
}
11+
}
12+
13+
/*
14+
resource "aws_instance" "worker-node" {
15+
ami = "ami-08eb150f611ca277f"
16+
vpc_security_group_ids = [aws_security_group.worker_node.id]
17+
subnet_id = aws_subnet.subnet_public_ip.id
18+
instance_type = "t3.medium"
19+
count = 2
20+
key_name = "myComputer"
21+
22+
tags = {
23+
Name = "worker-node"
24+
}
25+
}
26+
*/

‎main.tf

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
provider "aws" {
2+
region = "eu-north-1"
3+
}

‎output.tf

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "instance_ids" {
2+
value = format("ubuntu@%s ansible_user=ubuntu", aws_instance.master_node.public_ip)
3+
}

‎security_group.tf

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
# Master Node
2+
3+
resource "aws_security_group" "control_plane" {
4+
vpc_id = "vpc-065771f2a3fc81dda"
5+
name = "control_plane_sg"
6+
description = "Security group for Kubernetes control plane node"
7+
8+
tags = {
9+
Name = "control_plane_sg"
10+
}
11+
}
12+
13+
# Ingress rules for control plane node
14+
resource "aws_security_group_rule" "control_plane_ingress_k8s_api" {
15+
type = "ingress"
16+
from_port = 6443
17+
to_port = 6443
18+
protocol = "tcp"
19+
security_group_id = aws_security_group.control_plane.id
20+
cidr_blocks = ["0.0.0.0/0"]
21+
}
22+
23+
resource "aws_security_group_rule" "control_plane_ingress_etcd" {
24+
type = "ingress"
25+
from_port = 2379
26+
to_port = 2380
27+
protocol = "tcp"
28+
security_group_id = aws_security_group.control_plane.id
29+
cidr_blocks = ["0.0.0.0/0"]
30+
}
31+
32+
resource "aws_security_group_rule" "control_plane_ingress_kubelet" {
33+
type = "ingress"
34+
from_port = 10248
35+
to_port = 10260
36+
protocol = "tcp"
37+
security_group_id = aws_security_group.control_plane.id
38+
cidr_blocks = ["0.0.0.0/0"]
39+
}
40+
41+
resource "aws_security_group_rule" "control_plane_ingress_generic" {
42+
type = "ingress"
43+
from_port = 80
44+
to_port = 8080
45+
protocol = "tcp"
46+
security_group_id = aws_security_group.control_plane.id
47+
cidr_blocks = ["0.0.0.0/0"]
48+
}
49+
50+
resource "aws_security_group_rule" "control_plane_ingress_ssh" {
51+
type = "ingress"
52+
from_port = 22
53+
to_port = 22
54+
protocol = "tcp"
55+
security_group_id = aws_security_group.control_plane.id
56+
cidr_blocks = ["0.0.0.0/0"]
57+
}
58+
59+
60+
resource "aws_security_group_rule" "control_plane_ingress_nodeport" {
61+
type = "ingress"
62+
from_port = 30000
63+
to_port = 32767
64+
protocol = "tcp"
65+
security_group_id = aws_security_group.control_plane.id
66+
cidr_blocks = ["0.0.0.0/0"]
67+
}
68+
69+
# Egress rule for control plane node (allow all outbound)
70+
resource "aws_security_group_rule" "control_plane_egress" {
71+
type = "egress"
72+
from_port = 0
73+
to_port = 0
74+
protocol = "-1"
75+
security_group_id = aws_security_group.control_plane.id
76+
cidr_blocks = ["0.0.0.0/0"]
77+
}
78+
79+
80+
81+
82+
#--------------------------------------------------------------------------------------
83+
#--------------------------------------------------------------------------------------
84+
85+
86+
87+
88+
89+
# Worker Node
90+
91+
resource "aws_security_group" "worker_node" {
92+
vpc_id = "vpc-065771f2a3fc81dda"
93+
name = "worker_node_sg"
94+
description = "Security group for Kubernetes worker plane node"
95+
96+
tags = {
97+
Name = "worker_node_sg"
98+
}
99+
}
100+
101+
# Ingress rules for worker node
102+
resource "aws_security_group_rule" "worker_node_ingress_kubelet" {
103+
type = "ingress"
104+
from_port = 10248
105+
to_port = 10260
106+
protocol = "tcp"
107+
security_group_id = aws_security_group.worker_node.id
108+
cidr_blocks = ["0.0.0.0/0"]
109+
}
110+
111+
resource "aws_security_group_rule" "worker_node_ingress_ssh" {
112+
type = "ingress"
113+
from_port = 22
114+
to_port = 22
115+
protocol = "tcp"
116+
security_group_id = aws_security_group.worker_node.id
117+
cidr_blocks = ["0.0.0.0/0"]
118+
}
119+
120+
resource "aws_security_group_rule" "worker_node_ingress_nodeport" {
121+
type = "ingress"
122+
from_port = 30000
123+
to_port = 32767
124+
protocol = "tcp"
125+
security_group_id = aws_security_group.worker_node.id
126+
cidr_blocks = ["0.0.0.0/0"]
127+
}
128+
129+
# Egress rule for worker node (allow all outbound)
130+
resource "aws_security_group_rule" "worker_node_egress" {
131+
type = "egress"
132+
from_port = 0
133+
to_port = 0
134+
protocol = "-1"
135+
security_group_id = aws_security_group.worker_node.id
136+
cidr_blocks = ["0.0.0.0/0"]
137+
}

‎subnet.tf

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "aws_subnet" "subnet_public_ip" {
2+
vpc_id = "vpc-065771f2a3fc81dda"
3+
cidr_block = "20.0.0.0/16"
4+
map_public_ip_on_launch = true
5+
availability_zone = "eu-north-1a"
6+
7+
tags = {
8+
Name = "subnet_public_ip"
9+
}
10+
}

0 commit comments

Comments
 (0)