5efde6fcf4
- terraform-vm/: ARM VM (A1.Flex Free Tier), Docker Compose, Block Volume, LB+WAF+SSL - terraform-oke/: OKE cluster (3 nodes Intel), NodePort, LB+WAF+SSL - k8s/: namespace, deployments, services, PVC, secrets, configmap - Dockerfile.frontend: self-contained nginx+dist image - push-images.sh: multi-arch build (amd64+arm64) + push to OCIR - dns.tf: conditional OCI DNS Zone + A record (when domain available) - Both stacks 100% independent, no shared modules - .gitignore: terraform state, .terraform/, *.tfvars
117 lines
2.9 KiB
HCL
117 lines
2.9 KiB
HCL
# -----------------------------------------------------------------------------
|
|
# OCI CIS Agent — OKE Deployment Stack
|
|
# OKE Cluster + Node Pool
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# --- Data Sources ---
|
|
|
|
data "oci_identity_availability_domains" "ads" {
|
|
compartment_id = var.tenancy_ocid
|
|
}
|
|
|
|
# Latest Oracle Linux 8 image compatible with VM.Standard3.Flex
|
|
data "oci_core_images" "oracle_linux" {
|
|
compartment_id = var.compartment_ocid
|
|
operating_system = "Oracle Linux"
|
|
operating_system_version = "8"
|
|
shape = var.node_shape
|
|
sort_by = "TIMECREATED"
|
|
sort_order = "DESC"
|
|
|
|
filter {
|
|
name = "display_name"
|
|
values = ["^Oracle-Linux-8\\.\\d+-\\d{4}\\.\\d{2}\\.\\d{2}-\\d+$"]
|
|
regex = true
|
|
}
|
|
}
|
|
|
|
# --- OKE Cluster ---
|
|
|
|
resource "oci_containerengine_cluster" "main" {
|
|
compartment_id = var.compartment_ocid
|
|
kubernetes_version = var.kubernetes_version
|
|
name = var.cluster_name
|
|
vcn_id = oci_core_vcn.main.id
|
|
type = "ENHANCED_CLUSTER"
|
|
|
|
cluster_pod_network_options {
|
|
cni_type = "FLANNEL_OVERLAY"
|
|
}
|
|
|
|
endpoint_config {
|
|
is_public_ip_enabled = false
|
|
subnet_id = oci_core_subnet.api_endpoint.id
|
|
}
|
|
|
|
options {
|
|
service_lb_subnet_ids = [oci_core_subnet.public.id]
|
|
|
|
kubernetes_network_config {
|
|
pods_cidr = "10.244.0.0/16"
|
|
services_cidr = "10.96.0.0/16"
|
|
}
|
|
|
|
persistent_volume_config {
|
|
freeform_tags = var.freeform_tags
|
|
}
|
|
|
|
service_lb_config {
|
|
freeform_tags = var.freeform_tags
|
|
}
|
|
}
|
|
|
|
freeform_tags = var.freeform_tags
|
|
}
|
|
|
|
# --- Node Pool ---
|
|
|
|
resource "oci_containerengine_node_pool" "app" {
|
|
compartment_id = var.compartment_ocid
|
|
cluster_id = oci_containerengine_cluster.main.id
|
|
kubernetes_version = var.kubernetes_version
|
|
name = "${var.cluster_name}-nodepool"
|
|
|
|
node_shape = var.node_shape
|
|
|
|
node_shape_config {
|
|
ocpus = var.node_ocpus
|
|
memory_in_gbs = var.node_memory_gb
|
|
}
|
|
|
|
node_source_details {
|
|
source_type = "IMAGE"
|
|
image_id = data.oci_core_images.oracle_linux.images[0].id
|
|
boot_volume_size_in_gbs = var.node_boot_volume_gb
|
|
}
|
|
|
|
node_config {
|
|
size = var.node_count
|
|
|
|
# Place nodes across all available ADs for HA
|
|
dynamic "placement_configs" {
|
|
for_each = data.oci_identity_availability_domains.ads.availability_domains
|
|
content {
|
|
availability_domain = placement_configs.value.name
|
|
subnet_id = oci_core_subnet.nodes.id
|
|
}
|
|
}
|
|
|
|
freeform_tags = var.freeform_tags
|
|
}
|
|
|
|
ssh_public_key = var.ssh_public_key
|
|
|
|
initial_node_labels {
|
|
key = "app"
|
|
value = "oci-cis-agent"
|
|
}
|
|
|
|
freeform_tags = var.freeform_tags
|
|
}
|
|
|
|
# --- Data source to retrieve node IPs after creation ---
|
|
|
|
data "oci_containerengine_node_pool" "app" {
|
|
node_pool_id = oci_containerengine_node_pool.app.id
|
|
}
|