89 lines
2.0 KiB
Terraform
89 lines
2.0 KiB
Terraform
data "aws_availability_zones" "available" {
|
|
state = "available"
|
|
}
|
|
|
|
locals {
|
|
availability_zone = coalesce(var.availability_zone, data.aws_availability_zones.available.names[0])
|
|
}
|
|
|
|
resource "aws_vpc" "cluster" {
|
|
cidr_block = "10.42.0.0/16"
|
|
enable_dns_hostnames = true
|
|
enable_dns_support = true
|
|
|
|
tags = { Name = "k8s-security-baseline" }
|
|
}
|
|
|
|
resource "aws_subnet" "cluster" {
|
|
vpc_id = aws_vpc.cluster.id
|
|
cidr_block = "10.42.1.0/24"
|
|
availability_zone = local.availability_zone
|
|
|
|
tags = { Name = "k8s-security-baseline" }
|
|
}
|
|
|
|
resource "aws_internet_gateway" "cluster" {
|
|
vpc_id = aws_vpc.cluster.id
|
|
}
|
|
|
|
resource "aws_route_table" "cluster" {
|
|
vpc_id = aws_vpc.cluster.id
|
|
|
|
route {
|
|
cidr_block = "0.0.0.0/0"
|
|
gateway_id = aws_internet_gateway.cluster.id
|
|
}
|
|
}
|
|
|
|
resource "aws_route_table_association" "cluster" {
|
|
subnet_id = aws_subnet.cluster.id
|
|
route_table_id = aws_route_table.cluster.id
|
|
}
|
|
|
|
resource "aws_security_group" "cluster" {
|
|
name = "k8s-security-baseline"
|
|
description = "Minimal access for the optional single-node K3s lab host"
|
|
vpc_id = aws_vpc.cluster.id
|
|
|
|
ingress {
|
|
description = "SSH from the administrator CIDR"
|
|
from_port = 22
|
|
to_port = 22
|
|
protocol = "tcp"
|
|
cidr_blocks = [var.admin_cidr]
|
|
}
|
|
|
|
ingress {
|
|
description = "Kubernetes API from the administrator CIDR"
|
|
from_port = 6443
|
|
to_port = 6443
|
|
protocol = "tcp"
|
|
cidr_blocks = [var.admin_cidr]
|
|
}
|
|
|
|
egress {
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
}
|
|
}
|
|
|
|
resource "aws_instance" "k3s" {
|
|
ami = var.ami_id
|
|
instance_type = var.instance_type
|
|
subnet_id = aws_subnet.cluster.id
|
|
vpc_security_group_ids = [aws_security_group.cluster.id]
|
|
key_name = var.ssh_key_name
|
|
associate_public_ip_address = true
|
|
|
|
root_block_device {
|
|
volume_size = 30
|
|
volume_type = "gp3"
|
|
encrypted = true
|
|
}
|
|
|
|
tags = { Name = "k8s-security-baseline" }
|
|
}
|
|
|