feat: added support for configuring the cni of admin and managed clusters (#23)

hyder · web-flow · commit ce7862fb87c6 · 2023-06-28T14:43:22.000+10:00
Users can now choose between flannel and NPN for their clusters

Signed-off-by: Ali Mukadam &lt;ali.mukadam@oracle.com&gt;
diff --git a/admin.tf b/admin.tf
@@ -64,6 +64,7 @@ module "admin" {
 
   # oke cluster options
   cluster_name                = lookup(var.admin_region, "admin_name")
+  cni_type                    = var.preferred_cni
   control_plane_type          = var.oke_control_plane
   control_plane_allowed_cidrs = ["0.0.0.0/0"]
   kubernetes_version          = var.kubernetes_version
@@ -73,7 +74,7 @@ module "admin" {
 
   # node pools
   kubeproxy_mode = "ipvs"
-  node_pools = var.nodepools
+  node_pools     = var.nodepools
 
   cloudinit_nodepool_common = var.cloudinit_nodepool_common
 
diff --git a/docs/src/SUMMARY.md b/docs/src/SUMMARY.md
@@ -14,6 +14,6 @@
   - [With Private Endpoints](./multi/pri-ep.md)
 - [Advanced Customizations](./advanced/advanced.md)
   - [Control plane](./advanced/controlplane.md)
-  - [Data plane]()
+  - [Data plane](./advanced/dataplane.md)
   - [DNS](./advanced/dns.md)
 - [Terraform Options](./terraformoptions.md)
diff --git a/docs/src/advanced/controlplane.md b/docs/src/advanced/controlplane.md
@@ -8,4 +8,11 @@ On OCI, the Verrazzano Control Plane is front-ended by an OCI Load Balancer and
 2. shape: the load balancer shape can be configured including the bandwidth, security posture
 3. DNS: the domain used to access the control plane services
 
-Depending on the values you choose, your architecture and possibly other requirements, additional configuration may be necessary.
+Depending on the values you choose, your architecture and possibly other requirements, additional configuration may be necessary.
+
+The following parameters configures the Verrazzano control plane:
+
+| Parameter | Description | Default |
+| --------- | ----------- | ------- |
+| verrazzano_control_plane | Determines whether the load balancer used to access the control plane is public or private. | public | 
+| verrazzano_load_balancer | Determines the shape of the load balancer | <pre>verrazzano_load_balancer = {<br>  shape    = "10Mbps"<br>  flex_min = "50"<br>  flex_max = "100" <br>}</pre>|
diff --git a/docs/src/advanced/dataplane.md b/docs/src/advanced/dataplane.md
@@ -0,0 +1,21 @@
+# Data plane
+
+The data plane is where the workload are run. This is usually done as part of the service mesh (Istio). 
+
+Istio usually has an ingress gateway that allows incoming traffic into the mesh.
+
+On OCI, the service mesh is front-ended by an OCI Load Balancer and Istio's ingress gateway.
+the ingress gateway is front-ended by an OCI Load Balancer. As such a number of configuration options are possible depending on the use case:
+
+1. access: the control plane can be made public or private. By default, it is public.
+2. shape: the load balancer shape can be configured including the bandwidth, security posture
+3. DNS: the domain used to access the control plane services
+
+Depending on the values you choose, your architecture and possibly other requirements, additional configuration may be necessary.
+
+The following parameters configures the Verrazzano control plane:
+
+| Parameter | Description | Default |
+| --------- | ----------- | ------- |
+| verrazzano_data_plane | Determines whether the load balancer used to access the control plane is public or private. | public | 
+| verrazzano_load_balancer | Determines the shape of the load balancer | <pre>verrazzano_load_balancer = {<br>  shape    = "10Mbps"<br>  flex_min = "50"<br>  flex_max = "100" <br>}</pre>|
diff --git a/modules/clusters/africa.tf b/modules/clusters/africa.tf
@@ -55,6 +55,7 @@
 #   # oke cluster options
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "johannesburg"
+#   cni_type                    = var.preferred_cni
 #   control_plane_type          = var.oke_control_plane
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
diff --git a/modules/clusters/australia.tf b/modules/clusters/australia.tf
@@ -55,6 +55,7 @@ module "melbourne" {
   # oke cluster options
   allow_worker_ssh_access     = false
   cluster_name                = "melbourne"
+  cni_type                    = var.preferred_cni  
   control_plane_type          = var.oke_control_plane
   control_plane_allowed_cidrs = ["0.0.0.0/0"]
   kubernetes_version          = var.kubernetes_version
@@ -142,6 +143,7 @@ module "melbourne" {
 #   # oke cluster options
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "sydney"
+#   cni_type                    = var.preferred_cni
 #   control_plane_type          = var.oke_control_plane
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
diff --git a/modules/clusters/brazil.tf b/modules/clusters/brazil.tf
@@ -55,6 +55,7 @@
 #   # oke cluster options
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "saupaulo"
+#   cni_type                    = var.preferred_cni
 #   control_plane_type          = var.oke_control_plane
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
@@ -140,6 +141,7 @@
 #   # oke cluster options
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "vinhedo"
+#   cni_type                    = var.preferred_cni
 #   control_plane_type          = var.oke_control_plane
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
diff --git a/modules/clusters/canada.tf b/modules/clusters/canada.tf
@@ -55,6 +55,7 @@
 #   # oke cluster options
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "toronto"
+#   cni_type                    = var.preferred_cni
 #   control_plane_type          = var.oke_control_plane
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
@@ -140,6 +141,7 @@
 #   # oke cluster options
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "montreal"
+#   cni_type                    = var.preferred_cni
 #   control_plane_type          = var.oke_control_plane
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
diff --git a/modules/clusters/europe.tf b/modules/clusters/europe.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "frankfurt"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("frankfurt")), "pods")
@@ -142,6 +143,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "amsterdam"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("amsterdam")), "pods")
@@ -228,6 +230,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "madrid"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("madrid")), "pods")
@@ -313,6 +316,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "milan"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("milan")), "pods")
@@ -398,6 +402,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "stockholm"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("stockholm")), "pods")
@@ -483,6 +488,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "zurich"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("zurich")), "pods")
diff --git a/modules/clusters/france.tf b/modules/clusters/france.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "paris"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("paris")), "pods")
@@ -141,6 +142,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "marseille"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("marseille")), "pods")
diff --git a/modules/clusters/india.tf b/modules/clusters/india.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "hyderabad"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("hyderabad")), "pods")
@@ -141,6 +142,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "mumbai"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("mumbai")), "pods")
diff --git a/modules/clusters/japan.tf b/modules/clusters/japan.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "osaka"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("osaka")), "pods")
@@ -141,6 +142,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "tokyo"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("tokyo")), "pods")
diff --git a/modules/clusters/korea.tf b/modules/clusters/korea.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "chuncheon"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("chuncheon")), "pods")
@@ -141,6 +142,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "seoul"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("seoul")), "pods")
diff --git a/modules/clusters/latam.tf b/modules/clusters/latam.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "queretaro"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("queretaro")), "pods")
@@ -141,6 +142,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "santiago"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("santiago")), "pods")
diff --git a/modules/clusters/middleeast.tf b/modules/clusters/middleeast.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "jeddah"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("jeddah")), "pods")
@@ -141,6 +142,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "jerusalem"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("jerusalem")), "pods")
diff --git a/modules/clusters/singapore.tf b/modules/clusters/singapore.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "singapore"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("singapore")), "pods")
diff --git a/modules/clusters/uae.tf b/modules/clusters/uae.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "dubai"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("dubai")), "pods")
@@ -140,6 +141,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "abudhabi"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("abudhabi")), "pods")
diff --git a/modules/clusters/uk.tf b/modules/clusters/uk.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "london"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("london")), "pods")
@@ -141,6 +142,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "newport"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("newport")), "pods")
diff --git a/modules/clusters/usa.tf b/modules/clusters/usa.tf
@@ -56,6 +56,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "ashburn"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("ashburn")), "pods")
@@ -141,6 +142,7 @@
 #   allow_worker_ssh_access     = false
 #   cluster_name                = "phoenix"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("phoenix")), "pods")
@@ -226,6 +228,7 @@
 #   allow_worker_ssh_access     = true
 #   cluster_name                = "sanjose"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("sanjose")), "pods")
@@ -311,6 +314,7 @@
 #   allow_worker_ssh_access     = true
 #   cluster_name                = "chicago"
 #   control_plane_type          = var.oke_control_plane
+#   cni_type                           = var.preferred_cni
 #   control_plane_allowed_cidrs = ["0.0.0.0/0"]
 #   kubernetes_version          = var.kubernetes_version
 #   pods_cidr                   = lookup(lookup(var.cidrs, lower("chicago")), "pods")
diff --git a/terraform.tfvars.example b/terraform.tfvars.example
@@ -34,6 +34,8 @@ kubernetes_version = "v1.24.1"
 
 oke_control_plane = "public"
 
+preferred_cni = "flannel"
+
 managed_clusters = {
   # Africa
   johannesburg = false
diff --git a/variables.tf b/variables.tf
@@ -152,6 +152,17 @@ variable "oke_control_plane" {
   }
 }
 
+variable "preferred_cni" {
+  default ="flannel"  
+  description = "Whether to use flannel or NPN"
+  type = string
+
+  validation {
+    condition     = contains(["flannel", "npn"], lower(var.preferred_cni))
+    error_message = "Accepted values are 'flannel' or 'npn'."
+  }  
+}
+
 variable "managed_clusters" {
   description = "A map of OCI regions where managed clusters will be created."
   type        = map(bool)
