Update 'worker.tf'

From terraform plan --help
>  -detailed-exitcode  Return detailed exit codes when the command exits. This
>                      will change the meaning of exit codes to:
>                      0 - Succeeded, diff is empty (no changes)
>                      1 - Errored
>                      2 - Succeeded, there is a diff

.drone.yml

@@ -6,6 +6,7 @@ name: Terraform root module
 environment:
   TF_IN_AUTOMATION: "1"
   GIT_SSH_COMMAND: "ssh -o StrictHostKeyChecking=no -i $${PWD}/id_rsa"
+  TF_VAR_lawndale_dns_host: "nat.lawndale"
   TF_VAR_lawndale_libvirt_uri_transport: ssh
   TF_VAR_lawndale_libvirt_uri_userhostport: "192.168.253.254:10022"
 
@@ -20,7 +21,7 @@ steps:
   commands:
     - echo "$${CI_SSH_KEY}" | base64 -d > id_rsa
     - chmod 600 id_rsa
-    - echo 'lawndale_libvirt_uri_extra = {"sshauth"="privkey","keyfile"="'$${PWD}'/id_rsa"}' >> ci.tfvars
+    - echo 'lawndale_libvirt_uri_extra = {"sshauth"="privkey","keyfile"="'$${PWD}'/id_rsa","no_verify"="1"}' >> ci.tfvars
     - terraform init
   environment:
     CI_SSH_KEY:
@@ -33,9 +34,7 @@ steps:
 - name: terraform plan
   image: hashicorp/terraform:1.1.8
   commands:
-    - mkdir -p ~/.ssh
-    - cp -a id_rsa ~/.ssh/id_rsa
-    - terraform plan -var-file ci.tfvars -out .tfplan
+    - terraform plan $([[ $${DRONE_BUILD_EVENT} = cron ]] && echo "-detailed-exitcode") -var-file ci.tfvars -out .tfplan
   environment:
     AWS_ACCESS_KEY_ID:
       from_secret: terraform-aws-key-id
@@ -56,23 +55,36 @@ steps:
     - push
   image: hashicorp/terraform:1.1.8
   commands:
-    - mkdir -p ~/.ssh
-    - cp -a id_rsa ~/.ssh/id_rsa
-    - terraform apply -var-file ci.tfvars .tfplan
+    - terraform apply .tfplan
   environment:
     AWS_ACCESS_KEY_ID:
       from_secret: terraform-aws-key-id
     AWS_SECRET_ACCESS_KEY:
       from_secret: terraform-aws-secret-access-key
-    KUBE_TOKEN:
-      from_secret: lawndale-k8s-ci-token
-    TF_VAR_lawndale_dns_key_secret:
-      from_secret: lawndale-dns-key-secret
-    TF_VAR_lawndale_dns_key_algorithm:
-      from_secret: lawndale-dns-key-algorithm
+---
+kind: pipeline
+type: kubernetes
+name: Check docs and format
+
+environment:
+  TF_IN_AUTOMATION: "1"
+
+trigger:
+  ref:
+    - refs/pull/*/head
+
+steps:
+- name: format and generate docs
+  image: hashicorp/terraform:1.1.8
+  commands:
+    - apk add bash wget 
+    - wget -q https://github.com/terraform-docs/terraform-docs/releases/download/v0.16.0/terraform-docs-v0.16.0-linux-amd64.tar.gz -O - | tar -xz terraform-docs -C /usr/local/bin
+    - terraform fmt
+    - terraform-docs .
+    - git diff --exit-code
 
 ---
 kind: signature
-hmac: ef5513e0943a9a8af92b43c9f29b638680fd92da235e6763a59ea821b22e4c7a
+hmac: 95f8db197163e884f2eee4b14af136b9ea1e0f88f626079b4a3b38b43b91c6a8
 
 ...

README.md

@@ -69,7 +69,9 @@ Version:
 The following resources are used by this module:
 
 - [helm_release.coredns](https://registry.terraform.io/providers/hashicorp/helm/2.5.1/docs/resources/release) (resource)
+- [helm_release.kube_state_metrics](https://registry.terraform.io/providers/hashicorp/helm/2.5.1/docs/resources/release) (resource)
 - [helm_release.metrics_server](https://registry.terraform.io/providers/hashicorp/helm/2.5.1/docs/resources/release) (resource)
+- [helm_release.traefik](https://registry.terraform.io/providers/hashicorp/helm/2.5.1/docs/resources/release) (resource)
 - [kubernetes_cluster_role.ci_cd](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/cluster_role) (resource)
 - [kubernetes_cluster_role.prometheus](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/cluster_role) (resource)
 - [kubernetes_cluster_role_binding.auto_approve_node_csrs](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/cluster_role_binding) (resource)
@@ -93,29 +95,27 @@ The following resources are used by this module:
 
 The following input variables are required:
 
-### <a name="input_lawndale_dns_key_secret"></a> [lawndale\_dns\_key\_secret](#input\_lawndale\_dns\_key\_secret)
-
-Description: DNSSEC key to use sigining the NSUPDATE queries for Lawndale
-
-Type: `string`
-
-### <a name="input_lawndale_dns_port"></a> [lawndale\_dns\_port](#input\_lawndale\_dns\_port)
-
-Description: Port where the lawndale internal DNS server listens on
-
-Type: `number`
-
-## Optional Inputs
-
-The following input variables are optional (have default values):
-
 ### <a name="input_lawndale_dns_host"></a> [lawndale\_dns\_host](#input\_lawndale\_dns\_host)
 
 Description: Address to reach lawndale internal DNS server
 
 Type: `string`
 
-Default: `"lawndale-hyper"`
+### <a name="input_lawndale_dns_key_secret"></a> [lawndale\_dns\_key\_secret](#input\_lawndale\_dns\_key\_secret)
+
+Description: DNSSEC key to use sigining the NSUPDATE queries for Lawndale
+
+Type: `string`
+
+### <a name="input_lawndale_libvirt_uri_transport"></a> [lawndale\_libvirt\_uri\_transport](#input\_lawndale\_libvirt\_uri\_transport)
+
+Description: Transport protocol (could be ssh or tls) to dial Lawndale hypervisor
+
+Type: `string`
+
+## Optional Inputs
+
+The following input variables are optional (have default values):
 
 ### <a name="input_lawndale_dns_key_algorithm"></a> [lawndale\_dns\_key\_algorithm](#input\_lawndale\_dns\_key\_algorithm)
 
@@ -125,6 +125,14 @@ Type: `string`
 
 Default: `"hmac-sha256"`
 
+### <a name="input_lawndale_dns_port"></a> [lawndale\_dns\_port](#input\_lawndale\_dns\_port)
+
+Description: Port where the lawndale internal DNS server listens on
+
+Type: `number`
+
+Default: `53`
+
 ### <a name="input_lawndale_dns_transport"></a> [lawndale\_dns\_transport](#input\_lawndale\_dns\_transport)
 
 Description: Port where the lawndale internal DNS server listens on
@@ -133,6 +141,38 @@ Type: `string`
 
 Default: `"udp"`
 
+### <a name="input_lawndale_libvirt_uri"></a> [lawndale\_libvirt\_uri](#input\_lawndale\_libvirt\_uri)
+
+Description: Libvirt URI to use accessing Lawndale hypervisor
+
+Type: `string`
+
+Default: `null`
+
+### <a name="input_lawndale_libvirt_uri_extra"></a> [lawndale\_libvirt\_uri\_extra](#input\_lawndale\_libvirt\_uri\_extra)
+
+Description: Libvirt URI extra parameters [https://libvirt.org/uri.html#transport-configuration](See Libvirt transport configuration)
+
+Type: `map(any)`
+
+Default: `{}`
+
+### <a name="input_lawndale_libvirt_uri_path"></a> [lawndale\_libvirt\_uri\_path](#input\_lawndale\_libvirt\_uri\_path)
+
+Description: Libvirt URI path sent to the libvirt daemon
+
+Type: `string`
+
+Default: `"/system"`
+
+### <a name="input_lawndale_libvirt_uri_userhostport"></a> [lawndale\_libvirt\_uri\_userhostport](#input\_lawndale\_libvirt\_uri\_userhostport)
+
+Description: Libvirt URI username, hostname or ip address, and port to reach lawndale hypervisor, in the format of `[username@]<hostname>[:port]`
+
+Type: `string`
+
+Default: `"lawndale-hyper"`
+
 ## Outputs
 
 No outputs.

ci.tf

@@ -100,4 +100,20 @@ resource "kubernetes_cluster_role" "ci_cd" {
     ]
     verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
   }
+
+  rule {
+    api_groups = ["traefik.containo.us"]
+    resources = [
+      "ingressroutes",
+      "ingressroutetcps",
+      "ingressrouteudps",
+      "middlewares",
+      "middlewaretcps",
+      "serverstransports",
+      "tlsoptions",
+      "tlsstores",
+      "traefikservices",
+    ]
+    verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
+  }
 }

kube-state-metrics.tf

@@ -0,0 +1,35 @@
+resource "helm_release" "kube_state_metrics" {
+  name      = "kube-state-metrics"
+  namespace = "kube-system"
+
+  repository = "https://prometheus-community.github.io/helm-charts"
+  chart      = "kube-state-metrics"
+  version    = "4.13.0"
+
+  values = [
+    jsonencode({
+      rbac = {
+        create         = true
+        useClusterRole = true
+      }
+      serviceAccount = {
+        create = true
+      }
+      podSecurityPolicy = {
+        enabled = false
+      }
+    }),
+    jsonencode({
+      autosharding = {
+        enabled = false
+      }
+    }),
+    jsonencode({
+      customLabels = {
+        "prometheus.io/scrape" = "true"
+        "prometheus.io/port"   = "8080"
+        "prometheus.io/scheme" = "http"
+      }
+    }),
+  ]
+}

locals.tf

@@ -3,6 +3,7 @@ locals {
   kubernetes_server  = "https://nat.lawndale:6443"
   kubernetes_version = "1.23.5"
   cluster_dns        = "10.32.0.10"
+  traefik_namespace  = "traefik"
 
   bootstrap_token = "${random_password.bootstrap_token_id.result}.${random_password.bootstrap_token_secret.result}"
 

traefik.tf

@@ -0,0 +1,32 @@
+resource "helm_release" "traefik" {
+  name             = "traefik"
+  namespace        = local.traefik_namespace
+  create_namespace = true
+
+  repository = "https://helm.traefik.io/traefik"
+  chart      = "traefik"
+
+  values = [
+    jsonencode({
+      rbac = {
+        enabled    = true
+        namespaced = false # traefik works for the whole cluster
+      }
+      podSecurityPolicy = {
+        enabled = false
+      }
+      deployment = {
+        enabled = false
+      }
+      daemonset = {
+        enabled = false
+      }
+      service = {
+        enabled = false
+      }
+      ingressroute = {
+        dashboard = { enabled = false }
+      }
+    })
+  ]
+}

variables.tf

@@ -1,7 +1,6 @@
 variable "lawndale_dns_host" {
   type        = string
   description = "Address to reach lawndale internal DNS server"
-  default     = "lawndale-hyper"
 }
 
 variable "lawndale_dns_port" {

worker.tf

@@ -1,7 +1,7 @@
 locals {
   pool_name       = "kubernetes-workers"
   worker_id_start = 80
-  worker_count    = 1
+  worker_count    = 2
 }
 
 resource "libvirt_pool" "kubernetes_workers" {