Skip to content

Commit 3dc5487

Browse files
trapeznikovtrapeznikov
authored
Add AKS Istio and Open service mesh support (#1878)
* add osm attribute * add aks service_mesh_profile * Add AKS with Istio example
1 parent cf96fa1 commit 3dc5487

File tree

5 files changed

+303
-1
lines changed

5 files changed

+303
-1
lines changed

‎.github/workflows/standalone-compute.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
"compute/kubernetes_services/105-cluster-usermsi",
2727
"compute/kubernetes_services/107-agic-brownfield",
2828
"compute/kubernetes_services/108-single-cluster-remote-adgroup-admin",
29+
"compute/kubernetes_services/109-single-cluster-istio",
2930
"compute/proximity_placement_group",
3031
"compute/virtual_machine_scale_set/100-linux-win-vmss-lb",
3132
"compute/virtual_machine_scale_set/101-linux-win-vmss-agw",

‎examples/compute/kubernetes_services/109-single-cluster-istio/aks.tfvars

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
preview_features = {
2+
"Microsoft.ContainerService" = [
3+
"AzureServiceMeshPreview"
4+
]
5+
}
6+
7+
global_settings = {
8+
default_region = "region1"
9+
regions = {
10+
region1 = "australiaeast"
11+
}
12+
}
13+
14+
resource_groups = {
15+
aks_re1 = {
16+
name = "aks-re1"
17+
region = "region1"
18+
}
19+
}
20+
21+
aks_clusters = {
22+
cluster_re1 = {
23+
name = "akscluster-re1-001"
24+
resource_group_key = "aks_re1"
25+
os_type = "Linux"
26+
27+
identity = {
28+
type = "SystemAssigned"
29+
}
30+
31+
vnet_key = "spoke_aks_re1"
32+
33+
network_profile = {
34+
network_plugin = "azure"
35+
load_balancer_sku = "standard"
36+
}
37+
38+
# enable_rbac = true
39+
role_based_access_control = {
40+
enabled = true
41+
azure_active_directory = {
42+
managed = true
43+
}
44+
}
45+
46+
oms_agent = {
47+
log_analytics_key = "central_logs_region1"
48+
}
49+
50+
service_mesh_profile = {
51+
internal_ingress_gateway_enabled = true
52+
mode = "Istio"
53+
}
54+
55+
# admin_groups = {
56+
# # ids = []
57+
# # azuread_groups = {
58+
# # keys = []
59+
# # }
60+
# }
61+
62+
load_balancer_profile = {
63+
# Only one option can be set
64+
managed_outbound_ip_count = 1
65+
}
66+
67+
default_node_pool = {
68+
name = "sharedsvc"
69+
vm_size = "Standard_F4s_v2"
70+
#subnet_key = "aks_nodepool_system"
71+
subnet = {
72+
key = "aks_nodepool_system"
73+
#resource_id = "/subscriptions/97958dac-xxxx-xxxx-xxxx-9f436fa73bd4/resourceGroups/qxgc-rg-aks-re1/providers/Microsoft.Network/virtualNetworks/qxgc-vnet-aks/subnets/qxgc-snet-aks_nodepool_system"
74+
}
75+
enabled_auto_scaling = false
76+
enable_node_public_ip = false
77+
max_pods = 30
78+
node_count = 1
79+
os_disk_size_gb = 512
80+
tags = {
81+
"project" = "system services"
82+
}
83+
}
84+
85+
node_resource_group_name = "aks-nodes-re1"
86+
87+
addon_profile = {
88+
azure_keyvault_secrets_provider = {
89+
secret_rotation_enabled = true
90+
secret_rotation_interval = "2m"
91+
}
92+
}
93+
}
94+
}

‎examples/compute/kubernetes_services/109-single-cluster-istio/diagnostics.tfvars

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
diagnostic_log_analytics = {
2+
central_logs_region1 = {
3+
region = "region1"
4+
name = "logs"
5+
resource_group_key = "aks_re1"
6+
}
7+
}

‎examples/compute/kubernetes_services/109-single-cluster-istio/networking.tfvars

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
vnets = {
2+
spoke_aks_re1 = {
3+
resource_group_key = "aks_re1"
4+
region = "region1"
5+
vnet = {
6+
name = "aks"
7+
address_space = ["100.64.48.0/22"]
8+
}
9+
specialsubnets = {}
10+
subnets = {
11+
aks_nodepool_system = {
12+
name = "aks_nodepool_system"
13+
cidr = ["100.64.48.0/24"]
14+
nsg_key = "azure_kubernetes_cluster_nsg"
15+
}
16+
aks_nodepool_user1 = {
17+
name = "aks_nodepool_user1"
18+
cidr = ["100.64.49.0/24"]
19+
nsg_key = "azure_kubernetes_cluster_nsg"
20+
}
21+
aks_nodepool_user2 = {
22+
name = "aks_nodepool_user2"
23+
cidr = ["100.64.50.0/24"]
24+
nsg_key = "azure_kubernetes_cluster_nsg"
25+
}
26+
AzureBastionSubnet = {
27+
name = "AzureBastionSubnet" #Must be called AzureBastionSubnet
28+
cidr = ["100.64.51.64/27"]
29+
nsg_key = "azure_bastion_nsg"
30+
}
31+
private_endpoints = {
32+
name = "private_endpoints"
33+
cidr = ["100.64.51.0/27"]
34+
enforce_private_link_endpoint_network_policies = true
35+
}
36+
jumpbox = {
37+
name = "jumpbox"
38+
cidr = ["100.64.51.128/27"]
39+
nsg_key = "azure_bastion_nsg"
40+
}
41+
}
42+
43+
}
44+
}
45+
46+
network_security_group_definition = {
47+
# This entry is applied to all subnets with no NSG defined
48+
empty_nsg = {}
49+
azure_kubernetes_cluster_nsg = {
50+
nsg = [
51+
{
52+
name = "aks-http-in-allow",
53+
priority = "100"
54+
direction = "Inbound"
55+
access = "Allow"
56+
protocol = "Tcp"
57+
source_port_range = "*"
58+
destination_port_range = "80"
59+
source_address_prefix = "*"
60+
destination_address_prefix = "*"
61+
},
62+
{
63+
name = "aks-https-in-allow",
64+
priority = "110"
65+
direction = "Inbound"
66+
access = "Allow"
67+
protocol = "Tcp"
68+
source_port_range = "*"
69+
destination_port_range = "443"
70+
source_address_prefix = "*"
71+
destination_address_prefix = "*"
72+
},
73+
{
74+
name = "aks-api-out-allow-1194",
75+
priority = "100"
76+
direction = "Outbound"
77+
access = "Allow"
78+
protocol = "Udp"
79+
source_port_range = "*"
80+
destination_port_range = "1194"
81+
source_address_prefix = "*"
82+
destination_address_prefix = "AzureCloud"
83+
},
84+
{
85+
name = "aks-api-out-allow-9000",
86+
priority = "110"
87+
direction = "Outbound"
88+
access = "Allow"
89+
protocol = "Tcp"
90+
source_port_range = "*"
91+
destination_port_range = "9000"
92+
source_address_prefix = "*"
93+
destination_address_prefix = "AzureCloud"
94+
},
95+
{
96+
name = "aks-ntp-out-allow",
97+
priority = "120"
98+
direction = "Outbound"
99+
access = "Allow"
100+
protocol = "Udp"
101+
source_port_range = "*"
102+
destination_port_range = "123"
103+
source_address_prefix = "*"
104+
destination_address_prefix = "*"
105+
},
106+
{
107+
name = "aks-https-out-allow-443",
108+
priority = "130"
109+
direction = "Outbound"
110+
access = "Allow"
111+
protocol = "Tcp"
112+
source_port_range = "*"
113+
destination_port_range = "443"
114+
source_address_prefix = "*"
115+
destination_address_prefix = "*"
116+
},
117+
]
118+
}
119+
azure_bastion_nsg = {
120+
121+
nsg = [
122+
{
123+
name = "bastion-in-allow",
124+
priority = "100"
125+
direction = "Inbound"
126+
access = "Allow"
127+
protocol = "Tcp"
128+
source_port_range = "*"
129+
destination_port_range = "443"
130+
source_address_prefix = "*"
131+
destination_address_prefix = "*"
132+
},
133+
{
134+
name = "bastion-control-in-allow-443",
135+
priority = "120"
136+
direction = "Inbound"
137+
access = "Allow"
138+
protocol = "Tcp"
139+
source_port_range = "*"
140+
destination_port_range = "135"
141+
source_address_prefix = "GatewayManager"
142+
destination_address_prefix = "*"
143+
},
144+
{
145+
name = "Kerberos-password-change",
146+
priority = "121"
147+
direction = "Inbound"
148+
access = "Allow"
149+
protocol = "Tcp"
150+
source_port_range = "*"
151+
destination_port_range = "4443"
152+
source_address_prefix = "GatewayManager"
153+
destination_address_prefix = "*"
154+
},
155+
{
156+
name = "bastion-vnet-out-allow-22",
157+
priority = "103"
158+
direction = "Outbound"
159+
access = "Allow"
160+
protocol = "Tcp"
161+
source_port_range = "*"
162+
destination_port_range = "22"
163+
source_address_prefix = "*"
164+
destination_address_prefix = "VirtualNetwork"
165+
},
166+
{
167+
name = "bastion-vnet-out-allow-3389",
168+
priority = "101"
169+
direction = "Outbound"
170+
access = "Allow"
171+
protocol = "Tcp"
172+
source_port_range = "*"
173+
destination_port_range = "3389"
174+
source_address_prefix = "*"
175+
destination_address_prefix = "VirtualNetwork"
176+
},
177+
{
178+
name = "bastion-azure-out-allow",
179+
priority = "120"
180+
direction = "Outbound"
181+
access = "Allow"
182+
protocol = "Tcp"
183+
source_port_range = "*"
184+
destination_port_range = "443"
185+
source_address_prefix = "*"
186+
destination_address_prefix = "AzureCloud"
187+
}
188+
]
189+
}
190+
}

‎modules/compute/aks/aks.tf

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ resource "azurerm_kubernetes_cluster" "aks" {
169169
for_each = try(var.settings.addon_profile.oms_agent[*], var.settings.oms_agent[*], {})
170170

171171
content {
172-
log_analytics_workspace_id = can(oms_agent.value.log_analytics_workspace_id) ? oms_agent.value.log_analytics_workspace_id : var.diagnostics.log_analytics[oms_agent.value.log_analytics_key].id
172+
log_analytics_workspace_id = can(oms_agent.value.log_analytics_workspace_id) ? oms_agent.value.log_analytics_workspace_id : var.diagnostics.log_analytics[oms_agent.value.log_analytics_key].id
173173
msi_auth_for_monitoring_enabled = try(oms_agent.value.msi_auth_for_monitoring_enabled, null)
174174
}
175175
}
@@ -349,8 +349,18 @@ resource "azurerm_kubernetes_cluster" "aks" {
349349
}
350350
}
351351

352+
dynamic "service_mesh_profile" {
353+
for_each = try(var.settings.service_mesh_profile[*], {})
354+
content {
355+
mode = try(service_mesh_profile.value.mode, null)
356+
internal_ingress_gateway_enabled = try(service_mesh_profile.value.internal_ingress_gateway_enabled, null)
357+
external_ingress_gateway_enabled = try(service_mesh_profile.value.external_ingress_gateway_enabled, null)
358+
}
359+
}
360+
352361
node_resource_group = azurecaf_name.rg_node.result
353362
oidc_issuer_enabled = try(var.settings.oidc_issuer_enabled, null)
363+
open_service_mesh_enabled = try(var.settings.open_service_mesh_enabled, null)
354364
private_cluster_enabled = try(var.settings.private_cluster_enabled, null)
355365
private_dns_zone_id = try(var.private_dns_zone_id, null)
356366
private_cluster_public_fqdn_enabled = try(var.settings.private_cluster_public_fqdn_enabled, null)

0 commit comments

Comments
 (0)