aula-07 e aula-08: Cluster Talos HA na Hetzner com Autoscaler
aula-07: Criação de imagem Talos customizada na Hetzner Cloud - Usa Talos Factory para gerar imagem ARM64/AMD64 - Inclui extensões: qemu-guest-agent, hcloud aula-08: Provisionamento de cluster Kubernetes Talos via OpenTofu - 3 Control Planes em HA (CAX11 ARM64) - 1 Worker Node (CAX11 ARM64) - Rede privada, Floating IP, Firewall - Cluster Autoscaler para Hetzner (0-5 workers extras) - Setup interativo com validação de pré-requisitos - Custo estimado: ~€18/mês (base) Também inclui: - .gitignore para ignorar arquivos sensíveis - CLAUDE.md com instruções do projeto
This commit is contained in:
Allyson de Paula
30
.gitignore
vendored
Normal file
30
.gitignore
vendored
Normal file
@@ -0,0 +1,30 @@
|
|||||||
|
# OpenTofu / Terraform
|
||||||
|
**/.terraform/
|
||||||
|
**/.tofu/
|
||||||
|
**/*.tfstate
|
||||||
|
**/*.tfstate.*
|
||||||
|
**/tfplan
|
||||||
|
**/tfplan.out
|
||||||
|
**/.terraform.lock.hcl
|
||||||
|
|
||||||
|
# Credenciais e configs sensíveis
|
||||||
|
**/terraform.tfvars
|
||||||
|
**/kubeconfig
|
||||||
|
**/kubeconfig-*
|
||||||
|
**/talosconfig
|
||||||
|
**/*.pem
|
||||||
|
**/*.key
|
||||||
|
|
||||||
|
# OS
|
||||||
|
.DS_Store
|
||||||
|
Thumbs.db
|
||||||
|
|
||||||
|
# Editor
|
||||||
|
*.swp
|
||||||
|
*.swo
|
||||||
|
*~
|
||||||
|
.idea/
|
||||||
|
.vscode/
|
||||||
|
|
||||||
|
# Node (aula-01)
|
||||||
|
node_modules/
|
||||||
114
CLAUDE.md
Normal file
114
CLAUDE.md
Normal file
@@ -0,0 +1,114 @@
|
|||||||
|
# CLAUDE.md
|
||||||
|
|
||||||
|
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
|
||||||
|
|
||||||
|
## Project Overview
|
||||||
|
|
||||||
|
This is a workshop repository for teaching Docker and Kubernetes concepts, specifically focusing on container health checks and liveness probes. It contains a deliberately "buggy" Node.js app that hangs after a configurable number of requests to demonstrate how container orchestration handles unhealthy containers.
|
||||||
|
|
||||||
|
## Repository Structure
|
||||||
|
|
||||||
|
- **aula-01/**: Docker Compose lesson - basic container deployment with restart policies
|
||||||
|
- **aula-02/**: Kubernetes lesson - deployment with liveness probes and ConfigMaps
|
||||||
|
- **aula-03/**: Kubernetes lesson - high availability with replicas and readiness probes
|
||||||
|
- **aula-04/**: Kubernetes lesson - NGINX Ingress with Keep Request (Lua) for zero-downtime
|
||||||
|
- **aula-05/**: Kubernetes lesson - KEDA + Victoria Metrics for metrics-based auto-scaling
|
||||||
|
- **aula-06/**: Kubernetes lesson - n8n deployment via Helm with Queue Mode (workers, webhooks, PostgreSQL, Redis)
|
||||||
|
- **aula-07/**: Talos Linux - creating custom Talos image for Hetzner Cloud
|
||||||
|
- **aula-08/**: OpenTofu - provisioning HA Talos Kubernetes cluster on Hetzner Cloud
|
||||||
|
|
||||||
|
## Running the Examples
|
||||||
|
|
||||||
|
### Aula 01 (Docker Compose)
|
||||||
|
```bash
|
||||||
|
cd aula-01
|
||||||
|
docker-compose up
|
||||||
|
```
|
||||||
|
The app runs on port 3000. After MAX_REQUESTS (default 3), the app stops responding.
|
||||||
|
|
||||||
|
### Aula 02 (Kubernetes)
|
||||||
|
```bash
|
||||||
|
cd aula-02
|
||||||
|
kubectl apply -f configmap.yaml
|
||||||
|
kubectl apply -f deployment.yaml
|
||||||
|
kubectl apply -f service.yaml
|
||||||
|
```
|
||||||
|
Access via NodePort 30080. The liveness probe at `/health` will detect when the app hangs and restart the container.
|
||||||
|
|
||||||
|
### Aula 03 (Kubernetes - High Availability)
|
||||||
|
```bash
|
||||||
|
cd aula-03
|
||||||
|
kubectl apply -f configmap.yaml
|
||||||
|
kubectl apply -f deployment.yaml
|
||||||
|
kubectl apply -f service.yaml
|
||||||
|
```
|
||||||
|
Builds on Aula 02 with multiple replicas and a readiness probe. When one pod hangs, the others continue serving requests. The readiness probe removes unhealthy pods from the Service immediately, while the liveness probe restarts them.
|
||||||
|
|
||||||
|
### Aula 04 (Kubernetes - NGINX Ingress with Keep Request)
|
||||||
|
Requires NGINX Ingress Controller with Lua support.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd aula-04
|
||||||
|
kubectl apply -f configmap.yaml
|
||||||
|
kubectl apply -f deployment.yaml
|
||||||
|
kubectl apply -f service.yaml
|
||||||
|
kubectl apply -f ingress-nginx.yaml
|
||||||
|
```
|
||||||
|
Access via NGINX Ingress. The Keep Request pattern uses Lua to hold requests when backends are unavailable, waiting up to 99s for a pod to become ready instead of returning 503 immediately. This eliminates user-visible failures during pod restarts.
|
||||||
|
|
||||||
|
### Aula 05 (Kubernetes - KEDA Auto-scaling)
|
||||||
|
```bash
|
||||||
|
cd aula-05
|
||||||
|
./setup.sh
|
||||||
|
```
|
||||||
|
Installs Victoria Metrics (metrics collection), KEDA (event-driven autoscaling), and NGINX Ingress. The ScaledObject monitors metrics like unavailable pods and restart counts, automatically scaling the deployment from 5 to 30 replicas based on demand.
|
||||||
|
|
||||||
|
### Aula 06 (Kubernetes - n8n via Helm)
|
||||||
|
```bash
|
||||||
|
cd aula-06
|
||||||
|
./setup.sh
|
||||||
|
```
|
||||||
|
Deploys n8n workflow automation platform via Helm chart with Queue Mode architecture: main node, workers (2-5 replicas with HPA), webhooks (1-3 replicas with HPA), PostgreSQL, and Redis. Access via http://n8n.localhost (requires NGINX Ingress).
|
||||||
|
|
||||||
|
### Aula 07 (Talos Linux - Custom Image)
|
||||||
|
Follow the instructions in `aula-07/README.md` to create a custom Talos Linux image on Hetzner Cloud using Talos Factory. This is a prerequisite for Aula 08.
|
||||||
|
|
||||||
|
### Aula 08 (OpenTofu - Talos Cluster on Hetzner Cloud)
|
||||||
|
```bash
|
||||||
|
cd aula-08
|
||||||
|
./setup.sh
|
||||||
|
```
|
||||||
|
Provisions a full HA Kubernetes cluster on Hetzner Cloud using OpenTofu:
|
||||||
|
- 3x Control Plane nodes (CAX11 ARM64)
|
||||||
|
- 1x Worker node (CAX11 ARM64)
|
||||||
|
- Private network, Floating IP, Firewall
|
||||||
|
- Cluster Autoscaler support (1-5 workers)
|
||||||
|
- Estimated cost: ~€18/month (base), up to ~€33/month with max autoscaling
|
||||||
|
|
||||||
|
Prerequisites:
|
||||||
|
- OpenTofu (`brew install opentofu`)
|
||||||
|
- talosctl (`brew install siderolabs/tap/talosctl`)
|
||||||
|
- kubectl
|
||||||
|
- Hetzner Cloud API token
|
||||||
|
- Talos image ID from Aula 07
|
||||||
|
|
||||||
|
Optional - Enable cluster autoscaling:
|
||||||
|
```bash
|
||||||
|
./install-autoscaler.sh
|
||||||
|
```
|
||||||
|
This installs the Kubernetes Cluster Autoscaler configured for Hetzner Cloud, automatically scaling workers from 1 to 5 based on pending pods.
|
||||||
|
|
||||||
|
To destroy the infrastructure: `./cleanup.sh`
|
||||||
|
|
||||||
|
## App Behavior
|
||||||
|
|
||||||
|
The Node.js app (`app.js`) is intentionally designed to:
|
||||||
|
1. Accept requests normally until `MAX_REQUESTS` is reached
|
||||||
|
2. Stop responding (hang) after the limit, simulating a crashed but running process
|
||||||
|
3. The `/health` endpoint also stops responding when the app is "stuck"
|
||||||
|
|
||||||
|
This behavior demonstrates why process-level monitoring (restart: always) is insufficient and why application-level health checks (liveness probes) are necessary.
|
||||||
|
|
||||||
|
## Environment Variables
|
||||||
|
|
||||||
|
- `MAX_REQUESTS`: Number of requests before the app hangs (default: 3)
|
||||||
@@ -1,26 +0,0 @@
|
|||||||
# Middleware Retry - tenta outros pods quando um falha
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: Middleware
|
|
||||||
metadata:
|
|
||||||
name: retry-middleware
|
|
||||||
spec:
|
|
||||||
retry:
|
|
||||||
attempts: 5 # 5 tentativas
|
|
||||||
initialInterval: 500ms # 500ms entre ciclos
|
|
||||||
---
|
|
||||||
# IngressRoute
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: node-bugado
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- web
|
|
||||||
routes:
|
|
||||||
- match: PathPrefix(`/`)
|
|
||||||
kind: Rule
|
|
||||||
middlewares:
|
|
||||||
- name: retry-middleware
|
|
||||||
services:
|
|
||||||
- name: node-bugado
|
|
||||||
port: 3000
|
|
||||||
@@ -204,7 +204,7 @@ echo " # Ver todos os pods"
|
|||||||
echo " kubectl get pods -n n8n"
|
echo " kubectl get pods -n n8n"
|
||||||
echo ""
|
echo ""
|
||||||
echo " # Ver logs do n8n"
|
echo " # Ver logs do n8n"
|
||||||
echo " kubectl logs -f -l app.kubernetes.io/component=main -n n8n"
|
echo " kubectl logs -f -n n8n deployment/n8n"
|
||||||
echo ""
|
echo ""
|
||||||
echo " # Ver HPA (autoscaler)"
|
echo " # Ver HPA (autoscaler)"
|
||||||
echo " kubectl get hpa -n n8n"
|
echo " kubectl get hpa -n n8n"
|
||||||
@@ -218,6 +218,12 @@ echo ""
|
|||||||
echo " # Fazer upgrade do helm chart"
|
echo " # Fazer upgrade do helm chart"
|
||||||
echo " helm upgrade --reuse-values --values --custom-values.yaml n8n community-charts/n8n --namespace n8n"
|
echo " helm upgrade --reuse-values --values --custom-values.yaml n8n community-charts/n8n --namespace n8n"
|
||||||
echo ""
|
echo ""
|
||||||
|
echo " # Verificar historico de releases"
|
||||||
|
echo " helm history n8n -n n8n"
|
||||||
|
echo ""
|
||||||
|
echo " # Fazer rollback do historico de releases"
|
||||||
|
echo " helm rollback n8n <nº da release>"
|
||||||
|
echo ""
|
||||||
echo "=============================================="
|
echo "=============================================="
|
||||||
echo ""
|
echo ""
|
||||||
|
|
||||||
|
|||||||
63
aula-07/README.md
Normal file
63
aula-07/README.md
Normal file
@@ -0,0 +1,63 @@
|
|||||||
|
---
|
||||||
|
criado: 2025-12-27T01:10:54-03:00
|
||||||
|
atualizado: 2025-12-27T02:25:34-03:00
|
||||||
|
---
|
||||||
|
|
||||||
|
|
||||||
|
A Hetzner Cloud não oferece suporte ao upload de imagens personalizadas. Somente via suporte [issue 3599](https://github.com/siderolabs/talos/issues/3599#issuecomment-841172018)
|
||||||
|
|
||||||
|
Workaround
|
||||||
|
1. Execute uma instância no modo de recuperação e substitua o sistema operacional pela imagem do Talos.
|
||||||
|
2. 🚧 De a cordo com a documentacao oficial é possivel usar [o Hashicorp Packer](https://www.packer.io/docs/builders/hetzner-cloud) para preparar uma imagem. Mas a documentação oficial foi removida dos builders. E nos meus testes deu kernel panic....
|
||||||
|
|
||||||
|
|
||||||
|
Passo 1 -> https://factory.talos.dev/
|
||||||
|
|
||||||
|
- [ ] siderolabs/amd-ucode / siderolabs/intel-ucode
|
||||||
|
- Spectre / Meltdown (V1, V2, V4)
|
||||||
|
- Predição de desvios
|
||||||
|
- Leitura de memória privilegiada a partir de userland
|
||||||
|
- Zenbleed (CVE-2023-20593)
|
||||||
|
- CPUs AMD Zen 2
|
||||||
|
- Vazamento de registros via execução especulativa
|
||||||
|
- Impacta **VMs e containers**
|
||||||
|
- Speculative Return Stack Overflow (SRSO)
|
||||||
|
- CPUs AMD modernas
|
||||||
|
- Jailbreak
|
||||||
|
- [ ] siderolabs/qemu-guest-agent (Hetzner usa QEMU / KVM)
|
||||||
|
- [ ] siderolabs/stargz-snapshotter (https://github.com/containerd/stargz-snapshotter)
|
||||||
|
- [ ] siderolabs/util-linux-tools (lsblk, mount, findmnt)
|
||||||
|
- [ ] siderolabs/binfmt-misc (Se for usar imagem multi-arch)
|
||||||
|
- siderolabs/tailscale OU cloudflared -> https://spot.rackspace.com/
|
||||||
|
- zfs -> Se for Baremetal (~50% mais rapido que ext4)
|
||||||
|
|
||||||
|
bootloader: dual-boot
|
||||||
|
|
||||||
|
https://factory.talos.dev/?arch=amd64&board=undefined&bootloader=dual-boot&cmdline-set=true&extensions=-&extensions=siderolabs%2Famd-ucode&extensions=siderolabs%2Fbinfmt-misc&extensions=siderolabs%2Fintel-ucode&extensions=siderolabs%2Fqemu-guest-agent&extensions=siderolabs%2Fstargz-snapshotter&extensions=siderolabs%2Futil-linux-tools&platform=hcloud&secureboot=undefined&target=cloud&version=1.12.0
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Testar se vc entrou em Rescue mode
|
||||||
|
df
|
||||||
|
|
||||||
|
### Resultado será tipo:
|
||||||
|
# Filesystem 1K-blocks Used Available Use% Mounted on
|
||||||
|
# udev 987432 0 987432 0% /dev
|
||||||
|
# 213.133.99.101:/nfs 308577696 247015616 45817536 85% /root/.oldroot/nfs
|
||||||
|
# overlay 995672 8340 987332 1% /
|
||||||
|
# tmpfs 995672 0 995672 0% /dev/shm
|
||||||
|
# tmpfs 398272 572 397700 1% /run
|
||||||
|
# tmpfs 5120 0 5120 0% /run/lock
|
||||||
|
# tmpfs 199132 0 199132 0% /run/user/0
|
||||||
|
|
||||||
|
# Baixar a imagem do Talos
|
||||||
|
cd /tmp
|
||||||
|
wget -O /tmp/talos.raw.xz https://factory.talos.dev/image/c4f17c623d4ac547a243489f1b3285afd64a76b491b1c5c24ef6363587cef55f/v1.12.0/hcloud-amd64.raw.xz
|
||||||
|
|
||||||
|
# Escrever o sistema (Vai demorar uns 4 a 5 minutos)
|
||||||
|
xz -d -c /tmp/talos.raw.xz | dd of=/dev/sda && sync
|
||||||
|
|
||||||
|
# Desligue a instancia antes do snapshot
|
||||||
|
shutdown -h now
|
||||||
|
```
|
||||||
132
aula-08/cleanup.sh
Executable file
132
aula-08/cleanup.sh
Executable file
@@ -0,0 +1,132 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# Aula 08 - Cleanup
|
||||||
|
# Destrói a infraestrutura provisionada
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Cores para output
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
BLUE='\033[0;34m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
cd "$SCRIPT_DIR"
|
||||||
|
|
||||||
|
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
|
||||||
|
log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
|
||||||
|
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
||||||
|
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "============================================"
|
||||||
|
echo " Cleanup - Destruir Infraestrutura"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Verificar se tofu está instalado
|
||||||
|
if ! command -v tofu &> /dev/null; then
|
||||||
|
log_error "OpenTofu não encontrado!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Verificar se há state
|
||||||
|
if [ ! -f "terraform.tfstate" ] && [ ! -d ".terraform" ]; then
|
||||||
|
log_warn "Nenhuma infraestrutura encontrada para destruir."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Verificar workers do autoscaler (criados fora do OpenTofu)
|
||||||
|
if [ -f "kubeconfig" ]; then
|
||||||
|
export KUBECONFIG="$SCRIPT_DIR/kubeconfig"
|
||||||
|
|
||||||
|
AUTOSCALER_WORKERS=$(kubectl get nodes -l node.kubernetes.io/instance-type=cax11 \
|
||||||
|
--no-headers 2>/dev/null | wc -l | tr -d ' ' || echo "0")
|
||||||
|
|
||||||
|
if [ "$AUTOSCALER_WORKERS" -gt "1" ]; then
|
||||||
|
log_warn "Detectados $AUTOSCALER_WORKERS workers (incluindo os do autoscaler)"
|
||||||
|
log_warn "Workers criados pelo autoscaler serão removidos via API Hetzner"
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
log_warn "ATENÇÃO: Esta operação irá DESTRUIR todos os recursos!"
|
||||||
|
echo ""
|
||||||
|
echo "Recursos que serão removidos:"
|
||||||
|
echo " - 3x Control Plane nodes"
|
||||||
|
echo " - Workers (incluindo os criados pelo autoscaler)"
|
||||||
|
echo " - Rede privada"
|
||||||
|
echo " - Floating IP"
|
||||||
|
echo " - Firewall"
|
||||||
|
echo " - Placement Group"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
read -p "Tem certeza que deseja continuar? (digite 'sim' para confirmar): " confirm
|
||||||
|
|
||||||
|
if [ "$confirm" != "sim" ]; then
|
||||||
|
log_info "Operação cancelada"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Remover workers do autoscaler primeiro (se existirem)
|
||||||
|
if [ -f "terraform.tfvars" ]; then
|
||||||
|
HCLOUD_TOKEN=$(grep 'hcloud_token' terraform.tfvars | cut -d'"' -f2)
|
||||||
|
CLUSTER_NAME=$(tofu output -raw cluster_name 2>/dev/null || echo "")
|
||||||
|
|
||||||
|
if [ -n "$HCLOUD_TOKEN" ] && [ -n "$CLUSTER_NAME" ]; then
|
||||||
|
log_info "Verificando workers do autoscaler..."
|
||||||
|
|
||||||
|
# Listar servers com label do cluster que NÃO são gerenciados pelo tofu
|
||||||
|
AUTOSCALER_SERVERS=$(HCLOUD_TOKEN="$HCLOUD_TOKEN" hcloud server list \
|
||||||
|
-l cluster="$CLUSTER_NAME" \
|
||||||
|
-o noheader -o columns=id,name 2>/dev/null | \
|
||||||
|
grep -E "worker-pool" || true)
|
||||||
|
|
||||||
|
if [ -n "$AUTOSCALER_SERVERS" ]; then
|
||||||
|
log_warn "Removendo workers criados pelo autoscaler..."
|
||||||
|
echo "$AUTOSCALER_SERVERS" | while read -r server_id server_name; do
|
||||||
|
log_info " Removendo $server_name (ID: $server_id)..."
|
||||||
|
HCLOUD_TOKEN="$HCLOUD_TOKEN" hcloud server delete "$server_id" --quiet 2>/dev/null || true
|
||||||
|
done
|
||||||
|
log_success "Workers do autoscaler removidos"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
log_info "Destruindo infraestrutura via OpenTofu..."
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
tofu destroy -auto-approve
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
log_success "Infraestrutura destruída!"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Limpar arquivos locais (manter .terraform para re-deploy rápido)
|
||||||
|
log_info "Limpando arquivos gerados..."
|
||||||
|
|
||||||
|
rm -f kubeconfig talosconfig tfplan terraform.tfstate terraform.tfstate.backup
|
||||||
|
|
||||||
|
log_success "Arquivos removidos"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Perguntar sobre terraform.tfvars
|
||||||
|
if [ -f "terraform.tfvars" ]; then
|
||||||
|
read -p "Remover terraform.tfvars também? (s/N): " remove_tfvars
|
||||||
|
if [[ "$remove_tfvars" =~ ^[Ss]$ ]]; then
|
||||||
|
rm -f terraform.tfvars
|
||||||
|
log_success "terraform.tfvars removido"
|
||||||
|
else
|
||||||
|
log_info "terraform.tfvars mantido (útil para re-deploy)"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
log_success "Cleanup concluído!"
|
||||||
158
aula-08/cluster-autoscaler.yaml
Normal file
158
aula-08/cluster-autoscaler.yaml
Normal file
@@ -0,0 +1,158 @@
|
|||||||
|
############################################################
|
||||||
|
# Cluster Autoscaler para Hetzner Cloud + Talos
|
||||||
|
# Escala workers automaticamente de 1 a 5 nodes
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: cluster-autoscaler
|
||||||
|
|
||||||
|
# Secret is created via install-autoscaler.sh (kubectl create secret)
|
||||||
|
# to properly handle base64 encoding of cloud-init
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: cluster-autoscaler
|
||||||
|
namespace: cluster-autoscaler
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cluster-autoscaler
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events", "endpoints"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods/eviction"]
|
||||||
|
verbs: ["create"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods/status"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["endpoints"]
|
||||||
|
resourceNames: ["cluster-autoscaler"]
|
||||||
|
verbs: ["get", "update"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["nodes"]
|
||||||
|
verbs: ["watch", "list", "get", "update"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["namespaces", "pods", "services", "replicationcontrollers", "persistentvolumeclaims", "persistentvolumes"]
|
||||||
|
verbs: ["watch", "list", "get"]
|
||||||
|
- apiGroups: ["batch"]
|
||||||
|
resources: ["jobs", "cronjobs"]
|
||||||
|
verbs: ["watch", "list", "get"]
|
||||||
|
- apiGroups: ["batch", "extensions"]
|
||||||
|
resources: ["jobs"]
|
||||||
|
verbs: ["get", "list", "patch", "watch"]
|
||||||
|
- apiGroups: ["extensions"]
|
||||||
|
resources: ["replicasets", "daemonsets"]
|
||||||
|
verbs: ["watch", "list", "get"]
|
||||||
|
- apiGroups: ["policy"]
|
||||||
|
resources: ["poddisruptionbudgets"]
|
||||||
|
verbs: ["watch", "list"]
|
||||||
|
- apiGroups: ["apps"]
|
||||||
|
resources: ["statefulsets", "replicasets", "daemonsets"]
|
||||||
|
verbs: ["watch", "list", "get"]
|
||||||
|
- apiGroups: ["storage.k8s.io"]
|
||||||
|
resources: ["storageclasses", "csinodes", "csidrivers", "csistoragecapacities"]
|
||||||
|
verbs: ["watch", "list", "get"]
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources: ["leases"]
|
||||||
|
verbs: ["create"]
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources: ["leases"]
|
||||||
|
resourceNames: ["cluster-autoscaler"]
|
||||||
|
verbs: ["get", "update"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["configmaps"]
|
||||||
|
verbs: ["create", "get", "update", "delete", "list", "watch"]
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cluster-autoscaler
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cluster-autoscaler
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: cluster-autoscaler
|
||||||
|
namespace: cluster-autoscaler
|
||||||
|
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: cluster-autoscaler
|
||||||
|
namespace: cluster-autoscaler
|
||||||
|
labels:
|
||||||
|
app: cluster-autoscaler
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: cluster-autoscaler
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: cluster-autoscaler
|
||||||
|
spec:
|
||||||
|
serviceAccountName: cluster-autoscaler
|
||||||
|
# Use host network to access external APIs (Hetzner)
|
||||||
|
hostNetwork: true
|
||||||
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
|
# Workaround: Talos DNS proxy doesn't forward to upstream correctly
|
||||||
|
hostAliases:
|
||||||
|
- ip: "213.239.246.73"
|
||||||
|
hostnames:
|
||||||
|
- "api.hetzner.cloud"
|
||||||
|
containers:
|
||||||
|
- name: cluster-autoscaler
|
||||||
|
image: registry.k8s.io/autoscaling/cluster-autoscaler:v1.31.0
|
||||||
|
command:
|
||||||
|
- ./cluster-autoscaler
|
||||||
|
- --cloud-provider=hetzner
|
||||||
|
- --nodes=0:5:CAX11:nbg1:worker-pool
|
||||||
|
- --nodes=0:0:CAX11:nbg1:draining-node-pool
|
||||||
|
- --scale-down-enabled=true
|
||||||
|
- --scale-down-delay-after-add=5m
|
||||||
|
- --scale-down-unneeded-time=3m
|
||||||
|
- --scale-down-utilization-threshold=0.5
|
||||||
|
- --skip-nodes-with-local-storage=false
|
||||||
|
- --skip-nodes-with-system-pods=false
|
||||||
|
- --balance-similar-node-groups=true
|
||||||
|
- --v=4
|
||||||
|
env:
|
||||||
|
- name: HCLOUD_TOKEN
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: hcloud-autoscaler
|
||||||
|
key: token
|
||||||
|
- name: HCLOUD_CLOUD_INIT
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: hcloud-autoscaler
|
||||||
|
key: cloud-init
|
||||||
|
- name: HCLOUD_IMAGE
|
||||||
|
value: "${TALOS_IMAGE_ID}"
|
||||||
|
- name: HCLOUD_NETWORK
|
||||||
|
value: "${NETWORK_NAME}"
|
||||||
|
- name: HCLOUD_FIREWALL
|
||||||
|
value: "${FIREWALL_NAME}"
|
||||||
|
- name: HCLOUD_SSH_KEY
|
||||||
|
value: "${SSH_KEY_NAME}"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 300Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 500Mi
|
||||||
139
aula-08/install-autoscaler.sh
Executable file
139
aula-08/install-autoscaler.sh
Executable file
@@ -0,0 +1,139 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# Instala o Cluster Autoscaler no cluster Talos
|
||||||
|
# Requer: cluster provisionado via setup.sh
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Cores
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
BLUE='\033[0;34m'
|
||||||
|
NC='\033[0m'
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
cd "$SCRIPT_DIR"
|
||||||
|
|
||||||
|
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
|
||||||
|
log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
|
||||||
|
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
||||||
|
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "============================================"
|
||||||
|
echo " Instalando Cluster Autoscaler"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Verificar pré-requisitos
|
||||||
|
if [ ! -f "kubeconfig" ]; then
|
||||||
|
log_error "kubeconfig não encontrado! Execute setup.sh primeiro."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -f "terraform.tfvars" ]; then
|
||||||
|
log_error "terraform.tfvars não encontrado!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
export KUBECONFIG="$SCRIPT_DIR/kubeconfig"
|
||||||
|
|
||||||
|
# Verificar conexão com cluster
|
||||||
|
log_info "Verificando conexão com o cluster..."
|
||||||
|
if ! kubectl get nodes &>/dev/null; then
|
||||||
|
log_error "Não foi possível conectar ao cluster!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
log_success "Conectado ao cluster"
|
||||||
|
|
||||||
|
# Obter valores do OpenTofu
|
||||||
|
log_info "Obtendo configurações do OpenTofu..."
|
||||||
|
|
||||||
|
WORKER_CONFIG_BASE64=$(tofu output -raw autoscaler_worker_config 2>/dev/null)
|
||||||
|
TALOS_IMAGE_ID=$(tofu output -raw autoscaler_image_id 2>/dev/null)
|
||||||
|
CLUSTER_NAME=$(tofu output -raw cluster_name 2>/dev/null)
|
||||||
|
NETWORK_ID=$(tofu output -raw network_id 2>/dev/null)
|
||||||
|
FIREWALL_ID=$(tofu output -raw firewall_id 2>/dev/null)
|
||||||
|
SSH_KEY_NAME=$(tofu output -raw ssh_key_name 2>/dev/null)
|
||||||
|
|
||||||
|
# Obter token do terraform.tfvars
|
||||||
|
HCLOUD_TOKEN=$(grep 'hcloud_token' terraform.tfvars | cut -d'"' -f2)
|
||||||
|
|
||||||
|
if [ -z "$WORKER_CONFIG_BASE64" ] || [ -z "$HCLOUD_TOKEN" ]; then
|
||||||
|
log_error "Não foi possível obter as configurações necessárias!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
log_success "Configurações obtidas"
|
||||||
|
echo " - Cluster: $CLUSTER_NAME"
|
||||||
|
echo " - Image ID: $TALOS_IMAGE_ID"
|
||||||
|
echo " - Network ID: $NETWORK_ID"
|
||||||
|
echo " - SSH Key: $SSH_KEY_NAME"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Criar namespace com política privileged (necessário para hostNetwork)
|
||||||
|
log_info "Criando namespace cluster-autoscaler..."
|
||||||
|
kubectl create namespace cluster-autoscaler --dry-run=client -o yaml | kubectl apply -f -
|
||||||
|
kubectl label namespace cluster-autoscaler pod-security.kubernetes.io/enforce=privileged --overwrite
|
||||||
|
|
||||||
|
# Criar secret com credenciais
|
||||||
|
log_info "Criando secret com credenciais..."
|
||||||
|
kubectl create secret generic hcloud-autoscaler \
|
||||||
|
--namespace cluster-autoscaler \
|
||||||
|
--from-literal=token="$HCLOUD_TOKEN" \
|
||||||
|
--from-literal=cloud-init="$WORKER_CONFIG_BASE64" \
|
||||||
|
--dry-run=client -o yaml | kubectl apply -f -
|
||||||
|
|
||||||
|
log_success "Secret criado"
|
||||||
|
|
||||||
|
# Aplicar RBAC e Deployment
|
||||||
|
log_info "Aplicando manifesto do cluster-autoscaler..."
|
||||||
|
|
||||||
|
# Substituir variáveis no template e aplicar
|
||||||
|
cat cluster-autoscaler.yaml | \
|
||||||
|
sed "s|\${TALOS_IMAGE_ID}|$TALOS_IMAGE_ID|g" | \
|
||||||
|
sed "s|\${NETWORK_NAME}|$CLUSTER_NAME-network|g" | \
|
||||||
|
sed "s|\${FIREWALL_NAME}|$CLUSTER_NAME-firewall|g" | \
|
||||||
|
sed "s|\${SSH_KEY_NAME}|$SSH_KEY_NAME|g" | \
|
||||||
|
kubectl apply -f -
|
||||||
|
|
||||||
|
log_success "Cluster Autoscaler instalado!"
|
||||||
|
|
||||||
|
# Aguardar pod ficar pronto
|
||||||
|
log_info "Aguardando pod do autoscaler..."
|
||||||
|
kubectl wait --for=condition=ready pod \
|
||||||
|
-l app=cluster-autoscaler \
|
||||||
|
-n cluster-autoscaler \
|
||||||
|
--timeout=120s
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
log_success "Cluster Autoscaler pronto!"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "============================================"
|
||||||
|
echo " Configuração do Autoscaler"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
echo " Pool: worker-pool"
|
||||||
|
echo " Tipo: CAX11 (ARM64)"
|
||||||
|
echo " Região: nbg1 (Nuremberg)"
|
||||||
|
echo " Min nodes: 1"
|
||||||
|
echo " Max nodes: 5"
|
||||||
|
echo ""
|
||||||
|
echo " Scale down após: 5 minutos"
|
||||||
|
echo " Utilização mínima: 50%"
|
||||||
|
echo ""
|
||||||
|
echo "Comandos úteis:"
|
||||||
|
echo ""
|
||||||
|
echo " # Ver logs do autoscaler"
|
||||||
|
echo " kubectl logs -n cluster-autoscaler -l app=cluster-autoscaler -f"
|
||||||
|
echo ""
|
||||||
|
echo " # Ver status dos nodes"
|
||||||
|
echo " kubectl get nodes"
|
||||||
|
echo ""
|
||||||
|
echo " # Testar scale up (criar pods pending)"
|
||||||
|
echo " kubectl create deployment test --image=nginx --replicas=10"
|
||||||
|
echo ""
|
||||||
391
aula-08/main.tf
Normal file
391
aula-08/main.tf
Normal file
@@ -0,0 +1,391 @@
|
|||||||
|
############################################################
|
||||||
|
# Hetzner Talos Kubernetes Cluster - Base Infrastructure
|
||||||
|
# Using custom Talos image created from ISO
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# PROVIDERS CONFIGURATION
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
provider "hcloud" {
|
||||||
|
token = var.hcloud_token
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# DATA SOURCES
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
# Use the custom Talos image created in aula-07
|
||||||
|
data "hcloud_image" "talos" {
|
||||||
|
id = var.talos_image_id
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# RANDOM RESOURCES
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "random_string" "cluster_id" {
|
||||||
|
length = 6
|
||||||
|
special = false
|
||||||
|
lower = true
|
||||||
|
upper = false
|
||||||
|
}
|
||||||
|
|
||||||
|
locals {
|
||||||
|
cluster_name = "talos-${random_string.cluster_id.result}"
|
||||||
|
common_labels = {
|
||||||
|
cluster = local.cluster_name
|
||||||
|
environment = var.environment
|
||||||
|
managed_by = "terraform"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# SSH KEY (for emergency access only)
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
data "hcloud_ssh_keys" "all" {}
|
||||||
|
|
||||||
|
locals {
|
||||||
|
ssh_key_normalized = trimspace(split(" ", var.ssh_public_key)[0] == "ssh-rsa" ?
|
||||||
|
join(" ", slice(split(" ", var.ssh_public_key), 0, 2)) :
|
||||||
|
var.ssh_public_key)
|
||||||
|
|
||||||
|
ssh_key_matches = [
|
||||||
|
for key in data.hcloud_ssh_keys.all.ssh_keys : key.id
|
||||||
|
if key.public_key == local.ssh_key_normalized || key.public_key == var.ssh_public_key
|
||||||
|
]
|
||||||
|
|
||||||
|
ssh_key_id = length(local.ssh_key_matches) > 0 ? local.ssh_key_matches[0] : hcloud_ssh_key.admin[0].id
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "hcloud_ssh_key" "admin" {
|
||||||
|
count = length(local.ssh_key_matches) == 0 ? 1 : 0
|
||||||
|
name = "${local.cluster_name}-admin"
|
||||||
|
public_key = var.ssh_public_key
|
||||||
|
labels = local.common_labels
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# NETWORK CONFIGURATION
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "hcloud_network" "cluster" {
|
||||||
|
name = "${local.cluster_name}-network"
|
||||||
|
ip_range = "10.0.0.0/16"
|
||||||
|
labels = local.common_labels
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "hcloud_network_subnet" "cluster" {
|
||||||
|
type = "cloud"
|
||||||
|
network_id = hcloud_network.cluster.id
|
||||||
|
network_zone = "eu-central"
|
||||||
|
ip_range = "10.0.1.0/24"
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# FIREWALL CONFIGURATION
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "hcloud_firewall" "cluster" {
|
||||||
|
name = "${local.cluster_name}-firewall"
|
||||||
|
labels = local.common_labels
|
||||||
|
|
||||||
|
# Talos API access
|
||||||
|
rule {
|
||||||
|
direction = "in"
|
||||||
|
protocol = "tcp"
|
||||||
|
port = "50000"
|
||||||
|
source_ips = ["0.0.0.0/0", "::/0"]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Kubernetes API
|
||||||
|
rule {
|
||||||
|
direction = "in"
|
||||||
|
protocol = "tcp"
|
||||||
|
port = "6443"
|
||||||
|
source_ips = ["0.0.0.0/0", "::/0"]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Allow HTTP/HTTPS for Ingress
|
||||||
|
rule {
|
||||||
|
direction = "in"
|
||||||
|
protocol = "tcp"
|
||||||
|
port = "80"
|
||||||
|
source_ips = ["0.0.0.0/0", "::/0"]
|
||||||
|
}
|
||||||
|
|
||||||
|
rule {
|
||||||
|
direction = "in"
|
||||||
|
protocol = "tcp"
|
||||||
|
port = "443"
|
||||||
|
source_ips = ["0.0.0.0/0", "::/0"]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Allow NodePort range (for services)
|
||||||
|
rule {
|
||||||
|
direction = "in"
|
||||||
|
protocol = "tcp"
|
||||||
|
port = "30000-32767"
|
||||||
|
source_ips = ["0.0.0.0/0", "::/0"]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Allow all outbound traffic
|
||||||
|
rule {
|
||||||
|
direction = "out"
|
||||||
|
protocol = "tcp"
|
||||||
|
port = "any"
|
||||||
|
destination_ips = ["0.0.0.0/0", "::/0"]
|
||||||
|
}
|
||||||
|
|
||||||
|
rule {
|
||||||
|
direction = "out"
|
||||||
|
protocol = "udp"
|
||||||
|
port = "any"
|
||||||
|
destination_ips = ["0.0.0.0/0", "::/0"]
|
||||||
|
}
|
||||||
|
|
||||||
|
rule {
|
||||||
|
direction = "out"
|
||||||
|
protocol = "icmp"
|
||||||
|
destination_ips = ["0.0.0.0/0", "::/0"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# PLACEMENT GROUP (keep nodes close for low latency)
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "hcloud_placement_group" "cluster" {
|
||||||
|
name = "${local.cluster_name}-pg"
|
||||||
|
type = "spread"
|
||||||
|
labels = local.common_labels
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# CONTROL PLANE NODES (HA with 3 CAX11 nodes)
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "hcloud_server" "control_plane" {
|
||||||
|
count = 3
|
||||||
|
name = "${local.cluster_name}-cp-${count.index}"
|
||||||
|
server_type = "cax11"
|
||||||
|
image = data.hcloud_image.talos.id
|
||||||
|
location = "nbg1" # CAX11 only available in Nuremberg
|
||||||
|
ssh_keys = [local.ssh_key_id]
|
||||||
|
|
||||||
|
firewall_ids = [hcloud_firewall.cluster.id]
|
||||||
|
placement_group_id = hcloud_placement_group.cluster.id
|
||||||
|
|
||||||
|
labels = merge(local.common_labels, {
|
||||||
|
role = "control-plane"
|
||||||
|
node = "cp-${count.index}"
|
||||||
|
arch = "arm64"
|
||||||
|
})
|
||||||
|
|
||||||
|
public_net {
|
||||||
|
ipv4_enabled = true
|
||||||
|
ipv6_enabled = true
|
||||||
|
}
|
||||||
|
|
||||||
|
lifecycle {
|
||||||
|
ignore_changes = [ssh_keys]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "hcloud_server_network" "control_plane" {
|
||||||
|
count = 3
|
||||||
|
server_id = hcloud_server.control_plane[count.index].id
|
||||||
|
network_id = hcloud_network.cluster.id
|
||||||
|
ip = "10.0.1.${10 + count.index}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Floating IP for stable control plane access
|
||||||
|
resource "hcloud_floating_ip" "control_plane" {
|
||||||
|
type = "ipv4"
|
||||||
|
name = "${local.cluster_name}-cp-ip"
|
||||||
|
home_location = "nbg1"
|
||||||
|
labels = local.common_labels
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "hcloud_floating_ip_assignment" "control_plane" {
|
||||||
|
floating_ip_id = hcloud_floating_ip.control_plane.id
|
||||||
|
server_id = hcloud_server.control_plane[0].id
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# WORKER NODE (Single CAX11)
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "hcloud_server" "worker" {
|
||||||
|
count = 1
|
||||||
|
name = "${local.cluster_name}-worker-${count.index}"
|
||||||
|
server_type = "cax11"
|
||||||
|
image = data.hcloud_image.talos.id
|
||||||
|
location = "nbg1"
|
||||||
|
ssh_keys = [local.ssh_key_id]
|
||||||
|
|
||||||
|
firewall_ids = [hcloud_firewall.cluster.id]
|
||||||
|
placement_group_id = hcloud_placement_group.cluster.id
|
||||||
|
|
||||||
|
labels = merge(local.common_labels, {
|
||||||
|
role = "worker"
|
||||||
|
node = "worker-${count.index}"
|
||||||
|
arch = "arm64"
|
||||||
|
})
|
||||||
|
|
||||||
|
public_net {
|
||||||
|
ipv4_enabled = true
|
||||||
|
ipv6_enabled = true
|
||||||
|
}
|
||||||
|
|
||||||
|
lifecycle {
|
||||||
|
ignore_changes = [ssh_keys]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "hcloud_server_network" "worker" {
|
||||||
|
count = 1
|
||||||
|
server_id = hcloud_server.worker[count.index].id
|
||||||
|
network_id = hcloud_network.cluster.id
|
||||||
|
ip = "10.0.1.${20 + count.index}"
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# TALOS CONFIGURATION
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
# Generate Talos machine secrets
|
||||||
|
resource "talos_machine_secrets" "this" {
|
||||||
|
talos_version = var.talos_version
|
||||||
|
}
|
||||||
|
|
||||||
|
# Generate Talos client configuration
|
||||||
|
data "talos_client_configuration" "this" {
|
||||||
|
cluster_name = local.cluster_name
|
||||||
|
client_configuration = talos_machine_secrets.this.client_configuration
|
||||||
|
endpoints = [hcloud_floating_ip.control_plane.ip_address]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Control plane configuration
|
||||||
|
data "talos_machine_configuration" "control_plane" {
|
||||||
|
count = 3
|
||||||
|
cluster_name = local.cluster_name
|
||||||
|
machine_type = "controlplane"
|
||||||
|
cluster_endpoint = "https://${hcloud_floating_ip.control_plane.ip_address}:6443"
|
||||||
|
machine_secrets = talos_machine_secrets.this.machine_secrets
|
||||||
|
talos_version = var.talos_version
|
||||||
|
|
||||||
|
config_patches = [
|
||||||
|
templatefile("${path.module}/talos-patches/control-plane.yaml", {
|
||||||
|
cluster_name = local.cluster_name
|
||||||
|
node_name = hcloud_server.control_plane[count.index].name
|
||||||
|
is_ha = true
|
||||||
|
is_first_cp = count.index == 0
|
||||||
|
etcd_peers = [for i in range(3) : "10.0.1.${10 + i}"]
|
||||||
|
floating_ip = hcloud_floating_ip.control_plane.ip_address
|
||||||
|
})
|
||||||
|
]
|
||||||
|
|
||||||
|
depends_on = [
|
||||||
|
hcloud_server.control_plane,
|
||||||
|
hcloud_floating_ip_assignment.control_plane
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Worker configuration
|
||||||
|
data "talos_machine_configuration" "worker" {
|
||||||
|
count = 1
|
||||||
|
cluster_name = local.cluster_name
|
||||||
|
machine_type = "worker"
|
||||||
|
cluster_endpoint = "https://${hcloud_floating_ip.control_plane.ip_address}:6443"
|
||||||
|
machine_secrets = talos_machine_secrets.this.machine_secrets
|
||||||
|
talos_version = var.talos_version
|
||||||
|
|
||||||
|
config_patches = [
|
||||||
|
templatefile("${path.module}/talos-patches/worker.yaml", {
|
||||||
|
cluster_name = local.cluster_name
|
||||||
|
node_name = hcloud_server.worker[count.index].name
|
||||||
|
})
|
||||||
|
]
|
||||||
|
|
||||||
|
depends_on = [
|
||||||
|
hcloud_server.worker,
|
||||||
|
hcloud_floating_ip_assignment.control_plane
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# APPLY TALOS CONFIGURATION
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "talos_machine_configuration_apply" "control_plane" {
|
||||||
|
count = 3
|
||||||
|
client_configuration = talos_machine_secrets.this.client_configuration
|
||||||
|
machine_configuration_input = data.talos_machine_configuration.control_plane[count.index].machine_configuration
|
||||||
|
endpoint = hcloud_server.control_plane[count.index].ipv4_address
|
||||||
|
node = hcloud_server.control_plane[count.index].ipv4_address
|
||||||
|
|
||||||
|
depends_on = [
|
||||||
|
hcloud_server_network.control_plane,
|
||||||
|
data.talos_machine_configuration.control_plane
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "talos_machine_configuration_apply" "worker" {
|
||||||
|
count = 1
|
||||||
|
client_configuration = talos_machine_secrets.this.client_configuration
|
||||||
|
machine_configuration_input = data.talos_machine_configuration.worker[count.index].machine_configuration
|
||||||
|
endpoint = hcloud_server.worker[count.index].ipv4_address
|
||||||
|
node = hcloud_server.worker[count.index].ipv4_address
|
||||||
|
|
||||||
|
depends_on = [
|
||||||
|
hcloud_server_network.worker,
|
||||||
|
data.talos_machine_configuration.worker,
|
||||||
|
talos_machine_configuration_apply.control_plane
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# BOOTSTRAP KUBERNETES
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "talos_machine_bootstrap" "this" {
|
||||||
|
client_configuration = talos_machine_secrets.this.client_configuration
|
||||||
|
node = hcloud_server.control_plane[0].ipv4_address
|
||||||
|
|
||||||
|
depends_on = [
|
||||||
|
talos_machine_configuration_apply.control_plane,
|
||||||
|
talos_machine_configuration_apply.worker
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# GET KUBECONFIG
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "talos_cluster_kubeconfig" "this" {
|
||||||
|
client_configuration = talos_machine_secrets.this.client_configuration
|
||||||
|
node = hcloud_server.control_plane[0].ipv4_address
|
||||||
|
|
||||||
|
depends_on = [talos_machine_bootstrap.this]
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# SAVE CONFIGURATIONS
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
resource "local_sensitive_file" "kubeconfig" {
|
||||||
|
# Replace the internal hostname with the floating IP for external access
|
||||||
|
content = replace(
|
||||||
|
talos_cluster_kubeconfig.this.kubeconfig_raw,
|
||||||
|
"https://${local.cluster_name}.local:6443",
|
||||||
|
"https://${hcloud_floating_ip.control_plane.ip_address}:6443"
|
||||||
|
)
|
||||||
|
filename = "${path.root}/kubeconfig"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "local_sensitive_file" "talosconfig" {
|
||||||
|
content = data.talos_client_configuration.this.talos_config
|
||||||
|
filename = "${path.root}/talosconfig"
|
||||||
|
}
|
||||||
153
aula-08/outputs.tf
Normal file
153
aula-08/outputs.tf
Normal file
@@ -0,0 +1,153 @@
|
|||||||
|
############################################################
|
||||||
|
# Outputs for Hetzner Talos Kubernetes Cluster
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
# Cluster Information
|
||||||
|
output "cluster_name" {
|
||||||
|
description = "The name of the Kubernetes cluster"
|
||||||
|
value = local.cluster_name
|
||||||
|
}
|
||||||
|
|
||||||
|
output "cluster_id" {
|
||||||
|
description = "The unique identifier for the cluster"
|
||||||
|
value = random_string.cluster_id.result
|
||||||
|
}
|
||||||
|
|
||||||
|
# Network Information
|
||||||
|
output "network_id" {
|
||||||
|
description = "The ID of the cluster's private network"
|
||||||
|
value = hcloud_network.cluster.id
|
||||||
|
}
|
||||||
|
|
||||||
|
output "network_cidr" {
|
||||||
|
description = "The CIDR range of the cluster network"
|
||||||
|
value = hcloud_network_subnet.cluster.ip_range
|
||||||
|
}
|
||||||
|
|
||||||
|
# Control Plane Information
|
||||||
|
output "control_plane_ip" {
|
||||||
|
description = "Public IP address of the control plane"
|
||||||
|
value = hcloud_floating_ip.control_plane.ip_address
|
||||||
|
}
|
||||||
|
|
||||||
|
output "control_plane_private_ips" {
|
||||||
|
description = "Private IP addresses of control plane nodes"
|
||||||
|
value = [for cp in hcloud_server_network.control_plane : cp.ip]
|
||||||
|
}
|
||||||
|
|
||||||
|
output "control_plane_ids" {
|
||||||
|
description = "Server IDs of control plane nodes"
|
||||||
|
value = [for cp in hcloud_server.control_plane : cp.id]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Worker Nodes Information
|
||||||
|
output "worker_ips" {
|
||||||
|
description = "Public IP addresses of worker nodes"
|
||||||
|
value = [for w in hcloud_server.worker : w.ipv4_address]
|
||||||
|
}
|
||||||
|
|
||||||
|
output "worker_private_ips" {
|
||||||
|
description = "Private IP addresses of worker nodes"
|
||||||
|
value = [for w in hcloud_server_network.worker : w.ip]
|
||||||
|
}
|
||||||
|
|
||||||
|
output "worker_ids" {
|
||||||
|
description = "Server IDs of worker nodes"
|
||||||
|
value = [for w in hcloud_server.worker : w.id]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Kubernetes Access
|
||||||
|
output "kubeconfig_path" {
|
||||||
|
description = "Path to the generated kubeconfig file"
|
||||||
|
value = local_sensitive_file.kubeconfig.filename
|
||||||
|
}
|
||||||
|
|
||||||
|
output "talosconfig_path" {
|
||||||
|
description = "Path to the generated talosconfig file"
|
||||||
|
value = local_sensitive_file.talosconfig.filename
|
||||||
|
}
|
||||||
|
|
||||||
|
# API Endpoints
|
||||||
|
output "kubernetes_api_endpoint" {
|
||||||
|
description = "Kubernetes API server endpoint"
|
||||||
|
value = "https://${hcloud_floating_ip.control_plane.ip_address}:6443"
|
||||||
|
}
|
||||||
|
|
||||||
|
output "talos_api_endpoint" {
|
||||||
|
description = "Talos API endpoint for management"
|
||||||
|
value = "https://${hcloud_floating_ip.control_plane.ip_address}:50000"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Cost Information
|
||||||
|
output "estimated_monthly_cost" {
|
||||||
|
description = "Estimated monthly cost for the infrastructure (EUR)"
|
||||||
|
value = {
|
||||||
|
control_plane = 3 * 3.79 # 3x CAX11
|
||||||
|
worker = 1 * 3.79 # 1x CAX11
|
||||||
|
floating_ip = 3.00 # Floating IPv4
|
||||||
|
total = (4 * 3.79) + 3.00 # ~€18.16
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# Connection Instructions
|
||||||
|
output "connection_instructions" {
|
||||||
|
description = "Instructions for connecting to the cluster"
|
||||||
|
value = <<-EOT
|
||||||
|
|
||||||
|
====================================
|
||||||
|
Kubernetes Cluster Ready!
|
||||||
|
====================================
|
||||||
|
|
||||||
|
1. Configure kubectl:
|
||||||
|
export KUBECONFIG=${local_sensitive_file.kubeconfig.filename}
|
||||||
|
kubectl get nodes
|
||||||
|
|
||||||
|
2. Configure talosctl:
|
||||||
|
export TALOSCONFIG=${local_sensitive_file.talosconfig.filename}
|
||||||
|
talosctl --nodes ${hcloud_floating_ip.control_plane.ip_address} health
|
||||||
|
|
||||||
|
3. Access Kubernetes API:
|
||||||
|
${"https://${hcloud_floating_ip.control_plane.ip_address}:6443"}
|
||||||
|
|
||||||
|
4. Nodes:
|
||||||
|
Control Plane: 3x CAX11 (ARM64)
|
||||||
|
Workers: 1x CAX11 (ARM64)
|
||||||
|
|
||||||
|
5. Total Monthly Cost: ~€18/month
|
||||||
|
|
||||||
|
====================================
|
||||||
|
EOT
|
||||||
|
}
|
||||||
|
|
||||||
|
# Cluster Autoscaler Configuration
|
||||||
|
output "autoscaler_worker_config" {
|
||||||
|
description = "Worker machine config for cluster autoscaler (base64)"
|
||||||
|
value = base64encode(data.talos_machine_configuration.worker[0].machine_configuration)
|
||||||
|
sensitive = true
|
||||||
|
}
|
||||||
|
|
||||||
|
output "autoscaler_image_id" {
|
||||||
|
description = "Talos image ID for cluster autoscaler"
|
||||||
|
value = var.talos_image_id
|
||||||
|
}
|
||||||
|
|
||||||
|
# Resource Labels
|
||||||
|
output "resource_labels" {
|
||||||
|
description = "Labels applied to all resources"
|
||||||
|
value = local.common_labels
|
||||||
|
}
|
||||||
|
|
||||||
|
# Firewall Information
|
||||||
|
output "firewall_id" {
|
||||||
|
description = "ID of the firewall protecting the cluster"
|
||||||
|
value = hcloud_firewall.cluster.id
|
||||||
|
}
|
||||||
|
|
||||||
|
# SSH Key Information (for autoscaler)
|
||||||
|
output "ssh_key_name" {
|
||||||
|
description = "Name of the SSH key used by the cluster"
|
||||||
|
value = length(local.ssh_key_matches) > 0 ? [
|
||||||
|
for key in data.hcloud_ssh_keys.all.ssh_keys : key.name
|
||||||
|
if key.id == local.ssh_key_matches[0]
|
||||||
|
][0] : "${local.cluster_name}-admin"
|
||||||
|
}
|
||||||
361
aula-08/setup.sh
Executable file
361
aula-08/setup.sh
Executable file
@@ -0,0 +1,361 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# Aula 08 - OpenTofu + Talos + Hetzner Cloud
|
||||||
|
# Provisiona cluster Kubernetes Talos em HA
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
set -e
|
||||||
|
|
||||||
|
# Cores para output
|
||||||
|
RED='\033[0;31m'
|
||||||
|
GREEN='\033[0;32m'
|
||||||
|
YELLOW='\033[1;33m'
|
||||||
|
BLUE='\033[0;34m'
|
||||||
|
NC='\033[0m' # No Color
|
||||||
|
|
||||||
|
# Diretório do script
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
cd "$SCRIPT_DIR"
|
||||||
|
|
||||||
|
# Funções de log
|
||||||
|
log_info() {
|
||||||
|
echo -e "${BLUE}[INFO]${NC} $1"
|
||||||
|
}
|
||||||
|
|
||||||
|
log_success() {
|
||||||
|
echo -e "${GREEN}[OK]${NC} $1"
|
||||||
|
}
|
||||||
|
|
||||||
|
log_warn() {
|
||||||
|
echo -e "${YELLOW}[WARN]${NC} $1"
|
||||||
|
}
|
||||||
|
|
||||||
|
log_error() {
|
||||||
|
echo -e "${RED}[ERROR]${NC} $1"
|
||||||
|
}
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# VERIFICAÇÃO DE PRÉ-REQUISITOS
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "============================================"
|
||||||
|
echo " Aula 08 - Cluster Talos via OpenTofu"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
log_info "Verificando pré-requisitos..."
|
||||||
|
|
||||||
|
# Verificar OpenTofu
|
||||||
|
if ! command -v tofu &> /dev/null; then
|
||||||
|
log_error "OpenTofu não encontrado!"
|
||||||
|
echo ""
|
||||||
|
echo "Instale o OpenTofu:"
|
||||||
|
echo " brew install opentofu # macOS"
|
||||||
|
echo " snap install opentofu # Linux"
|
||||||
|
echo ""
|
||||||
|
echo "Mais info: https://opentofu.org/docs/intro/install/"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
log_success "OpenTofu $(tofu version | head -1)"
|
||||||
|
|
||||||
|
# Verificar talosctl
|
||||||
|
if ! command -v talosctl &> /dev/null; then
|
||||||
|
log_error "talosctl não encontrado!"
|
||||||
|
echo ""
|
||||||
|
echo "Instale o talosctl:"
|
||||||
|
echo " brew install siderolabs/tap/talosctl # macOS"
|
||||||
|
echo " curl -sL https://talos.dev/install | sh # Linux"
|
||||||
|
echo ""
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
log_success "talosctl $(talosctl version --client 2>/dev/null | grep 'Client' | awk '{print $2}' || echo 'instalado')"
|
||||||
|
|
||||||
|
# Verificar kubectl
|
||||||
|
if ! command -v kubectl &> /dev/null; then
|
||||||
|
log_error "kubectl não encontrado!"
|
||||||
|
echo ""
|
||||||
|
echo "Instale o kubectl:"
|
||||||
|
echo " brew install kubectl # macOS"
|
||||||
|
echo " snap install kubectl # Linux"
|
||||||
|
echo ""
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
log_success "kubectl $(kubectl version --client -o yaml 2>/dev/null | grep gitVersion | awk '{print $2}' || echo 'instalado')"
|
||||||
|
|
||||||
|
# Verificar hcloud CLI (opcional, mas útil)
|
||||||
|
if command -v hcloud &> /dev/null; then
|
||||||
|
log_success "hcloud CLI instalado"
|
||||||
|
else
|
||||||
|
log_warn "hcloud CLI não instalado (opcional)"
|
||||||
|
echo " Para listar imagens: brew install hcloud"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# COLETA DE CREDENCIAIS
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
# Verificar se terraform.tfvars já existe
|
||||||
|
if [ -f "terraform.tfvars" ]; then
|
||||||
|
log_warn "terraform.tfvars já existe!"
|
||||||
|
read -p "Deseja sobrescrever? (s/N): " overwrite
|
||||||
|
if [[ ! "$overwrite" =~ ^[Ss]$ ]]; then
|
||||||
|
log_info "Usando terraform.tfvars existente"
|
||||||
|
SKIP_CREDENTIALS=true
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$SKIP_CREDENTIALS" != "true" ]; then
|
||||||
|
echo "============================================"
|
||||||
|
echo " Configuração de Credenciais"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Token Hetzner
|
||||||
|
echo "1. Token da API Hetzner Cloud"
|
||||||
|
echo " Obtenha em: https://console.hetzner.cloud/projects/*/security/tokens"
|
||||||
|
echo ""
|
||||||
|
read -sp " Digite o token: " HCLOUD_TOKEN
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
if [ -z "$HCLOUD_TOKEN" ]; then
|
||||||
|
log_error "Token não pode ser vazio!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
log_success "Token configurado"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# SSH Key
|
||||||
|
echo "2. Chave SSH pública"
|
||||||
|
DEFAULT_SSH_KEY="$HOME/.ssh/id_rsa.pub"
|
||||||
|
if [ -f "$DEFAULT_SSH_KEY" ]; then
|
||||||
|
echo " Encontrada: $DEFAULT_SSH_KEY"
|
||||||
|
read -p " Usar esta chave? (S/n): " use_default
|
||||||
|
if [[ ! "$use_default" =~ ^[Nn]$ ]]; then
|
||||||
|
SSH_PUBLIC_KEY=$(cat "$DEFAULT_SSH_KEY")
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$SSH_PUBLIC_KEY" ]; then
|
||||||
|
read -p " Caminho da chave pública: " ssh_path
|
||||||
|
if [ -f "$ssh_path" ]; then
|
||||||
|
SSH_PUBLIC_KEY=$(cat "$ssh_path")
|
||||||
|
else
|
||||||
|
log_error "Arquivo não encontrado: $ssh_path"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
log_success "Chave SSH configurada"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# ID da imagem Talos
|
||||||
|
echo "3. ID da imagem Talos (snapshot da aula-07)"
|
||||||
|
echo " Para listar: hcloud image list --type snapshot"
|
||||||
|
echo ""
|
||||||
|
read -p " Digite o ID da imagem: " TALOS_IMAGE_ID
|
||||||
|
|
||||||
|
if [ -z "$TALOS_IMAGE_ID" ]; then
|
||||||
|
log_error "ID da imagem não pode ser vazio!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Validar que é número
|
||||||
|
if ! [[ "$TALOS_IMAGE_ID" =~ ^[0-9]+$ ]]; then
|
||||||
|
log_error "ID deve ser um número!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
log_success "Image ID: $TALOS_IMAGE_ID"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Criar terraform.tfvars
|
||||||
|
log_info "Criando terraform.tfvars..."
|
||||||
|
cat > terraform.tfvars << EOF
|
||||||
|
# Gerado automaticamente por setup.sh
|
||||||
|
# $(date)
|
||||||
|
|
||||||
|
hcloud_token = "$HCLOUD_TOKEN"
|
||||||
|
ssh_public_key = "$SSH_PUBLIC_KEY"
|
||||||
|
talos_image_id = $TALOS_IMAGE_ID
|
||||||
|
|
||||||
|
environment = "workshop"
|
||||||
|
enable_monitoring = true
|
||||||
|
EOF
|
||||||
|
log_success "terraform.tfvars criado"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# INICIALIZAÇÃO DO OPENTOFU
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Inicializando OpenTofu"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
log_info "Executando tofu init..."
|
||||||
|
tofu init
|
||||||
|
|
||||||
|
log_success "OpenTofu inicializado"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# PLANEJAMENTO
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Planejando Infraestrutura"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
log_info "Executando tofu plan..."
|
||||||
|
tofu plan -out=tfplan
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
log_success "Plano criado!"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Mostrar resumo
|
||||||
|
echo "============================================"
|
||||||
|
echo " Recursos a serem criados:"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
echo " - 4x CAX11 (3 CP + 1 Worker) = 4 x €3.79 = €15.16"
|
||||||
|
echo " - 1x Floating IPv4 = €3.00"
|
||||||
|
echo " - Rede/Firewall/Placement = Grátis"
|
||||||
|
echo ""
|
||||||
|
echo " Custo estimado: ~€18.16/mês (sem VAT)"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# APLICAÇÃO
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
read -p "Deseja aplicar o plano? (s/N): " apply
|
||||||
|
if [[ ! "$apply" =~ ^[Ss]$ ]]; then
|
||||||
|
log_warn "Operação cancelada pelo usuário"
|
||||||
|
echo ""
|
||||||
|
echo "Para aplicar manualmente:"
|
||||||
|
echo " tofu apply tfplan"
|
||||||
|
echo ""
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
log_info "Aplicando infraestrutura..."
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
tofu apply tfplan
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
log_success "Infraestrutura provisionada!"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# CONFIGURAÇÃO PÓS-DEPLOY
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Configuração Pós-Deploy"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Aguardar cluster ficar pronto
|
||||||
|
log_info "Aguardando cluster Talos ficar pronto..."
|
||||||
|
sleep 10
|
||||||
|
|
||||||
|
# Configurar talosctl
|
||||||
|
if [ -f "talosconfig" ]; then
|
||||||
|
log_info "Configurando talosctl..."
|
||||||
|
export TALOSCONFIG="$SCRIPT_DIR/talosconfig"
|
||||||
|
|
||||||
|
# Obter IP do control plane
|
||||||
|
CP_IP=$(tofu output -raw control_plane_ip 2>/dev/null || echo "")
|
||||||
|
|
||||||
|
if [ -n "$CP_IP" ]; then
|
||||||
|
log_info "Aguardando API do Talos em $CP_IP..."
|
||||||
|
|
||||||
|
# Tentar health check (pode demorar alguns minutos)
|
||||||
|
for i in {1..30}; do
|
||||||
|
if talosctl --talosconfig talosconfig -n "$CP_IP" health --wait-timeout 10s 2>/dev/null; then
|
||||||
|
log_success "Cluster Talos saudável!"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
echo -n "."
|
||||||
|
sleep 10
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Configurar kubectl
|
||||||
|
if [ -f "kubeconfig" ]; then
|
||||||
|
log_info "Configurando kubectl..."
|
||||||
|
export KUBECONFIG="$SCRIPT_DIR/kubeconfig"
|
||||||
|
|
||||||
|
log_info "Aguardando nodes ficarem Ready..."
|
||||||
|
for i in {1..30}; do
|
||||||
|
if kubectl get nodes 2>/dev/null | grep -q "Ready"; then
|
||||||
|
log_success "Nodes prontos!"
|
||||||
|
kubectl get nodes
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
echo -n "."
|
||||||
|
sleep 10
|
||||||
|
done
|
||||||
|
echo ""
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
############################################################
|
||||||
|
# RESUMO FINAL
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Cluster Provisionado com Sucesso!"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# Mostrar outputs
|
||||||
|
echo "Endpoints:"
|
||||||
|
tofu output -raw kubernetes_api_endpoint 2>/dev/null && echo "" || true
|
||||||
|
tofu output -raw talos_api_endpoint 2>/dev/null && echo "" || true
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "Arquivos gerados:"
|
||||||
|
echo " - kubeconfig : Configuração do kubectl"
|
||||||
|
echo " - talosconfig : Configuração do talosctl"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
echo "Comandos úteis:"
|
||||||
|
echo ""
|
||||||
|
echo " # Usar kubectl com este cluster"
|
||||||
|
echo " export KUBECONFIG=$SCRIPT_DIR/kubeconfig"
|
||||||
|
echo " kubectl get nodes"
|
||||||
|
echo ""
|
||||||
|
echo " # Usar talosctl com este cluster"
|
||||||
|
echo " export TALOSCONFIG=$SCRIPT_DIR/talosconfig"
|
||||||
|
echo " talosctl -n <IP> health"
|
||||||
|
echo ""
|
||||||
|
echo " # Ver outputs do OpenTofu"
|
||||||
|
echo " tofu output"
|
||||||
|
echo ""
|
||||||
|
echo " # Destruir infraestrutura (CUIDADO!)"
|
||||||
|
echo " ./cleanup.sh"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
log_success "Setup concluído!"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "============================================"
|
||||||
|
echo " Próximo passo (opcional)"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
echo " Para habilitar autoscaling de 1-5 workers:"
|
||||||
|
echo " ./install-autoscaler.sh"
|
||||||
|
echo ""
|
||||||
63
aula-08/talos-patches/control-plane.yaml
Normal file
63
aula-08/talos-patches/control-plane.yaml
Normal file
@@ -0,0 +1,63 @@
|
|||||||
|
# Talos Control Plane Configuration Patch
|
||||||
|
# Base configuration for HA control plane
|
||||||
|
machine:
|
||||||
|
# Network configuration for Floating IP
|
||||||
|
network:
|
||||||
|
interfaces:
|
||||||
|
- interface: eth0
|
||||||
|
dhcp: true
|
||||||
|
%{ if is_first_cp ~}
|
||||||
|
addresses:
|
||||||
|
- ${floating_ip}/32
|
||||||
|
%{ endif ~}
|
||||||
|
|
||||||
|
# Network optimizations
|
||||||
|
sysctls:
|
||||||
|
net.core.somaxconn: "8192"
|
||||||
|
net.ipv4.tcp_max_syn_backlog: "8192"
|
||||||
|
net.core.netdev_max_backlog: "5000"
|
||||||
|
net.ipv4.ip_local_port_range: "1024 65535"
|
||||||
|
net.ipv4.tcp_tw_reuse: "1"
|
||||||
|
net.ipv4.tcp_fin_timeout: "15"
|
||||||
|
fs.file-max: "2097152"
|
||||||
|
fs.inotify.max_user_watches: "524288"
|
||||||
|
vm.max_map_count: "262144"
|
||||||
|
|
||||||
|
# Kubelet configuration
|
||||||
|
kubelet:
|
||||||
|
extraArgs:
|
||||||
|
max-pods: "110"
|
||||||
|
kube-reserved: "cpu=200m,memory=300Mi"
|
||||||
|
system-reserved: "cpu=200m,memory=200Mi"
|
||||||
|
|
||||||
|
# Time sync
|
||||||
|
time:
|
||||||
|
servers:
|
||||||
|
- ntp1.hetzner.de
|
||||||
|
- ntp2.hetzner.com
|
||||||
|
- ntp3.hetzner.net
|
||||||
|
|
||||||
|
# Features
|
||||||
|
features:
|
||||||
|
rbac: true
|
||||||
|
stableHostname: true
|
||||||
|
|
||||||
|
cluster:
|
||||||
|
# Control plane configuration
|
||||||
|
controlPlane:
|
||||||
|
endpoint: https://${floating_ip}:6443
|
||||||
|
|
||||||
|
# Network configuration
|
||||||
|
network:
|
||||||
|
cni:
|
||||||
|
name: flannel
|
||||||
|
dnsDomain: cluster.local
|
||||||
|
serviceSubnets:
|
||||||
|
- 10.96.0.0/12
|
||||||
|
podSubnets:
|
||||||
|
- 10.244.0.0/16
|
||||||
|
|
||||||
|
# Etcd configuration for HA
|
||||||
|
etcd:
|
||||||
|
advertisedSubnets:
|
||||||
|
- 10.0.1.0/24
|
||||||
44
aula-08/talos-patches/worker.yaml
Normal file
44
aula-08/talos-patches/worker.yaml
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
# Talos Worker Configuration Patch
|
||||||
|
# Base configuration for worker nodes
|
||||||
|
machine:
|
||||||
|
# Network optimizations
|
||||||
|
sysctls:
|
||||||
|
net.core.somaxconn: "8192"
|
||||||
|
net.ipv4.tcp_max_syn_backlog: "8192"
|
||||||
|
net.core.netdev_max_backlog: "5000"
|
||||||
|
net.ipv4.ip_local_port_range: "1024 65535"
|
||||||
|
net.ipv4.tcp_tw_reuse: "1"
|
||||||
|
net.ipv4.tcp_fin_timeout: "15"
|
||||||
|
fs.file-max: "2097152"
|
||||||
|
fs.inotify.max_user_watches: "524288"
|
||||||
|
vm.max_map_count: "262144"
|
||||||
|
|
||||||
|
# Kubelet configuration
|
||||||
|
kubelet:
|
||||||
|
extraArgs:
|
||||||
|
max-pods: "110"
|
||||||
|
kube-reserved: "cpu=100m,memory=200Mi"
|
||||||
|
system-reserved: "cpu=100m,memory=100Mi"
|
||||||
|
|
||||||
|
# Time sync
|
||||||
|
time:
|
||||||
|
servers:
|
||||||
|
- ntp1.hetzner.de
|
||||||
|
- ntp2.hetzner.com
|
||||||
|
- ntp3.hetzner.net
|
||||||
|
|
||||||
|
# Features
|
||||||
|
features:
|
||||||
|
rbac: true
|
||||||
|
stableHostname: true
|
||||||
|
|
||||||
|
cluster:
|
||||||
|
# Network configuration
|
||||||
|
network:
|
||||||
|
cni:
|
||||||
|
name: flannel
|
||||||
|
dnsDomain: cluster.local
|
||||||
|
serviceSubnets:
|
||||||
|
- 10.96.0.0/12
|
||||||
|
podSubnets:
|
||||||
|
- 10.244.0.0/16
|
||||||
53
aula-08/terraform.tfvars.example
Normal file
53
aula-08/terraform.tfvars.example
Normal file
@@ -0,0 +1,53 @@
|
|||||||
|
# Exemplo de arquivo terraform.tfvars
|
||||||
|
# Copie este arquivo para terraform.tfvars e preencha com seus valores
|
||||||
|
|
||||||
|
# ============================================
|
||||||
|
# CREDENCIAIS (OBRIGATÓRIO)
|
||||||
|
# ============================================
|
||||||
|
|
||||||
|
# Token da API Hetzner Cloud
|
||||||
|
# Obtenha em: https://console.hetzner.cloud/projects/[PROJECT_ID]/security/tokens
|
||||||
|
hcloud_token = "seu_token_hetzner_aqui"
|
||||||
|
|
||||||
|
# Chave SSH pública para acesso emergencial aos nodes
|
||||||
|
# Obtenha com: cat ~/.ssh/id_rsa.pub
|
||||||
|
ssh_public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC... seu@email.com"
|
||||||
|
|
||||||
|
# ID da imagem Talos customizada (criada na aula-07)
|
||||||
|
# Obtenha com: hcloud image list --type snapshot
|
||||||
|
talos_image_id = 123456789
|
||||||
|
|
||||||
|
# ============================================
|
||||||
|
# CONFIGURAÇÃO DO CLUSTER
|
||||||
|
# ============================================
|
||||||
|
|
||||||
|
# Ambiente (prod, staging, dev)
|
||||||
|
environment = "workshop"
|
||||||
|
|
||||||
|
# Versão do Talos OS (opcional - default: v1.11.2)
|
||||||
|
# talos_version = "v1.11.2"
|
||||||
|
|
||||||
|
# ============================================
|
||||||
|
# MONITORAMENTO
|
||||||
|
# ============================================
|
||||||
|
|
||||||
|
# Habilitar Victoria Metrics
|
||||||
|
enable_monitoring = true
|
||||||
|
|
||||||
|
# ============================================
|
||||||
|
# AUTO-SCALING
|
||||||
|
# ============================================
|
||||||
|
|
||||||
|
# Thresholds de CPU para scaling
|
||||||
|
scale_up_threshold = 70 # Escala quando CPU > 70%
|
||||||
|
scale_down_threshold = 30 # Reduz quando CPU < 30%
|
||||||
|
|
||||||
|
# ============================================
|
||||||
|
# LABELS CUSTOMIZADAS (OPCIONAL)
|
||||||
|
# ============================================
|
||||||
|
|
||||||
|
# Labels adicionais para todos os recursos
|
||||||
|
custom_labels = {
|
||||||
|
projeto = "k8s-base"
|
||||||
|
responsavel = "devops"
|
||||||
|
}
|
||||||
38
aula-08/test-autoscaler.yaml
Normal file
38
aula-08/test-autoscaler.yaml
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
############################################################
|
||||||
|
# Deployment de teste para o Cluster Autoscaler
|
||||||
|
# Cria pods que consomem recursos para forçar scale-up
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: test-autoscaler
|
||||||
|
namespace: default
|
||||||
|
spec:
|
||||||
|
replicas: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: test-autoscaler
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: test-autoscaler
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: nginx:alpine
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 400m # Cada pod pede 0.4 CPU
|
||||||
|
memory: 512Mi # Cada pod pede 512MB RAM
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 640Mi
|
||||||
|
# Evita que pods rodem nos control-planes
|
||||||
|
affinity:
|
||||||
|
nodeAffinity:
|
||||||
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
nodeSelectorTerms:
|
||||||
|
- matchExpressions:
|
||||||
|
- key: node-role.kubernetes.io/control-plane
|
||||||
|
operator: DoesNotExist
|
||||||
63
aula-08/variables.tf
Normal file
63
aula-08/variables.tf
Normal file
@@ -0,0 +1,63 @@
|
|||||||
|
############################################################
|
||||||
|
# Variables for Hetzner Talos Kubernetes Cluster
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
# Authentication
|
||||||
|
variable "hcloud_token" {
|
||||||
|
type = string
|
||||||
|
description = "Hetzner Cloud API token"
|
||||||
|
sensitive = true
|
||||||
|
}
|
||||||
|
|
||||||
|
# Cluster Configuration
|
||||||
|
variable "environment" {
|
||||||
|
type = string
|
||||||
|
description = "Environment name (prod, staging, dev)"
|
||||||
|
default = "prod"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# SSH Configuration
|
||||||
|
variable "ssh_public_key" {
|
||||||
|
type = string
|
||||||
|
description = "Public SSH key for emergency access to nodes"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Talos Configuration
|
||||||
|
variable "talos_image_id" {
|
||||||
|
type = number
|
||||||
|
description = "ID da imagem Talos customizada na Hetzner (criada na aula-07). Obtenha com: hcloud image list --type snapshot"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "talos_version" {
|
||||||
|
type = string
|
||||||
|
description = "Talos version to use"
|
||||||
|
default = "v1.11.2" # Match the official image version
|
||||||
|
}
|
||||||
|
|
||||||
|
# Monitoring Configuration
|
||||||
|
variable "enable_monitoring" {
|
||||||
|
type = bool
|
||||||
|
description = "Enable Victoria Metrics monitoring stack"
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
# Auto-scaling Configuration
|
||||||
|
variable "scale_up_threshold" {
|
||||||
|
type = number
|
||||||
|
description = "CPU percentage to trigger scale up"
|
||||||
|
default = 70
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "scale_down_threshold" {
|
||||||
|
type = number
|
||||||
|
description = "CPU percentage to trigger scale down"
|
||||||
|
default = 30
|
||||||
|
}
|
||||||
|
|
||||||
|
# Tags for resource management
|
||||||
|
variable "custom_labels" {
|
||||||
|
type = map(string)
|
||||||
|
description = "Custom labels to add to all resources"
|
||||||
|
default = {}
|
||||||
|
}
|
||||||
35
aula-08/versions.tf
Normal file
35
aula-08/versions.tf
Normal file
@@ -0,0 +1,35 @@
|
|||||||
|
############################################################
|
||||||
|
# OpenTofu Version and Provider Requirements
|
||||||
|
# Compatible with OpenTofu >= 1.6.0
|
||||||
|
############################################################
|
||||||
|
|
||||||
|
terraform {
|
||||||
|
required_version = ">= 1.6.0"
|
||||||
|
|
||||||
|
required_providers {
|
||||||
|
hcloud = {
|
||||||
|
source = "hetznercloud/hcloud"
|
||||||
|
version = "~> 1.45"
|
||||||
|
}
|
||||||
|
|
||||||
|
talos = {
|
||||||
|
source = "siderolabs/talos"
|
||||||
|
version = "0.6.0"
|
||||||
|
}
|
||||||
|
|
||||||
|
random = {
|
||||||
|
source = "hashicorp/random"
|
||||||
|
version = "~> 3.5"
|
||||||
|
}
|
||||||
|
|
||||||
|
null = {
|
||||||
|
source = "hashicorp/null"
|
||||||
|
version = "~> 3.2"
|
||||||
|
}
|
||||||
|
|
||||||
|
local = {
|
||||||
|
source = "hashicorp/local"
|
||||||
|
version = "~> 2.4"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user