Skip to content
This repository was archived by the owner on Oct 31, 2019. It is now read-only.

Commit 5d99692

Browse files
garthyjlamillan
garthy
authored and
jlamillan
committed
Add flex volume driver/provisioner support
1 parent e0ff2d1 commit 5d99692

File tree

20 files changed

+275
-5
lines changed

20 files changed

+275
-5
lines changed

‎identity/user.tf‎ renamed to ‎identity/cloud_controller_user.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ resource "oci_identity_api_key" "cloud_controller_key_assoc" {
1818
}
1919

2020
resource "oci_identity_user_group_membership" "cloud_controller_user_group_assoc" {
21-
compartment_id = "${var.compartment_ocid}"
21+
compartment_id = "${var.tenancy_ocid}"
2222
user_id = "${oci_identity_user.cloud_controller_user.id}"
2323
group_id = "${oci_identity_group.cloud_controller_group.id}"
2424
}

‎identity/flexvolume_user.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
resource "tls_private_key" "flexvolume_driver_user_key" {
2+
algorithm = "RSA" rsa_bits = 2048
3+
}
4+
5+
resource "oci_identity_group" "flexvolume_driver_group" {
6+
name = "${var.label_prefix}flexvolume_driver_group"
7+
description = "Terraform created group for OCI Cloud Controller Manager"
8+
}
9+
10+
resource "oci_identity_user" "flexvolume_driver_user" {
11+
name = "${var.label_prefix}flexvolume_driver_user"
12+
description = "Terraform created user for OCI Cloud Controller Manager"
13+
}
14+
15+
resource "oci_identity_api_key" "flexvolume_driver_key_assoc" {
16+
user_id = "${oci_identity_user.flexvolume_driver_user.id}"
17+
key_value = "${tls_private_key.flexvolume_driver_user_key.public_key_pem}"
18+
}
19+
20+
resource "oci_identity_user_group_membership" "flexvolume_driver_user_group_assoc" {
21+
compartment_id = "${var.tenancy_ocid}"
22+
user_id = "${oci_identity_user.flexvolume_driver_user.id}"
23+
group_id = "${oci_identity_group.flexvolume_driver_group.id}"
24+
}
25+
26+
resource "oci_identity_policy" "flexvolume_driver_policy" {
27+
depends_on = ["oci_identity_group.flexvolume_driver_group"]
28+
compartment_id = "${var.compartment_ocid}"
29+
name = "${var.label_prefix}flexvolume_driver_policy"
30+
description = "${var.label_prefix}flexvolume_driver_group policy"
31+
statements = [
32+
"Allow group id ${oci_identity_group.flexvolume_driver_group.id} to read vnic-attachments in compartment id ${var.compartment_ocid}",
33+
"Allow group id ${oci_identity_group.flexvolume_driver_group.id} to read vnics in compartment id ${var.compartment_ocid}",
34+
"Allow group id ${oci_identity_group.flexvolume_driver_group.id} to read instances in compartment id ${var.compartment_ocid}",
35+
"Allow group id ${oci_identity_group.flexvolume_driver_group.id} to read subnets in compartment id ${var.compartment_ocid}",
36+
"Allow group id ${oci_identity_group.flexvolume_driver_group.id} to use volumes in compartment id ${var.compartment_ocid}",
37+
"Allow group id ${oci_identity_group.flexvolume_driver_group.id} to use instances in compartment id ${var.compartment_ocid}",
38+
"Allow group id ${oci_identity_group.flexvolume_driver_group.id} to manage volume-attachments in compartment id ${var.compartment_ocid}",
39+
]
40+
}

‎identity/outputs.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,38 @@ output "cloud_controller_private_key" {
1414
output "cloud_controller_user_fingerprint" {
1515
value = "run 'terraform output cloud_controller_private_key > cc_key && openssl rsa -in cc_key -pubout -outform DER | openssl md5 -c && rm cc_key' determine the fingerprint"
1616
}
17+
18+
output "flexvolume_driver_user" {
19+
value = "${oci_identity_user.flexvolume_driver_user.id}"
20+
}
21+
22+
output "flexvolume_driver_public_key" {
23+
value = "${tls_private_key.flexvolume_driver_user_key.public_key_pem}"
24+
}
25+
26+
output "flexvolume_driver_private_key" {
27+
sensitive = true
28+
value = "${tls_private_key.flexvolume_driver_user_key.private_key_pem}"
29+
}
30+
31+
output "flexvolume_driver_user_fingerprint" {
32+
value = "run 'terraform output flexvolume_driver_private_key > cc_key && openssl rsa -in cc_key -pubout -outform DER | openssl md5 -c && rm cc_key' determine the fingerprint"
33+
}
34+
35+
output "volume_provisioner_user" {
36+
value = "${oci_identity_user.volume_provisioner_user.id}"
37+
}
38+
39+
output "volume_provisioner_public_key" {
40+
value = "${tls_private_key.volume_provisioner_user_key.public_key_pem}"
41+
}
42+
43+
output "volume_provisioner_private_key" {
44+
sensitive = true
45+
value = "${tls_private_key.volume_provisioner_user_key.private_key_pem}"
46+
}
47+
48+
output "volume_provisioner_user_fingerprint" {
49+
value = "run 'terraform output volume_provisioner_private_key > cc_key && openssl rsa -in cc_key -pubout -outform DER | openssl md5 -c && rm cc_key' determine the fingerprint"
50+
}
51+

‎identity/volume_provisioner_user.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
resource "tls_private_key" "volume_provisioner_user_key" {
2+
algorithm = "RSA" rsa_bits = 2048
3+
}
4+
5+
resource "oci_identity_group" "volume_provisioner_group" {
6+
name = "${var.label_prefix}volume_provisioner_group"
7+
description = "Terraform created group for OCI Cloud Controller Manager"
8+
}
9+
10+
resource "oci_identity_user" "volume_provisioner_user" {
11+
name = "${var.label_prefix}volume_provisioner_user"
12+
description = "Terraform created user for OCI Cloud Controller Manager"
13+
}
14+
15+
resource "oci_identity_api_key" "volume_provisioner_key_assoc" {
16+
user_id = "${oci_identity_user.volume_provisioner_user.id}"
17+
key_value = "${tls_private_key.volume_provisioner_user_key.public_key_pem}"
18+
}
19+
20+
resource "oci_identity_user_group_membership" "volume_provisioner_user_group_assoc" {
21+
compartment_id = "${var.tenancy_ocid}"
22+
user_id = "${oci_identity_user.volume_provisioner_user.id}"
23+
group_id = "${oci_identity_group.volume_provisioner_group.id}"
24+
}
25+
26+
resource "oci_identity_policy" "volume_provisioner_policy" {
27+
depends_on = ["oci_identity_group.volume_provisioner_group"]
28+
compartment_id = "${var.compartment_ocid}"
29+
name = "${var.label_prefix}volume_provisioner_policy"
30+
description = "${var.label_prefix}volume_provisioner_group policy"
31+
statements = [
32+
"Allow group id ${oci_identity_group.volume_provisioner_group.id} to manage volumes in compartment id ${var.compartment_ocid}",
33+
]
34+
}

‎instances/k8smaster/cloud_init/bootstrap.template.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,16 @@ write_files:
5757
encoding: "gzip+base64"
5858
content: |
5959
${cloud_provider_secret_content}
60+
- path: "/root/flexvolume-driver-secret.yaml"
61+
permissions: "0600"
62+
encoding: "gzip+base64"
63+
content: |
64+
${flexvolume_driver_secret_content}
65+
- path: "/root/volume-provisioner-secret.yaml"
66+
permissions: "0600"
67+
encoding: "gzip+base64"
68+
content: |
69+
${volume_provisioner_secret_content}
6070
- path: "/root/services/flannel.service"
6171
permissions: "0600"
6272
encoding: "gzip+base64"

‎instances/k8smaster/datasources.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,8 @@ data "template_file" "kube_master_cloud_init_file" {
145145
cnibridge_service_content = "${base64gzip(data.template_file.cnibridge-service.rendered)}"
146146
cnibridge_sh_content = "${base64gzip(data.template_file.cnibridge-sh.rendered)}"
147147
cloud_provider_secret_content = "${base64gzip(var.cloud_controller_secret)}"
148+
flexvolume_driver_secret_content = "${base64gzip(var.flexvolume_driver_secret)}"
149+
volume_provisioner_secret_content = "${base64gzip(var.volume_provisioner_secret)}"
148150
}
149151
}
150152

‎instances/k8smaster/manifests/kube-controller-manager.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ spec:
3232
- mountPath: /etc/kubernetes/ca
3333
name: ssl-certs-kubernetes
3434
readOnly: true
35-
- mountPath: /etc/ssl/certs
35+
- mountPath: /etc/ssl
3636
name: ssl-certs-host
3737
readOnly: true
38-
- mountPath: /etc/pki/certs
38+
- mountPath: /etc/pki
3939
name: pki-certs-host
4040
readOnly: true
4141
- mountPath: /usr/libexec/kubernetes/kubelet-plugins
@@ -45,10 +45,10 @@ spec:
4545
path: /etc/kubernetes/ssl
4646
name: ssl-certs-kubernetes
4747
- hostPath:
48-
path: /etc/ssl/certs
48+
path: /etc/ssl
4949
name: ssl-certs-host
5050
- hostPath:
51-
path: /etc/pki/certs
51+
path: /etc/pki
5252
name: pki-certs-host
5353
- hostPath:
5454
path: /usr/libexec/kubernetes/kubelet-plugins

‎instances/k8smaster/scripts/setup.template.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,13 @@ cat >/etc/cni/net.d/10-flannel.conf <<EOF
114114
}
115115
EOF
116116

117+
## Install Flex Volume Driver for OCI
118+
#####################################
119+
mkdir -p /usr/libexec/kubernetes/kubelet-plugins/volume/exec/oracle~oci/
120+
curl -L --retry 3 https://github.com/oracle/oci-flexvolume-driver/releases/download/0.1.0/oci -o/usr/libexec/kubernetes/kubelet-plugins/volume/exec/oracle~oci/oci
121+
chmod a+x /usr/libexec/kubernetes/kubelet-plugins/volume/exec/oracle~oci/oci
122+
mv /root/flexvolume-driver-secret.yaml /usr/libexec/kubernetes/kubelet-plugins/volume/exec/oracle~oci/config.yaml
123+
117124
## Install kubelet, kubectl, and kubernetes-cni
118125
###############################################
119126
yum-config-manager --add-repo http://yum.kubernetes.io/repos/kubernetes-el7-x86_64
@@ -190,4 +197,13 @@ kubectl create -f /root/services/kube-dns.yaml
190197
## install kubernetes-dashboard
191198
kubectl create -f /root/services/kubernetes-dashboard.yaml
192199

200+
## Install Volume Provisioner of OCI
201+
kubectl create secret generic oci-volume-provisioner -n kube-system --from-file=config.yaml=/root/volume-provisioner-secret.yaml
202+
kubectl apply -f https://raw.githubusercontent.com/oracle/oci-volume-provisioner/master/manifests/oci-volume-provisioner-rbac.yaml
203+
kubectl apply -f https://raw.githubusercontent.com/oracle/oci-volume-provisioner/master/manifests/oci-volume-provisioner.yaml
204+
kubectl apply -f https://raw.githubusercontent.com/oracle/oci-volume-provisioner/master/manifests/storage-class.yaml
205+
kubectl apply -f https://raw.githubusercontent.com/oracle/oci-volume-provisioner/master/manifests/storage-class-ext3.yaml
206+
207+
rm -f /root/volume-provisioner-secret.yaml
208+
193209
echo "Finished running setup.sh"

‎instances/k8smaster/variables.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,3 +73,7 @@ variable "master_docker_max_log_files" {
7373
}
7474

7575
variable "cloud_controller_secret" {}
76+
77+
variable "flexvolume_driver_secret" {}
78+
79+
variable "volume_provisioner_secret" {}

‎instances/k8sworker/scripts/setup.template.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,13 @@ cat >/etc/cni/net.d/10-flannel.conf <<EOF
158158
}
159159
EOF
160160

161+
## Install Flex Volume Driver for OCI
162+
#####################################
163+
mkdir -p /usr/libexec/kubernetes/kubelet-plugins/volume/exec/oracle~oci/
164+
curl -L --retry 3 https://github.com/oracle/oci-flexvolume-driver/releases/download/0.1.0/oci -o/usr/libexec/kubernetes/kubelet-plugins/volume/exec/oracle~oci/oci
165+
chmod a+x /usr/libexec/kubernetes/kubelet-plugins/volume/exec/oracle~oci/oci
166+
167+
161168
## Install kubelet, kubectl, and kubernetes-cni
162169
###############################################
163170
yum-config-manager --add-repo http://yum.kubernetes.io/repos/kubernetes-el7-x86_64

0 commit comments

Comments
 (0)