terraform-azure-kubernetes/lb.tf at master · poseidon/terraform-azure-kubernetes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
# DNS record for the apiserver load balancer
resource "azurerm_dns_a_record" "apiserver" {
  resource_group_name = var.dns_zone_group

  # DNS Zone name where record should be created
  zone_name = var.dns_zone

  # DNS record
  name = var.cluster_name
  ttl  = 300

  # IPv4 address of apiserver load balancer
  records = [azurerm_public_ip.apiserver-ipv4.ip_address]
}

# Static IPv4 address for the apiserver frontend
resource "azurerm_public_ip" "apiserver-ipv4" {
  resource_group_name = azurerm_resource_group.cluster.name

  name              = "${var.cluster_name}-apiserver-ipv4"
  location          = var.region
  sku               = "Standard"
  allocation_method = "Static"
}

# Static IPv4 address for the ingress frontend
resource "azurerm_public_ip" "ingress-ipv4" {
  resource_group_name = azurerm_resource_group.cluster.name

  name              = "${var.cluster_name}-ingress-ipv4"
  location          = var.region
  sku               = "Standard"
  allocation_method = "Static"
}

# Network Load Balancer for apiservers and ingress
resource "azurerm_lb" "cluster" {
  resource_group_name = azurerm_resource_group.cluster.name

  name     = var.cluster_name
  location = var.region
  sku      = "Standard"

  frontend_ip_configuration {
    name                 = "apiserver"
    public_ip_address_id = azurerm_public_ip.apiserver-ipv4.id
  }

  frontend_ip_configuration {
    name                 = "ingress"
    public_ip_address_id = azurerm_public_ip.ingress-ipv4.id
  }
}

resource "azurerm_lb_rule" "apiserver" {
  name                           = "apiserver"
  loadbalancer_id                = azurerm_lb.cluster.id
  frontend_ip_configuration_name = "apiserver"

  protocol                 = "Tcp"
  frontend_port            = 6443
  backend_port             = 6443
  backend_address_pool_ids = [azurerm_lb_backend_address_pool.controller.id]
  probe_id                 = azurerm_lb_probe.apiserver.id
}

resource "azurerm_lb_rule" "ingress-http" {
  name                           = "ingress-http"
  loadbalancer_id                = azurerm_lb.cluster.id
  frontend_ip_configuration_name = "ingress"
  disable_outbound_snat          = true

  protocol                 = "Tcp"
  frontend_port            = 80
  backend_port             = 80
  backend_address_pool_ids = [azurerm_lb_backend_address_pool.worker.id]
  probe_id                 = azurerm_lb_probe.ingress.id
}

resource "azurerm_lb_rule" "ingress-https" {
  name                           = "ingress-https"
  loadbalancer_id                = azurerm_lb.cluster.id
  frontend_ip_configuration_name = "ingress"
  disable_outbound_snat          = true

  protocol                 = "Tcp"
  frontend_port            = 443
  backend_port             = 443
  backend_address_pool_ids = [azurerm_lb_backend_address_pool.worker.id]
  probe_id                 = azurerm_lb_probe.ingress.id
}

# Worker outbound TCP/UDP SNAT
resource "azurerm_lb_outbound_rule" "worker-outbound" {
  name            = "worker"
  loadbalancer_id = azurerm_lb.cluster.id
  frontend_ip_configuration {
    name = "ingress"
  }

  protocol                = "All"
  backend_address_pool_id = azurerm_lb_backend_address_pool.worker.id
}

# Address pool of controllers
resource "azurerm_lb_backend_address_pool" "controller" {
  name            = "controller"
  loadbalancer_id = azurerm_lb.cluster.id
}

# Address pool of workers
resource "azurerm_lb_backend_address_pool" "worker" {
  name            = "worker"
  loadbalancer_id = azurerm_lb.cluster.id
}

# Health checks / probes

# TCP health check for apiserver
resource "azurerm_lb_probe" "apiserver" {
  name            = "apiserver"
  loadbalancer_id = azurerm_lb.cluster.id
  protocol        = "Tcp"
  port            = 6443

  # unhealthy threshold
  number_of_probes = 3

  interval_in_seconds = 5
}

# HTTP health check for ingress
resource "azurerm_lb_probe" "ingress" {
  name            = "ingress"
  loadbalancer_id = azurerm_lb.cluster.id
  protocol        = "Http"
  port            = 10254
  request_path    = "/healthz"

  # unhealthy threshold
  number_of_probes = 3

  interval_in_seconds = 5
}