Add cert checker module: implement Kubernetes resources, certificate validation logic, and deployment restart functionality

2025-10-02 16:53:28 +02:00
parent e6a3f3affd
commit a412c96c46
15 changed files with 644 additions and 10 deletions
@@ -0,0 +1,259 @@
+
+resource "kubernetes_service_account" "metrics_server" {
+  metadata {
+    name      = "metrics-server"
+    namespace = var.namespace
+    labels = {
+      k8s-app = "metrics-server"
+    }
+  }
+}
+
+resource "kubernetes_cluster_role" "aggregated_metrics_reader" {
+  metadata {
+    name = "system:aggregated-metrics-reader"
+    labels = {
+      k8s-app                                        = "metrics-server"
+      "rbac.authorization.k8s.io/aggregate-to-admin" = "true"
+      "rbac.authorization.k8s.io/aggregate-to-edit"  = "true"
+      "rbac.authorization.k8s.io/aggregate-to-view"  = "true"
+    }
+  }
+  rule {
+    api_groups = ["metrics.k8s.io"]
+    resources  = ["pods", "nodes"]
+    verbs      = ["get", "list", "watch"]
+  }
+}
+
+resource "kubernetes_cluster_role" "metrics_server" {
+  metadata {
+    name = "system:metrics-server"
+    labels = {
+      k8s-app = "metrics-server"
+    }
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["nodes/metrics"]
+    verbs      = ["get"]
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["pods", "nodes"]
+    verbs      = ["get", "list", "watch"]
+  }
+}
+
+resource "kubernetes_role_binding" "metrics_server_auth_reader" {
+  metadata {
+    name      = "metrics-server-auth-reader"
+    namespace = var.namespace
+    labels = {
+      k8s-app = "metrics-server"
+    }
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = "extension-apiserver-authentication-reader"
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = "metrics-server"
+    namespace = var.namespace
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "metrics_server_auth_delegator" {
+  metadata {
+    name = "metrics-server:system:auth-delegator"
+    labels = {
+      k8s-app = "metrics-server"
+    }
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "system:auth-delegator"
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = "metrics-server"
+    namespace = var.namespace
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "metrics_server" {
+  metadata {
+    name = "system:metrics-server"
+    labels = {
+      k8s-app = "metrics-server"
+    }
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "system:metrics-server"
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = "metrics-server"
+    namespace = var.namespace
+  }
+}
+
+resource "kubernetes_service" "metrics_server" {
+  metadata {
+    name      = "metrics-server"
+    namespace = var.namespace
+    labels = {
+      k8s-app = "metrics-server"
+    }
+  }
+  spec {
+    selector = {
+      k8s-app = "metrics-server"
+    }
+    port {
+      name        = "https"
+      port        = 443
+      protocol    = "TCP"
+      target_port = "https"
+    }
+  }
+}
+
+resource "kubernetes_deployment" "metrics_server" {
+  metadata {
+    name      = "metrics-server"
+    namespace = var.namespace
+    labels = {
+      k8s-app = "metrics-server"
+    }
+  }
+  spec {
+    selector {
+      match_labels = {
+        k8s-app = "metrics-server"
+      }
+    }
+    strategy {
+      type = "RollingUpdate"
+      rolling_update {
+        max_unavailable = 0
+      }
+    }
+    template {
+      metadata {
+        labels = {
+          k8s-app = "metrics-server"
+        }
+      }
+      spec {
+        service_account_name = "metrics-server"
+        priority_class_name  = "system-cluster-critical"
+        node_selector = {
+          "kubernetes.io/os"   = "linux"
+          "kubernetes.io/arch" = "$ARCH"
+        }
+        container {
+          name              = "metrics-server"
+          image             = "registry.k8s.io/metrics-server/metrics-server:${local.app_version}"
+          image_pull_policy = "IfNotPresent"
+          args = [
+            "--cert-dir=/tmp",
+            "--secure-port=4443",
+            "--kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname",
+            "--kubelet-use-node-status-port",
+            "--metric-resolution=15s",
+            "--kubelet-insecure-tls"
+          ]
+          port {
+            container_port = 4443
+            name           = "https"
+            protocol       = "TCP"
+          }
+          liveness_probe {
+            http_get {
+              path   = "/livez"
+              port   = "https"
+              scheme = "HTTPS"
+            }
+            failure_threshold = 3
+            period_seconds    = 10
+          }
+          readiness_probe {
+            http_get {
+              path   = "/readyz"
+              port   = "https"
+              scheme = "HTTPS"
+            }
+            failure_threshold     = 3
+            initial_delay_seconds = 20
+            period_seconds        = 10
+          }
+          resources {
+            requests = {
+              cpu    = "100m"
+              memory = "200Mi"
+            }
+          }
+          security_context {
+            read_only_root_filesystem = true
+            run_as_non_root           = true
+            run_as_user               = 1000
+          }
+          volume_mount {
+            name       = "tmp-dir"
+            mount_path = "/tmp"
+          }
+        }
+        volume {
+          name = "tmp-dir"
+          empty_dir {}
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_manifest" "metrics_server_apiservice" {
+  manifest = {
+    apiVersion = "apiregistration.k8s.io/v1"
+    kind       = "APIService"
+    metadata = {
+      name = "v1beta1.metrics.k8s.io"
+      labels = {
+        k8s-app = "metrics-server"
+      }
+    }
+    spec = {
+      group                 = "metrics.k8s.io"
+      groupPriorityMinimum  = 100
+      insecureSkipTLSVerify = true
+      service = {
+        name      = "metrics-server"
+        namespace = var.namespace
+      }
+      version         = "v1beta1"
+      versionPriority = 100
+    }
+  }
+}
+
+# resource "kubernetes_cluster_role_binding" "microk8s_admin" {
+#   metadata {
+#     name = "microk8s-admin"
+#   }
+#   role_ref {
+#     api_group = "rbac.authorization.k8s.io"
+#     kind      = "ClusterRole"
+#     name      = "admin"
+#   }
+#   subject {
+#     kind      = "User"
+#     name      = "front-proxy-client"
+#     api_group = "rbac.authorization.k8s.io"
+#   }
+# }