From 1a38a9df88c05c13c87b8e82b9bad783d668ef7f Mon Sep 17 00:00:00 2001
From: rguichard <rguichard@vsense.fr>
Date: Fri, 27 Jul 2018 14:57:29 +0200
Subject: [PATCH] add security groups for traffic to 30000-32767/tcp
This will make NodePort services work out of the box
---
contrib/terraform/openstack/modules/compute/main.tf | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/contrib/terraform/openstack/modules/compute/main.tf b/contrib/terraform/openstack/modules/compute/main.tf
index 940049aa9..370b88879 100644
--- a/contrib/terraform/openstack/modules/compute/main.tf
+++ b/contrib/terraform/openstack/modules/compute/main.tf
@@ -59,6 +59,17 @@ resource "openstack_compute_secgroup_v2" "k8s" {
self = true
}
}
+resource "openstack_compute_secgroup_v2" "worker" {
+ name = "${var.cluster_name}-k8s-worker"
+ description = "${var.cluster_name} - Kubernetes worker nodes"
+
+ rule {
+ ip_protocol = "tcp"
+ from_port = "30000"
+ to_port = "32767"
+ cidr = "0.0.0.0/0"
+ }
+}
resource "openstack_compute_instance_v2" "bastion" {
name = "${var.cluster_name}-bastion-${count.index+1}"
@@ -226,6 +237,7 @@ resource "openstack_compute_instance_v2" "k8s_node" {
security_groups = ["${openstack_compute_secgroup_v2.k8s.name}",
"${openstack_compute_secgroup_v2.bastion.name}",
+ "${openstack_compute_secgroup_v2.worker.name}",
"default",
]
@@ -253,6 +265,7 @@ resource "openstack_compute_instance_v2" "k8s_node_no_floating_ip" {
}
security_groups = ["${openstack_compute_secgroup_v2.k8s.name}",
+ "${openstack_compute_secgroup_v2.worker.name}",
"default",
]
--
GitLab