第 3 章 使用 Terraform 创建 ROSA 集群

流程

1. 可选 ： 因为在此过程中，Terraform 文件会在当前目录中创建，因此您可以创建一个新目录来存储这些文件并运行以下命令来进入其中：

   $ mkdir terraform-cluster && cd terraform-cluster

   Copy to Clipboard Toggle word wrap
2. 使用 离线 Red Hat OpenShift Cluster Manager 令牌 向您的帐户授予权限。

3. 复制离线令牌，并通过运行以下命令来将令牌设置为环境变量：

   $ export RHCS_TOKEN=<your_offline_token>

   Copy to Clipboard Toggle word wrap
   注意

   此环境变量会在每个会话的末尾重置，如重启计算机或关闭终端。

流程

1. 运行以下命令来创建 main.tf 文件：

   $ cat<<-EOF>main.tf
   #
   # Copyright (c) 2023 Red Hat, Inc.
   #
   # Licensed under the Apache License, Version 2.0 (the "License");
   # you may not use this file except in compliance with the License.
   # You may obtain a copy of the License at
   #
   #   http://www.apache.org/licenses/LICENSE-2.0
   #
   # Unless required by applicable law or agreed to in writing, software
   # distributed under the License is distributed on an "AS IS" BASIS,
   # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   # See the License for the specific language governing permissions and
   # limitations under the License.
   #
   terraform {
     required_providers {
       aws = {
         source  = "hashicorp/aws"
         version = ">= 4.20.0"
       }
       rhcs = {
         version = ">= 1.6.3"
         source  = "terraform-redhat/rhcs"
       }
     }
   }
   
   # Export token using the RHCS_TOKEN environment variable
   provider "rhcs" {}
   
   provider "aws" {
     region = var.aws_region
     ignore_tags {
       key_prefixes = ["kubernetes.io/"]
     }
     default_tags {
       tags = var.default_aws_tags
     }
   }
   
   data "aws_availability_zones" "available" {}
   
   locals {
     # Extract availability zone names for the specified region, limit it to 3 if multi az or 1 if single
     region_azs = var.multi_az ? slice([for zone in data.aws_availability_zones.available.names : format("%s", zone)], 0, 3) : slice([for zone in data.aws_availability_zones.available.names : format("%s", zone)], 0, 1)
   }
   
   resource "random_string" "random_name" {
     length  = 6
     special = false
     upper   = false
   }
   
   locals {
     worker_node_replicas = var.multi_az ? 3 : 2
     # If cluster_name is not null, use that, otherwise generate a random cluster name
     cluster_name = coalesce(var.cluster_name, "rosa-\${random_string.random_name.result}")
   }
   
   # The network validator requires an additional 60 seconds to validate Terraform clusters.
   resource "time_sleep" "wait_60_seconds" {
     count = var.create_vpc ? 1 : 0
     depends_on = [module.vpc]
     create_duration = "60s"
   }
   
   module "rosa-hcp" {
     source                 = "terraform-redhat/rosa-hcp/rhcs"
     version                = "1.6.3"
     cluster_name           = local.cluster_name
     openshift_version      = var.openshift_version
     account_role_prefix    = local.cluster_name
     operator_role_prefix   = local.cluster_name
     replicas               = local.worker_node_replicas
     aws_availability_zones = local.region_azs
     create_oidc            = true
     private                = var.private_cluster
     aws_subnet_ids         = var.create_vpc ? var.private_cluster ? module.vpc[0].private_subnets : concat(module.vpc[0].public_subnets, module.vpc[0].private_subnets) : var.aws_subnet_ids
     create_account_roles   = true
     create_operator_roles  = true
   # Optional: Configure a cluster administrator user \ 

   1

   
   #
   # Option 1: Default cluster-admin user
   # Create an administrator user (cluster-admin) and automatically
   # generate a password by uncommenting the following parameter:
   #  create_admin_user = true
   # Generated administrator credentials are displayed in terminal output.
   #
   # Option 2: Specify administrator username and password
   # Create an administrator user and define your own password
   # by uncommenting and editing the values of the following parameters:
   #  admin_credentials_username = <username>
   #  admin_credentials_password = <password>
   
     depends_on = [time_sleep.wait_60_seconds]
   }
   EOF

   Copy to Clipboard Toggle word wrap

   1

   可选： 在集群创建过程中创建管理员用户，方法是取消注释适当的参数并在需要时编辑其值。

2. 运行以下命令来创建 variables.tf 文件：

   注意

   在运行该命令 以构建 集群前复制并编辑此文件。

   $ cat<<-EOF>variables.tf
   #
   # Copyright (c) 2023 Red Hat, Inc.
   #
   # Licensed under the Apache License, Version 2.0 (the "License");
   # you may not use this file except in compliance with the License.
   # You may obtain a copy of the License at
   #
   #   http://www.apache.org/licenses/LICENSE-2.0
   #
   # Unless required by applicable law or agreed to in writing, software
   # distributed under the License is distributed on an "AS IS" BASIS,
   # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   # See the License for the specific language governing permissions and
   # limitations under the License.
   #
   variable "openshift_version" {
     type        = string
     default     = "4.14.20"
     description = "Desired version of OpenShift for the cluster, for example '4.14.20'. If version is greater than the currently running version, an upgrade will be scheduled."
   }
   
   variable "create_vpc" {
     type        = bool
     description = "If you would like to create a new VPC, set this value to 'true'. If you do not want to create a new VPC, set this value to 'false'."
   }
   
   # ROSA Cluster info
   variable "cluster_name" {
     default     = null
     type        = string
     description = "The name of the ROSA cluster to create"
   }
   
   variable "additional_tags" {
     default = {
       Terraform   = "true"
       Environment = "dev"
     }
     description = "Additional AWS resource tags"
     type        = map(string)
   }
   
   variable "multi_az" {
     type        = bool
     description = "Multi AZ Cluster for High Availability"
     default     = true
   }
   
   variable "worker_node_replicas" {
     default     = 3
     description = "Number of worker nodes to provision. Single zone clusters need at least 2 nodes, multizone clusters need at least 3 nodes"
     type        = number
   }
   
   variable "aws_subnet_ids" {
     type        = list(any)
     description = "A list of either the public or public + private subnet IDs to use for the cluster blocks to use for the cluster"
     default     = ["subnet-01234567890abcdef", "subnet-01234567890abcdef", "subnet-01234567890abcdef"]
   }
   
   variable "private_cluster" {
     type        = bool
     description = "If you want to create a private cluster, set this value to 'true'. If you want a publicly available cluster, set this value to 'false'."
   }
   
   #VPC Info
   variable "vpc_name" {
     type        = string
     description = "VPC Name"
     default     = "tf-qs-vpc"
   }
   
   variable "vpc_cidr_block" {
     type        = string
     description = "value of the CIDR block to use for the VPC"
     default     = "10.0.0.0/16"
   }
   
   variable "private_subnet_cidrs" {
     type        = list(any)
     description = "The CIDR blocks to use for the private subnets"
     default     = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
   }
   
   variable "public_subnet_cidrs" {
     type        = list(any)
     description = "The CIDR blocks to use for the public subnets"
     default     = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
   }
   
   variable "single_nat_gateway" {
     type        = bool
     description = "Single NAT or per NAT for subnet"
     default     = false
   }
   
   #AWS Info
   variable "aws_region" {
     type    = string
     default = "us-east-2"
   }
   
   variable "default_aws_tags" {
     type        = map(string)
     description = "Default tags for AWS"
     default     = {}
   }
   EOF

   Copy to Clipboard Toggle word wrap

3. 运行以下命令来创建 vpc.tf 文件：

   $ cat<<-EOF>vpc.tf
   #
   # Copyright (c) 2023 Red Hat, Inc.
   #
   # Licensed under the Apache License, Version 2.0 (the "License");
   # you may not use this file except in compliance with the License.
   # You may obtain a copy of the License at
   #
   #   http://www.apache.org/licenses/LICENSE-2.0
   #
   # Unless required by applicable law or agreed to in writing, software
   # distributed under the License is distributed on an "AS IS" BASIS,
   # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   # See the License for the specific language governing permissions and
   # limitations under the License.
   #
   module "vpc" {
     source  = "terraform-aws-modules/vpc/aws"
     version = "5.1.2"
   
     count = var.create_vpc ? 1 : 0
     name  = var.vpc_name
     cidr  = var.vpc_cidr_block
   
     azs             = local.region_azs
     private_subnets = var.multi_az ? var.private_subnet_cidrs : [var.private_subnet_cidrs[0]]
     public_subnets  = var.multi_az ? var.public_subnet_cidrs : [var.public_subnet_cidrs[0]]
   
     enable_nat_gateway   = true
     single_nat_gateway   = var.single_nat_gateway
     enable_dns_hostnames = true
     enable_dns_support   = true
   
     tags = var.additional_tags
   }
   EOF

   Copy to Clipboard Toggle word wrap

   您已准备好启动 Terraform。

流程

1. 将 Terraform 设置为根据您的 Terraform 文件创建资源，运行以下命令：

   $ terraform init

   Copy to Clipboard Toggle word wrap

2. 可选 ：运行以下命令来验证您复制的 Terraform 是否正确：

   $ terraform validate

   Copy to Clipboard Toggle word wrap

   输出示例

   Success! The configuration is valid.

   Copy to Clipboard Toggle word wrap

3. 运行以下命令，使用 Terraform 创建集群：

   $ terraform apply

   Copy to Clipboard Toggle word wrap

   Terraform 界面需要两个问题来创建集群，如下所示：

   输出示例

   var.create_vpc
     If you would like to create a new VPC, set this value to 'true'. If you do not want to create a new VPC, set this value to 'false'.
   
     Enter a value:
   
   var.private_cluster
     If you want to create a private cluster, set this value to 'true'. If you want a publicly available cluster, set this value to 'false'.
   
     Enter a value:

   Copy to Clipboard Toggle word wrap

4. 当 Terraform 界面列出要创建或修改的资源并提示确认时，输入 yes 才能继续或取消：

   输出示例

   Plan: 63 to add, 0 to change, 0 to destroy.
   
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.

   Copy to Clipboard Toggle word wrap

   如果您输入 yes，您的 Terraform 计划将启动，创建 AWS 帐户角色、Operator 角色和 Red Hat OpenShift Service on AWS 集群。

验证

1. 运行以下命令验证集群是否已创建：

   $ rosa list clusters

   Copy to Clipboard Toggle word wrap

   显示集群的 ID、名称和状态的输出示例

   ID                                NAME          STATE  TOPOLOGY
   27c3snjsupa9obua74ba8se5kcj11269  rosa-tf-demo  ready  Hosted CP

   Copy to Clipboard Toggle word wrap

2. 运行以下命令验证您的帐户角色是否已创建：

   $ rosa list account-roles

   Copy to Clipboard Toggle word wrap

   输出示例

   I: Fetching account roles
   ROLE NAME                                   ROLE TYPE      ROLE ARN                                                           OPENSHIFT VERSION  AWS Managed
   ROSA-demo-Installer-Role                    Installer      arn:aws:iam::<ID>:role/ROSA-demo-Installer-Role                    4.14               No
   ROSA-demo-Support-Role                      Support        arn:aws:iam::<ID>:role/ROSA-demo-Support-Role                      4.14               No
   ROSA-demo-Worker-Role                       Worker         arn:aws:iam::<ID>:role/ROSA-demo-Worker-Role                       4.14               No

   Copy to Clipboard Toggle word wrap

3. 运行以下命令验证您的 Operator 角色是否已创建：

   $ rosa list operator-roles

   Copy to Clipboard Toggle word wrap

   显示 Terraform 创建的 Operator 角色的输出示例

   I: Fetching operator roles
   ROLE PREFIX    AMOUNT IN BUNDLE
   rosa-demo      8

   Copy to Clipboard Toggle word wrap

流程

1. 在运行 terraform apply 命令来创建集群的目录中，运行以下命令删除集群：

   $ terraform destroy

   Copy to Clipboard Toggle word wrap

   Terraform 接口提示您输入两个变量。它们应与创建集群时提供的答案匹配：

   var.create_vpc
     If you would like to create a new VPC, set this value to 'true.' If you do not want to create a new VPC, set this value to 'false.'
   
     Enter a value:
   
   var.private_cluster
     If you want to create a private cluster, set this value to 'true.' If you want a publicly available cluster, set this value to 'false.'
   
     Enter a value:

   Copy to Clipboard Toggle word wrap

2. 输入 yes 以启动角色和集群删除：

   输出示例

   Plan: 0 to add, 0 to change, 63 to destroy.
   
   Do you really want to destroy all resources?
     Terraform will destroy all your managed infrastructure, as shown above.
     There is no undo. Only 'yes' will be accepted to confirm.
   
     Enter a value: yes

   Copy to Clipboard Toggle word wrap

验证

1. 运行以下命令验证集群是否已销毁：

   $ rosa list clusters

   Copy to Clipboard Toggle word wrap

   没有显示集群的输出示例

   I: No clusters available

   Copy to Clipboard Toggle word wrap

2. 运行以下命令验证帐户角色是否已销毁：

   $ rosa list account-roles

   Copy to Clipboard Toggle word wrap

   没有显示 Terraform 创建帐户角色的输出示例

   I: Fetching account roles
   I: No account roles available

   Copy to Clipboard Toggle word wrap

3. 运行以下命令验证 Operator 角色是否已销毁：

   $ rosa list operator-roles

   Copy to Clipboard Toggle word wrap

   输出显示没有 Terraform 创建的 Operator 角色的示例

   I: Fetching operator roles
   I: No operator roles available

   Copy to Clipboard Toggle word wrap