第 3 章 使用 Terraform 创建 ROSA （经典架构）集群

流程

1. 可选: 因为在安装过程中在当前目录中创建 Terraform 文件，所以您可以创建一个新的目录来存储这些文件并导航到其中：

   $ mkdir terraform-cluster && cd terraform-cluster

2. 使用 离线 Red Hat OpenShift Cluster Manager 令牌 向您的帐户授予权限。

3. 运行以下命令复制离线令牌，并将令牌设置为环境变量：

   $ export RHCS_TOKEN=<your_offline_token>

   注意

   此环境变量会在每个会话的末尾重置，如重启计算机或关闭终端。

流程

1. 运行以下命令来创建 main.tf 文件：

   $ cat<<-EOF>main.tf
   #
   # Copyright (c) 2023 Red Hat, Inc.
   #
   # Licensed under the Apache License, Version 2.0 (the "License");
   # you may not use this file except in compliance with the License.
   # You may obtain a copy of the License at
   #
   #   http://www.apache.org/licenses/LICENSE-2.0
   #
   # Unless required by applicable law or agreed to in writing, software
   # distributed under the License is distributed on an "AS IS" BASIS,
   # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   # See the License for the specific language governing permissions and
   # limitations under the License.
   #
   
   terraform {
     required_providers {
       aws = {
         source  = "hashicorp/aws"
         version = ">= 4.20.0"
       }
       rhcs = {
         version = ">= 1.6.2"
         source  = "terraform-redhat/rhcs"
       }
     }
   }
   
   # Export token using the RHCS_TOKEN environment variable
   provider "rhcs" {}
   
   provider "aws" {
     region = var.aws_region
     ignore_tags {
       key_prefixes = ["kubernetes.io/"]
     }
     default_tags {
       tags = var.default_aws_tags
     }
   }
   
   data "aws_availability_zones" "available" {}
   
   locals {
     # The default setting creates 3 availability zones. Set to "false" to create a single availability zones.
     region_azs = var.multi_az ? slice([for zone in data.aws_availability_zones.available.names : format("%s", zone)], 0, 3) : slice([for zone in data.aws_availability_zones.available.names : format("%s", zone)], 0, 1)
   }
   
   resource "random_string" "random_name" {
     length  = 6
     special = false
     upper   = false
   }
   
   locals {
     path                 = coalesce(var.path, "/")
     worker_node_replicas = try(var.worker_node_replicas, var.multi_az ? 3 : 2)
     # If cluster_name is not null, use that, otherwise generate a random cluster name
     cluster_name = coalesce(var.cluster_name, "rosa-\${random_string.random_name.result}")
   }
   
   # The network validator requires an additional 60 seconds to validate Terraform clusters.
   resource "time_sleep" "wait_60_seconds" {
     count = var.create_vpc ? 1 : 0
     depends_on = [module.vpc]
     create_duration = "60s"
   }
   
   module "rosa-classic" {
     source                 = "terraform-redhat/rosa-classic/rhcs"
     version                = "1.5.0"
     cluster_name           = local.cluster_name
     openshift_version      = var.openshift_version
     account_role_prefix    = local.cluster_name
     operator_role_prefix   = local.cluster_name
     replicas               = local.worker_node_replicas
     aws_availability_zones = local.region_azs
     create_oidc            = true
     private                = var.private_cluster
     aws_private_link       = var.private_cluster
     aws_subnet_ids         = var.create_vpc ? var.private_cluster ? module.vpc[0].private_subnets : concat(module.vpc[0].public_subnets, module.vpc[0].private_subnets) : var.aws_subnet_ids
     multi_az               = var.multi_az
     create_account_roles   = true
     create_operator_roles  = true
   # Optional: Configure a cluster administrator user <.>
   #
   # Option 1: Default cluster-admin user
   # Create an administrator user (cluster-admin) and automatically
   # generate a password by uncommenting the following parameter:
   #  create_admin_user = true
   # Generated administrator credentials are displayed in terminal output.
   #
   # Option 2: Specify administrator username and password
   # Create an administrator user and define your own password
   # by uncommenting and editing the values of the following parameters:
   #  admin_credentials_username = <username>
   #  admin_credentials_password = <password>
   
     depends_on = [time_sleep.wait_60_seconds]
   }
   EOF

   <.> 可选：通过取消注释适当的参数并编辑其值，在集群创建过程中创建管理员用户。

2. 运行以下命令来创建 variables.tf 文件：

   注意

   在运行该命令 以构建 集群前复制并编辑此文件。

   $ cat<<-EOF>variables.tf
   #
   # Copyright (c) 2023 Red Hat, Inc.
   #
   # Licensed under the Apache License, Version 2.0 (the "License");
   # you may not use this file except in compliance with the License.
   # You may obtain a copy of the License at
   #
   #   http://www.apache.org/licenses/LICENSE-2.0
   #
   # Unless required by applicable law or agreed to in writing, software
   # distributed under the License is distributed on an "AS IS" BASIS,
   # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   # See the License for the specific language governing permissions and
   # limitations under the License.
   #
   variable "openshift_version" {
     type        = string
     default     = "4.14.20"
     description = "Desired version of OpenShift for the cluster, for example '4.14.20'. If version is greater than the currently running version, an upgrade will be scheduled."
   }
   
   variable "create_vpc" {
     type        = bool
     description = "If you would like to create a new VPC, set this value to 'true'. If you do not want to create a new VPC, set this value to 'false'."
   }
   
   # ROSA Cluster info
   variable "cluster_name" {
     default     = null
     type        = string
     description = "The name of the ROSA cluster to create"
   }
   
   variable "additional_tags" {
     default = {
       Terraform   = "true"
       Environment = "dev"
     }
     description = "Additional AWS resource tags"
     type        = map(string)
   }
   
   variable "path" {
     description = "(Optional) The arn path for the account/operator roles as well as their policies."
     type        = string
     default     = null
   }
   
   variable "multi_az" {
     type        = bool
     description = "Multi AZ Cluster for High Availability"
     default     = true
   }
   
   variable "worker_node_replicas" {
     default     = 3
     description = "Number of worker nodes to provision. Single zone clusters need at least 2 nodes, multizone clusters need at least 3 nodes"
     type        = number
   }
   
   variable "aws_subnet_ids" {
     type        = list(any)
     description = "A list of either the public or public + private subnet IDs to use for the cluster blocks to use for the cluster"
     default     = ["subnet-01234567890abcdef", "subnet-01234567890abcdef", "subnet-01234567890abcdef"]
   }
   
   variable "private_cluster" {
     type        = bool
     description = "If you want to create a private cluster, set this value to 'true'. If you want a publicly available cluster, set this value to 'false'."
   }
   
   #VPC Info
   variable "vpc_name" {
     type        = string
     description = "VPC Name"
     default     = "tf-qs-vpc"
   }
   
   variable "vpc_cidr_block" {
     type        = string
     description = "value of the CIDR block to use for the VPC"
     default     = "10.0.0.0/16"
   }
   
   variable "private_subnet_cidrs" {
     type        = list(any)
     description = "The CIDR blocks to use for the private subnets"
     default     = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
   }
   
   variable "public_subnet_cidrs" {
     type        = list(any)
     description = "The CIDR blocks to use for the public subnets"
     default     = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
   }
   
   variable "single_nat_gateway" {
     type        = bool
     description = "Single NAT or per NAT for subnet"
     default     = false
   }
   
   #AWS Info
   variable "aws_region" {
     type    = string
     default = "us-east-2"
   }
   
   variable "default_aws_tags" {
     type        = map(string)
     description = "Default tags for AWS"
     default     = {}
   }
   EOF

3. 运行以下命令来创建 vpc.tf 文件：

   $ cat<<-EOF>vpc.tf
   #
   # Copyright (c) 2023 Red Hat, Inc.
   #
   # Licensed under the Apache License, Version 2.0 (the "License");
   # you may not use this file except in compliance with the License.
   # You may obtain a copy of the License at
   #
   #   http://www.apache.org/licenses/LICENSE-2.0
   #
   # Unless required by applicable law or agreed to in writing, software
   # distributed under the License is distributed on an "AS IS" BASIS,
   # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   # See the License for the specific language governing permissions and
   # limitations under the License.
   #
   module "vpc" {
     source  = "terraform-aws-modules/vpc/aws"
     version = "5.1.2"
   
     count = var.create_vpc ? 1 : 0
     name  = var.vpc_name
     cidr  = var.vpc_cidr_block
   
     azs             = local.region_azs
     private_subnets = var.private_subnet_cidrs
     public_subnets  = var.public_subnet_cidrs
   
     enable_nat_gateway   = true
     single_nat_gateway   = var.single_nat_gateway
     enable_dns_hostnames = true
     enable_dns_support   = true
   
     tags = var.additional_tags
   }
   EOF

   您已准备好启动 Terraform。

流程

1. 将 Terraform 设置为根据您的 Terraform 文件创建资源，运行以下命令：

   $ terraform init

2. 可选 ：运行以下命令来验证您复制的 Terraform 是否正确：

   $ terraform validate

   输出示例

   Success! The configuration is valid.

3. 运行以下命令，使用 Terraform 创建集群：

   $ terraform apply

   Terraform 界面需要两个问题来创建集群，并熟悉以下内容：

   输出示例

   var.create_vpc
     If you would like to create a new VPC, set this value to 'true'. If you do not want to create a new VPC, set this value to 'false'.
   
     Enter a value:
   
   var.private_cluster
     If you want to create a private cluster, set this value to 'true'. If you want a publicly available cluster, set this value to 'false'.
   
     Enter a value:

4. 当 Terraform 界面列出要创建或修改的资源并提示确认时，输入 yes 才能继续或取消：

   输出示例

   Plan: 74 to add, 0 to change, 0 to destroy.
   
   Do you want to perform these actions?
     Terraform will perform the actions described above.
     Only 'yes' will be accepted to approve.
   
     Enter a value: yes

   如果输入 yes，您的 Terraform 计划将启动，创建 AWS 帐户角色、Operator 角色和 ROSA Classic 集群。

验证

1. 运行以下命令验证集群是否已创建：

   $ rosa list clusters

   显示集群的 ID、名称和状态的输出示例

   ID                                NAME          STATE  TOPOLOGY
   27c3snjsupa9obua74ba8se5kcj11269  rosa-tf-demo  ready  Classic (STS)

2. 运行以下命令验证您的帐户角色是否已创建：

   $ rosa list account-roles

   输出示例

   I: Fetching account roles
   ROLE NAME                                   ROLE TYPE      ROLE ARN                                                           OPENSHIFT VERSION  AWS Managed
   ROSA-demo-ControlPlane-Role                 Control plane  arn:aws:iam::<ID>:role/ROSA-demo-ControlPlane-Role                 4.14               No
   ROSA-demo-Installer-Role                    Installer      arn:aws:iam::<ID>:role/ROSA-demo-Installer-Role                    4.14               No
   ROSA-demo-Support-Role                      Support        arn:aws:iam::<ID>:role/ROSA-demo-Support-Role                      4.14               No
   ROSA-demo-Worker-Role                       Worker         arn:aws:iam::<ID>:role/ROSA-demo-Worker-Role                       4.14               No

3. 运行以下命令验证您的 Operator 角色是否已创建：

   $ rosa list operator-roles

   显示 Terraform 创建的 Operator 角色的输出示例

   I: Fetching operator roles
   ROLE PREFIX    AMOUNT IN BUNDLE
   rosa-demo      6

流程

1. 在运行 terraform apply 命令创建集群的目录中，运行以下命令删除集群：

   $ terraform destroy

   Terraform 接口提示您输入两个变量。它们应与创建集群时提供的答案匹配：

   var.create_vpc
     If you would like to create a new VPC, set this value to 'true.' If you do not want to create a new VPC, set this value to 'false.'
   
     Enter a value:
   
   var.private_cluster
     If you want to create a private cluster, set this value to 'true.' If you want a publicly available cluster, set this value to 'false.'
   
     Enter a value:

2. 输入 yes 以启动角色和集群删除：

   输出示例

   Plan: 0 to add, 0 to change, 74 to destroy.
   
   Do you really want to destroy all resources?
     Terraform will destroy all your managed infrastructure, as shown above.
     There is no undo. Only 'yes' will be accepted to confirm.
   
     Enter a value: yes

验证

1. 运行以下命令验证集群是否已销毁：

   $ rosa list clusters

   没有显示集群的输出示例

   I: No clusters available

2. 运行以下命令，验证帐户角色是否已销毁：

   $ rosa list account-roles

   没有显示 Terraform 创建帐户角色的输出示例

   I: Fetching account roles
   I: No account roles available

3. 运行以下命令，验证 Operator 角色是否已销毁：

   $ rosa list operator-roles

   输出显示没有 Terraform 创建的 Operator 角色的示例

   I: Fetching operator roles
   I: No operator roles available