108 lines
4.1 KiB
HCL
108 lines
4.1 KiB
HCL
# Keycloak cluster of the S2I2S OpenStack project.
|
|
#
|
|
# Two VMs in hard anti affinity ('anti-affinity' server group policy: the
|
|
# scheduler fails instead of putting them on the same hypervisor), 30 GB of root
|
|
# disk, m1.medium (RAM 4 - VCPUs 2), no data volume.
|
|
#
|
|
# Each instance has two interfaces:
|
|
# - the main private network (10.10.0.163, 10.10.0.164), where the L7 HAPROXY
|
|
# load balancers and Prometheus reach it;
|
|
# - the dedicated network of the database, the only way to PostgreSQL. The
|
|
# address comes from the allocation pool of that subnet.
|
|
#
|
|
# Apply order: main_net_dns_router -> project-setup -> postgresql -> this one.
|
|
|
|
data "terraform_remote_state" "privnet_dns_router" {
|
|
backend = "local"
|
|
config = {
|
|
path = "../main_net_dns_router/terraform.tfstate"
|
|
}
|
|
}
|
|
|
|
data "terraform_remote_state" "project_setup" {
|
|
backend = "local"
|
|
config = {
|
|
path = "../project-setup/terraform.tfstate"
|
|
}
|
|
}
|
|
|
|
# Dedicated network and client security group of the database
|
|
data "terraform_remote_state" "postgresql" {
|
|
backend = "local"
|
|
config = {
|
|
path = "../postgresql/terraform.tfstate"
|
|
}
|
|
}
|
|
|
|
module "labs_common_variables" {
|
|
source = "../../modules/labs_common_variables"
|
|
}
|
|
|
|
module "project_variables" {
|
|
source = "../variables"
|
|
}
|
|
|
|
module "ssh_settings" {
|
|
source = "../../modules/ssh-key-ref"
|
|
}
|
|
|
|
locals {
|
|
# From the network/DNS state
|
|
dns_zone = data.terraform_remote_state.privnet_dns_router.outputs.dns_zone
|
|
dns_zone_id = data.terraform_remote_state.privnet_dns_router.outputs.dns_zone_id
|
|
main_private_network_id = data.terraform_remote_state.privnet_dns_router.outputs.main_private_network_id
|
|
main_private_subnet_id = data.terraform_remote_state.privnet_dns_router.outputs.main_subnet_network_id
|
|
|
|
# From the project setup state
|
|
default_security_group_id = data.terraform_remote_state.project_setup.outputs.default_security_group_id
|
|
basic_services_ip = data.terraform_remote_state.project_setup.outputs.basic_services_ip
|
|
main_haproxy_l7_ip = data.terraform_remote_state.project_setup.outputs.main_haproxy_l7_ip
|
|
main_loadbalancer_name = data.terraform_remote_state.project_setup.outputs.main_loadbalancer_hostname
|
|
|
|
# From the postgresql state
|
|
postgresql_network_id = data.terraform_remote_state.postgresql.outputs.postgresql_network_id
|
|
postgresql_subnet_id = data.terraform_remote_state.postgresql.outputs.postgresql_subnet_id
|
|
postgresql_client_security_group_id = data.terraform_remote_state.postgresql.outputs.postgresql_client_access_security_group_id
|
|
|
|
# From the common and project variables
|
|
availability_zone = module.labs_common_variables.availability_zones_names.availability_zone_no_gpu
|
|
ubuntu_2404 = module.labs_common_variables.ubuntu_2404
|
|
ubuntu2404_data_file = module.labs_common_variables.ubuntu2404_data_file
|
|
keycloak_ip = module.project_variables.keycloak_ip
|
|
}
|
|
|
|
module "keycloak" {
|
|
source = "../../modules/keycloak"
|
|
|
|
# Address plan of the project. The sizing comes from the module defaults
|
|
keycloak_ip = local.keycloak_ip
|
|
|
|
main_private_network_id = local.main_private_network_id
|
|
main_private_subnet_id = local.main_private_subnet_id
|
|
default_security_group_id = local.default_security_group_id
|
|
haproxy_l7_ip = local.main_haproxy_l7_ip
|
|
prometheus_cidr = local.basic_services_ip.prometheus_cidr
|
|
|
|
postgresql_network_id = local.postgresql_network_id
|
|
postgresql_subnet_id = local.postgresql_subnet_id
|
|
postgresql_client_security_group_id = local.postgresql_client_security_group_id
|
|
|
|
availability_zone = local.availability_zone
|
|
image = {
|
|
uuid = local.ubuntu_2404.uuid
|
|
user_data_file = local.ubuntu2404_data_file
|
|
}
|
|
ssh_key_name = module.ssh_settings.ssh_key_name
|
|
|
|
# The service is published by the main load balancer, so the public name is a
|
|
# CNAME to it
|
|
dns_zone_id = local.dns_zone_id
|
|
keycloak_cname_target = local.main_loadbalancer_name
|
|
keycloak_recordsets = {
|
|
accounts = {
|
|
name = "accounts.${local.dns_zone.name}"
|
|
description = "Keycloak of the S2I2S project, published by the main load balancer"
|
|
}
|
|
}
|
|
}
|