update

kubespray/contrib/terraform/openstack/modules/compute/ansible_bastion_template.txt

@@ -0,0 +1 @@
+ansible_ssh_common_args: "-o ProxyCommand='ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -W %h:%p -q USER@BASTION_ADDRESS {% if ansible_ssh_private_key_file is defined %}-i {{ ansible_ssh_private_key_file }}{% endif %}'"

kubespray/contrib/terraform/openstack/modules/compute/main.tf

@@ -0,0 +1,903 @@
+data "openstack_images_image_v2" "vm_image" {
+  count = var.image_uuid == "" ? 1 : 0
+  most_recent = true
+  name = var.image
+}
+
+data "openstack_images_image_v2" "gfs_image" {
+  count = var.image_gfs_uuid == "" ? var.image_uuid == "" ? 1 : 0 : 0
+  most_recent = true
+  name = var.image_gfs == "" ? var.image : var.image_gfs
+}
+
+data "openstack_images_image_v2" "image_master" {
+  count = var.image_master_uuid == "" ? var.image_uuid == "" ? 1 : 0 : 0
+  name = var.image_master == "" ? var.image : var.image_master
+}
+
+data "cloudinit_config" "cloudinit" {
+  part {
+    content_type =  "text/cloud-config"
+    content = file("${path.module}/templates/cloudinit.yaml")
+  }
+}
+
+data "openstack_networking_network_v2" "k8s_network" {
+  count = var.use_existing_network ? 1 : 0
+  name  = var.network_name
+}
+
+resource "openstack_compute_keypair_v2" "k8s" {
+  name       = "kubernetes-${var.cluster_name}"
+  public_key = chomp(file(var.public_key_path))
+}
+
+resource "openstack_networking_secgroup_v2" "k8s_master" {
+  name                 = "${var.cluster_name}-k8s-master"
+  description          = "${var.cluster_name} - Kubernetes Master"
+  delete_default_rules = true
+}
+
+resource "openstack_networking_secgroup_v2" "k8s_master_extra" {
+  count                = "%{if var.extra_sec_groups}1%{else}0%{endif}"
+  name                 = "${var.cluster_name}-k8s-master-${var.extra_sec_groups_name}"
+  description          = "${var.cluster_name} - Kubernetes Master nodes - rules not managed by terraform"
+  delete_default_rules = true
+}
+
+resource "openstack_networking_secgroup_rule_v2" "k8s_master" {
+  count             = length(var.master_allowed_remote_ips)
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = "6443"
+  port_range_max    = "6443"
+  remote_ip_prefix  = var.master_allowed_remote_ips[count.index]
+  security_group_id = openstack_networking_secgroup_v2.k8s_master.id
+}
+
+resource "openstack_networking_secgroup_rule_v2" "k8s_master_ports" {
+  count             = length(var.master_allowed_ports)
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = lookup(var.master_allowed_ports[count.index], "protocol", "tcp")
+  port_range_min    = lookup(var.master_allowed_ports[count.index], "port_range_min")
+  port_range_max    = lookup(var.master_allowed_ports[count.index], "port_range_max")
+  remote_ip_prefix  = lookup(var.master_allowed_ports[count.index], "remote_ip_prefix", "0.0.0.0/0")
+  security_group_id = openstack_networking_secgroup_v2.k8s_master.id
+}
+
+resource "openstack_networking_secgroup_v2" "bastion" {
+  name                 = "${var.cluster_name}-bastion"
+  count                = var.number_of_bastions != "" ? 1 : 0
+  description          = "${var.cluster_name} - Bastion Server"
+  delete_default_rules = true
+}
+
+resource "openstack_networking_secgroup_rule_v2" "bastion" {
+  count             = var.number_of_bastions != "" ? length(var.bastion_allowed_remote_ips) : 0
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = "22"
+  port_range_max    = "22"
+  remote_ip_prefix  = var.bastion_allowed_remote_ips[count.index]
+  security_group_id = openstack_networking_secgroup_v2.bastion[0].id
+}
+
+resource "openstack_networking_secgroup_rule_v2" "k8s_bastion_ports" {
+  count             = length(var.bastion_allowed_ports)
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = lookup(var.bastion_allowed_ports[count.index], "protocol", "tcp")
+  port_range_min    = lookup(var.bastion_allowed_ports[count.index], "port_range_min")
+  port_range_max    = lookup(var.bastion_allowed_ports[count.index], "port_range_max")
+  remote_ip_prefix  = lookup(var.bastion_allowed_ports[count.index], "remote_ip_prefix", "0.0.0.0/0")
+  security_group_id = openstack_networking_secgroup_v2.bastion[0].id
+}
+
+resource "openstack_networking_secgroup_v2" "k8s" {
+  name                 = "${var.cluster_name}-k8s"
+  description          = "${var.cluster_name} - Kubernetes"
+  delete_default_rules = true
+}
+
+resource "openstack_networking_secgroup_rule_v2" "k8s" {
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  remote_group_id   = openstack_networking_secgroup_v2.k8s.id
+  security_group_id = openstack_networking_secgroup_v2.k8s.id
+}
+
+resource "openstack_networking_secgroup_rule_v2" "k8s_allowed_remote_ips" {
+  count             = length(var.k8s_allowed_remote_ips)
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = "22"
+  port_range_max    = "22"
+  remote_ip_prefix  = var.k8s_allowed_remote_ips[count.index]
+  security_group_id = openstack_networking_secgroup_v2.k8s.id
+}
+
+resource "openstack_networking_secgroup_rule_v2" "egress" {
+  count             = length(var.k8s_allowed_egress_ips)
+  direction         = "egress"
+  ethertype         = "IPv4"
+  remote_ip_prefix  = var.k8s_allowed_egress_ips[count.index]
+  security_group_id = openstack_networking_secgroup_v2.k8s.id
+}
+
+resource "openstack_networking_secgroup_v2" "worker" {
+  name                 = "${var.cluster_name}-k8s-worker"
+  description          = "${var.cluster_name} - Kubernetes worker nodes"
+  delete_default_rules = true
+}
+
+resource "openstack_networking_secgroup_v2" "worker_extra" {
+  count                = "%{if var.extra_sec_groups}1%{else}0%{endif}"
+  name                 = "${var.cluster_name}-k8s-worker-${var.extra_sec_groups_name}"
+  description          = "${var.cluster_name} - Kubernetes worker nodes - rules not managed by terraform"
+  delete_default_rules = true
+}
+
+resource "openstack_networking_secgroup_rule_v2" "worker" {
+  count             = length(var.worker_allowed_ports)
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = lookup(var.worker_allowed_ports[count.index], "protocol", "tcp")
+  port_range_min    = lookup(var.worker_allowed_ports[count.index], "port_range_min")
+  port_range_max    = lookup(var.worker_allowed_ports[count.index], "port_range_max")
+  remote_ip_prefix  = lookup(var.worker_allowed_ports[count.index], "remote_ip_prefix", "0.0.0.0/0")
+  security_group_id = openstack_networking_secgroup_v2.worker.id
+}
+
+resource "openstack_compute_servergroup_v2" "k8s_master" {
+  count    = var.master_server_group_policy != "" ? 1 : 0
+  name     = "k8s-master-srvgrp"
+  policies = [var.master_server_group_policy]
+}
+
+resource "openstack_compute_servergroup_v2" "k8s_node" {
+  count    = var.node_server_group_policy != "" ? 1 : 0
+  name     = "k8s-node-srvgrp"
+  policies = [var.node_server_group_policy]
+}
+
+resource "openstack_compute_servergroup_v2" "k8s_etcd" {
+  count    = var.etcd_server_group_policy != "" ? 1 : 0
+  name     = "k8s-etcd-srvgrp"
+  policies = [var.etcd_server_group_policy]
+}
+
+locals {
+# master groups
+  master_sec_groups = compact([
+    openstack_networking_secgroup_v2.k8s_master.id,
+    openstack_networking_secgroup_v2.k8s.id,
+    var.extra_sec_groups ?openstack_networking_secgroup_v2.k8s_master_extra[0].id : "",
+  ])
+# worker groups
+  worker_sec_groups = compact([
+    openstack_networking_secgroup_v2.k8s.id,
+    openstack_networking_secgroup_v2.worker.id,
+    var.extra_sec_groups ? openstack_networking_secgroup_v2.worker_extra[0].id : "",
+  ])
+# bastion groups
+  bastion_sec_groups = compact(concat([
+    openstack_networking_secgroup_v2.k8s.id,
+    openstack_networking_secgroup_v2.bastion[0].id,
+  ]))
+# etcd groups
+  etcd_sec_groups = compact([openstack_networking_secgroup_v2.k8s.id])
+# glusterfs groups
+  gfs_sec_groups = compact([openstack_networking_secgroup_v2.k8s.id])
+
+# Image uuid
+  image_to_use_node = var.image_uuid != "" ? var.image_uuid : data.openstack_images_image_v2.vm_image[0].id
+# Image_gfs uuid
+  image_to_use_gfs = var.image_gfs_uuid != "" ? var.image_gfs_uuid : var.image_uuid != "" ? var.image_uuid : data.openstack_images_image_v2.gfs_image[0].id
+# image_master uuidimage_gfs_uuid
+  image_to_use_master = var.image_master_uuid != "" ? var.image_master_uuid : var.image_uuid != "" ? var.image_uuid : data.openstack_images_image_v2.image_master[0].id
+}
+
+resource "openstack_networking_port_v2" "bastion_port" {
+  count                 = var.number_of_bastions
+  name                  = "${var.cluster_name}-bastion-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.bastion_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "bastion" {
+  name       = "${var.cluster_name}-bastion-${count.index + 1}"
+  count      = var.number_of_bastions
+  image_id   = var.bastion_root_volume_size_in_gb == 0 ? local.image_to_use_node : null
+  flavor_id  = var.flavor_bastion
+  key_pair   = openstack_compute_keypair_v2.k8s.name
+  user_data  = data.cloudinit_config.cloudinit.rendered
+
+  dynamic "block_device" {
+    for_each = var.bastion_root_volume_size_in_gb > 0 ? [local.image_to_use_node] : []
+    content {
+      uuid                  = local.image_to_use_node
+      source_type           = "image"
+      volume_size           = var.bastion_root_volume_size_in_gb
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.bastion_port.*.id, count.index)
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "bastion"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+
+  provisioner "local-exec" {
+    command = "sed -e s/USER/${var.ssh_user}/ -e s/BASTION_ADDRESS/${var.bastion_fips[0]}/ ${path.module}/ansible_bastion_template.txt > ${var.group_vars_path}/no_floating.yml"
+  }
+}
+
+resource "openstack_networking_port_v2" "k8s_master_port" {
+  count                 = var.number_of_k8s_masters
+  name                  = "${var.cluster_name}-k8s-master-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.master_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "k8s_master" {
+  name              = "${var.cluster_name}-k8s-master-${count.index + 1}"
+  count             = var.number_of_k8s_masters
+  availability_zone = element(var.az_list, count.index)
+  image_id          = var.master_root_volume_size_in_gb == 0 ? local.image_to_use_master : null
+  flavor_id         = var.flavor_k8s_master
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+  user_data         = data.cloudinit_config.cloudinit.rendered
+
+
+  dynamic "block_device" {
+    for_each = var.master_root_volume_size_in_gb > 0 ? [local.image_to_use_master] : []
+    content {
+      uuid                  = local.image_to_use_master
+      source_type           = "image"
+      volume_size           = var.master_root_volume_size_in_gb
+      volume_type           = var.master_volume_type
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.k8s_master_port.*.id, count.index)
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.master_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_master[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_master[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "etcd,kube_control_plane,${var.supplementary_master_groups},k8s_cluster"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+
+  provisioner "local-exec" {
+    command = "sed -e s/USER/${var.ssh_user}/ -e s/BASTION_ADDRESS/${element(concat(var.bastion_fips, var.k8s_master_fips), 0)}/ ${path.module}/ansible_bastion_template.txt > ${var.group_vars_path}/no_floating.yml"
+  }
+}
+
+resource "openstack_networking_port_v2" "k8s_masters_port" {
+  for_each              = var.number_of_k8s_masters == 0 && var.number_of_k8s_masters_no_etcd == 0 && var.number_of_k8s_masters_no_floating_ip == 0 && var.number_of_k8s_masters_no_floating_ip_no_etcd == 0 ? var.k8s_masters : {}
+  name                  = "${var.cluster_name}-k8s-${each.key}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.master_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "k8s_masters" {
+  for_each          = var.number_of_k8s_masters == 0 && var.number_of_k8s_masters_no_etcd == 0 && var.number_of_k8s_masters_no_floating_ip == 0 && var.number_of_k8s_masters_no_floating_ip_no_etcd == 0 ? var.k8s_masters : {}
+  name              = "${var.cluster_name}-k8s-${each.key}"
+  availability_zone = each.value.az
+  image_id          = var.master_root_volume_size_in_gb == 0 ? local.image_to_use_master : null
+  flavor_id         = each.value.flavor
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+
+  dynamic "block_device" {
+    for_each = var.master_root_volume_size_in_gb > 0 ? [local.image_to_use_master] : []
+    content {
+      uuid                  = local.image_to_use_master
+      source_type           = "image"
+      volume_size           = var.master_root_volume_size_in_gb
+      volume_type           = var.master_volume_type
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = openstack_networking_port_v2.k8s_masters_port[each.key].id
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.master_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_master[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_master[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "%{if each.value.etcd == true}etcd,%{endif}kube_control_plane,${var.supplementary_master_groups},k8s_cluster%{if each.value.floating_ip == false},no_floating%{endif}"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+
+  provisioner "local-exec" {
+    command = "%{if each.value.floating_ip}sed s/USER/${var.ssh_user}/ ${path.root}/ansible_bastion_template.txt | sed s/BASTION_ADDRESS/${element(concat(var.bastion_fips, [for key, value in var.k8s_masters_fips : value.address]), 0)}/ > ${var.group_vars_path}/no_floating.yml%{else}true%{endif}"
+  }
+}
+
+resource "openstack_networking_port_v2" "k8s_master_no_etcd_port" {
+  count                 = var.number_of_k8s_masters_no_etcd
+  name                  = "${var.cluster_name}-k8s-master-ne-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.master_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "k8s_master_no_etcd" {
+  name              = "${var.cluster_name}-k8s-master-ne-${count.index + 1}"
+  count             = var.number_of_k8s_masters_no_etcd
+  availability_zone = element(var.az_list, count.index)
+  image_id          = var.master_root_volume_size_in_gb == 0 ? local.image_to_use_master : null
+  flavor_id         = var.flavor_k8s_master
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+  user_data         = data.cloudinit_config.cloudinit.rendered
+
+
+  dynamic "block_device" {
+    for_each = var.master_root_volume_size_in_gb > 0 ? [local.image_to_use_master] : []
+    content {
+      uuid                  = local.image_to_use_master
+      source_type           = "image"
+      volume_size           = var.master_root_volume_size_in_gb
+      volume_type           = var.master_volume_type
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.k8s_master_no_etcd_port.*.id, count.index)
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.master_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_master[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_master[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "kube_control_plane,${var.supplementary_master_groups},k8s_cluster"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+
+  provisioner "local-exec" {
+    command = "sed -e s/USER/${var.ssh_user}/ -e s/BASTION_ADDRESS/${element(concat(var.bastion_fips, var.k8s_master_fips), 0)}/ ${path.module}/ansible_bastion_template.txt > ${var.group_vars_path}/no_floating.yml"
+  }
+}
+
+resource "openstack_networking_port_v2" "etcd_port" {
+  count                 = var.number_of_etcd
+  name                  = "${var.cluster_name}-etcd-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.etcd_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "etcd" {
+  name              = "${var.cluster_name}-etcd-${count.index + 1}"
+  count             = var.number_of_etcd
+  availability_zone = element(var.az_list, count.index)
+  image_id          = var.etcd_root_volume_size_in_gb == 0 ? local.image_to_use_master : null
+  flavor_id         = var.flavor_etcd
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+  user_data         = data.cloudinit_config.cloudinit.rendered
+
+  dynamic "block_device" {
+    for_each = var.etcd_root_volume_size_in_gb > 0 ? [local.image_to_use_master] : []
+    content {
+      uuid                  = local.image_to_use_master
+      source_type           = "image"
+      volume_size           = var.etcd_root_volume_size_in_gb
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.etcd_port.*.id, count.index)
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.etcd_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_etcd[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_etcd[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "etcd,no_floating"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+}
+
+resource "openstack_networking_port_v2" "k8s_master_no_floating_ip_port" {
+  count                 = var.number_of_k8s_masters_no_floating_ip
+  name                  = "${var.cluster_name}-k8s-master-nf-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.master_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "k8s_master_no_floating_ip" {
+  name              = "${var.cluster_name}-k8s-master-nf-${count.index + 1}"
+  count             = var.number_of_k8s_masters_no_floating_ip
+  availability_zone = element(var.az_list, count.index)
+  image_id          = var.master_root_volume_size_in_gb == 0 ? local.image_to_use_master : null
+  flavor_id         = var.flavor_k8s_master
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+
+  dynamic "block_device" {
+    for_each = var.master_root_volume_size_in_gb > 0 ? [local.image_to_use_master] : []
+    content {
+      uuid                  = local.image_to_use_master
+      source_type           = "image"
+      volume_size           = var.master_root_volume_size_in_gb
+      volume_type           = var.master_volume_type
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.k8s_master_no_floating_ip_port.*.id, count.index)
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.master_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_master[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_master[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "etcd,kube_control_plane,${var.supplementary_master_groups},k8s_cluster,no_floating"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+}
+
+resource "openstack_networking_port_v2" "k8s_master_no_floating_ip_no_etcd_port" {
+  count                 = var.number_of_k8s_masters_no_floating_ip_no_etcd
+  name                  = "${var.cluster_name}-k8s-master-ne-nf-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.master_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "k8s_master_no_floating_ip_no_etcd" {
+  name              = "${var.cluster_name}-k8s-master-ne-nf-${count.index + 1}"
+  count             = var.number_of_k8s_masters_no_floating_ip_no_etcd
+  availability_zone = element(var.az_list, count.index)
+  image_id          = var.master_root_volume_size_in_gb == 0 ? local.image_to_use_master : null
+  flavor_id         = var.flavor_k8s_master
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+  user_data         = data.cloudinit_config.cloudinit.rendered
+
+  dynamic "block_device" {
+    for_each = var.master_root_volume_size_in_gb > 0 ? [local.image_to_use_master] : []
+    content {
+      uuid                  = local.image_to_use_master
+      source_type           = "image"
+      volume_size           = var.master_root_volume_size_in_gb
+      volume_type           = var.master_volume_type
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.k8s_master_no_floating_ip_no_etcd_port.*.id, count.index)
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.master_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_master[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_master[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "kube_control_plane,${var.supplementary_master_groups},k8s_cluster,no_floating"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+}
+
+resource "openstack_networking_port_v2" "k8s_node_port" {
+  count                 = var.number_of_k8s_nodes
+  name                  = "${var.cluster_name}-k8s-node-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.worker_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "k8s_node" {
+  name              = "${var.cluster_name}-k8s-node-${count.index + 1}"
+  count             = var.number_of_k8s_nodes
+  availability_zone = element(var.az_list_node, count.index)
+  image_id          = var.node_root_volume_size_in_gb == 0 ? local.image_to_use_node : null
+  flavor_id         = var.flavor_k8s_node
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+  user_data         = data.cloudinit_config.cloudinit.rendered
+
+  dynamic "block_device" {
+    for_each = var.node_root_volume_size_in_gb > 0 ? [local.image_to_use_node] : []
+    content {
+      uuid                  = local.image_to_use_node
+      source_type           = "image"
+      volume_size           = var.node_root_volume_size_in_gb
+      volume_type           = var.node_volume_type
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.k8s_node_port.*.id, count.index)
+  }
+
+
+  dynamic "scheduler_hints" {
+    for_each = var.node_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_node[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_node[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "kube_node,k8s_cluster,${var.supplementary_node_groups}"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+
+  provisioner "local-exec" {
+    command = "sed -e s/USER/${var.ssh_user}/ -e s/BASTION_ADDRESS/${element(concat(var.bastion_fips, var.k8s_node_fips), 0)}/ ${path.module}/ansible_bastion_template.txt > ${var.group_vars_path}/no_floating.yml"
+  }
+}
+
+resource "openstack_networking_port_v2" "k8s_node_no_floating_ip_port" {
+  count                 = var.number_of_k8s_nodes_no_floating_ip
+  name                  = "${var.cluster_name}-k8s-node-nf-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.worker_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "k8s_node_no_floating_ip" {
+  name              = "${var.cluster_name}-k8s-node-nf-${count.index + 1}"
+  count             = var.number_of_k8s_nodes_no_floating_ip
+  availability_zone = element(var.az_list_node, count.index)
+  image_id          = var.node_root_volume_size_in_gb == 0 ? local.image_to_use_node : null
+  flavor_id         = var.flavor_k8s_node
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+  user_data         = data.cloudinit_config.cloudinit.rendered
+
+  dynamic "block_device" {
+    for_each = var.node_root_volume_size_in_gb > 0 ? [local.image_to_use_node] : []
+    content {
+      uuid                  = local.image_to_use_node
+      source_type           = "image"
+      volume_size           = var.node_root_volume_size_in_gb
+      volume_type           = var.node_volume_type
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.k8s_node_no_floating_ip_port.*.id, count.index)
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.node_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_node[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_node[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "kube_node,k8s_cluster,no_floating,${var.supplementary_node_groups}"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+}
+
+resource "openstack_networking_port_v2" "k8s_nodes_port" {
+  for_each              = var.number_of_k8s_nodes == 0 && var.number_of_k8s_nodes_no_floating_ip == 0 ? var.k8s_nodes : {}
+  name                  = "${var.cluster_name}-k8s-node-${each.key}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.worker_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "k8s_nodes" {
+  for_each          = var.number_of_k8s_nodes == 0 && var.number_of_k8s_nodes_no_floating_ip == 0 ? var.k8s_nodes : {}
+  name              = "${var.cluster_name}-k8s-node-${each.key}"
+  availability_zone = each.value.az
+  image_id          = var.node_root_volume_size_in_gb == 0 ? local.image_to_use_node : null
+  flavor_id         = each.value.flavor
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+  user_data         = data.cloudinit_config.cloudinit.rendered
+
+  dynamic "block_device" {
+    for_each = var.node_root_volume_size_in_gb > 0 ? [local.image_to_use_node] : []
+    content {
+      uuid                  = local.image_to_use_node
+      source_type           = "image"
+      volume_size           = var.node_root_volume_size_in_gb
+      volume_type           = var.node_volume_type
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = openstack_networking_port_v2.k8s_nodes_port[each.key].id
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.node_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_node[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_node[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user
+    kubespray_groups = "kube_node,k8s_cluster,%{if each.value.floating_ip == false}no_floating,%{endif}${var.supplementary_node_groups},${try(each.value.extra_groups, "")}"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+
+  provisioner "local-exec" {
+    command = "%{if each.value.floating_ip}sed -e s/USER/${var.ssh_user}/ -e s/BASTION_ADDRESS/${element(concat(var.bastion_fips, [for key, value in var.k8s_nodes_fips : value.address]), 0)}/ ${path.module}/ansible_bastion_template.txt > ${var.group_vars_path}/no_floating.yml%{else}true%{endif}"
+  }
+}
+
+resource "openstack_networking_port_v2" "glusterfs_node_no_floating_ip_port" {
+  count                 = var.number_of_gfs_nodes_no_floating_ip
+  name                  = "${var.cluster_name}-gfs-node-nf-${count.index + 1}"
+  network_id            = var.use_existing_network ? data.openstack_networking_network_v2.k8s_network[0].id : var.network_id
+  admin_state_up        = "true"
+  port_security_enabled = var.force_null_port_security ? null : var.port_security_enabled
+  security_group_ids    = var.port_security_enabled ? local.gfs_sec_groups : null
+  no_security_groups    = var.port_security_enabled ? null : false
+  fixed_ip {
+    subnet_id = var.private_subnet_id
+  }
+
+  depends_on = [
+    var.network_router_id
+  ]
+}
+
+resource "openstack_compute_instance_v2" "glusterfs_node_no_floating_ip" {
+  name              = "${var.cluster_name}-gfs-node-nf-${count.index + 1}"
+  count             = var.number_of_gfs_nodes_no_floating_ip
+  availability_zone = element(var.az_list, count.index)
+  image_name        = var.gfs_root_volume_size_in_gb == 0 ? local.image_to_use_gfs : null
+  flavor_id         = var.flavor_gfs_node
+  key_pair          = openstack_compute_keypair_v2.k8s.name
+
+  dynamic "block_device" {
+    for_each = var.gfs_root_volume_size_in_gb > 0 ? [local.image_to_use_gfs] : []
+    content {
+      uuid                  = local.image_to_use_gfs
+      source_type           = "image"
+      volume_size           = var.gfs_root_volume_size_in_gb
+      boot_index            = 0
+      destination_type      = "volume"
+      delete_on_termination = true
+    }
+  }
+
+  network {
+    port = element(openstack_networking_port_v2.glusterfs_node_no_floating_ip_port.*.id, count.index)
+  }
+
+  dynamic "scheduler_hints" {
+    for_each = var.node_server_group_policy != "" ? [openstack_compute_servergroup_v2.k8s_node[0]] : []
+    content {
+      group = openstack_compute_servergroup_v2.k8s_node[0].id
+    }
+  }
+
+  metadata = {
+    ssh_user         = var.ssh_user_gfs
+    kubespray_groups = "gfs-cluster,network-storage,no_floating"
+    depends_on       = var.network_router_id
+    use_access_ip    = var.use_access_ip
+  }
+}
+
+resource "openstack_networking_floatingip_associate_v2" "bastion" {
+  count                 = var.number_of_bastions
+  floating_ip           = var.bastion_fips[count.index]
+  port_id               = element(openstack_networking_port_v2.bastion_port.*.id, count.index)
+}
+
+
+resource "openstack_networking_floatingip_associate_v2" "k8s_master" {
+  count                 = var.number_of_k8s_masters
+  floating_ip           = var.k8s_master_fips[count.index]
+  port_id               = element(openstack_networking_port_v2.k8s_master_port.*.id, count.index)
+}
+
+resource "openstack_networking_floatingip_associate_v2" "k8s_masters" {
+  for_each              = var.number_of_k8s_masters == 0 && var.number_of_k8s_masters_no_etcd == 0 && var.number_of_k8s_masters_no_floating_ip == 0 && var.number_of_k8s_masters_no_floating_ip_no_etcd == 0 ? { for key, value in var.k8s_masters : key => value if value.floating_ip } : {}
+  floating_ip           = var.k8s_masters_fips[each.key].address
+  port_id               = openstack_networking_port_v2.k8s_masters_port[each.key].id
+}
+
+resource "openstack_networking_floatingip_associate_v2" "k8s_master_no_etcd" {
+  count                 = var.master_root_volume_size_in_gb == 0 ? var.number_of_k8s_masters_no_etcd : 0
+  floating_ip           = var.k8s_master_no_etcd_fips[count.index]
+  port_id               = element(openstack_networking_port_v2.k8s_master_no_etcd_port.*.id, count.index)
+}
+
+resource "openstack_networking_floatingip_associate_v2" "k8s_node" {
+  count                 = var.node_root_volume_size_in_gb == 0 ? var.number_of_k8s_nodes : 0
+  floating_ip           = var.k8s_node_fips[count.index]
+  port_id               = element(openstack_networking_port_v2.k8s_node_port.*.id, count.index)
+}
+
+resource "openstack_networking_floatingip_associate_v2" "k8s_nodes" {
+  for_each              = var.number_of_k8s_nodes == 0 && var.number_of_k8s_nodes_no_floating_ip == 0 ? { for key, value in var.k8s_nodes : key => value if value.floating_ip } : {}
+  floating_ip           = var.k8s_nodes_fips[each.key].address
+  port_id               = openstack_networking_port_v2.k8s_nodes_port[each.key].id
+}
+
+resource "openstack_blockstorage_volume_v2" "glusterfs_volume" {
+  name        = "${var.cluster_name}-glusterfs_volume-${count.index + 1}"
+  count       = var.gfs_root_volume_size_in_gb == 0 ? var.number_of_gfs_nodes_no_floating_ip : 0
+  description = "Non-ephemeral volume for GlusterFS"
+  size        = var.gfs_volume_size_in_gb
+}
+
+resource "openstack_compute_volume_attach_v2" "glusterfs_volume" {
+  count       = var.gfs_root_volume_size_in_gb == 0 ? var.number_of_gfs_nodes_no_floating_ip : 0
+  instance_id = element(openstack_compute_instance_v2.glusterfs_node_no_floating_ip.*.id, count.index)
+  volume_id   = element(openstack_blockstorage_volume_v2.glusterfs_volume.*.id, count.index)
+}

kubespray/contrib/terraform/openstack/modules/compute/templates/cloudinit.yaml

@@ -0,0 +1,17 @@
+# yamllint disable rule:comments
+#cloud-config
+## in some cases novnc console access is required
+## it requires ssh password to be set
+#ssh_pwauth: yes
+#chpasswd:
+#  list: |
+#    root:secret
+#  expire: False
+
+## in some cases direct root ssh access via ssh key is required
+#disable_root: false
+
+## in some cases additional CA certs are required
+#ca-certs:
+#  trusted: |
+#      -----BEGIN CERTIFICATE-----

kubespray/contrib/terraform/openstack/modules/compute/variables.tf

@@ -0,0 +1,195 @@
+variable "cluster_name" {}
+
+variable "az_list" {
+  type = list(string)
+}
+
+variable "az_list_node" {
+  type = list(string)
+}
+
+variable "number_of_k8s_masters" {}
+
+variable "number_of_k8s_masters_no_etcd" {}
+
+variable "number_of_etcd" {}
+
+variable "number_of_k8s_masters_no_floating_ip" {}
+
+variable "number_of_k8s_masters_no_floating_ip_no_etcd" {}
+
+variable "number_of_k8s_nodes" {}
+
+variable "number_of_k8s_nodes_no_floating_ip" {}
+
+variable "number_of_bastions" {}
+
+variable "number_of_gfs_nodes_no_floating_ip" {}
+
+variable "bastion_root_volume_size_in_gb" {}
+
+variable "etcd_root_volume_size_in_gb" {}
+
+variable "master_root_volume_size_in_gb" {}
+
+variable "node_root_volume_size_in_gb" {}
+
+variable "gfs_root_volume_size_in_gb" {}
+
+variable "gfs_volume_size_in_gb" {}
+
+variable "master_volume_type" {}
+
+variable "node_volume_type" {}
+
+variable "public_key_path" {}
+
+variable "image" {}
+
+variable "image_gfs" {}
+
+variable "ssh_user" {}
+
+variable "ssh_user_gfs" {}
+
+variable "flavor_k8s_master" {}
+
+variable "flavor_k8s_node" {}
+
+variable "flavor_etcd" {}
+
+variable "flavor_gfs_node" {}
+
+variable "network_name" {}
+
+variable "flavor_bastion" {}
+
+variable "network_id" {
+  default = ""
+}
+
+variable "use_existing_network" {
+  type = bool
+}
+
+variable "network_router_id" {
+  default = ""
+}
+
+variable "k8s_master_fips" {
+  type = list
+}
+
+variable "k8s_master_no_etcd_fips" {
+  type = list
+}
+
+variable "k8s_node_fips" {
+  type = list
+}
+
+variable "k8s_masters_fips" {
+  type = map
+}
+
+variable "k8s_nodes_fips" {
+  type = map
+}
+
+variable "bastion_fips" {
+  type = list
+}
+
+variable "bastion_allowed_remote_ips" {
+  type = list
+}
+
+variable "master_allowed_remote_ips" {
+  type = list
+}
+
+variable "k8s_allowed_remote_ips" {
+  type = list
+}
+
+variable "k8s_allowed_egress_ips" {
+  type = list
+}
+
+variable "k8s_masters" {}
+
+variable "k8s_nodes" {}
+
+variable "supplementary_master_groups" {
+  default = ""
+}
+
+variable "supplementary_node_groups" {
+  default = ""
+}
+
+variable "master_allowed_ports" {
+  type = list
+}
+
+variable "worker_allowed_ports" {
+  type = list
+}
+
+variable "bastion_allowed_ports" {
+  type = list
+}
+
+variable "use_access_ip" {}
+
+variable "master_server_group_policy" {
+  type = string
+}
+
+variable "node_server_group_policy" {
+  type = string
+}
+
+variable "etcd_server_group_policy" {
+  type = string
+}
+
+variable "extra_sec_groups" {
+  type = bool
+}
+
+variable "extra_sec_groups_name" {
+  type = string
+}
+
+variable "image_uuid" {
+  type = string
+}
+
+variable "image_gfs_uuid" {
+  type = string
+}
+
+variable "image_master" {
+  type = string
+}
+
+variable "image_master_uuid" {
+  type = string
+}
+
+variable "group_vars_path" {
+  type = string
+}
+
+variable "port_security_enabled" {
+  type = bool
+}
+
+variable "force_null_port_security" {
+  type = bool
+}
+
+variable "private_subnet_id" {
+  type = string
+}

kubespray/contrib/terraform/openstack/modules/compute/versions.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    openstack = {
+      source = "terraform-provider-openstack/openstack"
+    }
+  }
+  required_version = ">= 0.12.26"
+}

kubespray/contrib/terraform/openstack/modules/ips/main.tf

@@ -0,0 +1,47 @@
+resource "null_resource" "dummy_dependency" {
+  triggers = {
+    dependency_id = var.router_id
+  }
+  depends_on = [
+    var.router_internal_port_id
+  ]
+}
+
+# If user specifies pre-existing IPs to use in k8s_master_fips, do not create new ones.
+resource "openstack_networking_floatingip_v2" "k8s_master" {
+  count      = length(var.k8s_master_fips) > 0 ? 0 : var.number_of_k8s_masters
+  pool       = var.floatingip_pool
+  depends_on = [null_resource.dummy_dependency]
+}
+
+resource "openstack_networking_floatingip_v2" "k8s_masters" {
+  for_each   = var.number_of_k8s_masters == 0 && var.number_of_k8s_masters_no_etcd == 0 ? { for key, value in var.k8s_masters : key => value if value.floating_ip } : {}
+  pool       = var.floatingip_pool
+  depends_on = [null_resource.dummy_dependency]
+}
+
+# If user specifies pre-existing IPs to use in k8s_master_fips, do not create new ones.
+resource "openstack_networking_floatingip_v2" "k8s_master_no_etcd" {
+  count      = length(var.k8s_master_fips) > 0 ? 0 : var.number_of_k8s_masters_no_etcd
+  pool       = var.floatingip_pool
+  depends_on = [null_resource.dummy_dependency]
+}
+
+resource "openstack_networking_floatingip_v2" "k8s_node" {
+  count      = var.number_of_k8s_nodes
+  pool       = var.floatingip_pool
+  depends_on = [null_resource.dummy_dependency]
+}
+
+resource "openstack_networking_floatingip_v2" "bastion" {
+  count      = length(var.bastion_fips) > 0 ? 0 : var.number_of_bastions
+  pool       = var.floatingip_pool
+  depends_on = [null_resource.dummy_dependency]
+}
+
+resource "openstack_networking_floatingip_v2" "k8s_nodes" {
+  for_each   = var.number_of_k8s_nodes == 0 ? { for key, value in var.k8s_nodes : key => value if value.floating_ip } : {}
+  pool       = var.floatingip_pool
+  depends_on = [null_resource.dummy_dependency]
+}
+

kubespray/contrib/terraform/openstack/modules/ips/outputs.tf

@@ -0,0 +1,25 @@
+# If k8s_master_fips is already defined as input, keep the same value since new FIPs have not been created.
+output "k8s_master_fips" {
+  value = length(var.k8s_master_fips) > 0 ? var.k8s_master_fips : openstack_networking_floatingip_v2.k8s_master[*].address
+}
+
+output "k8s_masters_fips" {
+  value = openstack_networking_floatingip_v2.k8s_masters
+}
+
+# If k8s_master_fips is already defined as input, keep the same value since new FIPs have not been created.
+output "k8s_master_no_etcd_fips" {
+  value = length(var.k8s_master_fips) > 0 ? var.k8s_master_fips : openstack_networking_floatingip_v2.k8s_master_no_etcd[*].address
+}
+
+output "k8s_node_fips" {
+  value = openstack_networking_floatingip_v2.k8s_node[*].address
+}
+
+output "k8s_nodes_fips" {
+  value = openstack_networking_floatingip_v2.k8s_nodes
+}
+
+output "bastion_fips" {
+  value = length(var.bastion_fips) > 0 ? var.bastion_fips : openstack_networking_floatingip_v2.bastion[*].address
+}

kubespray/contrib/terraform/openstack/modules/ips/variables.tf

@@ -0,0 +1,27 @@
+variable "number_of_k8s_masters" {}
+
+variable "number_of_k8s_masters_no_etcd" {}
+
+variable "number_of_k8s_nodes" {}
+
+variable "floatingip_pool" {}
+
+variable "number_of_bastions" {}
+
+variable "external_net" {}
+
+variable "network_name" {}
+
+variable "router_id" {
+  default = ""
+}
+
+variable "k8s_masters" {}
+
+variable "k8s_nodes" {}
+
+variable "k8s_master_fips" {}
+
+variable "bastion_fips" {}
+
+variable "router_internal_port_id" {}

kubespray/contrib/terraform/openstack/modules/ips/versions.tf

@@ -0,0 +1,11 @@
+terraform {
+  required_providers {
+    null = {
+      source = "hashicorp/null"
+    }
+    openstack = {
+      source = "terraform-provider-openstack/openstack"
+    }
+  }
+  required_version = ">= 0.12.26"
+}

kubespray/contrib/terraform/openstack/modules/network/main.tf

@@ -0,0 +1,34 @@
+resource "openstack_networking_router_v2" "k8s" {
+  name                = "${var.cluster_name}-router"
+  count               = var.use_neutron == 1 && var.router_id == null ? 1 : 0
+  admin_state_up      = "true"
+  external_network_id = var.external_net
+}
+
+data "openstack_networking_router_v2" "k8s" {
+  router_id = var.router_id
+  count     = var.use_neutron == 1 && var.router_id != null ? 1 : 0
+}
+
+resource "openstack_networking_network_v2" "k8s" {
+  name                  = var.network_name
+  count                 = var.use_neutron
+  dns_domain            = var.network_dns_domain != null ? var.network_dns_domain : null
+  admin_state_up        = "true"
+  port_security_enabled = var.port_security_enabled
+}
+
+resource "openstack_networking_subnet_v2" "k8s" {
+  name            = "${var.cluster_name}-internal-network"
+  count           = var.use_neutron
+  network_id      = openstack_networking_network_v2.k8s[count.index].id
+  cidr            = var.subnet_cidr
+  ip_version      = 4
+  dns_nameservers = var.dns_nameservers
+}
+
+resource "openstack_networking_router_interface_v2" "k8s" {
+  count     = var.use_neutron
+  router_id = "%{if openstack_networking_router_v2.k8s != []}${openstack_networking_router_v2.k8s[count.index].id}%{else}${var.router_id}%{endif}"
+  subnet_id = openstack_networking_subnet_v2.k8s[count.index].id
+}

kubespray/contrib/terraform/openstack/modules/network/outputs.tf

@@ -0,0 +1,15 @@
+output "router_id" {
+  value = "%{if var.use_neutron == 1} ${var.router_id == null ? element(concat(openstack_networking_router_v2.k8s.*.id, [""]), 0) : var.router_id} %{else} %{endif}"
+}
+
+output "network_id" {
+  value = element(concat(openstack_networking_network_v2.k8s.*.id, [""]),0)
+}
+
+output "router_internal_port_id" {
+  value = element(concat(openstack_networking_router_interface_v2.k8s.*.id, [""]), 0)
+}
+
+output "subnet_id" {
+  value = element(concat(openstack_networking_subnet_v2.k8s.*.id, [""]), 0)
+}

kubespray/contrib/terraform/openstack/modules/network/variables.tf

@@ -0,0 +1,21 @@
+variable "external_net" {}
+
+variable "network_name" {}
+
+variable "network_dns_domain" {}
+
+variable "cluster_name" {}
+
+variable "dns_nameservers" {
+  type = list
+}
+
+variable "port_security_enabled" {
+  type = bool
+}
+
+variable "subnet_cidr" {}
+
+variable "use_neutron" {}
+
+variable "router_id" {}

kubespray/contrib/terraform/openstack/modules/network/versions.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    openstack = {
+      source = "terraform-provider-openstack/openstack"
+    }
+  }
+  required_version = ">= 0.12.26"
+}