本文介紹如何使用Terraform創建ACK托管集群。
本教程所含示例代碼支持一鍵運行,您可以直接運行代碼。一鍵運行
前提條件
已開通容器服務 Kubernetes 版ACK。若需要使用Terraform開通,請參見通過Terraform開通ACK并授權角色。
由于阿里云賬號(主賬號)具有資源的所有權限,一旦發生泄露將面臨重大風險。建議您使用RAM用戶,并為該RAM用戶創建AccessKey,具體操作方式請參見創建RAM用戶和創建AccessKey。
為運行Terraform命令的RAM用戶綁定以下最小權限策略,以獲取管理本示例所涉及資源的權限。更多信息,請參見為RAM用戶授權。
該權限策略允許RAM用戶進行VPC、交換機及ACK的創建、查看與刪除操作。
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "vpc:CreateVpc", "vpc:CreateVSwitch", "cs:CreateCluster", "vpc:DescribeVpcAttribute", "vpc:DescribeVSwitchAttributes", "vpc:DescribeRouteTableList", "vpc:DescribeNatGateways", "cs:DescribeTaskInfo", "cs:DescribeClusterDetail", "cs:GetClusterCerts", "cs:CheckControlPlaneLogEnable", "cs:CreateClusterNodePool", "cs:DescribeClusterNodePoolDetail", "cs:ModifyClusterNodePool", "vpc:DeleteVpc", "vpc:DeleteVSwitch", "cs:DeleteCluster", "cs:DeleteClusterNodepool" ], "Resource": "*" } ] }
準備Terraform運行環境,您可以選擇以下任一方式來使用Terraform。
在Terraform Explorer中使用Terraform:阿里云提供了Terraform的在線運行環境,您無需安裝Terraform,登錄后即可在線使用和體驗Terraform。適用于零成本、快速、便捷地體驗和調試Terraform的場景。
Cloud Shell:阿里云Cloud Shell中預裝了Terraform的組件,并已配置好身份憑證,您可直接在Cloud Shell中運行Terraform的命令。適用于低成本、快速、便捷地訪問和使用Terraform的場景。
在本地安裝和配置Terraform:適用于網絡連接較差或需要自定義開發環境的場景。
重要請確保版本不低于v0.12.28。如需檢查現有版本,請運行
terraform --version
命令。
使用的資源
本教程示例包含的部分資源會產生一定費用,請在不需要時及時進行釋放或退訂。
alicloud_zones:查詢可用區。
alicloud_instance_types:根據條件查詢符合要求的ECS實例類型。
alicloud_vpc:創建專有網絡VPC。
alicloud_vswitch:創建虛擬交換機(vSwitch)為VPC劃分一個或多個子網。
alicloud_cs_managed_kubernetes:創建ACK托管版集群。
alicloud_cs_kubernetes_node_pool:為ACK托管集群創建節點池。
使用Terraform創建ACK托管集群(Terway)
本示例將創建一個包含普通節點池、托管節點池及自動伸縮節點池的ACK托管集群,并為該集群默認安裝一系列組件,包括Terway(網絡組件)、csi-plugin(存儲組件)、csi-provisioner(存儲組件)、logtail-ds(日志組件)、Nginx Ingress Controller、ack-arms-prometheus(監控組件)以及ack-node-problem-detector(節點診斷組件)。
創建一個工作目錄,并在該工作目錄中創建名為main.tf的配置文件,然后將以下代碼復制到main.tf中。
provider "alicloud" { region = var.region_id } variable "region_id" { type = string default = "cn-shenzhen" } variable "cluster_spec" { type = string description = "The cluster specifications of kubernetes cluster,which can be empty. Valid values:ack.standard : Standard managed clusters; ack.pro.small : Professional managed clusters." default = "ack.pro.small" } # 指定虛擬交換機(vSwitches)的可用區。 variable "availability_zone" { description = "The availability zones of vswitches." default = ["cn-shenzhen-c", "cn-shenzhen-e", "cn-shenzhen-f"] } # 指定交換機ID(vSwitch IDs)的列表。 variable "node_vswitch_ids" { description = "List of existing node vswitch ids for terway." type = list(string) default = [] } # 用于創建新vSwitches的CIDR地址塊列表。 variable "node_vswitch_cidrs" { description = "List of cidr blocks used to create several new vswitches when 'node_vswitch_ids' is not specified." type = list(string) default = ["172.16.0.0/23", "172.16.2.0/23", "172.16.4.0/23"] } # 指定網絡組件Terway配置。如果為空,默認會根據terway_vswitch_cidrs的創建新的terway vSwitch。 variable "terway_vswitch_ids" { description = "List of existing pod vswitch ids for terway." type = list(string) default = [] } # 當沒有指定terway_vswitch_ids時,用于創建Terway使用的vSwitch的CIDR地址塊。 variable "terway_vswitch_cidrs" { description = "List of cidr blocks used to create several new vswitches when 'terway_vswitch_ids' is not specified." type = list(string) default = ["172.16.208.0/20", "172.16.224.0/20", "172.16.240.0/20"] } # 定義了用于啟動工作節點的ECS實例類型。 variable "worker_instance_types" { description = "The ecs instance types used to launch worker nodes." default = ["ecs.g6.2xlarge", "ecs.g6.xlarge"] } # 設置工作節點的密碼 variable "password" { description = "The password of ECS instance." default = "Test123456" } # 指定ACK集群安裝的組件。包括Terway(網絡組件)、csi-plugin(存儲組件)、csi-provisioner(存儲組件)、logtail-ds(日志組件)、Nginx Ingress Controller、ack-arms-prometheus(監控組件)以及ack-node-problem-detector(節點診斷組件)。 variable "cluster_addons" { type = list(object({ name = string config = string })) default = [ { "name" = "terway-eniip", "config" = "", }, { "name" = "logtail-ds", "config" = "{\"IngressDashboardEnabled\":\"true\"}", }, { "name" = "nginx-ingress-controller", "config" = "{\"IngressSlbNetworkType\":\"internet\"}", }, { "name" = "arms-prometheus", "config" = "", }, { "name" = "ack-node-problem-detector", "config" = "{\"sls_project_name\":\"\"}", }, { "name" = "csi-plugin", "config" = "", }, { "name" = "csi-provisioner", "config" = "", } ] } # 指定創建ACK托管集群名稱的前綴。 variable "k8s_name_prefix" { description = "The name prefix used to create managed kubernetes cluster." default = "tf-ack-shenzhen" } # 默認資源名稱。 locals { k8s_name_terway = substr(join("-", [var.k8s_name_prefix, "terway"]), 0, 63) k8s_name_flannel = substr(join("-", [var.k8s_name_prefix, "flannel"]), 0, 63) k8s_name_ask = substr(join("-", [var.k8s_name_prefix, "ask"]), 0, 63) new_vpc_name = "tf-vpc-172-16" new_vsw_name_azD = "tf-vswitch-azD-172-16-0" new_vsw_name_azE = "tf-vswitch-azE-172-16-2" new_vsw_name_azF = "tf-vswitch-azF-172-16-4" nodepool_name = "default-nodepool" managed_nodepool_name = "managed-node-pool" autoscale_nodepool_name = "autoscale-node-pool" log_project_name = "log-for-${local.k8s_name_terway}" } # 節點ECS實例配置。將查詢滿足CPU、Memory要求的ECS實例類型。 data "alicloud_instance_types" "default" { cpu_core_count = 8 memory_size = 32 availability_zone = var.availability_zone[0] kubernetes_node_role = "Worker" } # 專有網絡。 resource "alicloud_vpc" "default" { vpc_name = local.new_vpc_name cidr_block = "172.16.0.0/12" } # Node交換機。 resource "alicloud_vswitch" "vswitches" { count = length(var.node_vswitch_ids) > 0 ? 0 : length(var.node_vswitch_cidrs) vpc_id = alicloud_vpc.default.id cidr_block = element(var.node_vswitch_cidrs, count.index) zone_id = element(var.availability_zone, count.index) } # Pod交換機。 resource "alicloud_vswitch" "terway_vswitches" { count = length(var.terway_vswitch_ids) > 0 ? 0 : length(var.terway_vswitch_cidrs) vpc_id = alicloud_vpc.default.id cidr_block = element(var.terway_vswitch_cidrs, count.index) zone_id = element(var.availability_zone, count.index) } # Kubernetes托管版。 resource "alicloud_cs_managed_kubernetes" "default" { name = local.k8s_name_terway # Kubernetes集群名稱。 cluster_spec = var.cluster_spec # 創建Pro版集群。 worker_vswitch_ids = split(",", join(",", alicloud_vswitch.vswitches.*.id)) # 節點池所在的vSwitch。指定一個或多個vSwitch的ID,必須在availability_zone指定的區域中。 pod_vswitch_ids = split(",", join(",", alicloud_vswitch.terway_vswitches.*.id)) # Pod虛擬交換機。 new_nat_gateway = true # 是否在創建Kubernetes集群時創建新的NAT網關。默認為true。 service_cidr = "10.11.0.0/16" # Pod網絡的CIDR塊。當cluster_network_type設置為flannel,你必須設定該參數。它不能與VPC CIDR相同,并且不能與VPC中的Kubernetes集群使用的CIDR相同,也不能在創建后進行修改。集群中允許的最大主機數量:256。 slb_internet_enabled = true # 是否為API Server創建Internet負載均衡。默認為false。 enable_rrsa = true control_plane_log_components = ["apiserver", "kcm", "scheduler", "ccm"] # 控制平面日志。 dynamic "addons" { # 組件管理。 for_each = var.cluster_addons content { name = lookup(addons.value, "name", var.cluster_addons) config = lookup(addons.value, "config", var.cluster_addons) } } } # 普通節點池。 resource "alicloud_cs_kubernetes_node_pool" "default" { cluster_id = alicloud_cs_managed_kubernetes.default.id # Kubernetes集群名稱。 node_pool_name = local.nodepool_name # 節點池名稱。 vswitch_ids = split(",", join(",", alicloud_vswitch.vswitches.*.id)) # 節點池所在的vSwitch。指定一個或多個vSwitch的ID,必須在availability_zone指定的區域中。 instance_types = var.worker_instance_types instance_charge_type = "PostPaid" desired_size = 2 # 節點池的期望節點數。 password = var.password # SSH登錄集群節點的密碼。 install_cloud_monitor = true # 是否為Kubernetes的節點安裝云監控。 system_disk_category = "cloud_efficiency" system_disk_size = 100 image_type = "AliyunLinux" data_disks { # 節點數據盤配置。 category = "cloud_essd" # 節點數據盤種類。 size = 120 # 節點數據盤大小。 } } # 創建托管節點池。 resource "alicloud_cs_kubernetes_node_pool" "managed_node_pool" { cluster_id = alicloud_cs_managed_kubernetes.default.id # Kubernetes集群名稱。 node_pool_name = local.managed_nodepool_name # 節點池名稱。 vswitch_ids = split(",", join(",", alicloud_vswitch.vswitches.*.id)) # 節點池所在的vSwitch。指定一個或多個vSwitch的ID,必須在availability_zone指定的區域中。 desired_size = 0 # 節點池的期望節點數。 management { auto_repair = true auto_upgrade = true max_unavailable = 1 } instance_types = var.worker_instance_types instance_charge_type = "PostPaid" password = var.password install_cloud_monitor = true system_disk_category = "cloud_efficiency" system_disk_size = 100 image_type = "AliyunLinux" data_disks { category = "cloud_essd" size = 120 } } # 創建自動伸縮節點池,節點池最多可以擴展到 10 個節點,最少保持 1 個節點。 resource "alicloud_cs_kubernetes_node_pool" "autoscale_node_pool" { cluster_id = alicloud_cs_managed_kubernetes.default.id node_pool_name = local.autoscale_nodepool_name vswitch_ids = split(",", join(",", alicloud_vswitch.vswitches.*.id)) scaling_config { min_size = 1 max_size = 10 } instance_types = var.worker_instance_types password = var.password # SSH登錄集群節點的密碼。 install_cloud_monitor = true # 是否為kubernetes的節點安裝云監控。 system_disk_category = "cloud_efficiency" system_disk_size = 100 image_type = "AliyunLinux3" data_disks { # 節點數據盤配置。 category = "cloud_essd" # 節點數據盤種類。 size = 120 # 節點數據盤大小。 } }
執行以下命令,初始化Terraform運行環境。
terraform init
返回如下信息,表示Terraform初始化成功。
Terraform has been successfully initialized! You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure. All Terraform commands should now work. If you ever set or change modules or backend configuration for Terraform, rerun this command to reinitialize your working directory. If you forget, other commands will detect it and remind you to do so if necessary.
創建執行計劃,并預覽變更。
terraform plan
執行以下命令,創建集群。
terraform apply
在執行過程中,根據提示輸入
yes
并按下Enter鍵,等待命令執行完成,若出現以下信息,則表示ACK集群創建成功。Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes ... alicloud_cs_managed_kubernetes.default: Creation complete after 5m48s [id=ccb53e72ec6c447c990762800********] ... Apply complete! Resources: 11 added, 0 changed, 0 destroyed.
驗證結果
執行terraform show命令
您可以使用以下命令查詢Terraform已創建資源的詳細信息。
terraform show
登錄ACK控制臺
登錄容器服務管理控制臺,查看已創建的集群。
清理資源
當您不再需要上述通過Terraform創建或管理的資源時,請運行terraform destroy
命令以釋放資源。關于terraform destroy
的更多信息,請參見Terraform常用命令。
terraform destroy
完整示例
當前示例代碼支持一鍵運行,您可以直接運行代碼。一鍵運行
provider "alicloud" {
region = var.region_id
}
variable "region_id" {
type = string
default = "cn-shenzhen"
}
variable "cluster_spec" {
type = string
description = "The cluster specifications of kubernetes cluster,which can be empty. Valid values:ack.standard : Standard managed clusters; ack.pro.small : Professional managed clusters."
default = "ack.pro.small"
}
# 指定虛擬交換機(vSwitches)的可用區。
variable "availability_zone" {
description = "The availability zones of vswitches."
default = ["cn-shenzhen-c", "cn-shenzhen-e", "cn-shenzhen-f"]
}
# 指定交換機ID(vSwitch IDs)的列表。
variable "node_vswitch_ids" {
description = "List of existing node vswitch ids for terway."
type = list(string)
default = []
}
# 用于創建新vSwitches的CIDR地址塊列表。
variable "node_vswitch_cidrs" {
description = "List of cidr blocks used to create several new vswitches when 'node_vswitch_ids' is not specified."
type = list(string)
default = ["172.16.0.0/23", "172.16.2.0/23", "172.16.4.0/23"]
}
# 指定網絡組件Terway配置。如果為空,默認會根據terway_vswitch_cidrs的創建新的terway vSwitch。
variable "terway_vswitch_ids" {
description = "List of existing pod vswitch ids for terway."
type = list(string)
default = []
}
# 當沒有指定terway_vswitch_ids時,用于創建Terway使用的vSwitch的CIDR地址塊。
variable "terway_vswitch_cidrs" {
description = "List of cidr blocks used to create several new vswitches when 'terway_vswitch_ids' is not specified."
type = list(string)
default = ["172.16.208.0/20", "172.16.224.0/20", "172.16.240.0/20"]
}
# 定義了用于啟動工作節點的ECS實例類型。
variable "worker_instance_types" {
description = "The ecs instance types used to launch worker nodes."
default = ["ecs.g6.2xlarge", "ecs.g6.xlarge"]
}
# 設置工作節點的密碼。
variable "password" {
description = "The password of ECS instance."
default = "Test123456"
}
# 指定ACK集群安裝的組件。包括Terway(網絡組件)、csi-plugin(存儲組件)、csi-provisioner(存儲組件)、logtail-ds(日志組件)、Nginx Ingress Controller、ack-arms-prometheus(監控組件)以及ack-node-problem-detector(節點診斷組件)。
variable "cluster_addons" {
type = list(object({
name = string
config = string
}))
default = [
{
"name" = "terway-eniip",
"config" = "",
},
{
"name" = "logtail-ds",
"config" = "{\"IngressDashboardEnabled\":\"true\"}",
},
{
"name" = "nginx-ingress-controller",
"config" = "{\"IngressSlbNetworkType\":\"internet\"}",
},
{
"name" = "arms-prometheus",
"config" = "",
},
{
"name" = "ack-node-problem-detector",
"config" = "{\"sls_project_name\":\"\"}",
},
{
"name" = "csi-plugin",
"config" = "",
},
{
"name" = "csi-provisioner",
"config" = "",
}
]
}
# 指定創建ACK托管集群名稱的前綴。
variable "k8s_name_prefix" {
description = "The name prefix used to create managed kubernetes cluster."
default = "tf-ack-shenzhen"
}
# 默認資源名稱。
locals {
k8s_name_terway = substr(join("-", [var.k8s_name_prefix, "terway"]), 0, 63)
k8s_name_flannel = substr(join("-", [var.k8s_name_prefix, "flannel"]), 0, 63)
k8s_name_ask = substr(join("-", [var.k8s_name_prefix, "ask"]), 0, 63)
new_vpc_name = "tf-vpc-172-16"
new_vsw_name_azD = "tf-vswitch-azD-172-16-0"
new_vsw_name_azE = "tf-vswitch-azE-172-16-2"
new_vsw_name_azF = "tf-vswitch-azF-172-16-4"
nodepool_name = "default-nodepool"
managed_nodepool_name = "managed-node-pool"
autoscale_nodepool_name = "autoscale-node-pool"
log_project_name = "log-for-${local.k8s_name_terway}"
}
# 節點ECS實例配置。將查詢滿足CPU、Memory要求的ECS實例類型。
data "alicloud_instance_types" "default" {
cpu_core_count = 8
memory_size = 32
availability_zone = var.availability_zone[0]
kubernetes_node_role = "Worker"
}
# 專有網絡。
resource "alicloud_vpc" "default" {
vpc_name = local.new_vpc_name
cidr_block = "172.16.0.0/12"
}
# Node交換機。
resource "alicloud_vswitch" "vswitches" {
count = length(var.node_vswitch_ids) > 0 ? 0 : length(var.node_vswitch_cidrs)
vpc_id = alicloud_vpc.default.id
cidr_block = element(var.node_vswitch_cidrs, count.index)
zone_id = element(var.availability_zone, count.index)
}
# Pod交換機。
resource "alicloud_vswitch" "terway_vswitches" {
count = length(var.terway_vswitch_ids) > 0 ? 0 : length(var.terway_vswitch_cidrs)
vpc_id = alicloud_vpc.default.id
cidr_block = element(var.terway_vswitch_cidrs, count.index)
zone_id = element(var.availability_zone, count.index)
}
# Kubernetes托管版。
resource "alicloud_cs_managed_kubernetes" "default" {
name = local.k8s_name_terway # Kubernetes集群名稱。
cluster_spec = var.cluster_spec # 創建Pro版集群。
worker_vswitch_ids = split(",", join(",", alicloud_vswitch.vswitches.*.id)) # 節點池所在的vSwitch。指定一個或多個vSwitch的ID,必須在availability_zone指定的區域中。
pod_vswitch_ids = split(",", join(",", alicloud_vswitch.terway_vswitches.*.id)) # Pod虛擬交換機。
new_nat_gateway = true # 是否在創建Kubernetes集群時創建新的NAT網關。默認為true。
service_cidr = "10.11.0.0/16" # Pod網絡的CIDR塊。當cluster_network_type設置為flannel,你必須設定該參數。它不能與VPC CIDR相同,并且不能與VPC中的Kubernetes集群使用的CIDR相同,也不能在創建后進行修改。集群中允許的最大主機數量:256。
slb_internet_enabled = true # 是否為API Server創建Internet負載均衡。默認為false。
enable_rrsa = true
control_plane_log_components = ["apiserver", "kcm", "scheduler", "ccm"] # 控制平面日志。
dynamic "addons" { # 組件管理。
for_each = var.cluster_addons
content {
name = lookup(addons.value, "name", var.cluster_addons)
config = lookup(addons.value, "config", var.cluster_addons)
}
}
}
# 普通節點池。
resource "alicloud_cs_kubernetes_node_pool" "default" {
cluster_id = alicloud_cs_managed_kubernetes.default.id # Kubernetes集群名稱。
node_pool_name = local.nodepool_name # 節點池名稱。
vswitch_ids = split(",", join(",", alicloud_vswitch.vswitches.*.id)) # 節點池所在的vSwitch。指定一個或多個vSwitch的ID,必須在availability_zone指定的區域中。
instance_types = var.worker_instance_types
instance_charge_type = "PostPaid"
desired_size = 2 # 節點池的期望節點數。
password = var.password # SSH登錄集群節點的密碼。
install_cloud_monitor = true # 是否為Kubernetes的節點安裝云監控。
system_disk_category = "cloud_efficiency"
system_disk_size = 100
image_type = "AliyunLinux"
data_disks { # 節點數據盤配置。
category = "cloud_essd" # 節點數據盤種類。
size = 120 # 節點數據盤大小。
}
}
# 創建托管節點池。
resource "alicloud_cs_kubernetes_node_pool" "managed_node_pool" {
cluster_id = alicloud_cs_managed_kubernetes.default.id # Kubernetes集群名稱。
node_pool_name = local.managed_nodepool_name # 節點池名稱。
vswitch_ids = split(",", join(",", alicloud_vswitch.vswitches.*.id)) # 節點池所在的vSwitch。指定一個或多個vSwitch的ID,必須在availability_zone指定的區域中。
desired_size = 0 # 節點池的期望節點數。
management {
auto_repair = true
auto_upgrade = true
max_unavailable = 1
}
instance_types = var.worker_instance_types
instance_charge_type = "PostPaid"
password = var.password
install_cloud_monitor = true
system_disk_category = "cloud_efficiency"
system_disk_size = 100
image_type = "AliyunLinux"
data_disks {
category = "cloud_essd"
size = 120
}
}
# 創建自動伸縮節點池,節點池最多可以擴展到 10 個節點,最少保持 1 個節點。
resource "alicloud_cs_kubernetes_node_pool" "autoscale_node_pool" {
cluster_id = alicloud_cs_managed_kubernetes.default.id
node_pool_name = local.autoscale_nodepool_name
vswitch_ids = split(",", join(",", alicloud_vswitch.vswitches.*.id))
scaling_config {
min_size = 1
max_size = 10
}
instance_types = var.worker_instance_types
password = var.password # SSH登錄集群節點的密碼。
install_cloud_monitor = true # 是否為kubernetes的節點安裝云監控。
system_disk_category = "cloud_efficiency"
system_disk_size = 100
image_type = "AliyunLinux3"
data_disks { # 節點數據盤配置。
category = "cloud_essd" # 節點數據盤種類。
size = 120 # 節點數據盤大小。
}
}