From 135f6c913ca1194a42d093bbe198313503cfb420 Mon Sep 17 00:00:00 2001 From: Bill Hegazy Date: Wed, 2 Oct 2019 14:09:27 +0700 Subject: [PATCH 1/6] change args to concat --- modules/k8s-tiller/main.tf | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/modules/k8s-tiller/main.tf b/modules/k8s-tiller/main.tf index 88966d0..8fb4bf5 100644 --- a/modules/k8s-tiller/main.tf +++ b/modules/k8s-tiller/main.tf @@ -87,13 +87,12 @@ resource "kubernetes_deployment" "tiller" { image_pull_policy = var.tiller_image_pull_policy command = ["/tiller"] - args = [ + args = concat([ "--storage=secret", - "--listen=localhost:44134", "--tls-key=${local.tls_certs_mount_path}/${var.tiller_tls_key_file_name}", "--tls-cert=${local.tls_certs_mount_path}/${var.tiller_tls_cert_file_name}", "--tls-ca-cert=${local.tls_certs_mount_path}/${var.tiller_tls_cacert_file_name}", - ] + ], local.tiller_listen_localhost_arg) env { name = "TILLER_NAMESPACE" From da8969dcb56af2fb1ca78082585bfd450deb5314 Mon Sep 17 00:00:00 2001 From: Bill Hegazy Date: Wed, 2 Oct 2019 14:10:41 +0700 Subject: [PATCH 2/6] add tiller_listen_localhost var --- modules/k8s-tiller/variables.tf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/k8s-tiller/variables.tf b/modules/k8s-tiller/variables.tf index 35ca9d9..a4f56ec 100644 --- a/modules/k8s-tiller/variables.tf +++ b/modules/k8s-tiller/variables.tf @@ -88,6 +88,12 @@ variable "tiller_image_pull_policy" { default = "IfNotPresent" } +variable "tiller_listen_localhost" { + description = "If Enabled, Tiller will only listen on localhost within the container." + type = bool + default = true +} + variable "tiller_history_max" { description = "The maximum number of revisions saved per release. Use 0 for no limit." type = number From 6b2f4a8d8b7cdea5fb4977cd39fdf85728b94745 Mon Sep 17 00:00:00 2001 From: Bill Hegazy Date: Wed, 2 Oct 2019 14:11:32 +0700 Subject: [PATCH 3/6] add missing local value --- modules/k8s-tiller/main.tf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/k8s-tiller/main.tf b/modules/k8s-tiller/main.tf index 8fb4bf5..2f8521b 100644 --- a/modules/k8s-tiller/main.tf +++ b/modules/k8s-tiller/main.tf @@ -429,6 +429,8 @@ locals { tiller_tls_ca_certs_secret_name = "${var.namespace}-namespace-tiller-ca-certs" tiller_tls_certs_secret_name = "${var.namespace}-namespace-tiller-certs" + tiller_listen_localhost_arg = var.tiller_listen_localhost ? ["--listen=localhost:44134"]: [] + tls_algorithm_config = var.private_key_algorithm == "ECDSA" ? "--tls-private-key-ecdsa-curve ${var.private_key_ecdsa_curve}" : "--tls-private-key-rsa-bits ${var.private_key_rsa_bits}" kubergrunt_auth_params = <<-EOF From 2aefc5d0ae992f2dba31ccfe12ba56d290f6a472 Mon Sep 17 00:00:00 2001 From: Bill Sayedsayedhegazy Date: Wed, 2 Oct 2019 21:32:05 +0700 Subject: [PATCH 4/6] terraform fmt --- modules/k8s-tiller/main.tf | 10 +++++----- modules/k8s-tiller/variables.tf | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/k8s-tiller/main.tf b/modules/k8s-tiller/main.tf index 2f8521b..acf8c58 100644 --- a/modules/k8s-tiller/main.tf +++ b/modules/k8s-tiller/main.tf @@ -263,8 +263,8 @@ resource "null_resource" "tiller_tls_ca_certs" { # Use environment variables for Kubernetes credentials to avoid leaking into the logs environment = { KUBECTL_SERVER_ENDPOINT = var.kubectl_server_endpoint - KUBECTL_CA_DATA = var.kubectl_ca_b64_data - KUBECTL_TOKEN = var.kubectl_token + KUBECTL_CA_DATA = var.kubectl_ca_b64_data + KUBECTL_TOKEN = var.kubectl_token } } @@ -317,8 +317,8 @@ resource "null_resource" "tiller_tls_certs" { # Use environment variables for Kubernetes credentials to avoid leaking into the logs environment = { KUBECTL_SERVER_ENDPOINT = var.kubectl_server_endpoint - KUBECTL_CA_DATA = var.kubectl_ca_b64_data - KUBECTL_TOKEN = var.kubectl_token + KUBECTL_CA_DATA = var.kubectl_ca_b64_data + KUBECTL_TOKEN = var.kubectl_token } } @@ -429,7 +429,7 @@ locals { tiller_tls_ca_certs_secret_name = "${var.namespace}-namespace-tiller-ca-certs" tiller_tls_certs_secret_name = "${var.namespace}-namespace-tiller-certs" - tiller_listen_localhost_arg = var.tiller_listen_localhost ? ["--listen=localhost:44134"]: [] + tiller_listen_localhost_arg = var.tiller_listen_localhost ? ["--listen=localhost:44134"] : [] tls_algorithm_config = var.private_key_algorithm == "ECDSA" ? "--tls-private-key-ecdsa-curve ${var.private_key_ecdsa_curve}" : "--tls-private-key-rsa-bits ${var.private_key_rsa_bits}" diff --git a/modules/k8s-tiller/variables.tf b/modules/k8s-tiller/variables.tf index a4f56ec..454cf35 100644 --- a/modules/k8s-tiller/variables.tf +++ b/modules/k8s-tiller/variables.tf @@ -90,8 +90,8 @@ variable "tiller_image_pull_policy" { variable "tiller_listen_localhost" { description = "If Enabled, Tiller will only listen on localhost within the container." - type = bool - default = true + type = bool + default = true } variable "tiller_history_max" { From 044ea198762054589ca5c961966d1b8867dfcd5e Mon Sep 17 00:00:00 2001 From: Bill Sayedsayedhegazy Date: Thu, 3 Oct 2019 11:09:43 +0700 Subject: [PATCH 5/6] bump terraform_version in circleci --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index dac5d8b..e50c78e 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -8,7 +8,7 @@ defaults: &defaults KUBERGRUNT_VERSION: v0.5.1 HELM_VERSION: v2.12.2 MODULE_CI_VERSION: v0.14.1 - TERRAFORM_VERSION: 0.12.1 + TERRAFORM_VERSION: 0.12.9 TERRAGRUNT_VERSION: NONE PACKER_VERSION: NONE GOLANG_VERSION: 1.11.2 From d9ab2f5432950f198420859d20dca7033f5f9d7e Mon Sep 17 00:00:00 2001 From: Bill Sayedsayedhegazy Date: Tue, 8 Oct 2019 19:59:34 +0700 Subject: [PATCH 6/6] terraform fmt minikube example --- examples/k8s-tiller-kubergrunt-minikube/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/k8s-tiller-kubergrunt-minikube/main.tf b/examples/k8s-tiller-kubergrunt-minikube/main.tf index 29b4a50..082daae 100644 --- a/examples/k8s-tiller-kubergrunt-minikube/main.tf +++ b/examples/k8s-tiller-kubergrunt-minikube/main.tf @@ -110,7 +110,7 @@ resource "null_resource" "wait_for_tiller" { # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ resource "null_resource" "grant_helm_access" { - count = var.configure_helm ? 1 : 0 + count = var.configure_helm ? 1 : 0 depends_on = [null_resource.wait_for_tiller] provisioner "local-exec" {