» alicloud_cs_managed_kubernetes

This resource will help you to manage a ManagedKubernetes Cluster in Alibaba Cloud Kubernetes Service.

» Example Usage

// If there is not specifying vpc_id, the module will launch a new vpc
resource "alicloud_vpc" "vpc" {
  count      = var.vpc_id == "" ? 1 : 0
  cidr_block = var.vpc_cidr
}

// According to the vswitch cidr blocks to launch several vswitches
resource "alicloud_vswitch" "vswitches" {
  count             = length(var.vswitch_ids) > 0 ? 0 : length(var.vswitch_cidrs)
  vpc_id            = var.vpc_id == "" ? join("", alicloud_vpc.vpc.*.id) : var.vpc_id
  cidr_block        = element(var.vswitch_cidrs, count.index)
  availability_zone = element(var.availability_zone, count.index)
}


// According to the vswitch cidr blocks to launch several vswitches
resource "alicloud_vswitch" "terway_vswitches" {
  count             = length(var.terway_vswitch_ids) > 0 ? 0 : length(var.terway_vswitch_cirds)
  vpc_id            = var.vpc_id == "" ? join("", alicloud_vpc.vpc.*.id) : var.vpc_id
  cidr_block        = element(var.terway_vswitch_cirds, count.index)
  availability_zone = element(var.availability_zone, count.index)
}

resource "alicloud_cs_managed_kubernetes" "k8s" {
  count                 = var.k8s_number
  worker_vswitch_ids    = length(var.vswitch_ids) > 0 ? split(",", join(",", var.vswitch_ids)): length(var.vswitch_cidrs) < 1 ? [] : split(",", join(",", alicloud_vswitch.vswitches.*.id))
  pod_vswitch_ids       = length(var.terway_vswitch_ids) > 0 ? split(",", join(",", var.terway_vswitch_ids)): length(var.terway_vswitch_cirds) < 1 ? [] : split(",", join(",", alicloud_vswitch.terway_vswitches.*.id))
  worker_instance_types = var.worker_instance_types
  worker_number         = var.worker_number
  node_cidr_mask        = var.node_cidr_mask
  enable_ssh            = var.enable_ssh
  install_cloud_monitor = var.install_cloud_monitor
  cpu_policy            = var.cpu_policy
  proxy_mode            = var.proxy_mode
  password              = var.password
  service_cidr          = var.service_cidr
  # version can not be defined in variables.tf. Options: 1.16.6-aliyun.1|1.14.8-aliyun.1
  version               = "1.16.6-aliyun.1"
  dynamic "addons" {
      for_each = var.cluster_addons
      content {
        name                    = lookup(addons.value, "name", var.cluster_addons)
        config                  = lookup(addons.value, "config", var.cluster_addons)
      }
  }
}

» Argument Reference

The following arguments are supported:

» Global params

  • name - (Optional) The kubernetes cluster's name. It is unique in one Alicloud account.
  • name_prefix - (Optional) The kubernetes cluster name's prefix. It is conflict with name. If it is specified, terraform will using it to build the only cluster name. Default to "Terraform-Creation".
  • version - (Optional, Available since 1.70.1) Desired Kubernetes version. If you do not specify a value, the latest available version at resource creation is used and no upgrades will occur except you set a higher version number. The value must be configured and increased to upgrade the version when desired. Downgrades are not supported by ACK.
  • password - (Required, Sensitive) The password of ssh login cluster node. You have to specify one of password key_name kms_encrypted_password fields.
  • key_name - (Required) The keypair of ssh login cluster node, you have to create it first. You have to specify one of password key_name kms_encrypted_password fields.
  • kms_encrypted_password - (Required, Available in 1.57.1+) An KMS encrypts password used to a cs kubernetes. You have to specify one of password key_name kms_encrypted_password fields.
  • kms_encryption_context - (Optional, MapString, Available in 1.57.1+) An KMS encryption context used to decrypt kms_encrypted_password before creating or updating a cs kubernetes with kms_encrypted_password. See Encryption Context. It is valid when kms_encrypted_password is set.
  • user_ca - (Optional, ForceNew) The path of customized CA cert, you can use this CA to sign client certs to connect your cluster.
  • enable_ssh - (Optional) Enable login to the node through SSH. default: false
  • install_cloud_monitor - (Optional) Install cloud monitor agent on ECS. default: true
  • cpu_policy - kubelet cpu policy. options: static|none. default: none.
  • proxy_mode - Proxy mode is option of kube-proxy. options: iptables|ipvs. default: ipvs.
  • image_id - Custom Image support. Must based on CentOS7 or AliyunLinux2.
  • user_data - (Optional, Available in 1.81.0+) Windows instances support batch and PowerShell scripts. If your script file is larger than 1 KB, we recommend that you upload the script to Object Storage Service (OSS) and pull it through the internal endpoint of your OSS bucket.
  • exclude_autoscaler_nodes - (Optional, Available in 1.88.0+) Exclude autoscaler nodes from worker_nodes. default: false
  • node_name_mode - (Optional, Available in 1.88.0+) Each node name consists of a prefix, an IP substring, and a suffix. For example, if the node IP address is 192.168.0.55, the prefix is aliyun.com, IP substring length is 5, and the suffix is test, the node name will be aliyun.com00055test.

» Addons

It is a new field since 1.75.0. You can specific network plugin,log component,ingress component and so on.

  main.tf

  dynamic "addons" {
      for_each = var.cluster_addons
      content {
        name                    = lookup(addons.value, "name", var.cluster_addons)
        config                  = lookup(addons.value, "config", var.cluster_addons)
      }
  }
    varibales.tf 

    // Network-flannel 
    variable "cluster_addons" {
        description = "Addon components in kubernetes cluster"

        type = list(object({
            name      = string
            config    = string
        }))

        default = [
            {
                "name"     = "flannel",
                "config"   = "",
            }
        ]
    }


    // Network-terway 
    variable "cluster_addons" {
        type = list(object({
            name      = string
            config    = string
        }))

        default = [
            {
                "name"     = "terway-eniip",
                "config"   = "",
            }
        ]
    }

    // Storage-csi
    variable "cluster_addons" {
        type = list(object({
            name      = string
            config    = string
        }))

        default = [
            {
                "name"     = "csi-plugin",
                "config"   = "",
            },
            {
                "name"     = "csi-provisioner",
                "config"   = "",
            }
        ]
    } 

    // Storage-flexvolume
    variable "cluster_addons" {
        type = list(object({
            name      = string
            config    = string
        }))

        default = [
            {
                "name"     = "flexvolume",
                "config"   = "",
            }
        ]
    } 

    // Log
    variable "cluster_addons" {
        type = list(object({
            name      = string
            config    = string
        }))

        default = [
            {
                "name"     = "logtail-ds",
                "config"   = "{\"IngressDashboardEnabled\":\"true\",\"sls_project_name\":\"your-sls-project-name\"}",
            }
        ]
    } 

    // Ingress
    variable "cluster_addons" {
        type = list(object({
            name      = string
            config    = string
        }))

        default = [
            {
                "name"     = "nginx-ingress-controller",
                "config"   = "{\"IngressSlbNetworkType\":\"internet\"}",
            }
        ]
    } 

    // Ingress-Disable
    variable "cluster_addons" {
        type = list(object({
            name      = string
            config    = string
            disabled  = bool
        }))

        default = [
            {
                "name"     = "nginx-ingress-controller",
                "config"   = "",
                "disabled": true,
            }
        ]
    } 

  • logtail-ds - You can specific IngressDashboardEnabled and sls_project_name in config. If you switch on IngressDashboardEnabled and sls_project_name,then logtail-ds would use sls_project_name as default log store.
  • nginx-ingress-controller - You can specific IngressSlbNetworkType in config. Options: internet|intranet.
    You can get more information about addons on ACK web console. When you create a ACK cluster. You can get openapi-spec before creating the cluster on submission page.

» Network

  • pod_cidr - (Required) [Flannel Specific] The CIDR block for the pod network when using Flannel.
  • pod_vswitch_ids - (Required) [Terway Specific] The vswitches for the pod network when using Terway.Be careful the pod_vswitch_ids can not equal to worker_vswtich_ids.but must be in same availability zones.
  • new_nat_gateway - (Optional) Whether to create a new nat gateway while creating kubernetes cluster. Default to true. Then openapi in Alibaba Cloud are not all on intranet, So turn this option on is a good choice.
  • service_cidr - (Optional) The CIDR block for the service network. It cannot be duplicated with the VPC CIDR and CIDR used by Kubernetes cluster in VPC, cannot be modified after creation.
  • node_cidr_mask - (Optional) The node cidr block to specific how many pods can run on single node. 24-28 is allowed. 24 means 232-24-1=255 and the node can run at most 255 pods. default: 24
  • slb_internet_enabled - (Optional) Whether to create internet load balancer for API Server. Default to true.

If you want to use Terway as CNI network plugin, You need to specific the pod_vswitch_ids field and addons with terway-eniip or terway-eni. The terway-eni mode for pod with one exclude ENI, the terway-eniip mode for pods share ENI. If you want to use Flannel as CNI network plugin, You need to specific the pod_cidr field and addons with flannel.

» Worker params

  • worker_number - (Required) The worker node number of the kubernetes cluster. Default to 3. It is limited up to 50 and if you want to enlarge it, please apply white list or contact with us.
  • worker_vswtich_ids - (Required) The vswitches used by workers.
  • worker_instance_types - (Required, ForceNew) The instance type of worker node. Specify one type for single AZ Cluster, three types for MultiAZ Cluster.
  • worker_instance_charge_type - (Optional, Force new resource) Worker payment type. PrePaid or PostPaid, defaults to PostPaid.
  • worker_period_unit - (Optional) Worker payment period unit. Month or Week, defaults to Month.
  • worker_period - (Optional) Worker payment period. When period unit is Month, it can be one of { “1”, “2”, “3”, “4”, “5”, “6”, “7”, “8”, “9”, “12”, “24”, “36”,”48”,”60”}. When period unit is Week, it can be one of {“1”, “2”, “3”, “4”}.
  • worker_auto_renew - (Optional) Enable worker payment auto-renew, defaults to false.
  • worker_auto_renew_period - (Optional) Worker payment auto-renew period. When period unit is Month, it can be one of {“1”, “2”, “3”, “6”, “12”}. When period unit is Week, it can be one of {“1”, “2”, “3”}.
  • worker_disk_category - (Optional) The system disk category of worker node. Its valid value are cloud_ssd and cloud_efficiency. Default to cloud_efficiency.
  • worker_disk_size - (Optional) The system disk size of worker node. Its valid value range [20~32768] in GB. Default to 40.

» Computed params (No need to configure)

  • kube_config - (Optional) The path of kube config, like ~/.kube/config.
  • client_cert - (Optional) The path of client certificate, like ~/.kube/client-cert.pem.
  • client_key - (Optional) The path of client key, like ~/.kube/client-key.pem.
  • cluster_ca_cert - (Optional) The path of cluster ca certificate, like ~/.kube/cluster-ca-cert.pem
  • availability_zone - (Optional) The Zone where new kubernetes cluster will be located. If it is not be specified, the vswitch_ids should be set, its value will be vswitch's zone.

» Removed params (Never Supported)

  • worker_instance_type - (Deprecated from version 1.16.0)(Required, Force new resource) The instance type of worker node.
  • vswitch_id - (Deprecated from version 1.16.0)(Force new resource) The vswitch where new kubernetes cluster will be located. If it is not specified, a new VPC and VSwicth will be built. It must be in the zone which availability_zone specified.
  • vswitch_ids - (Required, ForceNew) The vswitch where new kubernetes cluster will be located. Specify one or more vswitch's id. It must be in the zone which availability_zone specified.
  • force_update - (Optional, Available in 1.50.0+) Whether to force the update of kubernetes cluster arguments. Default to false.
  • is_outdated - (Optional) Whether to use outdated instance type. Default to false.
  • log_config - (Optional, ForceNew) A list of one element containing information about the associated log store. It contains the following attributes:
    • type - Type of collecting logs, only SLS are supported currently.
    • project - Log Service project name, cluster logs will output to this project.
  • cluster_network_type - (Optional) The network that cluster uses, use flannel or terway.

» Timeouts

  • create - (Defaults to 90 mins) Used when creating the kubernetes cluster (until it reaches the initial running status).
  • update - (Defaults to 60 mins) Used when activating the kubernetes cluster when necessary during update.
  • delete - (Defaults to 60 mins) Used when terminating the kubernetes cluster.

» Attributes Reference

The following attributes are exported:

  • id - The ID of the container cluster.
  • name - The name of the container cluster.
  • availability_zone - The ID of availability zone.
  • vpc_id - The ID of VPC where the current cluster is located.
  • slb_intranet - The ID of private load balancer where the current cluster master node is located.
  • security_group_id - The ID of security group where the current cluster worker node is located.
  • nat_gateway_id - The ID of nat gateway used to launch kubernetes cluster.
  • worker_nodes - List of cluster worker nodes. It contains several attributes to Block Nodes.
  • connections - Map of kubernetes cluster connection information. It contains several attributes to Block Connections.
  • version - The Kubernetes server version for the cluster.
  • worker_ram_role_name - The RamRole Name attached to worker node.

» Block Nodes

  • id - ID of the node.
  • name - Node name.
  • private_ip - The private IP address of node.
  • role - (Deprecated from version 1.9.4)

» Block Connections

» Import

Kubernetes cluster can be imported using the id, e.g. Then complete the main.tf accords to the result of terraform plan

$ terraform import alicloud_cs_managed_kubernetes.main cluster-id