MichaelFisher1997
4965017b86
Add hcloud_load_balancer_network resource to attach LB to private network. This is required before targets can use use_private_ip=true. LB gets IP 10.0.1.5 on the private network.
51 lines
1.5 KiB
HCL
51 lines
1.5 KiB
HCL
# Load Balancer for Kubernetes API High Availability
|
|
# Provides a single endpoint for all control planes
|
|
|
|
resource "hcloud_load_balancer" "kube_api" {
|
|
name = "${var.cluster_name}-api"
|
|
load_balancer_type = "lb11" # Cheapest tier: €5.39/month
|
|
location = var.location
|
|
|
|
labels = {
|
|
cluster = var.cluster_name
|
|
role = "kube-api"
|
|
}
|
|
}
|
|
|
|
# Attach Load Balancer to private network (required for use_private_ip)
|
|
resource "hcloud_load_balancer_network" "kube_api" {
|
|
load_balancer_id = hcloud_load_balancer.kube_api.id
|
|
network_id = hcloud_network.cluster.id
|
|
ip = cidrhost(var.subnet_cidr, 5) # 10.0.1.5
|
|
}
|
|
|
|
# Attach all control plane servers as targets
|
|
resource "hcloud_load_balancer_target" "kube_api_targets" {
|
|
count = var.control_plane_count
|
|
type = "server"
|
|
load_balancer_id = hcloud_load_balancer.kube_api.id
|
|
server_id = hcloud_server.control_plane[count.index].id
|
|
use_private_ip = true
|
|
|
|
depends_on = [hcloud_load_balancer_network.kube_api, hcloud_server.control_plane]
|
|
}
|
|
|
|
# Kubernetes API service on port 6443
|
|
resource "hcloud_load_balancer_service" "kube_api" {
|
|
load_balancer_id = hcloud_load_balancer.kube_api.id
|
|
protocol = "tcp"
|
|
listen_port = 6443
|
|
destination_port = 6443
|
|
|
|
health_check {
|
|
protocol = "tcp"
|
|
port = 6443
|
|
interval = 15
|
|
timeout = 10
|
|
retries = 3
|
|
}
|
|
}
|
|
|
|
# Firewall rule to allow LB access to control planes on 6443
|
|
# This is added to the existing cluster firewall
|