feat(kubernetes): deploy the hcloud-csi to the cluster

A container storage interface (CSI) is used to kubernetes clusters to
use volumes to store data. This uses the official Hetzner CSI to enable
it in out cluster.

modules/kubernetes/README.md

@@ -5,25 +5,42 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.8.0 |
+| <a name="requirement_github"></a> [github](#requirement\_github) | >= 6.2.2, < 7.0.0 |
 | <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.31.0, < 3.0.0 |
+| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.11.2, < 1.0.0 |
 
 ## Providers
 
-No providers.
+| Name | Version |
+|------|---------|
+| <a name="provider_github"></a> [github](#provider\_github) | 6.2.2 |
+| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.31.0 |
+| <a name="provider_time"></a> [time](#provider\_time) | 0.11.2 |
 
 ## Modules
 
 No modules.
 
 ## Resources
 
-No resources.
+| Name | Type |
+|------|------|
+| [kubernetes_annotations.restarts](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/annotations) | resource |
+| [kubernetes_manifest.csi_driver](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource |
+| [kubernetes_secret_v1.hcloud_token](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
+| [time_static.restarted_at](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/static) | resource |
+| [github_release.csi_driver](https://registry.terraform.io/providers/integrations/github/latest/docs/data-sources/release) | data source |
+| [github_repository_file.csi_driver](https://registry.terraform.io/providers/integrations/github/latest/docs/data-sources/repository_file) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_hcloud_token"></a> [hcloud\_token](#input\_hcloud\_token) | Hetzner API token | `string` | n/a | yes |
+| <a name="input_hetzner_csi_driver_owner"></a> [hetzner\_csi\_driver\_owner](#input\_hetzner\_csi\_driver\_owner) | GitHub owner to get the CSI driver from | `string` | `"hetznercloud"` | no |
+| <a name="input_hetzner_csi_driver_repo"></a> [hetzner\_csi\_driver\_repo](#input\_hetzner\_csi\_driver\_repo) | GitHub repo to get the CSI driver from | `string` | `"csi-driver"` | no |
+| <a name="input_hetzner_csi_driver_version"></a> [hetzner\_csi\_driver\_version](#input\_hetzner\_csi\_driver\_version) | Tag of the CSI driver to use - provide the tag name or latest | `string` | `"latest"` | no |
 | <a name="input_kube_context"></a> [kube\_context](#input\_kube\_context) | Kubernetes context to use | `string` | `"default"` | no |
 | <a name="input_kubeconfig"></a> [kubeconfig](#input\_kubeconfig) | Kubeconfig for the cluster | `string` | n/a | yes |
 

modules/kubernetes/csi.tf

@@ -0,0 +1,77 @@
+# Copyright 2024 Simon Emms <[email protected]>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+data "github_release" "csi_driver" {
+  repository = var.hetzner_csi_driver_repo
+  owner      = var.hetzner_csi_driver_owner
+
+  retrieve_by = var.hetzner_csi_driver_version == "latest" ? var.hetzner_csi_driver_version : "tag"
+  release_tag = var.hetzner_csi_driver_version != "latest" ? var.hetzner_csi_driver_version : null
+}
+
+data "github_repository_file" "csi_driver" {
+  repository = "${var.hetzner_csi_driver_owner}/${var.hetzner_csi_driver_repo}"
+  branch     = data.github_release.csi_driver.release_tag
+  file       = "deploy/kubernetes/hcloud-csi.yml"
+}
+
+// This secret is required by the Hetzner CSI to create cloud resources
+resource "kubernetes_secret_v1" "hcloud_token" {
+  metadata {
+    name      = "hcloud"
+    namespace = "kube-system"
+  }
+
+  data = {
+    token = var.hcloud_token
+  }
+}
+
+resource "kubernetes_manifest" "csi_driver" {
+  for_each = {
+    for m in provider::kubernetes::manifest_decode_multi(data.github_repository_file.csi_driver.content) :
+    "${m.apiVersion}.${m.kind}.${m.metadata.name}" => m
+  }
+  manifest = each.value
+
+  // The hcloud-csi-controller deployment has 5 containers
+  computed_fields = [
+    "spec.template.spec.containers[0].resources",
+    "spec.template.spec.containers[1].resources",
+    "spec.template.spec.containers[2].resources",
+    "spec.template.spec.containers[3].resources",
+    "spec.template.spec.containers[4].resources",
+  ]
+
+  depends_on = [kubernetes_secret_v1.hcloud_token, kubernetes_annotations.restarts]
+}
+
+// Restart the core-dns pods as the CSI controller may be in a failed state
+// @link https://github.com/hetznercloud/csi-driver/issues/465#issuecomment-1649216197
+resource "time_static" "restarted_at" {}
+
+resource "kubernetes_annotations" "restarts" {
+  // The order is important
+  for_each = toset(["coredns"])
+
+  api_version = "apps/v1"
+  kind        = "Deployment"
+  metadata {
+    name      = each.key
+    namespace = "kube-system"
+  }
+  template_annotations = {
+    "kubectl.kubernetes.io/restartedAt" = time_static.restarted_at.rfc3339
+  }
+}

modules/kubernetes/terraform.tf

@@ -13,12 +13,20 @@
 # limitations under the License.
 
 terraform {
-  required_version = ">= 1.0.0"
+  required_version = ">= 1.8.0"
   required_providers {
+    github = {
+      source  = "integrations/github"
+      version = ">= 6.2.2, < 7.0.0"
+    }
     kubernetes = {
       source  = "hashicorp/kubernetes"
       version = ">= 2.31.0, < 3.0.0"
     }
+    time = {
+      source  = "hashicorp/time"
+      version = ">= 0.11.2, < 1.0.0"
+    }
   }
 }
 

modules/kubernetes/variables.tf

@@ -12,6 +12,30 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+variable "hcloud_token" {
+  type        = string
+  description = "Hetzner API token"
+  sensitive   = true
+}
+
+variable "hetzner_csi_driver_owner" {
+  type        = string
+  description = "GitHub owner to get the CSI driver from"
+  default     = "hetznercloud"
+}
+
+variable "hetzner_csi_driver_repo" {
+  type        = string
+  description = "GitHub repo to get the CSI driver from"
+  default     = "csi-driver"
+}
+
+variable "hetzner_csi_driver_version" {
+  type        = string
+  description = "Tag of the CSI driver to use - provide the tag name or latest"
+  default     = "latest"
+}
+
 variable "kubeconfig" {
   type        = string
   description = "Kubeconfig for the cluster"