feat(kubernetes): add hetzner ccm and csi

modules/kubernetes/README.md

@@ -14,6 +14,7 @@
 | Name | Version |
 |------|---------|
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 2.14.0 |
+| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.31.0 |
 
 ## Modules
 
@@ -24,12 +25,20 @@ No modules.
 | Name | Type |
 |------|------|
 | [helm_release.cilium](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+| [helm_release.hcloud_ccm](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+| [helm_release.hcloud_csi](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+| [kubernetes_annotations.hcloud_ccm](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/annotations) | resource |
+| [kubernetes_secret_v1.hcloud](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_cilium_version"></a> [cilium\_version](#input\_cilium\_version) | Version of Cilium to use - defaults to latest | `string` | `null` | no |
+| <a name="input_hcloud_network_name"></a> [hcloud\_network\_name](#input\_hcloud\_network\_name) | Hetzner network name | `string` | n/a | yes |
+| <a name="input_hcloud_token"></a> [hcloud\_token](#input\_hcloud\_token) | Hetzner API token | `string` | n/a | yes |
+| <a name="input_hetzner_cloud_config_manager_version"></a> [hetzner\_cloud\_config\_manager\_version](#input\_hetzner\_cloud\_config\_manager\_version) | Version of the HCloud CCM to use - defaults to latest | `string` | `null` | no |
+| <a name="input_hetzner_csi_driver_version"></a> [hetzner\_csi\_driver\_version](#input\_hetzner\_csi\_driver\_version) | Tag of the CSI driver to use - defaults to latest | `string` | `null` | no |
 | <a name="input_k3s_cluster_cidr"></a> [k3s\_cluster\_cidr](#input\_k3s\_cluster\_cidr) | CIDR used for the k3s cluster | `string` | `"10.244.0.0/16"` | no |
 | <a name="input_kube_context"></a> [kube\_context](#input\_kube\_context) | Kubernetes context to use | `string` | `"default"` | no |
 | <a name="input_kubeconfig"></a> [kubeconfig](#input\_kubeconfig) | Kubeconfig for the cluster | `string` | n/a | yes |

modules/kubernetes/hetzner.tf

@@ -0,0 +1,87 @@
+# Copyright 2024 Simon Emms <[email protected]>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+resource "kubernetes_secret_v1" "hcloud" {
+  metadata {
+    name      = "hcloud"
+    namespace = "kube-system"
+  }
+
+  data = {
+    network = var.hcloud_network_name # Required by the CCM
+    token   = var.hcloud_token        # Required by the CSI
+  }
+
+  depends_on = [helm_release.cilium]
+}
+
+resource "helm_release" "hcloud_ccm" {
+  chart           = "hcloud-cloud-controller-manager"
+  name            = "hccm"
+  atomic          = true
+  cleanup_on_fail = true
+  namespace       = "kube-system"
+  repository      = "https://charts.hetzner.cloud"
+  reset_values    = true
+  version         = var.hetzner_cloud_config_manager_version
+  wait            = true
+
+  set {
+    name  = "networking.enabled"
+    value = "true"
+  }
+
+  set {
+    name  = "networking.clusterCIDR"
+    value = var.k3s_cluster_cidr
+  }
+
+  depends_on = [kubernetes_secret_v1.hcloud]
+}
+
+resource "kubernetes_annotations" "hcloud_ccm" {
+  api_version = "apps/v1"
+  kind        = "Deployment"
+  metadata {
+    name      = helm_release.hcloud_ccm.chart
+    namespace = helm_release.hcloud_ccm.namespace
+  }
+  template_annotations = {
+    "secret" = sha512(yamlencode(kubernetes_secret_v1.hcloud.data))
+  }
+}
+
+resource "helm_release" "hcloud_csi" {
+  chart           = "hcloud-csi"
+  name            = "hcsi"
+  atomic          = true
+  cleanup_on_fail = true
+  namespace       = "kube-system"
+  repository      = "https://charts.hetzner.cloud"
+  reset_values    = true
+  version         = var.hetzner_csi_driver_version
+  wait            = true
+
+  set {
+    name  = "controller.podAnnotations.secret"
+    value = sha512(yamlencode(kubernetes_secret_v1.hcloud.data))
+  }
+
+  # set {
+  #   name = "controller.nodeSelector.node-role\.kubernetes\.io/control-plane"
+  #   value = ""
+  # }
+
+  depends_on = [kubernetes_secret_v1.hcloud]
+}

modules/kubernetes/variables.tf

@@ -19,6 +19,29 @@ variable "cilium_version" {
   default     = null
 }
 
+variable "hcloud_network_name" {
+  type        = string
+  description = "Hetzner network name"
+}
+
+variable "hcloud_token" {
+  type        = string
+  description = "Hetzner API token"
+  sensitive   = true
+}
+
+variable "hetzner_cloud_config_manager_version" {
+  type        = string
+  description = "Version of the HCloud CCM to use - defaults to latest"
+  default     = null
+}
+
+variable "hetzner_csi_driver_version" {
+  type        = string
+  description = "Tag of the CSI driver to use - defaults to latest"
+  default     = null
+}
+
 variable "k3s_cluster_cidr" {
   type        = string
   description = "CIDR used for the k3s cluster"

stacks/dev/kubernetes/terragrunt.hcl

@@ -24,12 +24,14 @@ dependency "hetzner" {
   config_path = "../hetzner"
 
   mock_outputs = {
-    k3s_cluster_cidr = "some-cluster-cidr"
-    kubeconfig       = "some-kubeconfig"
+    hcloud_network_name = "some-network-name"
+    k3s_cluster_cidr    = "some-cluster-cidr"
+    kubeconfig          = "some-kubeconfig"
   }
 }
 
 inputs = {
-  k3s_cluster_cidr = dependency.hetzner.outputs.k3s_cluster_cidr
-  kubeconfig       = dependency.hetzner.outputs.kubeconfig
+  hcloud_network_name = dependency.hetzner.outputs.hcloud_network_name
+  k3s_cluster_cidr    = dependency.hetzner.outputs.k3s_cluster_cidr
+  kubeconfig          = dependency.hetzner.outputs.kubeconfig
 }