Merge 20220201

OWNERS_ALIASES

@@ -15,7 +15,6 @@ aliases:
     - kirankt
     - patrickdillon
     - rna-afk
-    - squidboylan
   libvirt-approvers:
     - praveenkumar
     - cfergeau

data/data/alibabacloud/bootstrap/main.tf

@@ -9,8 +9,7 @@ locals {
     },
     var.ali_extra_tags,
   )
-  system_disk_size     = 120
-  system_disk_category = "cloud_essd"
+  is_external = var.ali_publish_strategy == "External" ? true : false
 }
 
 provider "alicloud" {
@@ -139,13 +138,13 @@ resource "alicloud_instance" "bootstrap" {
   image_id                   = var.ali_image_id
   vswitch_id                 = var.vswitch_ids[0]
   security_groups            = [alicloud_security_group.sg_bootstrap.id, var.sg_master_id]
-  internet_max_bandwidth_out = 5
+  internet_max_bandwidth_out = local.is_external ? 5 : 0
   role_name                  = alicloud_ram_role.role.name
 
   system_disk_name        = "${local.prefix}_sys_disk-bootstrap"
   system_disk_description = local.description
-  system_disk_category    = local.system_disk_category
-  system_disk_size        = local.system_disk_size
+  system_disk_category    = var.ali_system_disk_category
+  system_disk_size        = var.ali_system_disk_size
 
   user_data = var.ali_bootstrap_stub_ignition
   tags = merge(
@@ -164,4 +163,4 @@ resource "alicloud_slb_backend_server" "slb_attachment_bootstraps" {
     server_id = alicloud_instance.bootstrap.id
     weight    = 90
   }
-}
+}

data/data/alibabacloud/bootstrap/outputs.tf

@@ -1,3 +1,3 @@
 output "bootstrap_ip" {
-  value = data.alicloud_instances.bootstrap_data.instances.0.public_ip
+  value = local.is_external ? data.alicloud_instances.bootstrap_data.instances.0.public_ip : data.alicloud_instances.bootstrap_data.instances.0.private_ip
 }

data/data/alibabacloud/cluster/dns/privatezone.tf

@@ -3,20 +3,15 @@ locals {
   prefix          = var.cluster_id
   cluster_name    = split(".", var.cluster_domain)[0]
   private_zone_id = var.private_zone_id == "" ? alicloud_pvtz_zone.pvtz.0.id : var.private_zone_id
+  is_external     = var.publish_strategy == "External" ? true : false
 }
 
 // Using this data source can open Private Zone service automatically.
 data "alicloud_pvtz_service" "open" {
   enable = "On"
 }
 
-data "alicloud_alidns_domains" "dns_public" {
-  domain_name_regex = "^${var.base_domain}$"
-}
-
 resource "alicloud_alidns_record" "dns_public_record" {
-  count = length(data.alicloud_alidns_domains.dns_public.domains) == 0 ? 0 : 1
-
   domain_name = var.base_domain
   rr          = "api.${local.cluster_name}"
   type        = "A"

data/data/alibabacloud/cluster/dns/variables.tf

@@ -38,3 +38,8 @@ variable "tags" {
   type        = map(string)
   description = "Tags to be applied to created resources."
 }
+
+variable "publish_strategy" {
+  type        = string
+  description = "The publishing strategy for endpoints like load balancers"
+}

data/data/alibabacloud/cluster/main.tf

@@ -1,5 +1,6 @@
 locals {
   description = "Created By OpenShift Installer"
+  is_external = var.ali_publish_strategy == "External" ? true : false
   tags = merge(
     {
       "GISV"                                      = "ocp",
@@ -38,6 +39,7 @@ module "vpc" {
   resource_group_id   = module.resource_group.resource_group_id
   vpc_cidr_block      = var.machine_v4_cidrs[0]
   tags                = local.tags
+  publish_strategy    = var.ali_publish_strategy
 }
 
 module "dns" {
@@ -51,6 +53,7 @@ module "dns" {
   slb_external_ip   = module.vpc.slb_external_ip
   slb_internal_ip   = module.vpc.slb_internal_ip
   tags              = local.tags
+  publish_strategy  = var.ali_publish_strategy
 }
 
 module "ram" {
@@ -68,6 +71,7 @@ module "master" {
   az_to_vswitch_id     = module.vpc.az_to_vswitch_id
   sg_id                = module.vpc.sg_master_id
   slb_ids              = module.vpc.slb_ids
+  slb_group_length     = module.vpc.slb_group_length
   instance_type        = var.ali_master_instance_type
   instance_count       = var.master_count
   image_id             = var.ali_image_id
@@ -76,4 +80,5 @@ module "master" {
   user_data_ign        = var.ignition_master
   role_name            = module.ram.role_master_name
   tags                 = local.tags
+  publish_strategy     = var.ali_publish_strategy
 }

data/data/alibabacloud/cluster/master/main.tf

@@ -36,7 +36,7 @@ resource "alicloud_instance" "master" {
 }
 
 resource "alicloud_slb_backend_server" "slb_attachment_masters" {
-  count            = "${length(var.slb_ids) * length(alicloud_instance.master.*.id)}"
+  count            = "${var.slb_group_length * length(alicloud_instance.master.*.id)}"
   load_balancer_id = "${element(var.slb_ids, ceil(count.index / length(alicloud_instance.master.*.id)))}"
   backend_servers {
     server_id = "${element(alicloud_instance.master.*.id, count.index)}"

data/data/alibabacloud/cluster/master/variables.tf

@@ -30,6 +30,10 @@ variable "slb_ids" {
   type = list(string)
 }
 
+variable "slb_group_length" {
+  description = "The length of the 'slb_ids' variable, to work around https://github.com/hashicorp/terraform/issues/12570."
+}
+
 variable "instance_count" {
   type = string
 }
@@ -67,3 +71,8 @@ variable "tags" {
   type        = map(string)
   description = "Tags to be applied to created resources."
 }
+
+variable "publish_strategy" {
+  type        = string
+  description = "The cluster publishing strategy, either Internal or External"
+}

data/data/alibabacloud/cluster/vpc/eip.tf

@@ -1,4 +1,6 @@
 resource "alicloud_eip_address" "eip" {
+  count = length(var.vswitch_ids) == 0 ? 1 : 0
+
   description          = local.description
   address_name         = "${local.prefix}-eip"
   payment_type         = "PayAsYouGo"
@@ -13,7 +15,9 @@ resource "alicloud_eip_address" "eip" {
 }
 
 resource "alicloud_eip_association" "eip_association" {
-  allocation_id = alicloud_eip_address.eip.id
-  instance_id   = alicloud_nat_gateway.nat_gateway.id
+  count = length(var.vswitch_ids) == 0 ? 1 : 0
+
+  allocation_id = alicloud_eip_address.eip[0].id
+  instance_id   = alicloud_nat_gateway.nat_gateway[0].id
   instance_type = "Nat"
 }

data/data/alibabacloud/cluster/vpc/nat_gateway.tf

@@ -1,8 +1,10 @@
 
 resource "alicloud_nat_gateway" "nat_gateway" {
+  count = length(var.vswitch_ids) == 0 ? 1 : 0
+
   vpc_id               = local.vpc_id
   nat_gateway_name     = "${local.prefix}-ngw"
-  vswitch_id           = alicloud_vswitch.vswitch_nat_gateway.id
+  vswitch_id           = alicloud_vswitch.vswitch_nat_gateway[0].id
   internet_charge_type = "PayByLcu"
   nat_type             = "Enhanced"
   description          = local.description
@@ -15,10 +17,10 @@ resource "alicloud_nat_gateway" "nat_gateway" {
 }
 
 resource "alicloud_snat_entry" "snat_entrys" {
-  count = length(local.vswitch_ids)
+  count = length(var.vswitch_ids) == 0 ? length(local.vswitch_ids) : 0
 
   depends_on        = [alicloud_eip_association.eip_association]
-  snat_table_id     = alicloud_nat_gateway.nat_gateway.snat_table_ids
+  snat_table_id     = alicloud_nat_gateway.nat_gateway[0].snat_table_ids
   source_vswitch_id = local.vswitch_ids[count.index]
-  snat_ip           = alicloud_eip_address.eip.ip_address
+  snat_ip           = alicloud_eip_address.eip[0].ip_address
 }

data/data/alibabacloud/cluster/vpc/outputs.tf

@@ -10,24 +10,16 @@ output "az_to_vswitch_id" {
   value = zipmap(data.alicloud_vswitches.vswitches.vswitches.*.zone_id, data.alicloud_vswitches.vswitches.vswitches.*.id)
 }
 
-output "gw_id" {
-  value = alicloud_nat_gateway.nat_gateway.id
-}
-
-output "eip_id" {
-  value = alicloud_eip_address.eip.id
-}
-
-output "eip_ip" {
-  value = alicloud_eip_address.eip.ip_address
+output "slb_ids" {
+  value = concat(alicloud_slb_load_balancer.slb_external[*].id, [alicloud_slb_load_balancer.slb_internal.id])
 }
 
-output "slb_ids" {
-  value = [alicloud_slb_load_balancer.slb_external.id, alicloud_slb_load_balancer.slb_internal.id]
+output "slb_group_length" {
+  value = length(concat(alicloud_slb_load_balancer.slb_external[*].id, [alicloud_slb_load_balancer.slb_internal.id]))
 }
 
 output "slb_external_ip" {
-  value = alicloud_slb_load_balancer.slb_external.address
+  value = local.is_external ? alicloud_slb_load_balancer.slb_external[0].address : null
 }
 
 output "slb_internal_ip" {

data/data/alibabacloud/cluster/vpc/slb.tf

@@ -1,5 +1,7 @@
 
 resource "alicloud_slb_load_balancer" "slb_external" {
+  count = local.is_external ? 1 : 0
+
   resource_group_id  = var.resource_group_id
   load_balancer_name = "${local.prefix}-slb-external"
   address_type       = "internet"
@@ -14,7 +16,9 @@ resource "alicloud_slb_load_balancer" "slb_external" {
 }
 
 resource "alicloud_slb_listener" "listener_external_6443" {
-  load_balancer_id          = alicloud_slb_load_balancer.slb_external.id
+  count = local.is_external ? 1 : 0
+
+  load_balancer_id          = alicloud_slb_load_balancer.slb_external[0].id
   backend_port              = 6443
   frontend_port             = 6443
   protocol                  = "tcp"

data/data/alibabacloud/cluster/vpc/variables.tf

@@ -36,3 +36,8 @@ variable "tags" {
   type        = map(string)
   description = "Tags to be applied to created resources."
 }
+
+variable "publish_strategy" {
+  type        = string
+  description = "The publishing strategy for endpoints like load balancers"
+}

data/data/alibabacloud/cluster/vpc/vpc.tf

@@ -2,9 +2,9 @@
 locals {
   description = "Created By OpenShift Installer"
   prefix      = var.cluster_id
-  newbits     = max(4, 20 - tonumber(split("/", var.vpc_cidr_block)[1]))
   vpc_id      = var.vpc_id == "" ? alicloud_vpc.vpc.0.id : var.vpc_id
   vswitch_ids = length(var.vswitch_ids) == 0 ? alicloud_vswitch.vswitches.*.id : var.vswitch_ids
+  is_external = var.publish_strategy == "External" ? true : false
 }
 
 data "alicloud_vswitches" "vswitches" {
@@ -32,7 +32,7 @@ resource "alicloud_vswitch" "vswitches" {
   vswitch_name = "${local.prefix}-vswitch-${var.zone_ids[count.index]}"
   description  = local.description
   vpc_id       = local.vpc_id
-  cidr_block   = cidrsubnet(var.vpc_cidr_block, local.newbits, count.index)
+  cidr_block   = cidrsubnet(var.vpc_cidr_block, ceil(log(length(var.zone_ids) + 1, 2)), count.index + 1)
   zone_id      = var.zone_ids[count.index]
   tags = merge(
     {
@@ -43,10 +43,12 @@ resource "alicloud_vswitch" "vswitches" {
 }
 
 resource "alicloud_vswitch" "vswitch_nat_gateway" {
+  count = length(var.vswitch_ids) == 0 ? 1 : 0
+
   vswitch_name = "${local.prefix}-vswitch-nat-gateway"
   description  = local.description
   vpc_id       = local.vpc_id
-  cidr_block   = cidrsubnet(var.vpc_cidr_block, local.newbits, local.newbits)
+  cidr_block   = cidrsubnet(var.vpc_cidr_block, ceil(log(length(var.zone_ids) + 1, 2)), 0)
   zone_id      = var.nat_gateway_zone_id
   tags = merge(
     {

data/data/alibabacloud/variables-alibabacloud.tf

@@ -19,6 +19,11 @@ variable "ali_vswitch_ids" {
   type = list(string)
 }
 
+variable "ali_publish_strategy" {
+  type        = string
+  description = "The cluster publishing strategy, either Internal or External"
+}
+
 variable "ali_private_zone_id" {
   type = string
 }

data/data/bootstrap/baremetal/files/usr/local/bin/startironic.sh.template

@@ -85,12 +85,6 @@ podman run -d --net host --privileged --name mariadb \
      -v $IRONIC_SHARED_VOLUME:/shared:z --entrypoint /bin/runmariadb \
      --env MARIADB_PASSWORD=$mariadb_password ${IRONIC_IMAGE}
 
-podman run -d --net host --privileged --name httpd \
-     --restart on-failure \
-     --env IRONIC_RAMDISK_SSH_KEY="$IRONIC_RAMDISK_SSH_KEY" \
-     --env PROVISIONING_INTERFACE=$PROVISIONING_NIC \
-     -v $IRONIC_SHARED_VOLUME:/shared:z --entrypoint /bin/runhttpd ${IRONIC_IMAGE}
-
 {{ if .PlatformData.BareMetal.ProvisioningIPv6 }}
 IPTABLES=ip6tables
 {{ else }}
@@ -121,6 +115,15 @@ podman run -d --name coreos-downloader \
      -v $IRONIC_SHARED_VOLUME:/shared:z \
      ${MACHINE_OS_IMAGES_IMAGE} /bin/copy-metal --all /shared/html/images/
 
+# Wait for images to be downloaded/ready
+podman wait -i 1000ms coreos-downloader
+
+podman run -d --net host --privileged --name httpd \
+     --restart on-failure \
+     --env IRONIC_RAMDISK_SSH_KEY="$IRONIC_RAMDISK_SSH_KEY" \
+     --env PROVISIONING_INTERFACE=$PROVISIONING_NIC \
+     -v $IRONIC_SHARED_VOLUME:/shared:z --entrypoint /bin/runhttpd ${IRONIC_IMAGE}
+
 # Add firewall rules to ensure the IPA ramdisk can reach httpd, Ironic and the Inspector API on the host
 for port in 80 5050 6385 ; do
     if ! $IPTABLES -C INPUT -i $PROVISIONING_NIC -p tcp -m tcp --dport $port -j ACCEPT > /dev/null 2>&1; then
@@ -151,9 +154,6 @@ done
 $IPTABLES -t raw -A DHCP_IRONIC -j DROP
 {{end}}
 
-# Wait for images to be downloaded/ready
-podman wait -i 1000ms coreos-downloader
-
 export KUBECONFIG=/opt/openshift/auth/kubeconfig-loopback
 
 mkdir -p /tmp/nmstate
@@ -184,6 +184,18 @@ else
     IRONIC_HOST="${IRONIC_IP}"
 fi
 
+{{if .Proxy -}}
+{{if .Proxy.HTTPProxy -}}
+HTTP_PROXY="{{.Proxy.HTTPProxy}}"
+{{end -}}
+{{if .Proxy.HTTPSProxy -}}
+HTTPS_PROXY="{{.Proxy.HTTPSProxy}}"
+{{end -}}
+{{if .Proxy.NoProxy -}}
+NO_PROXY="{{.Proxy.NoProxy}}"
+{{end -}}
+{{end -}}
+
 # Create a podman secret for the image-customization-server 
 podman secret rm pull-secret || true
 base64 -w 0 /root/.docker/config.json | podman secret create pull-secret -
@@ -197,6 +209,9 @@ podman run -d --net host --privileged --name image-customization \
     --env IRONIC_AGENT_IMAGE="$IRONIC_AGENT_IMAGE" \
     --env IP_OPTIONS=$EXTERNAL_IP_OPTIONS \
     --env REGISTRIES_CONF_PATH=/tmp/containers/registries.conf \
+    --env HTTP_PROXY="$HTTP_PROXY" \
+    --env HTTPS_PROXY="$HTTPS_PROXY" \
+    --env NO_PROXY="$NO_PROXY" \
     --entrypoint '["/image-customization-server", "--nmstate-dir=/tmp/nmstate/", "--images-publish-addr=http://0.0.0.0:8084"]' \
     -v /tmp/nmstate/:/tmp/nmstate/ \
     -v $IRONIC_SHARED_VOLUME:/shared:z \

data/data/bootstrap/files/usr/local/bin/bootkube.sh.template

@@ -402,11 +402,7 @@ run_cluster_bootstrap() {
         --volume "$PWD:/assets:z" \
         --volume /etc/kubernetes:/etc/kubernetes:z \
         "${CLUSTER_BOOTSTRAP_IMAGE}" \
-        start \
-          --tear-down-early=false \
-          --tear-down-delay="{{.TearDownDelay}}" \
-          --asset-dir=/assets \
-          --required-pods="${REQUIRED_PODS}"
+        start --tear-down-early=false --asset-dir=/assets --required-pods="${REQUIRED_PODS}"
 }
 
 if [ ! -f cb-bootstrap.done ]