prskr/infrastructure
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat(fw): add firewall to limit traffic to ICMP and SSH

Browse source
This commit is contained in:
Peter Kurfer 2022-09-26 18:00:15 +02:00
parent 5a92679755
commit 560309ad0f
No known key found for this signature in database
2 changed files with 25 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
infrastructure/firewall.tf Normal file
View file

@ -0,0 +1,25 @@
resource "hcloud_firewall" "k8s_nodes_firewall" {
name = "k8s-nodes"
rule {
direction = "in"
protocol = "icmp"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
rule {
direction = "in"
protocol = "tcp"
port = "22"
source_ips = [
"0.0.0.0/0",
"::/0"
]
}
apply_to {
label_selector = "cluster=icb4dc0.de"
}
}

24
infrastructure/k8s_cluster.tf
View file

@ -1,27 +1,3 @@
# resource "hcloud_primary_ip" "cp1_ip6" {
# name = "cp1_ip6"
# datacenter = "hel1-dc2"
# type = "ipv6"
# assignee_type = "server"
# auto_delete = false
# }
# resource "hcloud_primary_ip" "worker1_ip6" {
# name = "worker1_ip6"
# datacenter = "hel1-dc2"
# type = "ipv6"
# assignee_type = "server"
# auto_delete = false
# }
# resource "hcloud_primary_ip" "worker2_ip6" {
# name = "worker2_ip6"
# datacenter = "hel1-dc2"
# type = "ipv6"
# assignee_type = "server"
# auto_delete = false
# }
resource "hcloud_network" "k8s_net" { resource "hcloud_network" "k8s_net" {
name = "k8s-net" name = "k8s-net"
ip_range = "172.16.0.0/12" ip_range = "172.16.0.0/12"