Custom tunnel

[Thijmen]

Hi folks,

Thanks for creating this tool, so far looks very promising!
I want to have each node to have a tunnel (e.g. OpenVPN or something else, I'm open for options) to a specific IP. Is such thing possible? I'd like to have at least my worker nodes to have access to a certain server in a network that I manage.

Thanks in advance,

Thijmen

[mysticaltech]

@kube-hetzner/core Any ideas on the matter?

Also, @maaft maybe you know more about that theme?

[Thijmen]

Perhaps a dumb question, but I've never used terraform project in another module. Can you share some links in order for me to dig into it? Thanks in advance!

[captnCC]

How do you use this module now? The normal way should be have a terraform project which imports this module like described in the kube.tf.example.

From there on you can use the output from the module module.kube-hetzner.agents_public_ipv4 to provision all nodes with the needed additional packages and configuration.

Just a sample (the used variables would need to be fixed)

resource "null_resource" "vpn" {
  for_each = module.kube-hetzner.agents_public_ipv4
  connection {
    user           = "root"
    private_key    = var.ssh_private_key
    agent_identity = local.ssh_agent_identity
    host           = each.value
    port           = var.ssh_port
  }
  provisioner "remote-exec" {
    ....
  }
}

Yet I would advise caution to do this task in terraform as it is an infrastructure provisioning tool and not really meant for configuration management.

But is it really necessary to have access on the node level or would it suffice to publish a service inside of Kubernetes that handles forwarding to your server?

[Thijmen]

I just use the kube.tf for the time being still, as I am still investigating other possible solutions. I was thinking about using Ansible to provision the servers with the right configuration for the tunnels, involves a bit of manual work (entering down the IP's in the inventory), but should be achievable. Thanks for the suggestion, appreciated!

[captnCC]

Since the combination of Terraform and Ansible isn't uncommon, there should be some kind of automation available to export the node ips to an ansible inventory

[Thijmen]

I'm still learning Terraform so if anyone has some good suggestions, feel free to mention them. Otherwise just some manual stuff is okay for now 😄