SSH-ключ для узла AWS Autoscaling Group не работает - PullRequest
Новая
       6

SSH-ключ для узла AWS Autoscaling Group не работает

0 голосов
/ 18 февраля 2019

Итак, я создал группу автоматического масштабирования, используя следующие файлы Terraform:

Группа автоматического масштабирования: 

resource "aws_autoscaling_group" "orbix-mvp" {
  desired_capacity     = 1
  launch_configuration = "${aws_launch_configuration.orbix-mvp.id}"
  max_size             = 1
  min_size             = 1
  name                 = "${var.project}-${var.stage}"
  vpc_zone_identifier  = ["${aws_subnet.orbix-mvp.*.id}"]

  tag {
    key                 = "Name"
    value               = "${var.project}-${var.stage}"
    propagate_at_launch = true
  }

  tag {
    key                 = "kubernetes.io/cluster/${var.project}-${var.stage}"
    value               = "owned"
    propagate_at_launch = true
  }
}

Запуск конфигурации: 

# This data source is included for ease of sample architecture deployment
# and can be swapped out as necessary.
data "aws_region" "current" {}

# EKS currently documents this required userdata for EKS worker nodes to
# properly configure Kubernetes applications on the EC2 instance.
# We utilize a Terraform local here to simplify Base64 encoding this
# information into the AutoScaling Launch Configuration.
# More information: https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html
locals {
  orbix-mvp-node-userdata = <<USERDATA
#!/bin/bash
set -o xtrace
/etc/eks/bootstrap.sh --apiserver-endpoint '${aws_eks_cluster.orbix-mvp.endpoint}' --b64-cluster-ca '${aws_eks_cluster.orbix-mvp.certificate_authority.0.data}' '${var.project}-${var.stage}'
USERDATA
}

resource "aws_launch_configuration" "orbix-mvp" {
  associate_public_ip_address = true
  iam_instance_profile        = "${aws_iam_instance_profile.orbix-mvp-node.name}"
  image_id                    = "${data.aws_ami.eks-worker.id}"
  instance_type               = "c5.large"
  name_prefix                 = "${var.project}-${var.stage}"
  security_groups             = ["${aws_security_group.orbix-mvp-node.id}"]
  user_data_base64            = "${base64encode(local.orbix-mvp-node-userdata)}"
  key_name                    = "devops"

  lifecycle {
    create_before_destroy = true
  }
}

Итак, я добавилуже сгенерированный ключ SSH под именем devops для конфигурации запуска.Я могу использовать SSH для созданных вручную экземпляров EC2 с этим ключом, однако я не могу представить SSH для экземпляров, созданных с помощью этой конфигурации.

Любая помощь приветствуется, спасибо:)

РЕДАКТИРОВАТЬ:

Узел группы безопасности Terraform: 

resource "aws_security_group" "orbix-mvp-node" {
  name        = "${var.project}-${var.stage}-node"
  description = "Security group for all nodes in the ${var.project}-${var.stage} cluster"
  vpc_id      = "${aws_vpc.orbix-mvp.id}"

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = "${
    map(
     "Name", "${var.project}-${var.stage}-node",
     "kubernetes.io/cluster/${var.project}-${var.stage}", "owned",
    )
  }"
}

resource "aws_security_group_rule" "demo-node-ingress-self" {
  description              = "Allow node to communicate with each other"
  from_port                = 0
  protocol                 = "-1"
  security_group_id        = "${aws_security_group.orbix-mvp-node.id}"
  source_security_group_id = "${aws_security_group.orbix-mvp-node.id}"
  to_port                  = 65535
  type                     = "ingress"
}

resource "aws_security_group_rule" "demo-node-ingress-cluster" {
  description              = "Allow worker Kubelets and pods to receive communication from the cluster control plane"
  from_port                = 1025
  protocol                 = "tcp"
  security_group_id        = "${aws_security_group.orbix-mvp-node.id}"
  source_security_group_id = "${aws_security_group.orbix-mvp-cluster.id}"
  to_port                  = 65535
  type                     = "ingress"
}

resource "aws_security_group_rule" "demo-node-port-22" {
  description              = "Add SSH access"
  from_port                = 22
  protocol                 = "tcp"
  security_group_id        = "${aws_security_group.orbix-mvp-node.id}"
  cidr_blocks              = ["0.0.0.0/0"]
  to_port                  = 22
  type                     = "ingress"
}
...