Skip to content

Commit 4620efe

Browse files
WeetA34WeetA34
authored
Fix Network Security Group Gameserver rule not applied on AKS cluster (agones-dev#2124)
* Fix Network Security Group Gameserver rule not applied * Variabilize resource group name & location. Comment useless azuread code. Add terraform block in aks module * Move minimum terraform version for AKS to 0.12.26 in order to be compatible with terraform 0.13+ required_providers block * Remove useless comments
1 parent 440ea2b commit 4620efe

4 files changed

Lines changed: 102 additions & 106 deletions

File tree

‎examples/terraform-submodules/aks/module.tf‎

Lines changed: 43 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -16,69 +16,88 @@
1616
// Run:
1717
// terraform apply [-var agones_version="1.3.0"]
1818

19+
terraform {
20+
required_version = ">= 0.12.26"
21+
}
22+
1923
// Install latest version of agones
2024
variable "agones_version" {
2125
default = ""
2226
}
2327

24-
variable "cluster_name" {
25-
default = "test-cluster"
28+
variable "client_id" {
29+
default = ""
30+
31+
}
32+
variable "client_secret" {
33+
default = ""
2634
}
2735

28-
variable "node_count" {
29-
default = 4
36+
variable "cluster_name" {
37+
default = "test-cluster"
3038
}
3139

3240
variable "disk_size" {
3341
default = 30
3442
}
3543

36-
variable "client_id" {
37-
default = ""
38-
}
39-
variable "client_secret" {
44+
variable "feature_gates" {
4045
default = ""
4146
}
4247

43-
variable "machine_type" { default = "Standard_D2_v2" }
44-
4548
variable "log_level" {
4649
default = "info"
4750
}
4851

49-
variable "feature_gates" {
50-
default = ""
52+
variable "machine_type" {
53+
default = "Standard_D2_v2"
54+
}
55+
56+
variable "node_count" {
57+
default = 4
58+
}
59+
60+
variable "resource_group_location" {
61+
default = "East US"
62+
}
63+
64+
variable "resource_group_name" {
65+
default = "agonesRG"
5166
}
5267

5368
module "aks_cluster" {
5469
source = "git::https://github.com/googleforgames/agones.git//install/terraform/modules/aks/?ref=main"
5570

56-
machine_type = var.machine_type
57-
cluster_name = var.cluster_name
58-
node_count = var.node_count
59-
disk_size = var.disk_size
60-
client_id = var.client_id
61-
client_secret = var.client_secret
71+
client_id = var.client_id
72+
client_secret = var.client_secret
73+
cluster_name = var.cluster_name
74+
disk_size = var.disk_size
75+
machine_type = var.machine_type
76+
node_count = var.node_count
77+
resource_group_location = var.resource_group_location
78+
resource_group_name = var.resource_group_name
6279
}
6380

6481
module "helm_agones" {
6582
source = "git::https://github.com/googleforgames/agones.git//install/terraform/modules/helm3/?ref=main"
6683

6784
agones_version = var.agones_version
68-
values_file = ""
85+
cluster_ca_certificate = module.aks_cluster.cluster_ca_certificate
6986
feature_gates = var.feature_gates
7087
host = module.aks_cluster.host
71-
token = module.aks_cluster.token
72-
cluster_ca_certificate = module.aks_cluster.cluster_ca_certificate
7388
log_level = var.log_level
89+
token = module.aks_cluster.token
90+
values_file = ""
91+
}
92+
93+
output "cluster_ca_certificate" {
94+
value = module.aks_cluster.cluster_ca_certificate
7495
}
7596

7697
output "host" {
7798
value = module.aks_cluster.host
7899
}
100+
79101
output "token" {
80102
value = module.aks_cluster.token
81103
}
82-
output "cluster_ca_certificate" {
83-
value = module.aks_cluster.cluster_ca_certificate
84-
}

‎install/terraform/modules/aks/aks.tf‎

Lines changed: 28 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -12,46 +12,20 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
provider "azuread" {
16-
version = "=0.4.0"
17-
}
18-
19-
provider "azurerm" {
20-
version = "=2.2.0"
21-
22-
features {}
23-
}
24-
25-
provider "random" {
26-
version = "~> 2.2"
27-
}
28-
29-
# Create Service Principal password
30-
resource "azuread_service_principal_password" "aks" {
31-
end_date = "2299-12-30T23:00:00Z" # Forever
32-
service_principal_id = azuread_service_principal.aks.id
33-
value = random_string.password.result
34-
}
35-
36-
# Create Azure AD Application for Service Principal
37-
resource "azuread_application" "aks" {
38-
name = "agones-sp"
39-
}
40-
41-
# Create Service Principal
42-
resource "azuread_service_principal" "aks" {
43-
application_id = azuread_application.aks.application_id
44-
}
4515

46-
# Generate random string to be used for Service Principal Password
47-
resource "random_string" "password" {
48-
length = 32
49-
special = true
16+
terraform {
17+
required_providers {
18+
azurerm = {
19+
source = "hashicorp/azurerm"
20+
version = "~> 2.63"
21+
}
22+
}
23+
required_version = ">= 0.12.26"
5024
}
5125

5226
resource "azurerm_resource_group" "agones_rg" {
53-
name = "agonesRG"
54-
location = "East US"
27+
location = var.resource_group_location
28+
name = var.resource_group_name
5529
}
5630

5731
resource "azurerm_kubernetes_cluster" "agones" {
@@ -60,7 +34,7 @@ resource "azurerm_kubernetes_cluster" "agones" {
6034
resource_group_name = azurerm_resource_group.agones_rg.name
6135
dns_prefix = "agones"
6236

63-
kubernetes_version = "1.19.11"
37+
kubernetes_version = var.kubernetes_version
6438

6539
default_node_pool {
6640
name = "default"
@@ -69,7 +43,6 @@ resource "azurerm_kubernetes_cluster" "agones" {
6943
os_disk_size_gb = var.disk_size
7044
enable_auto_scaling = false
7145
enable_node_public_ip = var.enable_node_public_ip
72-
#vnet_subnet_id = azurerm_subnet.aks.id
7346
}
7447

7548
service_principal {
@@ -107,36 +80,24 @@ resource "azurerm_kubernetes_cluster_node_pool" "metrics" {
10780
}
10881
}
10982

110-
resource "azurerm_network_security_group" "agones_sg" {
111-
name = "agonesSecurityGroup"
112-
location = azurerm_resource_group.agones_rg.location
113-
resource_group_name = azurerm_resource_group.agones_rg.name
114-
}
83+
data "azurerm_resources" "network_security_groups" {
84+
resource_group_name = azurerm_kubernetes_cluster.agones.node_resource_group
11585

116-
resource "azurerm_network_security_rule" "gameserver" {
117-
name = "gameserver"
118-
priority = 100
119-
direction = "Inbound"
120-
access = "Allow"
121-
protocol = "UDP"
122-
source_port_range = "*"
123-
destination_port_range = "7000-8000"
124-
source_address_prefix = "*"
125-
destination_address_prefix = "*"
126-
resource_group_name = azurerm_resource_group.agones_rg.name
127-
network_security_group_name = azurerm_network_security_group.agones_sg.name
86+
type = "Microsoft.Network/networkSecurityGroups"
12887
}
12988

130-
resource "azurerm_network_security_rule" "outbound" {
131-
name = "outbound"
132-
priority = 100
133-
direction = "Outbound"
134-
access = "Allow"
135-
protocol = "Tcp"
136-
source_port_range = "*"
137-
destination_port_range = "*"
138-
source_address_prefix = "*"
139-
destination_address_prefix = "*"
140-
resource_group_name = azurerm_resource_group.agones_rg.name
141-
network_security_group_name = azurerm_network_security_group.agones_sg.name
89+
resource "azurerm_network_security_rule" "gameserver" {
90+
name = "gameserver"
91+
priority = 100
92+
direction = "Inbound"
93+
access = "Allow"
94+
protocol = "Udp"
95+
source_port_range = "*"
96+
destination_port_range = "7000-8000"
97+
source_address_prefix = "*"
98+
destination_address_prefix = "*"
99+
# 2021.06.07-WeetA34: Force lowercase to avoid resource recreation due to attribute saved as lowercase
100+
resource_group_name = lower(data.azurerm_resources.network_security_groups.resource_group_name)
101+
# Ensure we get the first network security group named aks-agentpool-*******-nsg
102+
network_security_group_name = [for network_security_group in data.azurerm_resources.network_security_groups.resources : network_security_group.name if length(regexall("^aks-agentpool-\\d+-nsg$", network_security_group.name)) > 0][0]
142103
}

‎install/terraform/modules/aks/variables.tf‎

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,31 +12,43 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
variable "machine_type" {
16-
default = "Standard_D2_v2"
17-
}
18-
19-
variable "node_count" {
20-
default = 4
15+
variable "client_id" {
2116
}
2217

23-
variable "disk_size" {
24-
default = 30
18+
variable "client_secret" {
2519
}
2620

2721
variable "cluster_name" {
2822
default = "test-cluster"
2923
}
3024

31-
variable "client_id" {
32-
}
33-
34-
variable "client_secret" {
25+
variable "disk_size" {
26+
default = 30
3527
}
3628

3729
# VMSS is used, so it is unpredictable how NICs will be given to VMs
3830
# So let Azure to create NICs with Public IPs as gameservers require
3931
# Azure Managment SDK can be used to obtain these IPs and map Agones GameServers internal IPs to public
40-
variable enable_node_public_ip {
32+
variable "enable_node_public_ip" {
4133
default = true
42-
}
34+
}
35+
36+
variable "kubernetes_version" {
37+
default = "1.19.11"
38+
}
39+
40+
variable "machine_type" {
41+
default = "Standard_D2_v2"
42+
}
43+
44+
variable "node_count" {
45+
default = 4
46+
}
47+
48+
variable "resource_group_location" {
49+
default = "East US"
50+
}
51+
52+
variable "resource_group_name" {
53+
default = "agonesRG"
54+
}

‎site/content/en/docs/Installation/Creating Cluster/aks.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ az network nsg rule create \
6767

6868
### Getting Public IPs to Nodes
6969

70-
70+
#### Kubernetes version prior to 1.18.19, 1.19.11 and 1.20.7
7171

7272
To find a resource's public IP, search for [Virtual Machine Scale Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Compute%2FvirtualMachineScaleSets) -> click on the set name(inside `MC_resourceGroupName_AKSName_westeurope` group) -> click `Instances` -> click on the instance name -> view `Public IP address`.
7373

@@ -76,6 +76,10 @@ To get public IP via API [look here](https://github.com/Azure/azure-libraries-fo
7676

7777
For more information on Public IPs for VM NICs, see [this document](https://docs.microsoft.com/azure/virtual-network/virtual-network-network-interface-addresses).
7878

79+
#### Kubernetes version starting 1.18.19, 1.19.11 and 1.20.7
80+
81+
Virtual Machines public IP is available directly in Kubernetes EXTERNAL-IP.
82+
7983
## Next Steps
8084

8185
- Continue to [Install Agones]({{< relref "../Install Agones/_index.md" >}}).

0 commit comments

Comments
 (0)