github.com/verrazzano/verrazzano@v1.7.1/tests/e2e/config/scripts/terraform/cluster/create-cluster.sh (about)

     1  #!/bin/bash
     2  #
     3  # Copyright (c) 2020, 2022, Oracle and/or its affiliates.
     4  # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
     5  #
     6  
     7  
     8  . ./init.sh
     9  
    10  $SCRIPT_DIR/terraform init -no-color -reconfigure
    11  
    12  set -o pipefail
    13  
    14  # retry 3 times, 30 seconds apart
    15  tries=0
    16  MAX_TRIES=3
    17  while true; do
    18     tries=$((tries+1))
    19     echo "terraform plan iteration ${tries}"
    20     $SCRIPT_DIR/terraform plan -var-file=$TF_VAR_nodepool_config.tfvars -var-file=$TF_VAR_region.tfvars -no-color && break
    21     if [ "$tries" -ge "$MAX_TRIES" ];
    22     then
    23        echo "Terraform plan tries exceeded.  Cluster creation has failed!"
    24        exit 1
    25     fi
    26     sleep 30
    27  done
    28  
    29  # retry 3 times, 30 seconds apart
    30  tries=0
    31  MAX_TRIES=3
    32  while true; do
    33     tries=$((tries+1))
    34     echo "terraform apply iteration ${tries}"
    35     $SCRIPT_DIR/terraform apply -var-file=$TF_VAR_nodepool_config.tfvars -var-file=$TF_VAR_region.tfvars -auto-approve -no-color && break
    36     if [ "$tries" -ge "$MAX_TRIES" ];
    37     then
    38        echo "Terraform apply tries exceeded.  Cluster creation has failed!"
    39        break
    40     fi
    41     echo "Deleting Cluster Terraform and applying again"
    42     $SCRIPT_DIR/delete-cluster.sh
    43     sleep 30
    44  done
    45  
    46  if [ "$tries" -ge "$MAX_TRIES" ];
    47  then
    48    exit 1
    49  fi
    50  
    51  echo "updating OKE private_workers_seclist to allow pub_lb_subnet access to workers"
    52  
    53  # the script would return 0 even if it fails to update OKE private_workers_seclist
    54  # because the OKE still could work if it didn't hit the rate limiting
    55  
    56  # find vcn id "${var.label_prefix}-${var.vcn_name}"
    57  VCN_ID=$(oci network vcn list \
    58    --compartment-id "${TF_VAR_compartment_id}" \
    59    --display-name "${TF_VAR_label_prefix}-oke-vcn" \
    60    | jq -r '.data[0].id')
    61  
    62  if [ -z "$VCN_ID" ]; then
    63      echo "Failed to get the id for OKE cluster vcn ${TF_VAR_label_prefix}-oke-vcn"
    64      exit 0
    65  fi
    66  
    67  # find private_workers_seclist id
    68  SEC_LIST_ID=$(oci network security-list list \
    69    --compartment-id "${TF_VAR_compartment_id}" \
    70    --display-name "${TF_VAR_label_prefix}-workers" \
    71    --vcn-id "${VCN_ID}" \
    72    | jq -r '.data[0].id')
    73  
    74  if [ -z "$SEC_LIST_ID" ]; then
    75      echo "Failed to get the id for security-list ${TF_VAR_label_prefix}-workers"
    76      exit 0
    77  fi
    78  
    79  # find pub_lb_subnet CIDR
    80  LB_SUBNET_CIDR=$(oci network subnet list \
    81    --compartment-id "${TF_VAR_compartment_id}" \
    82    --display-name "${TF_VAR_label_prefix}-pub_lb" \
    83    --vcn-id "${VCN_ID}" \
    84    | jq -r '.data[0]."cidr-block"')
    85  
    86  if [ -z "$LB_SUBNET_CIDR" ]; then
    87      echo "Failed to get the cidr-block for subnet ${TF_VAR_label_prefix}-pub_lb"
    88      exit 0
    89  fi
    90  
    91  # get current ingress-security-rules
    92  oci network security-list get --security-list-id "${SEC_LIST_ID}" | jq '.data."ingress-security-rules"' > ingress-security-rules.json
    93  if [ $? -eq 0 ]; then
    94    echo "ingress-security-rules for security-list ${TF_VAR_label_prefix}-private-workers:"
    95    cat ingress-security-rules.json
    96  else
    97    echo "Failed to retrieve the ingress-security-rules for security-list ${TF_VAR_label_prefix}-private-workers"
    98    exit 0
    99  fi
   100  
   101  # add pub_lb_subnet ingress-security-rule
   102  cat ingress-security-rules.json | jq --arg LB_SUBNET_CIDR "${LB_SUBNET_CIDR}" '. += [{"description": "allow pub_lb_subnet access to workers","is-stateless": false,"protocol": "6","source": $LB_SUBNET_CIDR,"tcp-options": {"destination-port-range": {"max": 32767,"min": 30000}}},{"description": "allow pub_lb_subnet health check access to workers","is-stateless": false,"protocol": "6","source": $LB_SUBNET_CIDR,"tcp-options": {"destination-port-range": {"max": 10256,"min": 10256}}}]' > new.ingress-security-rules.json
   103  
   104  # update private_workers_seclist
   105  oci network security-list update --force --security-list-id "${SEC_LIST_ID}" --ingress-security-rules "file://${PWD}/new.ingress-security-rules.json"
   106  if [ $? -eq 0 ]; then
   107    echo "Updated the OKE private_workers_seclist"
   108  else
   109    echo "Failed to update the OKE private_workers_seclist"
   110  fi