landing-zone-cen-ack.yml

ROSTemplateFormatVersion: '2015-09-01'
Transform: Aliyun::Terraform-v1.2
Description:
  en: This template is used to plan networking between two ACK clusters across accounts
    in the same region by using a transit router to test the connectivity between
    the pods in the clusters.
  zh-cn: 进行跨账号同地域容器集群通过转发路由器组网，验证两个集群内Pod连通性。
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
    - Parameters:
      - user1_id
      - user2_id
      Label:
        default:
          zh-cn: 账号配置（请确保账号具有AliyunServiceRolePolicyForCEN权限）
          en: Account Configuration
    - Parameters:
      - region
      - zone_id
      Label:
        default:
          zh-cn: 地域和可用区配置
          en: Region and Zone Configuration
    - Parameters:
      - user1_vpc_cidr
      - user1_pod_vsw_cidr
      - user1_node_vsw_cidr
      - user1_service_cidr
      Label:
        default:
          zh-cn: 账号1网段配置(注意VPC间配置的网段不可重叠)
          en: CIDR Configuration
    - Parameters:
      - user2_vpc_cidr
      - user2_pod_vsw_cidr
      - user2_node_vsw_cidr
      - user2_service_cidr
      Label:
        default:
          zh-cn: 账号2网段配置(注意VPC间配置的网段不可重叠)
          en: CIDR Configuration
    - Parameters:
      - create_ecs
      Label:
        default:
          zh-cn: ECS创建配置
          en: ECS Creation Configuration
      Type: bool
    - Parameters:
      - region1_instance_type
      - region1_system_disk_category
      - region2_instance_type
      - region2_system_disk_category
      - ecs_password
      Label:
        default:
          zh-cn: Ecs实例类型及密码配置（当选择不创建ECS实例时，无需配置）
          en: Ecs InstanceType and Password Configuration
    TemplateTags:
    - acs:integrate:landing_zone:cen_tr
Workspace:
  main.tf: |
    data "alicloud_account" "current" {
    }
    locals {
      role_name = "ResourceDirectoryAccountAccessRole"
      user1_is_admin = var.user1_id == data.alicloud_account.current.id ? true : false
      user2_is_admin = var.user2_id == data.alicloud_account.current.id ? true : false
    }
    # provider
    provider "alicloud" {
      alias = "user1"
      region = var.region
      assume_role {
        role_arn = local.user1_is_admin ? null : format("acs:ram::%s:role/%s", var.user1_id, local.role_name)
        session_name = "AccountLandingZoneSetup"
        session_expiration = 999
      }
    }


    provider "alicloud" {
      alias = "user2"
      region = var.region
      assume_role {
        role_arn = local.user2_is_admin ? null : format("acs:ram::%s:role/%s", var.user2_id, local.role_name)
        session_name = "AccountLandingZoneSetup"
        session_expiration = 999
      }
    }

    module "user1_vpc" {
      source = "./vpc"
      providers = {alicloud: alicloud.user1}
      vpc_cidr = var.user1_vpc_cidr
      pod_vsw_cidr = var.user1_pod_vsw_cidr
      node_vsw_cidr = var.user1_node_vsw_cidr
      zone_id = var.zone_id
    }


    module "user2_vpc" {
      source = "./vpc"
      providers = {alicloud: alicloud.user2}
      vpc_cidr = var.user2_vpc_cidr
      pod_vsw_cidr = var.user2_pod_vsw_cidr
      node_vsw_cidr = var.user2_node_vsw_cidr
      zone_id = var.zone_id
    }


    resource "alicloud_cen_instance" "cen" {
      provider = alicloud.user1
      cen_instance_name = "云上企业网络"
    }

    resource "alicloud_cen_transit_router" "tr" {
      provider = alicloud.user1
      cen_id = alicloud_cen_instance.cen.id
    }

    resource "alicloud_cen_instance_grant" "grant" {
      provider          = alicloud.user2
      cen_id            = alicloud_cen_instance.cen.id
      child_instance_id = module.user2_vpc.vpc_id
      cen_owner_id      = var.user1_id
    }

    resource "alicloud_cen_transit_router_vpc_attachment" "vpc_att" {
      provider = alicloud.user1
      count = 2
      transit_router_attachment_name = format("vpc_attachment_%s", count.index)
      cen_id            = alicloud_cen_instance.cen.id
      transit_router_id = alicloud_cen_transit_router.tr.transit_router_id
      vpc_id            = [module.user1_vpc.vpc_id, module.user2_vpc.vpc_id][count.index]
      vpc_owner_id = count.index == 0? null : var.user2_id
      zone_mappings {
        zone_id    = var.zone_id
        vswitch_id = [module.user1_vpc.pod_vsw_id, module.user2_vpc.pod_vsw_id][count.index]
      }
      depends_on = [alicloud_cen_instance_grant.grant]
    }

    resource "alicloud_route_entry" "route_entry1" {
      provider = alicloud.user1
      for_each = toset([var.user1_vpc_cidr, var.user2_vpc_cidr])
      route_table_id        = module.user1_vpc.route_table_id
      destination_cidrblock = each.key
      nexthop_type          = "Attachment"
      nexthop_id            = alicloud_cen_transit_router_vpc_attachment.vpc_att[0].transit_router_attachment_id
    }

    resource "alicloud_route_entry" "route_entry2" {
      provider = alicloud.user2
      for_each = toset([var.user1_vpc_cidr, var.user2_vpc_cidr])
      route_table_id        = module.user2_vpc.route_table_id
      destination_cidrblock = each.key
      nexthop_type          = "Attachment"
      nexthop_id            = alicloud_cen_transit_router_vpc_attachment.vpc_att[1].transit_router_attachment_id
    }

    resource "alicloud_cen_transit_router_route_table" "route_table" {
      provider = alicloud.user1
      transit_router_id = alicloud_cen_transit_router.tr.transit_router_id
    }

    resource "alicloud_cen_transit_router_route_entry" "route_entry" {
      count = 2
      provider = alicloud.user1
      transit_router_route_table_id                     = alicloud_cen_transit_router_route_table.route_table.transit_router_route_table_id
      transit_router_route_entry_destination_cidr_block = [var.user1_vpc_cidr, var.user2_vpc_cidr][count.index]
      transit_router_route_entry_next_hop_type          = "Attachment"
      transit_router_route_entry_next_hop_id            = alicloud_cen_transit_router_vpc_attachment.vpc_att.*.transit_router_attachment_id[count.index]
    }

    resource "alicloud_cen_transit_router_route_table_association" "association" {
      provider = alicloud.user1
      count = 2
      transit_router_route_table_id = alicloud_cen_transit_router_route_table.route_table.transit_router_route_table_id
      transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.vpc_att.*.transit_router_attachment_id[count.index]
    }

    module "user1_k8s" {
      source = "./k8s"
      providers = {alicloud: alicloud.user1}
      pod_vsw_id = module.user1_vpc.pod_vsw_id
      node_vsw_id = module.user1_vpc.node_vsw_id
      service_cidr = var.user1_service_cidr
    }

    module "user2_k8s" {
      source = "./k8s"
      providers = {alicloud: alicloud.user2}
      pod_vsw_id = module.user2_vpc.pod_vsw_id
      node_vsw_id = module.user2_vpc.node_vsw_id
      service_cidr = var.user2_service_cidr
    }
  .metadata: |-
    {
      "ALIYUN::ROS::Interface": {
        "ParameterGroups": [
          {
            "Parameters": [
              "user1_id",
              "user2_id"
            ],
            "Label": {
              "default": {
                "zh-cn": "账号配置（请确保账号具有AliyunServiceRolePolicyForCEN权限）",
                "en": "Account Configuration"
              }
            }
          },
          {
            "Parameters": [
              "region",
              "zone_id"
            ],
            "Label": {
              "default": {
                "zh-cn": "地域和可用区配置",
                "en": "Region and Zone Configuration"
              }
            }
          },
          {
            "Parameters": [
              "user1_vpc_cidr",
              "user1_pod_vsw_cidr",
              "user1_node_vsw_cidr",
              "user1_service_cidr"
            ],
            "Label": {
              "default": {
                "zh-cn": "账号1网段配置(注意VPC间配置的网段不可重叠)",
                "en": "CIDR Configuration"
              }
            }
          },
          {
            "Parameters": [
              "user2_vpc_cidr",
              "user2_pod_vsw_cidr",
              "user2_node_vsw_cidr",
              "user2_service_cidr"
            ],
            "Label": {
              "default": {
                "zh-cn": "账号2网段配置(注意VPC间配置的网段不可重叠)",
                "en": "CIDR Configuration"
              }
            }
          },
          {
            "Parameters": [
              "create_ecs"
            ],
            "Type": "bool"
          },
          {
            "Parameters": [
              "region1_instance_type",
              "region1_system_disk_category",
              "region2_instance_type",
              "region2_system_disk_category",
              "ecs_password"
            ],
            "Label": {
              "default": {
                "zh-cn": "Ecs实例类型及密码配置（当选择不创建ECS实例时，无需配置）",
                "en": "Ecs InstanceType and Password Configuration"
              }
            }
          }
        ],
        "TemplateTags": [
          "acs:integrate:landing_zone:cen_tr"
        ]
      }
    }
  cen/main.tf: |
    variable "vpc_id" {}
    variable "vsw_id" {}
    variable "zone_id" {}

    resource "alicloud_cen_instance" "cen" {
      cen_instance_name = "云上企业网络"
    }

    resource "alicloud_cen_transit_router" "tr" {
      cen_id = alicloud_cen_instance.cen.id
    }

    resource "alicloud_cen_transit_router_vpc_attachment" "vpc_att" {
      cen_id            = alicloud_cen_instance.cen.id
      transit_router_id = alicloud_cen_transit_router.tr.transit_router_id
      vpc_id            = var.vpc_id
      zone_mappings {
        zone_id    = var.zone_id
        vswitch_id = var.vsw_id
      }
    }

    //resource "alicloud_cen_instance_grant" "grant" {
    //  provider = alicloud.user2
    //  cen_id            = alicloud_cen_instance.cen.id
    //  child_instance_id = alicloud_vpc.vpc2.id
    //  cen_owner_id      = var.user1_id
    //}


    //
    //resource "alicloud_cen_transit_router_vpc_attachment" "vpc_att2" {
    //  provider = alicloud.user1
    //  cen_id            = alicloud_cen_instance.cen.id
    //  transit_router_id = alicloud_cen_transit_router.tr.transit_router_id
    //  vpc_id            = alicloud_vpc.vpc2.id
    //  zone_mappings {
    //    zone_id    = var.zone_id
    //    vswitch_id = alicloud_vswitch.user2_pod_vsw.id
    //  }
    //  vpc_owner_id = var.user2_id
    //  depends_on = [alicloud_cen_instance_grant.grant]
    //}

    output "cen_id" {
      value = alicloud_cen_instance.cen.id
    }
  k8s/main.tf: |
    variable "pod_vsw_id" {}
    variable "node_vsw_id" {}
    variable "service_cidr" {}

    # Kubernetes托管版。
    resource "alicloud_cs_managed_kubernetes" "k8s" {
      # Kubernetes集群名称。
      name               = "cluster_demo"
      # 创建Pro版集群。
      cluster_spec       = "ack.pro.small"
      version            = "1.24.6-aliyun.1"
      # 新的Kubernetes集群将位于的vSwitch。指定一个或多个vSwitch的ID。它必须在availability_zone指定的区域中。
      worker_vswitch_ids = [var.node_vsw_id]
      pod_vswitch_ids    = [var.pod_vsw_id]
      service_cidr       = var.service_cidr
      enable_rrsa = true

      addons {
        name = "terway-eniip"
      }
    }

    resource "alicloud_cs_kubernetes_node_pool" "k8s_node_pool" {
      name           = "node_demo"
      cluster_id     = alicloud_cs_managed_kubernetes.k8s.id
      vswitch_ids    = [var.node_vsw_id]
      instance_types = ["ecs.g6.large"]
      image_type = "AliyunLinux"
      system_disk_category = "cloud_essd"
      system_disk_size     = 80
      password = "Ros12345"
      desired_size = 3
      runtime_name          = "containerd"
      runtime_version       = "1.5.13"
    }
  variables.tf: |
    variable "user1_id" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::ResourceManager::Account",
        "Label": {
            "zh-cn": "账号1的ID"
        }
      }
      EOT
    }

    variable "user2_id" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::ResourceManager::Account",
        "Label": {
            "zh-cn": "账号2的ID"
        }
      }
      EOT
    }


    variable "region" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::ECS::RegionId",
        "Description":"企业版转发路由器支持的地域和可用区: https://help.aliyun.com/document_detail/181681.html",
        "Label": {
            "zh-cn": "资源部署地域"
        }
      }
      EOT
      default = "cn-beijing"
    }

    variable "zone_id" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ZoneId",
        "AssociationPropertyMetadata": {
            "RegionId": "$${region}"
        },
        "Label": {
            "zh-cn": "可用区ID"
        }
      }
      EOT
      default = "cn-beijing-k"
    }


    variable "user1_vpc_cidr" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::VPC::VPC::CidrBlock",
        "Label": {
            "zh-cn": "VPC1的CIDR"
        }
      }
      EOT
      default = "10.0.0.0/16"
    }

    variable "user1_pod_vsw_cidr" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::VPC::VSwitch::CidrBlock",
        "Label": {
            "zh-cn": "账号1Pod节点VSW的CIDR"
        }
      }
      EOT
      default = "10.0.128.0/20"
    }

    variable "user1_node_vsw_cidr" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::VPC::VSwitch::CidrBlock",
        "Label": {
            "zh-cn": "账号1Node节点VSW的CIDR"
        }
      }
      EOT
      default = "10.0.0.0/24"
    }

    variable "user1_service_cidr" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::VPC::VPC::CidrBlock",
        "Label": {
            "zh-cn": "账号1Service节点的CIDR"
        }
      }
      EOT
      default = "172.16.0.0/20"
    }

    variable "user2_vpc_cidr" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::VPC::VPC::CidrBlock",
        "Label": {
            "zh-cn": "VPC2的CIDR"
        }
      }
      EOT
      default = "192.168.0.0/16"
    }

    variable "user2_pod_vsw_cidr" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::VPC::VSwitch::CidrBlock",
        "Label": {
            "zh-cn": "账号2Pod节点VSW的CIDR"
        }
      }
      EOT
      default = "192.168.16.0/20"
    }


    variable "user2_node_vsw_cidr" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::VPC::VSwitch::CidrBlock",
        "Label": {
            "zh-cn": "账号2Node节点VSW的CIDR"
        }
      }
      EOT
      default = "192.168.0.0/24"
    }

    variable "user2_service_cidr" {
      type = string
      description = <<EOT
      {
        "AssociationProperty": "ALIYUN::VPC::VPC::CidrBlock",
        "Label": {
            "zh-cn": "账号2Service节点的CIDR"
        }
      }
      EOT
      default = "172.16.16.0/20"
    }
  vpc/main.tf: |
    variable "vpc_cidr" {}
    variable "pod_vsw_cidr" {}
    variable "node_vsw_cidr" {}
    variable "zone_id" {}


    resource "alicloud_vpc" "vpc" {
      vpc_name = "vpc_test"
      cidr_block = var.vpc_cidr
    }

    resource "alicloud_vswitch" "pod_vsw" {
      vpc_id = alicloud_vpc.vpc.id
      cidr_block = var.pod_vsw_cidr
      zone_id = var.zone_id
    }

    resource "alicloud_vswitch" "node_vsw" {
      vpc_id = alicloud_vpc.vpc.id
      cidr_block = var.node_vsw_cidr
      zone_id = var.zone_id
    }

    output "vpc_id" {
      value = alicloud_vpc.vpc.id
    }
    output "pod_vsw_id" {
      value = alicloud_vswitch.pod_vsw.id
    }
    output "node_vsw_id" {
      value = alicloud_vswitch.node_vsw.id
    }
    output "route_table_id" {
      value = alicloud_vpc.vpc.route_table_id
    }