yandexcloud-k3s/terraform/main/instance_group.tf

resource "yandex_compute_instance_group" "k8s_master" {
  name                = "k8s-master"
  description         = "Masters instance group for Kubernetes cluster"
  service_account_id  = yandex_iam_service_account.instance_group_sa.id
  deletion_protection = true
  labels = {
    "kubernetes" = "cluster"
    "role"       = "control-plane"
  }

  instance_template {
    name     = "master-{instance.index_in_zone}-{instance.zone_id}-k8s"
    hostname = "master-{instance.index_in_zone}.{instance.zone_id}.k8s.internal"
    labels = {
      "instance-group" = "master"
      "kubernetes"     = "control-plane"
      "salt"           = "minion"
    }
    service_account_id = yandex_iam_service_account.instance_group_vm_sa.id

    platform_id = "standard-v3"
    resources {
      core_fraction = 100
      cores         = 2
      gpus          = 0
      memory        = 4
    }

    boot_disk {
      initialize_params {
        image_id    = data.yandex_compute_image.ubuntu_2404.id
        description = "Boot disk"
        size        = 10
        type        = "network-hdd"
      }
      mode = "READ_WRITE"
    }
    secondary_disk {
      device_name = "data"
      initialize_params {
        description = "Data disk"
        size        = 10
        type        = "network-ssd"
      }
      mode = "READ_WRITE"
    }

    network_interface {
      network_id = yandex_vpc_network.default.id
      subnet_ids = [
        yandex_vpc_subnet.default_ru_central1_a.id,
        yandex_vpc_subnet.default_ru_central1_b.id,
        yandex_vpc_subnet.default_ru_central1_d.id,
        yandex_vpc_subnet.default_ru_central1_e.id,
      ]
      nat = false
    }
    network_settings {
      type = "STANDARD"
    }

    metadata_options {
      aws_v1_http_endpoint = 1
      aws_v1_http_token    = 2
      gce_http_endpoint    = 1
      gce_http_token       = 1
    }
    metadata = {
      enable-oslogin        = true
      serial-port-enable    = 1
      install-unified-agent = 0
      user-data = templatefile("${path.module}/configs/cloud_init/master.yaml", {
        k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
        k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
        k3s_dir                        = local.k3s_data_dir
        k3s_token                      = random_password.k3s_token.result
        k3s_master_ip                  = local.k8s_main_master_fqdn
        k3s_fqdn                       = var.cluster_domain
        yc_cloud_id                    = var.cloud_id
      })
    }
  }

  scale_policy {
    fixed_scale {
      size = 2
    }
  }
  allocation_policy {
    zones = ["ru-central1-a", "ru-central1-b", "ru-central1-d", "ru-central1-e"]
  }
  deploy_policy {
    max_creating     = 3
    max_deleting     = 3
    max_expansion    = 0
    max_unavailable  = 1
    startup_duration = 300
    strategy         = "proactive"
  }

  load_balancer {
    target_group_name            = "k8s-master-instance-group"
    target_group_description     = "Load balancer target group for k8s masters"
    max_opening_traffic_duration = 600
    ignore_health_checks         = true
  }
  health_check {
    healthy_threshold   = 2
    unhealthy_threshold = 2
    interval            = 2
    timeout             = 1

    tcp_options {
      port = 6443
    }
  }
  max_checking_health_duration = 600

  depends_on = [
    yandex_compute_instance.k8s_main_master,
    yandex_iam_service_account.instance_group_sa,
    yandex_resourcemanager_folder_iam_member.instance_group_sa_compute_editor,
    yandex_resourcemanager_folder_iam_member.instance_group_sa_lb_editor
  ]
}

resource "yandex_compute_instance_group" "k8s_worker" {
  name                = "k8s-worker"
  description         = "Workers instance group for Kubernetes cluster"
  service_account_id  = yandex_iam_service_account.instance_group_sa.id
  deletion_protection = true
  labels = {
    "kubernetes" = "cluster"
    "role"       = "worker"
  }

  instance_template {
    name     = "worker-{instance.index_in_zone}-{instance.zone_id}-k8s"
    hostname = "worker-{instance.index_in_zone}.{instance.zone_id}.k8s.internal"
    labels = {
      "instance-group" = "worker"
      "kubernetes"     = "worker"
      "salt"           = "minion"
    }
    service_account_id = yandex_iam_service_account.instance_group_vm_sa.id

    platform_id = "standard-v3"
    resources {
      core_fraction = 100
      cores         = 4
      gpus          = 0
      memory        = 8
    }

    boot_disk {
      initialize_params {
        image_id    = data.yandex_compute_image.ubuntu_2404.id
        description = "Boot disk"
        size        = 10
        type        = "network-hdd"
      }
      mode = "READ_WRITE"
    }
    secondary_disk {
      device_name = "data"
      initialize_params {
        description = "Data disk"
        size        = 10
        type        = "network-ssd"
      }
      mode = "READ_WRITE"
    }

    network_interface {
      network_id = yandex_vpc_network.default.id
      subnet_ids = [
        yandex_vpc_subnet.default_ru_central1_a.id,
        yandex_vpc_subnet.default_ru_central1_b.id,
        yandex_vpc_subnet.default_ru_central1_d.id,
        yandex_vpc_subnet.default_ru_central1_e.id,
      ]
      nat = false
    }
    network_settings {
      type = "STANDARD"
    }

    metadata_options {
      aws_v1_http_endpoint = 1
      aws_v1_http_token    = 2
      gce_http_endpoint    = 1
      gce_http_token       = 1
    }
    metadata = {
      enable-oslogin        = true
      serial-port-enable    = 1
      install-unified-agent = 0
      user-data = templatefile("${path.module}/configs/cloud_init/worker.yaml", {
        k3s_credential_provider_config = base64encode(file("${path.module}/configs/k3s/credentialprovider.yaml"))
        k3s_credential_provider        = base64encode(file("${path.module}/configs/k3s/yc-credential-provider"))
        k3s_dir                        = local.k3s_data_dir
        k3s_token                      = random_password.k3s_token.result
        k3s_master_ip                  = local.k8s_main_master_fqdn
        yc_cloud_id                    = var.cloud_id
      })
    }
  }

  scale_policy {
    fixed_scale {
      size = 2
    }
  }
  allocation_policy {
    zones = ["ru-central1-a", "ru-central1-b", "ru-central1-d", "ru-central1-e"]
  }
  deploy_policy {
    max_creating     = 3
    max_deleting     = 3
    max_expansion    = 0
    max_unavailable  = 1
    startup_duration = 300
    strategy         = "proactive"
  }

  load_balancer {
    target_group_name            = "k8s-worker-instance-group"
    target_group_description     = "Load balancer target group for k8s workers"
    max_opening_traffic_duration = 600
    ignore_health_checks         = true
  }
  health_check {
    healthy_threshold   = 2
    unhealthy_threshold = 2
    interval            = 2
    timeout             = 1

    tcp_options {
      port = 80
    }
  }
  max_checking_health_duration = 600

  depends_on = [
    yandex_compute_instance.k8s_main_master,
    yandex_iam_service_account.instance_group_sa,
    yandex_resourcemanager_folder_iam_member.instance_group_sa_compute_editor,
    yandex_resourcemanager_folder_iam_member.instance_group_sa_lb_editor
  ]
}