serverplus'da Terraform: infratuzilma kod sifatida

serverplus'da Terraform nima

serverplus OpenStack asosida qurilgan, shuning uchun uning infratuzilmasini rasmiy terraform-provider-openstack provayderi yordamida kod sifatida boshqarish mumkin. Serverlar, tarmoqlar va qoidalarni .tf fayllarida tasvirlaysiz, Terraform (yoki mos OpenTofu) esa bulutni kerakli holatga keltiradi: takrorlanadigan, git'da ko'rib chiqiladigan va orqaga qaytariladigan tarzda.

Nima kerak bo'ladi

• Terraform yoki OpenTofu lokal (yoki CI'da) o'rnatilgan.
• Paneldan application credentials (id + secret) — «Kirishni boshqarish» bo'limi. Bu akkaunt parolidan xavfsizroq.
• ~/.config/openstack/clouds.yaml fayli kirish ma'lumotlari bilan (CLI uchun bo'lgani kabi).

clouds:
  serverplus:
    auth_type: v3applicationcredential
    auth:
      auth_url: https://identity.serverplus.uz/v3
      application_credential_id: <ID>
      application_credential_secret: <SECRET>
    region_name: RegionOne
    interface: public
    identity_api_version: 3

Provayderni sozlash

Minimal versions.tf va kirishni to'g'ridan-to'g'ri clouds.yaml'dan oladigan provayder:

terraform {
  required_providers {
    openstack = {
      source  = "terraform-provider-openstack/openstack"
      version = "~> 3.0"
    }
  }
}

provider "openstack" {
  cloud = "serverplus"
}

Birinchi server

main.tf namunasi: SSH-kalit, 22-portli security group, xususiy tarmoqdagi virtual mashina va tashqi (floating) IP.

resource "openstack_compute_keypair_v2" "kp" {
  name       = "tf-key"
  public_key = file("~/.ssh/id_rsa.pub")
}

resource "openstack_networking_secgroup_v2" "web" {
  name = "tf-web"
}

resource "openstack_networking_secgroup_rule_v2" "ssh" {
  direction         = "ingress"
  ethertype         = "IPv4"
  protocol          = "tcp"
  port_range_min    = 22
  port_range_max    = 22
  remote_ip_prefix  = "0.0.0.0/0"
  security_group_id = openstack_networking_secgroup_v2.web.id
}

resource "openstack_compute_instance_v2" "vm" {
  name            = "tf-vm-1"
  image_name      = "Ubuntu 22.04"
  flavor_name     = "m1.small"
  key_pair        = openstack_compute_keypair_v2.kp.name
  security_groups = [openstack_networking_secgroup_v2.web.name]
  network { name = "private" }
}

Tarmoq haqida. Server tashqi shlyuzli routerli tarmoqda bo'lishi kerak, aks holda internet bo'lmaydi. Obraz, flavor va tarmoq nomlarini paneldan yoki openstack image list, openstack flavor list, openstack network list buyruqlaridan oling.

Ishga tushirish

export OS_CLOUD=serverplus
terraform init
terraform plan
terraform apply

terraform destroy   # удалить всё, что создано

Xavfsizlik

• State-fayl — maxfiy. terraform.tfstate'ga parollar va kalitlar tushadi. Uni git'ga joylamang; himoyalangan backend'da (masalan, serverplus S3-xotirasida) shifrlab saqlang.
• Akkaunt paroli emas, application credentials'dan foydalaning — ularni bir marta bosib bekor qilish mumkin.
• Sirlarni .tf'da qattiq yozmang, o'zgaruvchilar va muhit orqali bering (TF_VAR_...).

Ko'p beriladigan savollar

Provayder autentifikatsiyadan o'tmayapti. OS_CLOUD=serverplus va clouds.yaml to'g'riligini tekshiring (identity_api_version: 3).

Terraform obraz yoki flavor topa olmayapti. Nomlar aniq mos kelishi kerak — openstack image list va openstack flavor list bilan solishtiring.

Floating IP berilmayapti. Tashqi tarmoq (pul) nomini aniqlang: openstack network list --external.