零基础教程！一文教你使用 Rancher 2.3 和 Terraform 运行 Windows 容器

$ terraform versionTerraform v0.12.9

az loginNote, we have launched a browser for you to login. For old experience with device code, use "az login --use-device-code"You have logged in. Now let us find all the subscriptions to which you have access...[  {    "cloudName": "AzureCloud",    "id": "14a619f7-a887-4635-8647-d8f46f92eaac",    "isDefault": true,    "name": "Rancher Labs Shared",    "state": "Enabled",    "tenantId": "abb5adde-bee8-4821-8b03-e63efdc7701c",    "user": {      "name": "jvb@rancher.com",      "type": "user"    }  }]

resource "azurerm_resource_group" "resource-group" {  name     = var.group-name  location = var.region}

os_profile {    computer_name = "${local.prefix}-${count.index}-vm"    admin_username = var.node-definition.admin-username    custom_data    = templatefile("./cloud-init.template", { docker-version = var.node-definition.docker-version, admin-username = var.node-definition.admin-username, additionalCommand = "${var.commandToExecute} --address ${azurerm_public_ip.publicIp[count.index].ip_address} --internal-address ${azurerm_network_interface.nic[count.index].ip_configuration[0].private_ip_address}"  })  }

#cloud-configrepo_update: truerepo_upgrade: all
runcmd:    - [ sh, -c, "curl https://releases.rancher.com/install-docker/${docker-version}.sh | sh && sudo usermod -a -G docker  ${admin-username}" ]    - [ sh, -c, "${additionalCommand}"]

resource "azurerm_network_interface" "nic" {  count               = var.node-count  name                = "${local.prefix}-${count.index}-nic"  location            = var.resource-group.location  resource_group_name = var.resource-group.name
  ip_configuration {    name                          = "${local.prefix}-ip-config-${count.index}"    subnet_id                     = var.subnet-id    private_ip_address_allocation = "static"    private_ip_address            = cidrhost("10.0.1.0/24", count.index + var.address-starting-index + 4)    public_ip_address_id          = azurerm_public_ip.publicIp[count.index].id  }}

resource "azurerm_public_ip" "frontendloadbalancer_publicip" {  name                = "rke-lb-publicip"  location            = var.resource-group.location  resource_group_name = var.resource-group.name  allocation_method   = "Static"  domain_name_label   = replace(var.domain-name-label, ".", "-")}

provider "cloudflare" {  email = "${var.cloudflare-email}"  api_key = "${var.cloudflare-token}"}
data "cloudflare_zones" "zones" {  filter {    name   = "${replace(var.domain-name, ".com", "")}.*" # Modify for other suffixes    status = "active"    paused = false  }}
# Add a record to the domainresource "cloudflare_record" "domain" {  zone_id = data.cloudflare_zones.zones.zones[0].id  name   = var.domain-name  value  = var.ip-address  type   = "A"  ttl    = "120"  proxied = "false"}

  dynamic nodes {    for_each = module.rancher-control.nodes    content {      address = module.rancher-control.publicIps[nodes.key].ip_address      internal_address = module.rancher-control.privateIps[nodes.key].private_ip_address      user    = module.rancher-control.node-definition.admin-username      role    = ["controlplane"]      ssh_key = file(module.rancher-control.node-definition.ssh-keypath-private)    }  }

  addons = <<EOL---kind: ServiceAccountapiVersion: v1metadata:  name: tiller  namespace: kube-system---kind: ClusterRoleBindingapiVersion: rbac.authorization.k8s.io/v1metadata:  name: tiller  namespace: kube-systemsubjects:- kind: ServiceAccount  name: tiller  namespace: kube-systemroleRef:  kind: ClusterRole  name: cluster-admin  apiGroup: rbac.authorization.k8s.ioEOL}

resource "null_resource" "install-cert-manager" {  depends_on = [null_resource.initialize-helm]  provisioner "local-exec" {    command = file("../install-cert-manager.sh")  }}

resource "null_resource" "install-rancher" {  depends_on = [null_resource.install-cert-manager]  provisioner "local-exec" {    command = templatefile("../install-rancher.sh", { lets-encrypt-email = var.lets-encrypt-email, lets-encrypt-environment = var.lets-encrypt-environment, rancher-domain-name = local.domain-name })  }}

provider "rancher2"  {  alias = "bootstrap"
  api_url   = var.rancher-url  bootstrap = true
  insecure = true}
resource "rancher2_bootstrap" "admin" {  provider = rancher2.bootstrap  password = var.admin-password  telemetry = true}

provider "rancher2" {  alias = "admin"
  api_url = rancher2_bootstrap.admin.url  token_key = rancher2_bootstrap.admin.token
  insecure = true}

resource "rancher2_setting" "url" {  provider = rancher2.admin  name = "server-url"  value = var.rancher-url}

resource "azuread_application" "ad-application" {  name                       = var.application-name  homepage                   = "https://${var.application-name}"  identifier_uris            = ["http://${var.application-name}"]  available_to_other_tenants = false}
resource "azuread_service_principal" "service-principal" {  application_id                = azuread_application.ad-application.application_id  app_role_assignment_required  = true}
resource "azurerm_role_assignment" "serviceprincipal-role" {  scope                = var.resource-group-id  role_definition_name = "Contributor"  principal_id         = azuread_service_principal.service-principal.id}
resource "random_string" "random" {  length = 32  special = true}
resource "azuread_service_principal_password" "service-principal-password" {  service_principal_id = azuread_service_principal.service-principal.id  value                = random_string.random.result  end_date             = timeadd(timestamp(), "720h")}

resource "rancher2_cluster" "manager" {  name = var.cluster-name  description = "Hybrid cluster with Windows and Linux workloads"  # windows_prefered_cluster = true Not currently supported  rke_config {    network {      plugin = "flannel"      options = {        flannel_backend_port = 4789        flannel_backend_type = "vxlan"        flannel_backend_vni = 4096      }    }    cloud_provider {      azure_cloud_provider {        aad_client_id = var.service-principal.client-id        aad_client_secret = var.service-principal.client-secret        subscription_id = var.service-principal.subscription-id        tenant_id = var.service-principal.tenant-id      }    }  }}

module "k8s-worker" {  source = "./node-module"  prefix = "worker"
  resource-group = module.k8s-resource-group.resource-group  node-count = var.k8s-worker-node-count  subnet-id = module.k8s-network.subnet-id  address-starting-index = var.k8s-etcd-node-count + var.k8s-controlplane-node-count  node-definition = local.node-definition  commandToExecute = "${module.cluster-module.linux-node-command} --worker"}

os_profile {  computer_name = "${local.prefix}-${count.index}-vm"  admin_username = var.node-definition.admin-username  admin_password = var.node-definition.admin-password}
os_profile_windows_config {  provision_vm_agent = true}

C:\Users\iamsuperman>docker psCONTAINER ID        IMAGE                                COMMAND                  CREATED             STATUS              PORTS               NAMES832ef7adaeca        rancher/rke-tools:v0.1.50            "pwsh -NoLogo -NonIn…"   10 minutes ago      Up 9 minutes                            nginx-proxy7e75dffce642        rancher/hyperkube:v1.15.4-rancher1   "pwsh -NoLogo -NonIn…"   10 minutes ago      Up 10 minutes                           kubelete22b656e22e0        rancher/hyperkube:v1.15.4-rancher1   "pwsh -NoLogo -NonIn…"   10 minutes ago      Up 9 minutes                            kube-proxy5a2a773f85ed        rancher/rke-tools:v0.1.50            "pwsh -NoLogo -NonIn…"   17 minutes ago      Up 17 minutes                           service-sidekick603bf5a4f2bd        rancher/rancher-agent:v2.3.0         "pwsh -NoLogo -NonIn…"   24 minutes ago      Up 24 minutes                           gifted_poincare

Outputs:
lets-encrypt-email = jason@vanbrackel.netlets-encrypt-environment = productionrancher-admin-password = {REDACTED}rancher-domain-name = https://jvb-win-hybrid.eastus2.cloudapp.azure.com/windows-admin-password = {REDACTED}

> kubectl get nodesNAME           STATUS   ROLES          AGE     VERSIONcontrol-0-vm   Ready    controlplane   16m     v1.15.4etcd-0-vm      Ready    etcd           16m     v1.15.4win-0-vm       Ready    worker         5m52s   v1.15.4worker-0-vm    Ready    worker         12m     v1.15.4> kubectl describe node worker-0-vmName:               worker-0-vmRoles:              workerLabels:             beta.kubernetes.io/arch=amd64                    beta.kubernetes.io/os=linux                    kubernetes.io/arch=amd64                    kubernetes.io/hostname=worker-0-vm                    kubernetes.io/os=linux                    node-role.kubernetes.io/worker=true...> kubectl describe node win-0-vmName:               win-0-vmRoles:              workerLabels:             beta.kubernetes.io/arch=amd64                    beta.kubernetes.io/os=windows                    kubernetes.io/arch=amd64                    kubernetes.io/hostname=win-0-vm                    kubernetes.io/os=windows