cos-generic-metadata

Generic cloud-init generator for Container Optimized OS

This helper module manages a cloud-config configuration that can start a container on Container Optimized OS (COS). Either a complete cloud-config template can be provided via the cloud_config variable with optional template variables via the config_variables, or a generic cloud-config can be generated based on typical parameters needed to start a container.

The module renders the generated cloud config in the cloud_config output, which can be directly used in instances or instance templates via the user-data metadata attribute.

Examples

Default configuration

This example will create a cloud-config that starts Envoy Proxy and expose it on port 80. For a complete example, look at the sibling envoy-traffic-director module that uses this module to start Envoy Proxy and connect it to Traffic Director.

module "cos-envoy" {
  source          = "./fabric/modules/cloud-config-container/cos-generic-metadata"
  container_image = "envoyproxy/envoy:v1.14.1"
  container_name  = "envoy"
  container_args  = "-c /etc/envoy/envoy.yaml --log-level info --allow-unknown-static-fields"
  container_volumes = [
    { host = "/etc/envoy/envoy.yaml", container = "/etc/envoy/envoy.yaml" }
  ]
  docker_args = "--network host --pid host"
  # file paths are mocked to run this example in tests
  files = {
    "/var/run/envoy/customize.sh" = {
      content     = file("/dev/null") # file("customize.sh")
      owner       = "root"
      permissions = "0744"
    }
    "/etc/envoy/envoy.yaml" = {
      content     = file("/dev/null") # file("envoy.yaml")
      owner       = "root"
      permissions = "0644"
    }
  }
  run_commands = [
    "iptables -t nat -N ENVOY_IN_REDIRECT",
    "iptables -t nat -A ENVOY_IN_REDIRECT -p tcp -j REDIRECT --to-port 15001",
    "iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j ENVOY_IN_REDIRECT",
    "iptables -t filter -A INPUT -p tcp -m tcp --dport 15001 -m state --state NEW,ESTABLISHED -j ACCEPT",
    "/var/run/envoy/customize.sh",
    "systemctl daemon-reload",
    "systemctl start envoy",
  ]
  users = [{
    username = "envoy",
    uid      = 1337
  }]
}

# tftest modules=0 resources=0

Variables

name	description	type	required	default
container_image	Container image.	string	✓
authenticate_gcr	Setup docker to pull images from private GCR. Requires at least one user since the token is stored in the home of the first user defined.	bool		false
boot_commands	List of cloud-init bootcmds.	list(string)		[]
cloud_config	Cloud config template path. If provided, takes precedence over all other arguments.	string		null
config_variables	Additional variables used to render the template passed via cloud_config.	map(any)		{}
container_args	Arguments for container.	string		""
container_name	Name of the container to be run.	string		"container"
container_volumes	List of volumes.	list(object({…}))		[]
docker_args	Extra arguments to be passed for docker.	string		null
file_defaults	Default owner and permissions for files.	object({…})		{…}
files	Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null.	map(object({…}))		{}
run_as_first_user	Run as the first user if users are specified.	bool		true
run_commands	List of cloud-init runcmds.	list(string)		[]
users	List of usernames to be created. If provided, first user will be used to run the container.	list(object({…}))		[…]

Outputs

name	description	sensitive
cloud_config	Rendered cloud-config file to be passed as user-data instance metadata.