Terraform入門教程，示例展示管理Docker和Kubernetes資源

我最新最全的文章都在 南瓜慢說 www.pkslow.com ，歡迎大家來喝茶！

1 簡介

最近工作中用到了Terraform，權當學習記錄一下，希望能幫助到其它人。

Terraform系列文章如下：

Terraform入門教程，示例展示管理Docker和Kubernetes資源

Terraform插件Provider管理，搜索、定義、下載

Terraform狀態State管理，讓變更有記錄

Terraform模塊Module管理，聚合資源的抽取與復用

Terraform常用命令

Terraform是一個可快速部署、方便管理IT基礎架構配置的工具，它的理念是Infrastructure as Code，一切資源都是代碼。如虛擬機、網絡、DNS等，這些都通過代碼來管理部署，而不是人工手動的去創建、刪除等。它能大大減少人為操作的風險，能快速部署多套環境，適應多種硬件資源，特別適合雲環境：AWS、GCP、Azure、阿里雲等。

它通過豐富的Providers來管理多種類型的資源，就像是插件一樣，如GCP、Docker、Kubernetes等。

本文將通過演示講解如何部署Docker/Kubernetes資源。

2 安裝

到官方下載界面對應的二進制文件，我通過命令操作，我選擇的是Mac的版本：

# 創建目錄
$ mkdir terraform
$ cd terraform/
# 下載安裝包
$ wget https://releases.hashicorp.com/terraform/0.15.4/terraform_0.15.4_darwin_amd64.zip
# 解壓
$ unzip terraform_0.15.4_darwin_amd64.zip
# 查看版本，顯示安裝成功
$ ./terraform --version
Terraform v0.15.4
on darwin_amd64

成功顯示了版本，我們把它添加到環境變量中去即可。

3 部署Docker資源

創建個目錄：

$ mkdir terraform-docker-demo && cd $_

創建一個main.tf文件，寫入以下內容：

terraform {
  required_providers {
    docker = {
      source = "kreuzwerker/docker"
    }
  }
}

provider "docker" {}

resource "docker_image" "nginx" {
  name         = "nginx:latest"
  keep_locally = false
}

resource "docker_container" "nginx" {
  image = docker_image.nginx.latest
  name  = "tutorial"
  ports {
    internal = 80
    external = 8000
  }
}

根據main.tf初始化項目：

$ terraform init

Initializing the backend...

Initializing provider plugins...
- Finding latest version of kreuzwerker/docker...
- Installing kreuzwerker/docker v2.12.2...
- Installed kreuzwerker/docker v2.12.2 (self-signed, key ID 24E54F214569A8A5)

Partner and community providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://www.terraform.io/docs/cli/plugins/signing.html

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

我們先執行plan來看看它將會有什么變更：

$ terraform plan

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # docker_container.nginx will be created
  + resource "docker_container" "nginx" {
      + attach           = false
      + bridge           = (known after apply)
      + command          = (known after apply)
      + container_logs   = (known after apply)
      + entrypoint       = (known after apply)
      + env              = (known after apply)
      + exit_code        = (known after apply)
      + gateway          = (known after apply)
      + hostname         = (known after apply)
      + id               = (known after apply)
      + image            = (known after apply)
      + init             = (known after apply)
      + ip_address       = (known after apply)
      + ip_prefix_length = (known after apply)
      + ipc_mode         = (known after apply)
      + log_driver       = "json-file"
      + logs             = false
      + must_run         = true
      + name             = "tutorial"
      + network_data     = (known after apply)
      + read_only        = false
      + remove_volumes   = true
      + restart          = "no"
      + rm               = false
      + security_opts    = (known after apply)
      + shm_size         = (known after apply)
      + start            = true
      + stdin_open       = false
      + tty              = false

      + healthcheck {
          + interval     = (known after apply)
          + retries      = (known after apply)
          + start_period = (known after apply)
          + test         = (known after apply)
          + timeout      = (known after apply)
        }

      + labels {
          + label = (known after apply)
          + value = (known after apply)
        }

      + ports {
          + external = 8000
          + internal = 80
          + ip       = "0.0.0.0"
          + protocol = "tcp"
        }
    }

  # docker_image.nginx will be created
  + resource "docker_image" "nginx" {
      + id           = (known after apply)
      + keep_locally = false
      + latest       = (known after apply)
      + name         = "nginx:latest"
      + output       = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.

執行變更：

$ terraform apply
docker_image.nginx: Creating...
docker_image.nginx: Still creating... [10s elapsed]
docker_image.nginx: Still creating... [20s elapsed]
docker_image.nginx: Creation complete after 28s [id=sha256:d1a364dc548d5357f0da3268c888e1971bbdb957ee3f028fe7194f1d61c6fdeenginx:latest]
docker_container.nginx: Creating...
docker_container.nginx: Creation complete after 1s [id=0dac86e383366959bd976cc843c88395a17c5734d729f62f07106caf604b466f]

它自動幫我們下載了鏡像和啟動了容器。通過以下命令查看nginx的主頁：

$ curl http://localhost:8000

現在我不想要這些資源了，通過以下命令刪除：

$ terraform destroy
docker_container.nginx: Destroying... [id=0dac86e383366959bd976cc843c88395a17c5734d729f62f07106caf604b466f]
docker_container.nginx: Destruction complete after 0s
docker_image.nginx: Destroying... [id=sha256:d1a364dc548d5357f0da3268c888e1971bbdb957ee3f028fe7194f1d61c6fdeenginx:latest]
docker_image.nginx: Destruction complete after 1s

4 部署Kubernetes資源

創建目錄：

$ mkdir terraform-kubernetes-demo && cd $_

創建main.tf文件：

terraform {
  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = ">= 2.0.0"
    }
  }
}
provider "kubernetes" {
  config_path = "~/.kube/config"
}
resource "kubernetes_namespace" "test" {
  metadata {
    name = "nginx"
  }
}
resource "kubernetes_deployment" "test" {
  metadata {
    name      = "nginx"
    namespace = kubernetes_namespace.test.metadata.0.name
  }
  spec {
    replicas = 2
    selector {
      match_labels = {
        app = "MyTestApp"
      }
    }
    template {
      metadata {
        labels = {
          app = "MyTestApp"
        }
      }
      spec {
        container {
          image = "nginx"
          name  = "nginx-container"
          port {
            container_port = 80
          }
        }
      }
    }
  }
}
resource "kubernetes_service" "test" {
  metadata {
    name      = "nginx"
    namespace = kubernetes_namespace.test.metadata.0.name
  }
  spec {
    selector = {
      app = kubernetes_deployment.test.spec.0.template.0.metadata.0.labels.app
    }
    type = "NodePort"
    port {
      node_port   = 30201
      port        = 80
      target_port = 80
    }
  }
}

直接執行：

terraform init
terraform apply

檢查結果：

$ kubectl -n nginx get deployment
NAME    READY   UP-TO-DATE   AVAILABLE   AGE
nginx   2/2     2            2           2m

$ kubectl -n nginx get service
NAME    TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
nginx   NodePort   10.98.213.164   <none>        80:30201/TCP   71s

$ curl http://localhost:30201

測試完成，刪除：

terraform destroy

5 總結

Terraform在雲計算領域還是有自己的一席之地的，值得了解學習。

代碼請查看：https://github.com/LarryDpk/pkslow-samples

---

歡迎關注微信公眾號<南瓜慢說>，將持續為你更新...

多讀書，多分享；多寫作，多整理。