opentofu 설치

“온프레미스 Kubernetes 환경에서
Okta(IdP) + QueryPie(PAM)를 Terraform으로 구축·연동하고
운영 접근을 코드로 관리하는 프로젝트”

[ Terraform ]
     |
     |── Okta Provider
     |     ├─ User / Group
     |     ├─ App (OIDC)
     |
     |── QueryPie (API / 가정)
     |     ├─ Role
     |     ├─ Account
     |
     └── Kubernetes
           ├─ ServiceAccount
           ├─ RBAC
           └─ 접근 연동 (개념)

 

 

구축 대상 클러스터

[root@k8s-master ~]# k get no -o wide
NAME         STATUS   ROLES           AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                      KERNEL-VERSION                 CONTAINER-RUNTIME
k8s-master   Ready    control-plane   73d   v1.32.9   10.0.2.15     <none>        Rocky Linux 9.6 (Blue Onyx)   5.14.0-570.17.1.el9_6.x86_64   cri-o://1.30.14
k8s-node01   Ready    <none>          73d   v1.32.9   10.0.2.16     <none>        Rocky Linux 9.6 (Blue Onyx)   5.14.0-570.17.1.el9_6.x86_64   cri-o://1.30.14
k8s-node02   Ready    <none>          73d   v1.32.9   10.0.2.17     <none>        Rocky Linux 9.6 (Blue Onyx)   5.14.0-570.17.1.el9_6.x86_64   cri-o://1.30.14

 

 

terraform 설치

k8s-master 노드에서 아래와 같이 설치 진행(repo 문제로 바로 안되었으나 GPT에게 물어 간단히 해결됨)

dnf install -y dnf-plugins-core
dnf config-manager --add-repo https://packages.opentofu.org/opentofu.repo
dnf install -y opentofu

 

아래와 같이 설치 확인됨

[root@k8s-master ~]# tofu version
OpenTofu v1.10.3
on linux_amd64

 

 

디렉토리 생성

mkdir -p ~/terraform-access-control
cd ~/terraform-access-control

 

 

terraform 기본 파일 생성

생성한 디렉토리에 아래와 같이 기본 파일을 생성 후 tofu 명령어가 실행 가능한 지 확인하자

 

# versions.tf

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    okta = {
      source  = "okta/okta"
      version = "~> 4.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.30"
    }
  }
}

 

# providers.tf

provider "okta" {
  org_name  = "dummy"
  base_url = "okta.com"
  api_token = "dummy"
}

provider "kubernetes" {
  config_path = "~/.kube/config"
}

 

# variables.tf

variable "environment" {
  description = "environment name"
  type        = string
  default     = "lab"
}

 

# main.tf

# Phase 1: intentionally empty

 

 

실행 확인

[root@k8s-master terraform-access-control]# tofu init

Initializing the backend...

Initializing provider plugins...
- Finding okta/okta versions matching "~> 4.0"...
- Finding hashicorp/kubernetes versions matching "~> 2.30"...
- Installing okta/okta v4.20.0...
- Installed okta/okta v4.20.0. Signature validation was skipped due to the registry not containing GPG keys for this provider
- Installing hashicorp/kubernetes v2.38.0...
- Installed hashicorp/kubernetes v2.38.0 (signed, key ID 0C0AF313E5FD9F80)

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that OpenTofu can guarantee to make the same selections by default when
you run "tofu init" in the future.

OpenTofu has been successfully initialized!

You may now begin working with OpenTofu. Try running "tofu plan" to see
any changes that are required for your infrastructure. All OpenTofu commands
should now work.

If you ever set or change modules or backend configuration for OpenTofu,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

[root@k8s-master terraform-access-control]# tofu plan

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and found no differences, so no changes are needed.