Docs

Volcengine Kubernetes Engine

Terraform

Creating VKE clusters without ECS nodes by using Terraform

This topic describes how to use Terraform to create a VKE cluster that does not contain ECS nodes.

Preparations

Before using Terraform to create a cluster without ECS nodes, follow the steps to install Terraform.

Download and install the desired version from the official Terraform website. For details, see the Terraform documentation.

warning

Ensure that the Terraform version is not earlier than v0.13. You can run the terraform version command to query the version information.

Provide Volcano Engine root user information in Terraform.

Create environment variables to store authentication credentials.

export VOLCENGINE_ACCESS_KEY="AK************"
export VOLCENGINE_SECRET_KEY="************"
export VOLCENGINE_REGION="cn-beijing"

The following table describes the parameters.

Parameters	Description
VOLCENGINE_ACCESS_KEY	The AccessKey ID (AK) of your Volcano Engine root user. For instructions on obtaining the AK, see Access key.
VOLCENGINE_SECRET_KEY	The Secret Access Key (SK) of your Volcano Engine root user. For instructions on obtaining the AK, see Access key.
VOLCENGINE_REGION	The region where the VKE cluster is located. For the regions supported by VKE and their region IDs, see Regions and availability zones.

Specify the provider section of the configuration file to provide authentication information.

provider "volcengine" {
access_key = "AK************"
secret_key = "************"
session_token = "sts token"
region = "cn-beijing"
}

The following table describes the parameters.

Parameters	Description
access_key	The AK of your Volcano Engine root user. For instructions on obtaining the AK, see Access key.
secret_key	The SK of your Volcano Engine root user. For instructions on obtaining the AK, see Access key.
session_token	(Optional) The security token for role assumption, which can be obtained by calling the AssumeRole API.
region	The region where the VKE cluster is located. Specify the same value as the value of the VOLCENGINE_REGION parameter configured in the previous step.

Creating a cluster without ECS nodes

Create a folder and place a configuration file named main.tf in it.

terraform {
required_providers {
volcengine = {
source = "volcengine/volcengine"
version = "0.0.140" # Query available versions from the official Terraform website (https://registry.terraform.io/providers/volcengine/volcengine/latest).
}
}
}

provider "volcengine" {
access_key = "**********" # The access key ID of the Volcano Engine root user.
secret_key = "**********" # The secret access key of the Volcano Engine root user.
region = "cn-beijing" # The region where the VKE cluster is located.
}

# Create a VPC.
resource "volcengine_vpc" "vke-tf-vpc" {
vpc_name = "vke-tf-vpc" # The name of the VPC.
cidr_block = "172.16.0.0/16" # VPC subnet CIDR block.
}

# Create a Virtual Switch (VSW).
resource "volcengine_subnet" "vke-tf-vsw" {
subnet_name = "vke-tf-vsw-1" # VSW subnet name.
cidr_block = "172.16.0.0/24" # VSW subnet CIDR block.
zone_id = "cn-beijing-a" # VSW availability zone.
vpc_id = volcengine_vpc.vke-tf-vpc.id # The ID of the VPC to which the VSW belongs.
}

# Create a VKE cluster.
resource "volcengine_vke_cluster" "vke-tf-test" {
name = "tf-created-vke-serverless" # Cluster name.
kubernetes_version = "1.26" # The Kubernetes version of the cluster. Currently, only the x.y version form is supported. The x.y.z version form is not supported.
# For Kubernetes versions supported by VKE, visit https://www.volcengine.com/docs/6460/108841.
description = "vke-serverless created by tf" # Cluster description.
delete_protection_enabled = true # Cluster deletion protection. The value true enables the feature. The value false disables the feature.
cluster_config {
subnet_ids = [volcengine_subnet.vke-tf-vsw.id] # Cluster subnet ID.
api_server_public_access_enabled = true # Whether to enable public access to API Server. The value true enables the feature. The value false disables the feature.
# Configure the billing mode and bandwidth for the EIP of API Server.
api_server_public_access_config {
public_access_network_config {
billing_type = "PostPaidByTraffic" # EIP billing mode. PostPaidByTraffic indicates Pay-as-you-go - Billing by actual traffic. PostPaidByBandwidth indicates Pay-as-you-go - Billing by bandwidth cap.
bandwidth = 10 # EIP bandwidth peak. For the PostPaidByTraffic billing mode, the value range is 1 to 200. For the PostPaidByBandwidth billing mode, the value range is 1 to 500.
}
}
resource_public_access_default_enabled = true # Enable public network access. The value true enables the feature. The value false disables the feature.
}
pods_config {
pod_network_mode = "VpcCniShared" # Container network model. VpcCniShared indicates the VPC-CNI network model. Flannel indicates the Flannel network model.
# When the network model is Flannel, flannel_config takes effect.
flannel_config {
pod_cidrs = ["192.168.0.0/20"] # Pod CIDR for Flannel pod networking.
max_pods_per_node = 64 # Maximum number of pod instances per node for Flannel pod networking. Valid values are 64, 16, 32, 128, and 256.
}
# When the network model is VpcCniShared, vpc_cni_config takes effect.
vpc_cni_config {
subnet_ids = [volcengine_subnet.vke-tf-vsw.id] # The ID of the pod subnet in VPC-CNI pod networking.
}
}
# Configure the cluster service CIDR.
services_config {
service_cidrsv4 = ["192.168.16.0/24"] # CIDR used by services within the cluster.
}
}

resource "volcengine_vke_addon" "fo1" {
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the vci-virtual-kubelet add-on (required).
name = "vci-virtual-kubelet"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo2" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the core-dns add-on (required).
name = "core-dns"
deploy_node_type = "VirtualNode"

}

resource "volcengine_vke_addon" "fo3" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the metrics-server add-on (required).
name = "metrics-server"
deploy_node_type = "VirtualNode"

}

resource "volcengine_vke_addon" "fo4" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the csi-ebs add-on.
name = "csi-ebs"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo5" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the csi-nas add-on.
name = "csi-nas"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo6" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the snapshot-controller add-on.
name = "snapshot-controller"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo7" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the apig-controller add-on.
name = "apig-controller"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo8" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the application-inspector add-on.
name = "application-inspector"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo9" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the application-inspector add-on.
name = "application-inspector"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo10" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the cronhpa add-on.
name = "cronhpa"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo11" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the image-accelerator add-on.
name = "image-accelerator"
deploy_node_type = "VirtualNode"
}

resource "volcengine_vke_addon" "fo12" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the prometheus-agent add-on.
name = "prometheus-agent"
deploy_node_type = "VirtualNode"
config = "{\"NodeExporterDisabled\":false,\"AutoScalingEnabled\":false,\"VmAgent\":{\"InitShards\":1,\"Requests\":{\"Cpu\":\"2\",\"Memory\":\"2Gi\"},\"Limits\":{\"Cpu\":\"4\",\"Memory\":\"4Gi\"}},\"KubeStateMetrics\":{\"InitShards\":1,\"Requests\":{\"Cpu\":\"0.2\",\"Memory\":\"512Mi\"},\"Limits\":{\"Cpu\":\"0.8\",\"Memory\":\"2Gi\"}}}"
}

resource "volcengine_vke_addon" "fo13" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the cr-credential-controller add-on.
name = "cr-credential-controller"
deploy_node_type = "VirtualNode"
deploy_mode = "Unmanaged"
config = "{\"CrConfigmapData\":{\"Namespace\":\"*\",\"ServiceAccount\":\"*\",\"Registries\":[{\"Instance\":\"helm-cr\",\"Region\":\"cn-beijing\"}]}}"
}

resource "volcengine_vke_addon" "fo14" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the event-collector add-on.
name = "event-collector"
deploy_node_type = "VirtualNode"
config = "{\"TopicId\":\"f48b51d8-a6f7-4c26-b2ae-c1de96******\",\"ProjectId\":\"145749e8-b46d-424e-8c8a-a7d401******\",\"AccessKeyId\":\"AK***********\",\"AccessKeySecret\":\"******************==\"}"
deploy_mode = "Unmanaged"
}

resource "volcengine_vke_addon" "fo15" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the ingress-nginx add-on.
name = "ingress-nginx"
deploy_node_type = "VirtualNode"
config = "{\"Replicas\":2,\"Resources\":{\"Requests\":{\"Cpu\":\"0.1\",\"Memory\":\"250Mi\"},\"Limits\":{\"Cpu\":\"0.5\",\"Memory\":\"1024Mi\"}},\"PrivateNetwork\":{\"SubnetId\":\"subnet-rrfr1oopsg00v0x57******\",\"IpFamily\":\"ipv4\"}}"
deploy_mode = "Unmanaged"
}

resource "volcengine_vke_addon" "fo16" {
depends_on = [volcengine_vke_addon.fo1]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the load-balancer-controller add-on.
name = "load-balancer-controller"
deploy_node_type = "VirtualNode"
config = "{\"IsSharedMode\":false,\"Resources\":{\"Requests\":{\"Cpu\":\"0.25\",\"Memory\":\"128Mi\"},\"Limits\":{\"Cpu\":\"1\",\"Memory\":\"512Mi\"}},\"PlbConfig\":{\"Enabled\":true,\"AccessKeyId\":\"AK************\",\"AccessKeySecret\":\"************==\",\"ServiceId\":\"syssrv-111\"},\"ClbConfig\":{\"Enabled\":false}}"
deploy_mode = "Unmanaged"
}

resource "volcengine_vke_addon" "fo17" {
depends_on = [volcengine_vke_addon.fo1, volcengine_vke_addon.fo5]
cluster_id = volcengine_vke_cluster.vke-tf-test.id
# Install the p2p-accelerator add-on. Ensure that P2P acceleration is enabled for the associated Container Registry instance.
name = "p2p-accelerator"
deploy_node_type = "VirtualNode"
config = "{\"Region\":\"cn-beijing\",\"VpcId\":\"vpc-min4y8zya1a******\",\"Registry\":\"helm-cr\",\"NydusEnabled\":false,\"DaemonProxyReplicas\":3,\"AccessKeyId\":\"AK************\",\"AccessKeySecret\":\"************==\",\"DeployNodeType\":\"VirtualNode\"}"
deploy_mode = "Unmanaged"
}

tip

Except the required add-ons indicated by the comments, other add-ons can be installed as needed. For details of add-on parameters, see Installing add-ons and CreateAddon.

If an add-on fails to install or encounters an exception, submit a ticket to obtain technical support.

Initialize the Terraform environment.

terraform init

The expected result is as follows.

Initializing the backend...

Initializing provider plugins...
- Finding volcengine/volcengine versions matching "0.0.140"...
- Installing volcengine/volcengine v0.0.140...

...

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Perform resource planning.

terraform plan

The expected result is as follows.

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create

Terraform will perform the following actions:

...

Plan: 3 to add, 0 to change, 0 to destroy.

Create a cluster.

terraform apply

The expected result is as follows.

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
+ create

Terraform will perform the following actions:

# volcengine_vke_cluster.foo will be created
+ resource "volcengine_vke_cluster" "foo" {
+ delete_protection_enabled = false
+ description = "created by terraform"
+ eip_allocation_id = (known after apply)
+ id = (known after apply)
+ kubeconfig_private = (known after apply)
+ kubeconfig_public = (known after apply)
+ kubernetes_version = (known after apply)
+ name = "tf-created-vke-serverless"

+ cluster_config {
+ api_server_public_access_enabled = true
+ ip_family = (known after apply)
+ resource_public_access_default_enabled = true
+ subnet_ids = [
+ "subnet-13fxz9n6n********",
+ "subnet-mis6wmt********",
]

+ api_server_public_access_config {
+ public_access_network_config {
+ bandwidth = 1
+ billing_type = "PostPaidByBandwidth"
}
}
}

+ pods_config {
+ pod_network_mode = "VpcCniShared"

+ vpc_cni_config {
+ subnet_ids = [
+ "subnet-13fxz9qbltgcg3n6n********",
+ "subnet-mis6wd60ohz45smt********",
]
}
}

+ services_config {
+ service_cidrsv4 = [
+ "172.30.0.0/18",
]
}

+ tags {
+ key = "tf-k1"
+ value = "tf-v1"
}
}

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.

Enter a value: yes

volcengine_vke_cluster.foo: Creating...
volcengine_vke_cluster.foo: Still creating... [10s elapsed]
volcengine_vke_cluster.foo: Still creating... [20s elapsed]
volcengine_vke_cluster.foo: Still creating... [30s elapsed]
volcengine_vke_cluster.foo: Still creating... [40s elapsed]
volcengine_vke_cluster.foo: Still creating... [50s elapsed]
volcengine_vke_cluster.foo: Still creating... [1m0s elapsed]
volcengine_vke_cluster.foo: Still creating... [1m10s elapsed]
volcengine_vke_cluster.foo: Still creating... [1m20s elapsed]
volcengine_vke_cluster.foo: Still creating... [1m30s elapsed]
volcengine_vke_cluster.foo: Still creating... [1m40s elapsed]
volcengine_vke_cluster.foo: Still creating... [1m50s elapsed]
volcengine_vke_cluster.foo: Still creating... [2m0s elapsed]
volcengine_vke_cluster.foo: Still creating... [2m10s elapsed]
volcengine_vke_cluster.foo: Still creating... [2m20s elapsed]
volcengine_vke_cluster.foo: Still creating... [2m30s elapsed]
volcengine_vke_cluster.foo: Still creating... [2m40s elapsed]
volcengine_vke_cluster.foo: Still creating... [2m50s elapsed]
volcengine_vke_cluster.foo: Still creating... [3m0s elapsed]
volcengine_vke_cluster.foo: Still creating... [3m10s elapsed]
volcengine_vke_cluster.foo: Still creating... [3m20s elapsed]
volcengine_vke_cluster.foo: Still creating... [3m30s elapsed]
volcengine_vke_cluster.foo: Still creating... [3m40s elapsed]
volcengine_vke_cluster.foo: Still creating... [3m50s elapsed]
volcengine_vke_cluster.foo: Still creating... [4m0s elapsed]
volcengine_vke_cluster.foo: Still creating... [4m10s elapsed]
volcengine_vke_cluster.foo: Still creating... [4m20s elapsed]
volcengine_vke_cluster.foo: Still creating... [4m30s elapsed]
volcengine_vke_cluster.foo: Still creating... [4m40s elapsed]
volcengine_vke_cluster.foo: Still creating... [4m50s elapsed]
volcengine_vke_cluster.foo: Still creating... [5m0s elapsed]
volcengine_vke_cluster.foo: Still creating... [5m10s elapsed]
volcengine_vke_cluster.foo: Still creating... [5m20s elapsed]
volcengine_vke_cluster.foo: Still creating... [5m30s elapsed]
volcengine_vke_cluster.foo: Still creating... [5m40s elapsed]
volcengine_vke_cluster.foo: Creation complete after 5m49s [id=ccnisgn536u6sdg******]

Last updated: 2026.06.16 16:17:49