add bucket and private-cluster-module
This commit is contained in:
Aleksei Krugliak
parent
a77c2a72f2
commit
4f58bc6b17
|
|
@ -0,0 +1,81 @@
|
||||||
|
# bucket
|
||||||
|
|
||||||
|
You should be an admin/owner of your sandbox or have enougth permissions to create a bucket.
|
||||||
|
|
||||||
|
If you use a lot of accounts and specific IAM rules, you can check the permissions of the user with the following command:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
gcloud projects get-iam-policy <GCP_PROJECT> --format=json | jq '.bindings[] | select(.members[] | contains("user:<YOUR@gmail.com>"))'
|
||||||
|
```
|
||||||
|
|
||||||
|
`"role": "roles/owner"` would be great for you.
|
||||||
|
|
||||||
|
## How to use the code
|
||||||
|
|
||||||
|
1. Create `terraform.tfvars` file with a few variables
|
||||||
|
|
||||||
|
```shell
|
||||||
|
project = "your-gcp-project"
|
||||||
|
iam_user_email = "your@gmail.com"
|
||||||
|
```
|
||||||
|
|
||||||
|
`region` is optional.
|
||||||
|
|
||||||
|
2. Create bucket
|
||||||
|
|
||||||
|
All commands will be applied via Terraform 1.8.0 or via OpenTofu, the same version.
|
||||||
|
I use alias `t` for the commands.
|
||||||
|
|
||||||
|
```shell
|
||||||
|
t init
|
||||||
|
t apply
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Destrouy bucket sfter your tests
|
||||||
|
|
||||||
|
```shell
|
||||||
|
t destroy
|
||||||
|
```
|
||||||
|
|
||||||
|
<!-- BEGIN_TF_DOCS -->
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
| Name | Version |
|
||||||
|
|------|---------|
|
||||||
|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~>1.8.0 |
|
||||||
|
| <a name="requirement_google"></a> [google](#requirement\_google) | ~>5.41.0 |
|
||||||
|
|
||||||
|
## Providers
|
||||||
|
|
||||||
|
| Name | Version |
|
||||||
|
|------|---------|
|
||||||
|
| <a name="provider_google"></a> [google](#provider\_google) | 5.41.0 |
|
||||||
|
|
||||||
|
## Modules
|
||||||
|
|
||||||
|
| Name | Source | Version |
|
||||||
|
|------|--------|---------|
|
||||||
|
| <a name="module_bucket"></a> [bucket](#module\_bucket) | terraform-google-modules/cloud-storage/google//modules/simple_bucket | ~> 6.0 |
|
||||||
|
|
||||||
|
## Resources
|
||||||
|
|
||||||
|
| Name | Type |
|
||||||
|
|------|------|
|
||||||
|
| [google_client_config.default](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/client_config) | data source |
|
||||||
|
|
||||||
|
## Inputs
|
||||||
|
|
||||||
|
| Name | Description | Type | Default | Required |
|
||||||
|
|------|-------------|------|---------|:--------:|
|
||||||
|
| <a name="input_iam_user_email"></a> [iam\_user\_email](#input\_iam\_user\_email) | Your gcloud account | `string` | `"demo@gmail.com"` | no |
|
||||||
|
| <a name="input_project"></a> [project](#input\_project) | Google Project to create resources in | `string` | `"demo"` | no |
|
||||||
|
| <a name="input_region"></a> [region](#input\_region) | The region to host the cluster in | `string` | `"europe-west1"` | no |
|
||||||
|
|
||||||
|
## Outputs
|
||||||
|
|
||||||
|
| Name | Description |
|
||||||
|
|------|-------------|
|
||||||
|
| <a name="output_gcloud_bucket_link"></a> [gcloud\_bucket\_link](#output\_gcloud\_bucket\_link) | Bucket web ui link |
|
||||||
|
| <a name="output_project"></a> [project](#output\_project) | GCloud Project ID |
|
||||||
|
| <a name="output_region"></a> [region](#output\_region) | GCloud Region |
|
||||||
|
<!-- END_TF_DOCS -->
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
module "bucket" {
|
||||||
|
# https://registry.terraform.io/modules/terraform-google-modules/cloud-storage/google/6.0.1/submodules/simple_bucket?tab=inputs
|
||||||
|
source = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
|
||||||
|
version = "~> 6.0"
|
||||||
|
|
||||||
|
name = "${var.project}-bucket"
|
||||||
|
project_id = var.project
|
||||||
|
location = "eu"
|
||||||
|
|
||||||
|
force_destroy = true # Use this only for testing purposes
|
||||||
|
|
||||||
|
iam_members = [{
|
||||||
|
role = "roles/storage.objectAdmin"
|
||||||
|
member = "user:${var.iam_user_email}"
|
||||||
|
}]
|
||||||
|
|
||||||
|
autoclass = true
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
output "region" {
|
||||||
|
description = "GCloud Region"
|
||||||
|
value = var.region
|
||||||
|
}
|
||||||
|
|
||||||
|
output "project" {
|
||||||
|
description = "GCloud Project ID"
|
||||||
|
value = var.project
|
||||||
|
}
|
||||||
|
|
||||||
|
output "gcloud_bucket_link" {
|
||||||
|
description = "Bucket web ui link"
|
||||||
|
value = "https://console.cloud.google.com/storage/browser/${module.bucket.name};tab=objects?forceOnBucketsSortingFiltering=true&project=${var.project}&prefix=&forceOnObjectsSortingFiltering=false"
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
data "google_client_config" "default" {}
|
||||||
|
|
||||||
|
provider "google" {
|
||||||
|
project = var.project
|
||||||
|
region = var.region
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
variable "project" {
|
||||||
|
type = string
|
||||||
|
description = "Google Project to create resources in"
|
||||||
|
default = "demo"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "region" {
|
||||||
|
type = string
|
||||||
|
description = "The region to host the cluster in"
|
||||||
|
default = "europe-west1"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "iam_user_email" {
|
||||||
|
type = string
|
||||||
|
description = "Your gcloud account"
|
||||||
|
default = "demo@gmail.com"
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
terraform {
|
||||||
|
required_version = "~>1.8.0"
|
||||||
|
|
||||||
|
required_providers {
|
||||||
|
# https://github.com/hashicorp/terraform-provider-google
|
||||||
|
google = {
|
||||||
|
source = "hashicorp/google"
|
||||||
|
version = "~>5.41.0"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,160 @@
|
||||||
|
# private-cluster-module
|
||||||
|
|
||||||
|
## What is created ty thah template
|
||||||
|
|
||||||
|
This example is using remote bucket state. You can modify this manually or not.
|
||||||
|
|
||||||
|
1. VPC network with one subnet
|
||||||
|
2. GKE cluster with external endpoint and only authorized networks access.
|
||||||
|
3. Workload nodepool with one node
|
||||||
|
3. Namespace `this-is-demo-cluster`
|
||||||
|
|
||||||
|
## How to use the code
|
||||||
|
|
||||||
|
### Optional bucket usage.
|
||||||
|
If you would try to use bucket state, you need to uncomment code block in [backend.tf](backend.tf).
|
||||||
|
|
||||||
|
Then go to [../bucket](../bucket/) directory and create the bucket by following the instructions at [README](../bucket/README.md).
|
||||||
|
|
||||||
|
Then return to this directory.
|
||||||
|
|
||||||
|
1. Create `terraform.tfvars` file with a few variables
|
||||||
|
|
||||||
|
```shell
|
||||||
|
project = "your-gcp-project"
|
||||||
|
host_project = "your-gcp-project"
|
||||||
|
|
||||||
|
master_authorized_networks = [
|
||||||
|
{ cidr_block = "0.0.0.1/32", display_name = "your current IP" }
|
||||||
|
]
|
||||||
|
```
|
||||||
|
|
||||||
|
`region`, `zone` and `environment_name` are optional
|
||||||
|
|
||||||
|
Your current IP you can get via this command for example:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
curl -s ifconfig.me
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Create cluster
|
||||||
|
All commands will be applied via Terraform 1.8.0 or via OpenTofu, the same version.
|
||||||
|
I use alias `t` for the commands.
|
||||||
|
|
||||||
|
```shell
|
||||||
|
t init
|
||||||
|
t apply
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Get the credentials for the new cluster (configure kubeconfig)
|
||||||
|
|
||||||
|
You can see all useful commands and links in the output:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
t output
|
||||||
|
```
|
||||||
|
|
||||||
|
There is a manual command:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
gcloud container clusters get-credentials $(t output -raw kubernetes_cluster_name) --region $(t output -raw zone) --project $(t output -raw project)
|
||||||
|
```
|
||||||
|
|
||||||
|
Or just use `./get-credentials.sh`
|
||||||
|
|
||||||
|
4. Destroy all resources
|
||||||
|
|
||||||
|
```shell
|
||||||
|
t destroy
|
||||||
|
```
|
||||||
|
|
||||||
|
## Additional info
|
||||||
|
|
||||||
|
Some manual tests.
|
||||||
|
|
||||||
|
### terraform
|
||||||
|
✅ create cluster<br>
|
||||||
|
✅ `./get-credentials.sh`<br>
|
||||||
|
✅ try access from different networks<br>
|
||||||
|
✅ manual cred command<br>
|
||||||
|
✅ output `gcloud_gke_get_creds` command<br>
|
||||||
|
✅ output links<br>
|
||||||
|
✅ create simple nginx pod `kubectl run nginx --image=nginx:latest -n default && kubectl get po -w`<br>
|
||||||
|
✅ `flux install && kubectl get po -n flux-system -w`<br>
|
||||||
|
✅ destroy cluster<br>
|
||||||
|
✅ test bucket backend
|
||||||
|
|
||||||
|
### opentofu
|
||||||
|
✅ create cluster<br>
|
||||||
|
✅ `./get-credentials.sh`<br>
|
||||||
|
✅ try access from different networks<br>
|
||||||
|
✅ manual cred command<br>
|
||||||
|
✅ output `gcloud_gke_get_creds` command<br>
|
||||||
|
✅ output links<br>
|
||||||
|
✅ create simple nginx pod `kubectl run nginx --image=nginx:latest -n default && kubectl get po -w`<br>
|
||||||
|
✅ `flux install && kubectl get po -n flux-system -w`<br>
|
||||||
|
✅ destroy cluster<br>
|
||||||
|
✅ test bucket backend
|
||||||
|
|
||||||
|
<!-- BEGIN_TF_DOCS -->
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
| Name | Version |
|
||||||
|
|------|---------|
|
||||||
|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | ~>1.8.0 |
|
||||||
|
| <a name="requirement_google"></a> [google](#requirement\_google) | ~>5.41.0 |
|
||||||
|
| <a name="requirement_google-beta"></a> [google-beta](#requirement\_google-beta) | ~> 5.41 |
|
||||||
|
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | ~>2.32.0 |
|
||||||
|
|
||||||
|
## Providers
|
||||||
|
|
||||||
|
| Name | Version |
|
||||||
|
|------|---------|
|
||||||
|
| <a name="provider_google"></a> [google](#provider\_google) | 5.41.0 |
|
||||||
|
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.32.0 |
|
||||||
|
|
||||||
|
## Modules
|
||||||
|
|
||||||
|
| Name | Source | Version |
|
||||||
|
|------|--------|---------|
|
||||||
|
| <a name="module_gke"></a> [gke](#module\_gke) | terraform-google-modules/kubernetes-engine/google//modules/beta-private-cluster-update-variant | 32.0.0 |
|
||||||
|
|
||||||
|
## Resources
|
||||||
|
|
||||||
|
| Name | Type |
|
||||||
|
|------|------|
|
||||||
|
| [google_compute_network.vpc](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_network) | resource |
|
||||||
|
| [google_compute_subnetwork.subnet](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_subnetwork) | resource |
|
||||||
|
| [google_project_service.service_networking](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_service) | resource |
|
||||||
|
| [kubernetes_namespace.this-is-demo-cluster](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
|
||||||
|
| [google_client_config.default](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/client_config) | data source |
|
||||||
|
|
||||||
|
## Inputs
|
||||||
|
|
||||||
|
| Name | Description | Type | Default | Required |
|
||||||
|
|------|-------------|------|---------|:--------:|
|
||||||
|
| <a name="input_bucket_credentials_json"></a> [bucket\_credentials\_json](#input\_bucket\_credentials\_json) | Default path to your gcloud credentials json file | `string` | `"~/.config/gcloud/application_default_credentials.json"` | no |
|
||||||
|
| <a name="input_bucket_name"></a> [bucket\_name](#input\_bucket\_name) | Bucket name | `string` | `"your-project-bucket"` | no |
|
||||||
|
| <a name="input_bucket_prefix"></a> [bucket\_prefix](#input\_bucket\_prefix) | Path to store your state in bucket | `string` | `"terraform/state/demo"` | no |
|
||||||
|
| <a name="input_environment_name"></a> [environment\_name](#input\_environment\_name) | Environment name | `string` | `"demo"` | no |
|
||||||
|
| <a name="input_host_project"></a> [host\_project](#input\_host\_project) | The GCP project housing the VPC network to host the cluster in | `string` | `"demo"` | no |
|
||||||
|
| <a name="input_master_authorized_networks"></a> [master\_authorized\_networks](#input\_master\_authorized\_networks) | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | `list(object({ cidr_block = string, display_name = string }))` | <pre>[<br> {<br> "cidr_block": "1.1.1.1/32",<br> "display_name": "Use your IP/VPN IP here"<br> }<br>]</pre> | no |
|
||||||
|
| <a name="input_project"></a> [project](#input\_project) | Google Project to create resources in | `string` | `"demo"` | no |
|
||||||
|
| <a name="input_region"></a> [region](#input\_region) | The region to host the cluster in | `string` | `"europe-west1"` | no |
|
||||||
|
| <a name="input_vpc_network"></a> [vpc\_network](#input\_vpc\_network) | The GCP network to apply firewall rules in | `string` | `"demo-vpc"` | no |
|
||||||
|
| <a name="input_zone"></a> [zone](#input\_zone) | The region to host the cluster in | `string` | `"europe-west1-b"` | no |
|
||||||
|
|
||||||
|
## Outputs
|
||||||
|
|
||||||
|
| Name | Description |
|
||||||
|
|------|-------------|
|
||||||
|
| <a name="output_gcloud_gke_get_creds"></a> [gcloud\_gke\_get\_creds](#output\_gcloud\_gke\_get\_creds) | Command to get GKE credentials |
|
||||||
|
| <a name="output_gcloud_gke_link"></a> [gcloud\_gke\_link](#output\_gcloud\_gke\_link) | GKE web ui link |
|
||||||
|
| <a name="output_gcloud_vpc_link"></a> [gcloud\_vpc\_link](#output\_gcloud\_vpc\_link) | VPC web ui link |
|
||||||
|
| <a name="output_kubernetes_cluster_host"></a> [kubernetes\_cluster\_host](#output\_kubernetes\_cluster\_host) | GKE Cluster Host |
|
||||||
|
| <a name="output_kubernetes_cluster_name"></a> [kubernetes\_cluster\_name](#output\_kubernetes\_cluster\_name) | GKE Cluster Name |
|
||||||
|
| <a name="output_master_authorized_networks_config"></a> [master\_authorized\_networks\_config](#output\_master\_authorized\_networks\_config) | Here are networks that are allowed to reach your k8s API |
|
||||||
|
| <a name="output_project"></a> [project](#output\_project) | GCloud Project ID |
|
||||||
|
| <a name="output_region"></a> [region](#output\_region) | GCloud Region |
|
||||||
|
| <a name="output_zone"></a> [zone](#output\_zone) | GCloud Project ID |
|
||||||
|
<!-- END_TF_DOCS -->
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
# Optionallly you can use bucket as backend
|
||||||
|
# If you would to do that - uncomment code below and follow instructions in README.md
|
||||||
|
|
||||||
|
terraform {
|
||||||
|
backend "gcs" {
|
||||||
|
bucket = var.bucket_name
|
||||||
|
prefix = var.bucket_prefix
|
||||||
|
credentials = var.bucket_credentials_json
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
resource "kubernetes_namespace" "this-is-demo-cluster" {
|
||||||
|
metadata {
|
||||||
|
name = "this-is-demo-cluster"
|
||||||
|
}
|
||||||
|
depends_on = [module.gke]
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if grep -H "opentofu.org" .terraform.lock.hcl > /dev/null; then
|
||||||
|
echo "trying to read tofu state"
|
||||||
|
gcloud container clusters get-credentials $(tofu output -raw kubernetes_cluster_name) --region $(tofu output -raw region) --project $(tofu output -raw project)
|
||||||
|
else
|
||||||
|
echo "trying to read terraform state"
|
||||||
|
gcloud container clusters get-credentials $(terraform output -raw kubernetes_cluster_name) --region $(terraform output -raw region) --project $(terraform output -raw project)
|
||||||
|
fi
|
||||||
|
|
@ -0,0 +1,73 @@
|
||||||
|
locals {
|
||||||
|
cluster_name = "${var.environment_name}-k8s-${var.region}"
|
||||||
|
}
|
||||||
|
|
||||||
|
module "gke" {
|
||||||
|
# https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/tree/master/modules/beta-private-cluster-update-variant
|
||||||
|
source = "terraform-google-modules/kubernetes-engine/google//modules/beta-private-cluster-update-variant"
|
||||||
|
version = "32.0.0"
|
||||||
|
project_id = var.project
|
||||||
|
network_project_id = var.host_project
|
||||||
|
name = local.cluster_name
|
||||||
|
region = var.region
|
||||||
|
zones = [var.zone]
|
||||||
|
network = google_compute_network.vpc.name
|
||||||
|
subnetwork = google_compute_subnetwork.subnet.name
|
||||||
|
ip_range_pods = "${var.project}-gke-pods"
|
||||||
|
ip_range_services = "${var.project}-gke-services"
|
||||||
|
http_load_balancing = true
|
||||||
|
horizontal_pod_autoscaling = true
|
||||||
|
enable_vertical_pod_autoscaling = true
|
||||||
|
network_policy = true
|
||||||
|
remove_default_node_pool = true
|
||||||
|
release_channel = "UNSPECIFIED"
|
||||||
|
create_service_account = false # means gsa, NOT k8s_sa
|
||||||
|
dns_cache = true
|
||||||
|
|
||||||
|
deletion_protection = false # Use this only for testing purposess!
|
||||||
|
|
||||||
|
maintenance_start_time = "2021-04-20T01:00:00Z"
|
||||||
|
maintenance_end_time = "2021-04-20T05:00:00Z"
|
||||||
|
maintenance_recurrence = "FREQ=WEEKLY;BYDAY=MO,TH,SU"
|
||||||
|
|
||||||
|
master_authorized_networks = var.master_authorized_networks
|
||||||
|
|
||||||
|
node_pools = [
|
||||||
|
{
|
||||||
|
name = "node-pool-1"
|
||||||
|
machine_type = "n2-standard-8"
|
||||||
|
min_count = 1
|
||||||
|
max_count = 2
|
||||||
|
disk_size_gb = 30
|
||||||
|
disk_type = "pd-standard"
|
||||||
|
image_type = "COS_CONTAINERD"
|
||||||
|
auto_repair = true
|
||||||
|
auto_upgrade = true
|
||||||
|
preemptible = true
|
||||||
|
initial_node_count = 1
|
||||||
|
node_metadata = "GKE_METADATA"
|
||||||
|
},
|
||||||
|
]
|
||||||
|
|
||||||
|
node_pools_oauth_scopes = {
|
||||||
|
all = [
|
||||||
|
"https://www.googleapis.com/auth/cloud-platform",
|
||||||
|
"https://www.googleapis.com/auth/compute",
|
||||||
|
"https://www.googleapis.com/auth/devstorage.read_only",
|
||||||
|
"https://www.googleapis.com/auth/logging.write",
|
||||||
|
"https://www.googleapis.com/auth/monitoring",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
node_pools_tags = {
|
||||||
|
all = [
|
||||||
|
"${local.cluster_name}-${var.region}",
|
||||||
|
"${local.cluster_name}-${var.region}-nodes"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
depends_on = [
|
||||||
|
google_compute_network.vpc,
|
||||||
|
google_compute_subnetwork.subnet
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
output "region" {
|
||||||
|
description = "GCloud Region"
|
||||||
|
value = var.region
|
||||||
|
}
|
||||||
|
|
||||||
|
output "project" {
|
||||||
|
description = "GCloud Project ID"
|
||||||
|
value = var.project
|
||||||
|
}
|
||||||
|
|
||||||
|
output "zone" {
|
||||||
|
description = "GCloud Project ID"
|
||||||
|
value = var.zone
|
||||||
|
}
|
||||||
|
|
||||||
|
output "kubernetes_cluster_name" {
|
||||||
|
description = "GKE Cluster Name"
|
||||||
|
value = module.gke.name
|
||||||
|
}
|
||||||
|
|
||||||
|
output "kubernetes_cluster_host" {
|
||||||
|
description = "GKE Cluster Host"
|
||||||
|
sensitive = true
|
||||||
|
value = module.gke.endpoint
|
||||||
|
}
|
||||||
|
|
||||||
|
output "gcloud_gke_get_creds" {
|
||||||
|
description = "Command to get GKE credentials"
|
||||||
|
value = "gcloud container clusters get-credentials ${local.cluster_name} --region ${var.region} --project ${var.project}"
|
||||||
|
}
|
||||||
|
|
||||||
|
output "gcloud_vpc_link" {
|
||||||
|
description = "VPC web ui link"
|
||||||
|
value = "https://console.cloud.google.com/networking/networks/list?project=${var.project}"
|
||||||
|
}
|
||||||
|
|
||||||
|
output "gcloud_gke_link" {
|
||||||
|
description = "GKE web ui link"
|
||||||
|
value = "https://console.cloud.google.com/kubernetes/clusters/details/${var.region}/${local.cluster_name}/details?project=${var.project}"
|
||||||
|
}
|
||||||
|
|
||||||
|
output "master_authorized_networks_config" {
|
||||||
|
description = "Here are networks that are allowed to reach your k8s API"
|
||||||
|
value = module.gke.master_authorized_networks_config
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
data "google_client_config" "default" {}
|
||||||
|
|
||||||
|
provider "google" {
|
||||||
|
project = var.project
|
||||||
|
region = var.region
|
||||||
|
}
|
||||||
|
|
||||||
|
provider "kubernetes" {
|
||||||
|
host = "https://${module.gke.endpoint}"
|
||||||
|
token = data.google_client_config.default.access_token
|
||||||
|
cluster_ca_certificate = base64decode(module.gke.ca_certificate)
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,63 @@
|
||||||
|
variable "project" {
|
||||||
|
type = string
|
||||||
|
description = "Google Project to create resources in"
|
||||||
|
default = "demo"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "region" {
|
||||||
|
type = string
|
||||||
|
description = "The region to host the cluster in"
|
||||||
|
default = "europe-west1"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "zone" {
|
||||||
|
type = string
|
||||||
|
description = "The region to host the cluster in"
|
||||||
|
default = "europe-west1-b"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "environment_name" {
|
||||||
|
type = string
|
||||||
|
description = "Environment name"
|
||||||
|
default = "demo"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "host_project" {
|
||||||
|
type = string
|
||||||
|
description = "The GCP project housing the VPC network to host the cluster in"
|
||||||
|
default = "demo"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "vpc_network" {
|
||||||
|
type = string
|
||||||
|
description = "The GCP network to apply firewall rules in"
|
||||||
|
default = "demo-vpc"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "master_authorized_networks" {
|
||||||
|
type = list(object({ cidr_block = string, display_name = string }))
|
||||||
|
description = "List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists)."
|
||||||
|
default = [
|
||||||
|
{ cidr_block = "1.1.1.1/32", display_name = "Use your IP/VPN IP here" },
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
# Google bucket for terraform state
|
||||||
|
|
||||||
|
variable "bucket_name" {
|
||||||
|
type = string
|
||||||
|
description = "Bucket name"
|
||||||
|
default = "your-project-bucket"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "bucket_prefix" {
|
||||||
|
type = string
|
||||||
|
description = "Path to store your state in bucket"
|
||||||
|
default = "terraform/state/demo"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "bucket_credentials_json" {
|
||||||
|
type = string
|
||||||
|
description = "Default path to your gcloud credentials json file"
|
||||||
|
default = "~/.config/gcloud/application_default_credentials.json"
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
terraform {
|
||||||
|
required_version = "~>1.8.0"
|
||||||
|
|
||||||
|
required_providers {
|
||||||
|
# https://github.com/hashicorp/terraform-provider-google
|
||||||
|
google = {
|
||||||
|
source = "hashicorp/google"
|
||||||
|
version = "~>5.41.0"
|
||||||
|
}
|
||||||
|
google-beta = {
|
||||||
|
source = "hashicorp/google-beta"
|
||||||
|
version = "~> 5.41"
|
||||||
|
}
|
||||||
|
|
||||||
|
# https://github.com/hashicorp/terraform-provider-kubernetes
|
||||||
|
kubernetes = {
|
||||||
|
source = "hashicorp/kubernetes"
|
||||||
|
version = "~>2.32.0"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,27 @@
|
||||||
|
# https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_subnetwork
|
||||||
|
resource "google_project_service" "service_networking" {
|
||||||
|
service = "servicenetworking.googleapis.com"
|
||||||
|
project = var.project
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_compute_network" "vpc" {
|
||||||
|
name = var.vpc_network
|
||||||
|
auto_create_subnetworks = "false"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "google_compute_subnetwork" "subnet" {
|
||||||
|
name = "${var.project}-subnet"
|
||||||
|
region = var.region
|
||||||
|
network = google_compute_network.vpc.name
|
||||||
|
ip_cidr_range = "10.1.0.0/24"
|
||||||
|
secondary_ip_range {
|
||||||
|
range_name = "${var.project}-gke-pods"
|
||||||
|
ip_cidr_range = "10.2.0.0/19"
|
||||||
|
}
|
||||||
|
secondary_ip_range {
|
||||||
|
range_name = "${var.project}-gke-services"
|
||||||
|
ip_cidr_range = "10.3.0.0/24"
|
||||||
|
}
|
||||||
|
private_ip_google_access = true
|
||||||
|
depends_on = [google_compute_network.vpc]
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue