Skip to content

Commit 1f96ef7

Browse files
author
Florencia Comuzzi
committed
create public cluster module
1 parent 8c77296 commit 1f96ef7

File tree

10 files changed

+103
-70
lines changed

10 files changed

+103
-70
lines changed

‎.github/workflows/terraform.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,6 @@ on:
1818
env:
1919
# verbosity setting for Terraform logs
2020
TF_LOG: INFO
21-
# # Credentials for deployment to AWS
22-
# AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
23-
# AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
24-
# # S3 bucket for the Terraform state
25-
# BUCKET_TF_STATE: ${{ secrets.BUCKET_TF_STATE}}
2621

2722
jobs:
2823
terraform:

‎docs/NETWORKING.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Networking Concerns
2+
GCP offers two GKE cluster modes: Standard and Autopilot. You cannot control the nodes in Autopilot
3+
mode so this module uses the Standard mode. In Standard clusters, you have full control over the
4+
nodes, and thus, you manage the networking aspects yourself.
5+
6+
7+
8+
The subnet should accommodate the maximum number of nodes that you expect in the cluster and the
9+
internal load balancer IP addresses across the cluster using the subnet.
10+
11+
You can use the cluster autoscaler to limit the maximum number of nodes.
12+
The Pod and service IP address ranges are represented as distinct secondary ranges of your subnet,
13+
implemented as alias IP addresses in VPC-native clusters.
14+
15+
Choose wide enough IP address ranges so that you can accommodate all nodes, Pods, and Services for
16+
the cluster.
17+
18+
Consider the following limitations:
19+
20+
* You can expand primary IP address ranges but you cannot shrink them. These IP address ranges cannot
21+
be discontiguous.
22+
* You can expand the Pod range by appending additional Pod ranges to the cluster or creating new node
23+
pools with other secondary Pod ranges.
24+
* The secondary IP address range for Services cannot be expanded or changed over the life of the
25+
cluster.
26+
* Review the limitations for the secondary IP address range for Pods and Services.
27+
28+
https://cloud.google.com/kubernetes-engine/docs/best-practices/networking

‎SETUP.md‎ renamed to ‎docs/SETUP.md‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# florenciacomuzzi-site-terraform
1+
# k8s-environment-terraform
22
This repository contains Terraform code to create a Linode instance and deploy a website to it.
33
The infrastructure is managed using Hashicorp Terraform Cloud.
44
Deployments are triggered from GitHub Actions workflows.
@@ -9,7 +9,6 @@ Deployments are triggered from GitHub Actions workflows.
99
* Login to GCP account.
1010
* Create a service account like `k8s-environment-terraform-cicd` to use for CICD.
1111
* Create a service account JSON file.
12-
* Add as a repository secret by going to Settings > Secrets and variables > Actions. Name it GCP_CREDENTIALS and paste in the credentials JSON.
1312
* Create the buckets for Terraform state like `prod-tf-state-bucket`. The bucket names are specified in the `backend/{env}.tfvars` file.
1413
* Go to the bucket > Permissions > Add Member > Service Account > k8s-environment-terraform-cicd@florenciacomuzzi.iam.gserviceaccount.com > Role >
1514
* Storage Object Admin
@@ -25,7 +24,7 @@ like `454824995744-compute@developer.gserviceaccount.com`. Go to IAM & Admin > S
2524

2625
### GitHub
2726
* Clone this repository. Name it like "mysite-site-terraform".
28-
* Create a TF_API_TOKEN repository secret by going to Settings > Secrets and variables > Actions. This secret is used by GitHub Actions to authenticate to Hashicorp Terraform Cloud during runs.
27+
* Add as a repository secret by going to Settings > Secrets and variables > Actions. Name it GCP_CREDENTIALS and paste in the credentials JSON.
2928
* Change the values of TF_CLOUD_ORGANIZATION and TF_WORKSPACE in .github/workflows/terraform-apply.yml and .github/workflows/terraform-plan.yml.
3029

3130

‎TODO.md‎ renamed to ‎docs/TODO.md‎

File renamed without changes.

‎docs/test-deployment.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
# installing kubectx and kubens is recommended
3+
# use gcloud to authenticate to kubernetes cluster
4+
# like gcloud container clusters get-credentials florenciacomuzzi-cluster-prod --region us-east1 --project florenciacomuzzi
5+
kubectl create deployment pingtest --image=busybox --replicas=3 -- sleep infinity

‎main.tf‎

Lines changed: 43 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,46 @@
1-
resource "google_compute_network" "default" {
2-
name = var.vpc_name
3-
auto_create_subnetworks = false
4-
enable_ula_internal_ipv6 = true
5-
}
6-
7-
resource "google_compute_subnetwork" "default" {
8-
name = "example-subnetwork"
9-
10-
ip_cidr_range = "10.0.0.0/16"
11-
region = var.region
12-
13-
stack_type = "IPV4_IPV6"
14-
ipv6_access_type = "INTERNAL" # Change to "EXTERNAL" if creating an external loadbalancer
15-
16-
network = google_compute_network.default.id
17-
secondary_ip_range {
18-
range_name = "services-range"
19-
ip_cidr_range = "192.168.0.0/24"
20-
}
21-
22-
secondary_ip_range {
23-
range_name = "pod-ranges"
24-
ip_cidr_range = "192.168.1.0/24"
1+
module "gke_public" {
2+
source = "terraform-google-modules/kubernetes-engine/google"
3+
project_id = var.project_id
4+
name = var.cluster_name
5+
region = var.region
6+
network = module.vpc.network_name
7+
subnetwork = module.vpc.subnet_name
8+
9+
ip_range_pods = "gke-pods"
10+
ip_range_services = "gke-services"
11+
12+
enable_private_nodes = false # Public cluster
13+
enable_private_endpoint = false # Public API endpoint
14+
enable_ip_masq_agent = true
15+
remove_default_node_pool = true
16+
17+
node_pools = [
18+
{
19+
name = "default-pool"
20+
machine_type = "e2-medium"
21+
min_count = 1
22+
max_count = 3
23+
disk_size_gb = 50
24+
autoscaling = true
25+
}
26+
]
27+
28+
node_pools_oauth_scopes = {
29+
all = [
30+
"https://www.googleapis.com/auth/cloud-platform"
31+
]
2532
}
2633
}
2734

28-
resource "google_container_cluster" "default" {
29-
name = var.cluster_name
30-
31-
location = var.region
32-
enable_autopilot = true
33-
enable_l4_ilb_subsetting = true
34-
35-
network = google_compute_network.default.id
36-
subnetwork = google_compute_subnetwork.default.id
37-
38-
ip_allocation_policy {
39-
stack_type = "IPV4_IPV6"
40-
services_secondary_range_name = google_compute_subnetwork.default.secondary_ip_range[0].range_name
41-
cluster_secondary_range_name = google_compute_subnetwork.default.secondary_ip_range[1].range_name
42-
}
43-
44-
# Set `deletion_protection` to `true` will ensure that one cannot
45-
# accidentally delete this instance by use of Terraform.
46-
deletion_protection = false
47-
}
35+
module "vpc" {
36+
source = "terraform-google-modules/network/google"
37+
project_id = var.project_id
38+
network_name = var.network_name
39+
subnets = [
40+
{
41+
subnet_name = var.subnet_name
42+
subnet_ip = var.subnet_cidr
43+
subnet_region = var.region
44+
}
45+
]
46+
}

‎providers.tf‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,12 @@ terraform {
99
}
1010
}
1111

12-
# Configure the Linode Provider
13-
# set google provider knowing that auth is handled by environment variable
14-
# provider "linode" {
15-
# # token = var.token
16-
# }
1712
provider "google" {
1813
project = var.project_id
1914
region = var.region
15+
default_labels = {
16+
infrastructure = "crossing-the-narrow-bridge"
17+
}
18+
add_terraform_attribution_label = true
19+
terraform_attribution_label_addition_strategy = "PROACTIVE"
2020
}

‎variables.tf‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,3 @@
1-
# variable "token" {
2-
# sensitive = true
3-
# type = string
4-
# description = "Linode API Token"
5-
# }
6-
71
variable "project_id" {
82
type = string
93
default = "florenciacomuzzi"
@@ -16,12 +10,22 @@ variable "region" {
1610
description = "GCP region"
1711
}
1812

19-
variable "vpc_name" {
13+
variable "network_name" {
14+
description = "The name of the VPC network"
15+
type = string
16+
}
17+
18+
variable "subnet_name" {
19+
description = "The name of the subnet"
20+
type = string
21+
}
22+
23+
variable "subnet_cidr" {
24+
description = "The CIDR block for the subnet"
2025
type = string
21-
description = "VPC network name"
2226
}
2327

2428
variable "cluster_name" {
29+
description = "The name of the GKE cluster"
2530
type = string
26-
description = "GKE cluster name"
2731
}

‎variables/dev.auto.tfvars‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
project_id = "florenciacomuzzi"
22
region = "us-east1"
3-
vpc_name = "florenciacomuzzi-vpc-dev"
4-
cluster_name = "florenciacomuzzi-cluster-dev"
3+
network_name = "florenciacomuzzi-vpc-dev"
4+
subnet_name = "my-subnet"
5+
cluster_name = "florenciacomuzzi-cluster-dev"
6+
subnet_cidr = "10.0.0.0/12"

‎variables/prod.auto.tfvars‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
project_id = "florenciacomuzzi"
22
region = "us-east1"
3-
vpc_name = "prod"
4-
cluster_name = "florenciacomuzzi-cluster-prod"
3+
vpc_name = "florenciacomuzzi-vpc-prod"
4+
cluster_name = "florenciacomuzzi-cluster-prod"
5+
ip_cidr_range = "10.0.0.0/12"

0 commit comments

Comments
 (0)