2021-07-09 01:54:20 +00:00
|
|
|
terraform {
|
|
|
|
required_providers {
|
|
|
|
google = {
|
|
|
|
source = "hashicorp/google"
|
|
|
|
version = "3.74.0"
|
|
|
|
}
|
2021-07-09 05:54:13 +00:00
|
|
|
google-beta = {
|
|
|
|
source = "hashicorp/google-beta"
|
|
|
|
version = "3.74.0"
|
|
|
|
}
|
2021-07-09 01:54:20 +00:00
|
|
|
random = {
|
|
|
|
source = "hashicorp/random"
|
|
|
|
version = "3.1.0"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-07-09 00:30:19 +00:00
|
|
|
variable "project" {
|
|
|
|
description = "Project ID."
|
|
|
|
type = string
|
2021-07-09 04:50:48 +00:00
|
|
|
default = "hip-wharf-319304"
|
2021-07-09 00:30:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
variable "region" {
|
|
|
|
description = "Region."
|
|
|
|
type = string
|
|
|
|
default = "us-central1"
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "zone" {
|
|
|
|
description = "Zone."
|
|
|
|
type = string
|
|
|
|
default = "us-central1-c"
|
|
|
|
}
|
|
|
|
|
|
|
|
provider "google" {
|
|
|
|
project = var.project
|
|
|
|
region = var.region
|
|
|
|
zone = var.zone
|
|
|
|
}
|
|
|
|
|
2021-07-09 01:54:20 +00:00
|
|
|
data "google_project" "project" {
|
2021-07-09 04:50:48 +00:00
|
|
|
project_id = var.project
|
2021-07-09 01:54:20 +00:00
|
|
|
}
|
|
|
|
|
2021-07-09 05:54:13 +00:00
|
|
|
#################### Workload Identity ####################
|
|
|
|
|
|
|
|
resource "random_id" "identity_pool" {
|
|
|
|
byte_length = 4
|
|
|
|
}
|
|
|
|
|
|
|
|
resource "google_iam_workload_identity_pool" "identity_pool" {
|
|
|
|
provider = google-beta
|
|
|
|
project = var.project
|
|
|
|
workload_identity_pool_id = "identity-pool-${random_id.identity_pool.hex}"
|
|
|
|
}
|
|
|
|
|
2021-07-09 01:43:49 +00:00
|
|
|
#################### KMS ##################################
|
|
|
|
|
|
|
|
resource "google_project_service" "cloudkms" {
|
|
|
|
project = var.project
|
|
|
|
service = "cloudkms.googleapis.com"
|
|
|
|
disable_dependent_services = true
|
|
|
|
}
|
|
|
|
|
2021-07-09 01:54:20 +00:00
|
|
|
resource "random_id" "gke_db" {
|
|
|
|
byte_length = 4
|
|
|
|
}
|
|
|
|
|
2021-07-09 01:43:49 +00:00
|
|
|
resource "google_kms_key_ring" "gke_db" {
|
|
|
|
project = var.project
|
2021-07-09 01:54:20 +00:00
|
|
|
name = "gke-db-${random_id.gke_db.hex}"
|
2021-07-09 01:43:49 +00:00
|
|
|
location = var.region
|
|
|
|
|
|
|
|
lifecycle {
|
|
|
|
prevent_destroy = true
|
|
|
|
}
|
|
|
|
|
|
|
|
depends_on = [
|
|
|
|
google_project_service.cloudkms
|
|
|
|
]
|
|
|
|
}
|
|
|
|
|
|
|
|
resource "google_kms_key_ring_iam_policy" "gke_db" {
|
|
|
|
key_ring_id = google_kms_key_ring.gke_db.id
|
|
|
|
policy_data = data.google_iam_policy.gke_db.policy_data
|
2021-07-09 01:54:20 +00:00
|
|
|
|
|
|
|
depends_on = [
|
|
|
|
google_project_service.cloudkms
|
|
|
|
]
|
2021-07-09 01:43:49 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
resource "google_kms_crypto_key" "gke_db" {
|
|
|
|
name = "gke-db-key"
|
|
|
|
key_ring = google_kms_key_ring.gke_db.id
|
|
|
|
|
|
|
|
lifecycle {
|
|
|
|
prevent_destroy = true
|
|
|
|
}
|
|
|
|
|
|
|
|
depends_on = [
|
2021-07-09 01:54:20 +00:00
|
|
|
google_project_service.container
|
2021-07-09 01:43:49 +00:00
|
|
|
]
|
|
|
|
}
|
|
|
|
|
|
|
|
data "google_iam_policy" "gke_db" {
|
|
|
|
binding {
|
|
|
|
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
|
|
|
|
|
|
|
|
members = [
|
2021-07-09 01:54:20 +00:00
|
|
|
"serviceAccount:service-${data.google_project.project.number}@container-engine-robot.iam.gserviceaccount.com"
|
2021-07-09 01:43:49 +00:00
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#################### GKE ##################################
|
|
|
|
|
|
|
|
resource "google_project_service" "container" {
|
2021-07-09 00:30:19 +00:00
|
|
|
project = var.project
|
|
|
|
service = "container.googleapis.com"
|
|
|
|
disable_dependent_services = true
|
|
|
|
}
|
|
|
|
|
2021-07-10 01:44:58 +00:00
|
|
|
resource "google_project_service" "containerregistry" {
|
|
|
|
project = var.project
|
|
|
|
service = "containerregistry.googleapis.com"
|
|
|
|
disable_dependent_services = true
|
|
|
|
}
|
|
|
|
|
2021-07-09 00:30:19 +00:00
|
|
|
resource "google_service_account" "gke" {
|
|
|
|
project = var.project
|
|
|
|
account_id = "gke-service-account"
|
|
|
|
display_name = "GKE Service Account"
|
|
|
|
}
|
|
|
|
|
2021-07-10 01:44:58 +00:00
|
|
|
# Allow GKE to access custom docker images in GCR
|
|
|
|
resource "google_storage_bucket_iam_member" "gke_gcr" {
|
|
|
|
bucket = "artifacts.${google_service_account.gke.project}.appspot.com"
|
|
|
|
role = "roles/storage.objectViewer"
|
|
|
|
member = "serviceAccount:${google_service_account.gke.email}"
|
|
|
|
|
|
|
|
depends_on = [
|
|
|
|
google_project_service.containerregistry
|
|
|
|
]
|
|
|
|
}
|
|
|
|
|
2021-07-09 00:30:19 +00:00
|
|
|
resource "google_container_cluster" "primary" {
|
|
|
|
project = var.project
|
|
|
|
name = "gke-cluster"
|
|
|
|
location = var.region
|
|
|
|
|
|
|
|
remove_default_node_pool = true
|
|
|
|
initial_node_count = 1
|
|
|
|
enable_shielded_nodes = true
|
2021-07-10 01:44:58 +00:00
|
|
|
min_master_version = "1.19.10-gke.1000"
|
2021-07-09 01:43:49 +00:00
|
|
|
|
|
|
|
database_encryption {
|
|
|
|
state = "ENCRYPTED"
|
|
|
|
key_name = google_kms_crypto_key.gke_db.self_link
|
|
|
|
}
|
|
|
|
|
2021-07-09 05:54:13 +00:00
|
|
|
maintenance_policy {
|
|
|
|
daily_maintenance_window {
|
|
|
|
start_time = "03:00"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
workload_identity_config {
|
|
|
|
identity_namespace = "${data.google_project.project.project_id}.svc.id.goog"
|
|
|
|
}
|
|
|
|
|
|
|
|
release_channel {
|
|
|
|
channel = "STABLE"
|
|
|
|
}
|
|
|
|
|
|
|
|
master_auth {
|
|
|
|
username = ""
|
|
|
|
password = ""
|
|
|
|
}
|
|
|
|
|
2021-07-10 01:44:58 +00:00
|
|
|
ip_allocation_policy {
|
|
|
|
cluster_ipv4_cidr_block = "10.1.0.0/16"
|
|
|
|
services_ipv4_cidr_block = "10.2.0.0/20"
|
|
|
|
}
|
|
|
|
|
|
|
|
lifecycle {
|
|
|
|
prevent_destroy = true
|
|
|
|
}
|
|
|
|
|
2021-07-09 01:43:49 +00:00
|
|
|
depends_on = [
|
|
|
|
google_project_service.container,
|
|
|
|
google_kms_key_ring_iam_policy.gke_db
|
|
|
|
]
|
2021-07-09 00:30:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
resource "google_container_node_pool" "primary" {
|
2021-07-09 05:54:13 +00:00
|
|
|
project = google_container_cluster.primary.project
|
|
|
|
name_prefix = "node-pool"
|
|
|
|
location = var.region
|
|
|
|
cluster = google_container_cluster.primary.name
|
|
|
|
initial_node_count = 1
|
2021-07-09 00:30:19 +00:00
|
|
|
|
|
|
|
autoscaling {
|
|
|
|
min_node_count = 0
|
2021-07-09 05:54:13 +00:00
|
|
|
max_node_count = 20
|
2021-07-09 00:30:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
node_config {
|
|
|
|
preemptible = true
|
|
|
|
machine_type = "e2-medium"
|
|
|
|
|
|
|
|
service_account = google_service_account.gke.email
|
|
|
|
oauth_scopes = [
|
|
|
|
"https://www.googleapis.com/auth/cloud-platform"
|
|
|
|
]
|
|
|
|
|
|
|
|
metadata = {
|
|
|
|
disable-legacy-endpoints = "true"
|
|
|
|
}
|
|
|
|
|
|
|
|
tags = []
|
2021-07-09 05:54:13 +00:00
|
|
|
|
|
|
|
shielded_instance_config {
|
|
|
|
enable_secure_boot = true
|
|
|
|
enable_integrity_monitoring = true
|
|
|
|
}
|
2021-07-09 00:30:19 +00:00
|
|
|
}
|
2021-07-09 01:43:49 +00:00
|
|
|
|
2021-07-09 06:09:42 +00:00
|
|
|
lifecycle {
|
|
|
|
ignore_changes = [
|
|
|
|
node_count
|
|
|
|
]
|
|
|
|
}
|
|
|
|
|
2021-07-09 01:43:49 +00:00
|
|
|
depends_on = [
|
|
|
|
google_project_service.container
|
|
|
|
]
|
2021-07-09 00:30:19 +00:00
|
|
|
}
|
2021-07-09 04:50:48 +00:00
|
|
|
|
|
|
|
output "gke_connect_command" {
|
|
|
|
description = "Command to run to connect to the kubernetes cluster."
|
2021-07-09 05:54:13 +00:00
|
|
|
value = "gcloud container clusters get-credentials ${google_container_cluster.primary.name} --region ${var.region} --project ${var.project}"
|
2021-07-09 04:50:48 +00:00
|
|
|
}
|
2021-07-12 04:06:49 +00:00
|
|
|
|
|
|
|
#################### SQL ##################################
|
|
|
|
|
|
|
|
module "cloudsql" {
|
|
|
|
source = "../modules/cloudsql"
|
|
|
|
project = var.project
|
|
|
|
region = var.region
|
|
|
|
}
|