talexander/infra_snippets
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Add the container registry for custom docker images.

Browse Source
This commit is contained in:
Tom Alexander 2021-07-09 21:44:58 -04:00
parent 0826402fcb
commit 3cbbc2b5a8
Signed by: talexander
GPG Key ID: D3A179C9A53C0EDE
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
main.tf
View File

@ -121,12 +121,29 @@ resource "google_project_service" "container" {
disable_dependent_services = true disable_dependent_services = true
} }
resource "google_project_service" "containerregistry" {
project = var.project
service = "containerregistry.googleapis.com"
disable_dependent_services = true
}
resource "google_service_account" "gke" { resource "google_service_account" "gke" {
project = var.project project = var.project
account_id = "gke-service-account" account_id = "gke-service-account"
display_name = "GKE Service Account" display_name = "GKE Service Account"
} }
# Allow GKE to access custom docker images in GCR
resource "google_storage_bucket_iam_member" "gke_gcr" {
bucket = "artifacts.${google_service_account.gke.project}.appspot.com"
role = "roles/storage.objectViewer"
member = "serviceAccount:${google_service_account.gke.email}"
depends_on = [
google_project_service.containerregistry
]
}
resource "google_container_cluster" "primary" { resource "google_container_cluster" "primary" {
project = var.project project = var.project
name = "gke-cluster" name = "gke-cluster"
@ -135,6 +152,7 @@ resource "google_container_cluster" "primary" {
remove_default_node_pool = true remove_default_node_pool = true
initial_node_count = 1 initial_node_count = 1
enable_shielded_nodes = true enable_shielded_nodes = true
min_master_version = "1.19.10-gke.1000"
database_encryption { database_encryption {
state = "ENCRYPTED" state = "ENCRYPTED"
@ -160,6 +178,15 @@ resource "google_container_cluster" "primary" {
password = "" password = ""
} }
ip_allocation_policy {
cluster_ipv4_cidr_block = "10.1.0.0/16"
services_ipv4_cidr_block = "10.2.0.0/20"
}
lifecycle {
prevent_destroy = true
}
depends_on = [ depends_on = [
google_project_service.container, google_project_service.container,
google_kms_key_ring_iam_policy.gke_db google_kms_key_ring_iam_policy.gke_db