Skip to content

Commit 2b7ef3d

Browse files
author
Aaron Lane
authored
Merge pull request #315 from bharathkkb/feature/gke-safe-cluster
Safer Cluster module
2 parents 0290261 + 5564e1b commit 2b7ef3d

File tree

60 files changed

+1610
-80
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+1610
-80
lines changed

‎.kitchen.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,13 @@ suites:
4545
systems:
4646
- name: shared_vpc
4747
backend: local
48+
- name: "safer_cluster"
49+
driver:
50+
root_module_directory: test/fixtures/safer_cluster
51+
verifier:
52+
systems:
53+
- name: safer_cluster
54+
backend: local
4855
- name: "simple_regional"
4956
driver:
5057
root_module_directory: test/fixtures/simple_regional

‎build/int.cloudbuild.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,26 @@ steps:
6464
- verify shared-vpc-local
6565
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
6666
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy shared-vpc-local']
67+
- id: create safer-cluster-local
68+
waitFor:
69+
- prepare
70+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
71+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create safer-cluster-local']
72+
- id: converge safer-cluster-local
73+
waitFor:
74+
- create safer-cluster-local
75+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
76+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge safer-cluster-local']
77+
- id: verify safer-cluster-local
78+
waitFor:
79+
- converge safer-cluster-local
80+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
81+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify safer-cluster-local']
82+
- id: destroy safer-cluster-local
83+
waitFor:
84+
- verify safer-cluster-local
85+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
86+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy safer-cluster-local']
6787
- id: create simple-regional-local
6888
waitFor:
6989
- prepare

‎examples/safer_cluster/README.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Safer GKE Cluster
2+
3+
This example illustrates how to instantiate the opinionated Safer Cluster module.
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|:----:|:-----:|:-----:|
10+
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
11+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
12+
| region | The region to host the cluster in | string | `"us-central1"` | no |
13+
14+
## Outputs
15+
16+
| Name | Description |
17+
|------|-------------|
18+
| ca\_certificate | The cluster ca certificate (base64 encoded) |
19+
| client\_token | The bearer token for auth |
20+
| cluster\_name | Cluster name |
21+
| kubernetes\_endpoint | The cluster endpoint |
22+
| location | |
23+
| master\_kubernetes\_version | Kubernetes version of the master |
24+
| network\_name | The name of the VPC being created |
25+
| project\_id | The project ID the cluster is in |
26+
| region | The region in which the cluster resides |
27+
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
28+
| subnet\_names | The names of the subnet being created |
29+
| zones | List of zones in which the cluster resides |
30+
31+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
32+
33+
To provision this example, run the following from within this directory:
34+
- `terraform init` to get the plugins
35+
- `terraform plan` to see the infrastructure plan
36+
- `terraform apply` to apply the infrastructure build
37+
- `terraform destroy` to destroy the built infrastructure

‎examples/safer_cluster/main.tf

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "random_string" "suffix" {
18+
length = 4
19+
special = false
20+
upper = false
21+
}
22+
23+
locals {
24+
cluster_type = "safer-cluster"
25+
network_name = "safer-cluster-network-${random_string.suffix.result}"
26+
subnet_name = "safer-cluster-subnet-${random_string.suffix.result}"
27+
master_auth_subnetwork = "safer-cluster-master-subnet-${random_string.suffix.result}"
28+
pods_range_name = "ip-range-pods-${random_string.suffix.result}"
29+
svc_range_name = "ip-range-svc-${random_string.suffix.result}"
30+
}
31+
32+
provider "google" {
33+
version = "~> 2.18.0"
34+
}
35+
36+
provider "google-beta" {
37+
version = "~> 2.18.0"
38+
}
39+
40+
module "gke" {
41+
source = "../../modules/safer-cluster/"
42+
project_id = var.project_id
43+
name = "${local.cluster_type}-cluster-${random_string.suffix.result}"
44+
regional = true
45+
region = var.region
46+
network = module.gcp-network.network_name
47+
subnetwork = module.gcp-network.subnets_names[0]
48+
ip_range_pods = local.pods_range_name
49+
ip_range_services = local.svc_range_name
50+
compute_engine_service_account = var.compute_engine_service_account
51+
master_ipv4_cidr_block = "172.16.0.0/28"
52+
master_authorized_networks_config = [
53+
{
54+
cidr_blocks = [
55+
{
56+
cidr_block = "10.60.0.0/17"
57+
display_name = "VPC"
58+
},
59+
]
60+
},
61+
]
62+
istio = true
63+
cloudrun = true
64+
}
65+
66+
data "google_client_config" "default" {
67+
}
68+

‎examples/safer_cluster/network.tf

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "gcp-network" {
18+
source = "terraform-google-modules/network/google"
19+
version = "~> 1.4.0"
20+
project_id = var.project_id
21+
network_name = local.network_name
22+
23+
subnets = [
24+
{
25+
subnet_name = local.subnet_name
26+
subnet_ip = "10.0.0.0/17"
27+
subnet_region = var.region
28+
},
29+
{
30+
subnet_name = local.master_auth_subnetwork
31+
subnet_ip = "10.60.0.0/17"
32+
subnet_region = var.region
33+
},
34+
]
35+
36+
secondary_ranges = {
37+
"${local.subnet_name}" = [
38+
{
39+
range_name = local.pods_range_name
40+
ip_cidr_range = "192.168.0.0/18"
41+
},
42+
{
43+
range_name = local.svc_range_name
44+
ip_cidr_range = "192.168.64.0/18"
45+
},
46+
]
47+
}
48+
}

‎examples/safer_cluster/outputs.tf

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
description = "The cluster endpoint"
19+
sensitive = true
20+
value = module.gke.endpoint
21+
}
22+
23+
output "cluster_name" {
24+
description = "Cluster name"
25+
value = module.gke.name
26+
}
27+
28+
output "location" {
29+
value = module.gke.location
30+
}
31+
32+
output "master_kubernetes_version" {
33+
description = "Kubernetes version of the master"
34+
value = module.gke.master_version
35+
}
36+
37+
output "client_token" {
38+
description = "The bearer token for auth"
39+
sensitive = true
40+
value = base64encode(data.google_client_config.default.access_token)
41+
}
42+
43+
output "ca_certificate" {
44+
description = "The cluster ca certificate (base64 encoded)"
45+
value = module.gke.ca_certificate
46+
}
47+
48+
output "service_account" {
49+
description = "The service account to default running nodes as if not overridden in `node_pools`."
50+
value = module.gke.service_account
51+
}
52+
53+
output "network_name" {
54+
description = "The name of the VPC being created"
55+
value = module.gcp-network.network_name
56+
}
57+
58+
output "subnet_names" {
59+
description = "The names of the subnet being created"
60+
value = module.gcp-network.subnets_names
61+
}
62+
63+
output "region" {
64+
description = "The region in which the cluster resides"
65+
value = module.gke.region
66+
}
67+
68+
output "zones" {
69+
description = "List of zones in which the cluster resides"
70+
value = module.gke.zones
71+
}
72+
73+
output "project_id" {
74+
description = "The project ID the cluster is in"
75+
value = var.project_id
76+
}

‎examples/safer_cluster/variables.tf

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
type = string
19+
description = "The project ID to host the cluster in"
20+
}
21+
22+
variable "region" {
23+
type = string
24+
description = "The region to host the cluster in"
25+
default = "us-central1"
26+
}
27+
28+
variable "compute_engine_service_account" {
29+
type = string
30+
description = "Service account to associate to the nodes in the cluster"
31+
}

‎examples/safer_cluster/versions.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 0.12"
19+
}

0 commit comments

Comments
 (0)