Skip to content

Commit 8bf2771

Browse files
author
Vadym Mudryi
committed
Added terraform boilerplate code for GCP
1 parent f8e7cef commit 8bf2771

File tree

16 files changed

+514
-0
lines changed

16 files changed

+514
-0
lines changed

‎terraform-templates/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This folder contains templates to prepare infrastructure for OpenCRVS deployment.

‎terraform-templates/google-cloud-platform/01.common/backend_bucket.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Bucket to store terraform state files for all project
2+
resource "google_storage_bucket" "backend_terraform_bucket" {
3+
name = "opencrvs-app-terraform-bucket"
4+
force_destroy = false
5+
location = "EU"
6+
storage_class = "STANDARD"
7+
project = var.project_id
8+
versioning {
9+
enabled = true
10+
}
11+
}

‎terraform-templates/google-cloud-platform/01.common/gke_vpc.tf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
resource "google_compute_network" "vpc_network" {
2+
name = "gke-vpc"
3+
project = var.project_id
4+
auto_create_subnetworks = false
5+
}
6+
7+
resource "google_compute_router" "nat_router" {
8+
name = "${google_compute_network.vpc_network.name}-nat-router"
9+
network = google_compute_network.vpc_network.name
10+
region = "europe-west1"
11+
project = var.project_id
12+
}
13+
14+
resource "google_compute_address" "nat_ips" {
15+
count = var.nat_ip_count
16+
name = "gke-nat-ip-${count.index + 1}"
17+
region = "europe-west1"
18+
project = var.project_id
19+
}
20+
21+
resource "google_compute_router_nat" "nat_config" {
22+
name = "${google_compute_network.vpc_network.name}-nat-config"
23+
router = google_compute_router.nat_router.name
24+
region = "europe-west1"
25+
project = var.project_id
26+
nat_ip_allocate_option = "MANUAL_ONLY"
27+
nat_ips = google_compute_address.nat_ips.*.self_link
28+
source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
29+
30+
min_ports_per_vm = 8192
31+
max_ports_per_vm = 65536
32+
33+
log_config {
34+
enable = false
35+
filter = "ALL"
36+
}
37+
}
38+
39+
resource "google_compute_global_address" "private_ip_alloc" {
40+
name = "opencrvs-private-connection-ip"
41+
purpose = "VPC_PEERING"
42+
address_type = "INTERNAL"
43+
prefix_length = 16
44+
network = google_compute_network.vpc_network.name
45+
project = var.project_id
46+
}
47+
48+
# Create a private connection
49+
resource "google_service_networking_connection" "service_networking" {
50+
network = google_compute_network.vpc_network.id
51+
service = "servicenetworking.googleapis.com"
52+
reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
53+
}

‎terraform-templates/google-cloud-platform/01.common/outputs.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
output "gke_vpc_self_link" {
2+
value = google_compute_network.vpc_network.self_link
3+
}
4+
5+
output "gke_vpc_name" {
6+
value = google_compute_network.vpc_network.name
7+
}
8+
9+
output "server_tls_policy" {
10+
value = google_compute_ssl_policy.custom_restricted.id
11+
}

‎terraform-templates/google-cloud-platform/01.common/project.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Enable APIs
2+
resource "google_project_service" "enabled_apis" {
3+
for_each = var.enabled_apis
4+
project = var.project_id
5+
service = each.key
6+
disable_on_destroy = false // Set to false to prevent the API from being disabled if the resource is destroyed.
7+
}

‎terraform-templates/google-cloud-platform/01.common/providers.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Include Google Provider to configure your Google Cloud Platform infrastructure.
2+
provider "google" {
3+
# credentials = var.credentials_file
4+
}
5+
6+
terraform {
7+
# Configure terraform to persist state in Google Storage Bucket
8+
# Exact configuration of bucket is configured per env in ./envs/<env_name>/backendconfig.tfvars file
9+
backend "gcs" {
10+
bucket = "opencrvs-app-terraform-bucket"
11+
prefix = "states/common"
12+
}
13+
14+
# Include Google Provider as required provider globally
15+
required_providers {
16+
google = {
17+
source = "hashicorp/google"
18+
}
19+
}
20+
}

‎terraform-templates/google-cloud-platform/01.common/ssl_policy.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
2+
resource "google_compute_ssl_policy" "custom_restricted" {
3+
name = "custom-restricted"
4+
project = var.project_id
5+
profile = "RESTRICTED"
6+
min_tls_version = "TLS_1_2"
7+
}

‎terraform-templates/google-cloud-platform/01.common/variables.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# File for defining global variables. Exact value variables can be set per env using ./envs/<env-name>/terraform.tfvars file
2+
# variable "tf_credentials_file" {
3+
# type = string
4+
# description = "Credentials file to use for Terraform"
5+
# default = "~/.secret/tf-sa.json"
6+
# sensitive = true
7+
# }
8+
9+
variable "project_id" {
10+
type = string
11+
default = "opencrvs-on-k8s"
12+
}
13+
14+
variable "location" {
15+
type = string
16+
default = "europe-west1"
17+
18+
}
19+
20+
21+
variable "enabled_apis" {
22+
type = set(string)
23+
description = "List enabled APIs for project here"
24+
# APIs enabled in scope of Check Point CloudGuard (Dome 9): Identity for integration
25+
default = [
26+
"compute.googleapis.com",
27+
"cloudresourcemanager.googleapis.com",
28+
"container.googleapis.com",
29+
"iam.googleapis.com",
30+
# "appengine.googleapis.com",
31+
# "bigquery.googleapis.com",
32+
# "cloudfunctions.googleapis.com",
33+
# "sqladmin.googleapis.com",
34+
# "bigtableadmin.googleapis.com",
35+
"pubsub.googleapis.com",
36+
"redis.googleapis.com",
37+
"serviceusage.googleapis.com",
38+
"servicenetworking.googleapis.com",
39+
"cloudkms.googleapis.com",
40+
"admin.googleapis.com",
41+
]
42+
}
43+
44+
variable "nat_ip_count" {
45+
description = "Number of NAT IP addresses to allocate"
46+
type = number
47+
default = 1 # Change this to the number of IP addresses you need
48+
}

‎terraform-templates/google-cloud-platform/02.gke_cluster/envs/.DS_Store‎

6 KB
Binary file not shown.

‎terraform-templates/google-cloud-platform/02.gke_cluster/gke.tf‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
module "gke" {
2+
source = "terraform-google-modules/kubernetes-engine/google//modules/beta-private-cluster-update-variant"
3+
version = "~>31.1.0"
4+
project_id = var.project_id
5+
name = var.gke_cluster_name
6+
regional = false
7+
kubernetes_version = "latest"
8+
zones = [var.gke_cluster_location]
9+
network = data.terraform_remote_state.common.outputs.gke_vpc_name
10+
subnetwork = google_compute_subnetwork.vpc_subnetwork.name
11+
ip_range_pods = "${var.gke_cluster_name}-pods-subnet"
12+
ip_range_services = "${var.gke_cluster_name}-services-subnet"
13+
release_channel = "REGULAR"
14+
enable_cost_allocation = true
15+
maintenance_start_time = "1970-01-01T22:00:00Z"
16+
maintenance_end_time = "1970-01-02T02:00:00Z"
17+
maintenance_recurrence = "FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR"
18+
# TODO: Ensure that Compute Instances have Confidential Computing enabled
19+
# enable_confidential_nodes = true
20+
# TODO: Double check after cluster creation
21+
cluster_autoscaling = {
22+
autoscaling_profile = "OPTIMIZE_UTILIZATION"
23+
auto_repair = true
24+
auto_upgrade = true
25+
enabled = false
26+
gpu_resources = []
27+
min_cpu_cores = 4
28+
max_cpu_cores = 16
29+
min_memory_gb = 16
30+
max_memory_gb = 50
31+
}
32+
http_load_balancing = true
33+
network_policy = false
34+
registry_project_ids = [var.project_id]
35+
horizontal_pod_autoscaling = true
36+
# Default: False
37+
filestore_csi_driver = false
38+
enable_gcfs = true
39+
# TODO: Check option
40+
enable_private_endpoint = false
41+
enable_private_nodes = true
42+
# TODO:
43+
master_ipv4_cidr_block = var.gke_master_ipv4_cidr_block
44+
monitoring_enable_managed_prometheus = false
45+
dns_cache = false
46+
remove_default_node_pool = true
47+
48+
node_pools = [
49+
{
50+
name = "main-pool"
51+
machine_type = var.gke_machine_type
52+
# node_locations = var.gke_cluster_location
53+
min_count = 1
54+
max_count = 20
55+
local_ssd_count = 0
56+
spot = var.gke_use_spot_instance_type
57+
local_ssd_ephemeral_count = 0
58+
disk_size_gb = 20
59+
disk_type = "pd-standard"
60+
image_type = "COS_CONTAINERD"
61+
# Image steaming
62+
enable_gcfs = true
63+
enable_gvnic = false
64+
logging_variant = "DEFAULT"
65+
auto_repair = true
66+
auto_upgrade = true
67+
preemptible = false
68+
initial_node_count = 1
69+
}
70+
]
71+
72+
node_pools_oauth_scopes = {
73+
all = [
74+
# Write access to Stackdriver Logging
75+
"https://www.googleapis.com/auth/logging.write",
76+
# Write access to Stackdriver Monitoring
77+
"https://www.googleapis.com/auth/monitoring",
78+
# Read-only access to Google Cloud Storage
79+
"https://www.googleapis.com/auth/devstorage.read_only"
80+
]
81+
}
82+
83+
node_pools_labels = {
84+
all = {}
85+
86+
default-node-pool = {
87+
default-node-pool = true
88+
}
89+
}
90+
91+
node_pools_metadata = {
92+
all = {
93+
# Block project-wide SSH keys
94+
"block-project-ssh-keys" = "TRUE"
95+
}
96+
97+
default-node-pool = {
98+
"block-project-ssh-keys" = "TRUE"
99+
node-pool-metadata-custom-value = "my-node-pool"
100+
}
101+
}
102+
103+
node_pools_taints = {
104+
all = []
105+
106+
default-node-pool = [
107+
{
108+
key = "default-node-pool"
109+
value = true
110+
effect = "PREFER_NO_SCHEDULE"
111+
},
112+
]
113+
}
114+
115+
node_pools_tags = {
116+
all = [
117+
var.gke_cluster_name
118+
]
119+
120+
default-node-pool = [
121+
"default-node-pool",
122+
]
123+
}
124+
}

0 commit comments

Comments
 (0)