Pour tout problème contactez-nous par mail : support@froggit.fr | La FAQ :grey_question: | Rejoignez-nous sur le Chat :speech_balloon:

Skip to content
Snippets Groups Projects
main.tf 5.46 KiB
Newer Older
  • Learn to ignore specific revisions
  • terraform {
      backend "http" {
      }
    
      required_providers {
        google = {
          source  = "hashicorp/google"
          version = "4.3.0"
        }
      }
    }
    
    provider "google" {
    
    Nicolas's avatar
    Nicolas committed
      credentials = file("./gcp-sa.json")
    
      project     = var.project_id
      region      = var.region
    }
    
    
    Nicolas's avatar
    Nicolas committed
    data "google_project" "project" {
      provider   = google
      project_id = var.project_id
    }
    
    
    ### Reserve Static IP
    resource "google_compute_global_address" "static_ip" {
      provider = google
      project  = var.project_id
    
    Nicolas's avatar
    Nicolas committed
      name     = "gke-frontend"
    
    }
    
    ### Create Network
    resource "google_compute_network" "vpc_network" {
      provider                = google
      project                 = var.project_id
      name                    = var.vpc_network_name
      auto_create_subnetworks = false
      mtu                     = 1460
      routing_mode            = "GLOBAL"
    }
    
    ### Create Subnetwork
    resource "google_compute_subnetwork" "vpc_subnetwork" {
      provider      = google
      project       = var.project_id
      name          = var.vpc_subnetwork_name
      ip_cidr_range = "192.168.100.0/24"
      region        = var.region
      network       = google_compute_network.vpc_network.id
      secondary_ip_range {
        range_name    = "pods"
        ip_cidr_range = "10.0.0.0/14"
      }
      secondary_ip_range {
        range_name    = "services"
        ip_cidr_range = "10.4.0.0/19"
      }
      private_ip_google_access = true
    
      depends_on = [
        google_compute_network.vpc_network
      ]
    }
    
    ### Create VPC network peering
    resource "google_compute_global_address" "vpc_private_ip_address" {
      provider      = google
      project       = var.project_id
      name          = var.vpc_private_ip_address_name
      purpose       = "VPC_PEERING"
      address_type  = "INTERNAL"
      prefix_length = 16
      network       = google_compute_network.vpc_network.id
    }
    
    resource "google_service_networking_connection" "vpc_private_vpc_connection" {
    
    Nicolas's avatar
    Nicolas committed
      provider = google
      network  = google_compute_network.vpc_network.id
      service  = "servicenetworking.googleapis.com"
    
      reserved_peering_ranges = [
        google_compute_global_address.vpc_private_ip_address.name
      ]
    }
    
    ### Create firewall rules
    resource "google_compute_firewall" "fw_http" {
      provider = google
      project  = var.project_id
      name     = var.fw_http_name
      network  = google_compute_network.vpc_network.name
      allow {
        protocol = "tcp"
        ports    = ["80"]
      }
      target_tags   = ["http-server"]
      source_ranges = ["0.0.0.0/0"]
      disabled      = false
    }
    
    resource "google_compute_firewall" "fw_https" {
      provider = google
      project  = var.project_id
      name     = var.fw_https_name
      network  = google_compute_network.vpc_network.name
      allow {
        protocol = "tcp"
        ports    = ["443"]
      }
      target_tags   = ["https-server"]
      source_ranges = ["0.0.0.0/0"]
      disabled      = false
    }
    
    resource "google_compute_firewall" "allow_from_iap_to_instances" {
      provider = google
      project  = var.project_id
      name     = var.fw_ssh_name
      network  = google_compute_network.vpc_network.name
      allow {
        protocol = "tcp"
        ports    = ["22"]
      }
      source_ranges = ["35.235.240.0/20"]
    }
    
    ### Create Cloud NAT
    resource "google_compute_router" "router" {
      provider = google
      project  = var.project_id
      name     = var.router_name
      region   = var.region
      network  = google_compute_network.vpc_network.id
      bgp {
        asn = 64514
      }
    }
    
    resource "google_compute_router_nat" "cloud_nat" {
      provider                           = google
      project                            = var.project_id
      name                               = var.cloud_nat_name
      region                             = var.region
      router                             = google_compute_router.router.name
      nat_ip_allocate_option             = "AUTO_ONLY"
      source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
    
      log_config {
        enable = false
        filter = "ERRORS_ONLY"
      }
    
      min_ports_per_vm = 64
    }
    
    ### Create Kubernetes Cluster
    resource "google_container_cluster" "cluster" {
    
    Nicolas's avatar
    Nicolas committed
      provider                  = google
      project                   = var.project_id
      name                      = var.cluster_name
      location                  = var.region
    
      remove_default_node_pool  = true
      initial_node_count        = 1
      logging_service           = "logging.googleapis.com/kubernetes"
      default_max_pods_per_node = 20
      networking_mode           = "VPC_NATIVE"
      network                   = google_compute_network.vpc_network.id
      subnetwork                = google_compute_subnetwork.vpc_subnetwork.id
      enable_shielded_nodes     = true
    
      private_cluster_config {
        enable_private_endpoint = false
        enable_private_nodes    = true
        master_ipv4_cidr_block  = "172.16.0.0/28"
      }
    
      default_snat_status {
        disabled = false
      }
    
      ip_allocation_policy {
        cluster_secondary_range_name  = "pods"
        services_secondary_range_name = "services"
      }
    
      workload_identity_config {
    
    Nicolas's avatar
    Nicolas committed
        workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
    
      }
    
      depends_on = [
        google_compute_network.vpc_network,
    
    Nicolas's avatar
    Nicolas committed
        google_compute_subnetwork.vpc_subnetwork
    
      ]
    }
    
    ### Create Kubernetes Node Pool
    resource "google_container_node_pool" "node_pool" {
      provider   = google
      project    = var.project_id
      name       = var.node_pool_name
      location   = var.region
      cluster    = google_container_cluster.cluster.name
      node_count = 1
    
      node_config {
    
    Nicolas's avatar
    Nicolas committed
        preemptible  = true
    
    Nicolas's avatar
    Nicolas committed
        machine_type = "e2-micro"
        disk_size_gb = "10"
    
    Nicolas's avatar
    Nicolas committed
        disk_type    = "pd-ssd"
        image_type   = "cos"
        oauth_scopes = [
    
          "https://www.googleapis.com/auth/cloud-platform"
        ]
    
        labels = {
          disktype    = "ssd"
          cputype     = "e2"
          preemptible = "true"
        }
      }
    }