Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Bastion Host configuration & GKE changes #20

Merged
merged 1 commit into from
Oct 27, 2023
Merged

fix: Bastion Host configuration & GKE changes #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 31 additions & 14 deletions modules/network/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,15 +55,15 @@ resource "google_compute_router_nat" "nat" {
nat_ips = [google_compute_address.static_ip.self_link]
}


# resource "google_compute_route" "default_to_internet" {
# name = "default-internet-gateway"
# network = google_compute_network.vpc.name
# dest_range = "0.0.0.0/0"
# next_hop_gateway = "default-internet-gateway"
# priority = 1000
# description = "Default route to the internet"
# }
# Open the IGW
resource "google_compute_route" "default_to_internet" {
name = "default-internet-gateway"
network = google_compute_network.vpc.name
dest_range = "0.0.0.0/0"
next_hop_gateway = "default-internet-gateway"
priority = 1000
description = "Default route to the internet"
}

# Static public IP address
resource "google_compute_address" "static_ip" {
Expand All @@ -86,9 +86,9 @@ resource "google_container_cluster" "my_gke" {
initial_node_count = var.initial_node_count
network = google_compute_network.vpc.id
subnetwork = google_compute_subnetwork.private.id
# logging_service = "logging.googleapis.com/kubernetes"
# monitoring_service = "monitoring.googleapis.com/kubernetes"
networking_mode = "VPC_NATIVE"
logging_service = "logging.googleapis.com/kubernetes"
monitoring_service = "monitoring.googleapis.com/kubernetes"
networking_mode = "VPC_NATIVE"


# Optional, if you want multi-zonal cluster
Expand All @@ -110,6 +110,15 @@ resource "google_container_cluster" "my_gke" {
channel = "REGULAR"
}

# master_auth {
# client_certificate_config {
# issue_client_certificate = false
# }
# }

master_authorized_networks_config {

}
# enable workload identity wherein all the service acc will be attached to the pods
# so that they can access the various google services (so its pod level and not node level)
workload_identity_config {
Expand All @@ -121,9 +130,10 @@ resource "google_container_cluster" "my_gke" {
services_secondary_range_name = "k8s-service-range"
}


private_cluster_config {
enable_private_nodes = true
enable_private_endpoint = false
enable_private_endpoint = true
master_ipv4_cidr_block = "172.16.0.0/28"
}

Expand Down Expand Up @@ -156,7 +166,12 @@ resource "google_container_node_pool" "general" {

service_account = google_service_account.kubernetes.email
oauth_scopes = [
"https://www.googleapis.com/auth/cloud-platform"
"https://www.googleapis.com/auth/devstorage.read_only",
"https://www.googleapis.com/auth/logging.write",
"https://www.googleapis.com/auth/monitoring",
"https://www.googleapis.com/auth/servicecontrol",
"https://www.googleapis.com/auth/service.management.readonly",
"https://www.googleapis.com/auth/trace.append",
]
}
}
Expand All @@ -175,6 +190,8 @@ resource "google_compute_firewall" "firewall" {
ports = ["22"]
}
source_ranges = ["0.0.0.0/0"]

target_tags = ["bastion"]
}


4 changes: 3 additions & 1 deletion modules/vm/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,14 @@ resource "google_compute_instance" "vm" {
}
}

tags = ["bastion"]

network_interface {
subnetwork = var.subnet_name
access_config {
# ephimeral public IP config
# https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#nested_access_config
nat_ip = var.static_ip
# nat_ip = var.static_ip
}
}
metadata = {
Expand Down
28 changes: 14 additions & 14 deletions root/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,23 +60,23 @@ resource "time_sleep" "creating_network" {
create_duration = "60s"
}

# module "vm" {
# depends_on = [time_sleep.creating_network]
# source = "../modules/vm"
# vm_name = var.vm_name
# subnet_name = var.subnet_name
# machine_type = var.machine_type
# zone = var.zone
# static_ip = module.network.static_ip
# }
module "vm" {
depends_on = [time_sleep.creating_network]
source = "../modules/vm"
vm_name = var.vm_name
subnet_name = var.subnet_name
machine_type = var.machine_type
zone = var.zone
static_ip = module.network.static_ip
}

# resource "time_sleep" "creating_vm" {
# depends_on = [module.vm]
# create_duration = "60s"
# }
resource "time_sleep" "creating_vm" {
depends_on = [module.vm]
create_duration = "10s"
}

module "os_login" {
depends_on = [time_sleep.creating_network]
depends_on = [time_sleep.creating_vm]
source = "../modules/os_login"
project_id = var.project_id
ssh_key_file = var.ssh_key_file
Expand Down