search

aibangjuxin / groovy

study groovy
1 stars 0 forks source link

- Create GKE by Terraform #145

Open aibangjuxin opened 3 weeks ago

aibangjuxin commented 3 weeks ago 
provider "google" {
  credentials = file("./sa.json")
  project     = "${var.project}"
  region      = "asia-east1"
}

resource "google_container_cluster" "private_cluster" {
  provider = google-beta
  project = "${var.project}"

  name     = "private-cluster"
  location = "asia-east1"

  network = google_compute_network.vpc_network.self_link
  subnetwork = google_compute_subnetwork.subnet.self_link

  private_cluster_config {
    enable_private_nodes   = true
    enable_private_endpoint = true
    master_ipv4_cidr_block = "172.16.0.0/28"
  }

  master_authorized_networks_config {
    cidr_blocks {
      cidr_block   = "192.168.64.0/24"
      display_name = "any"
    }
  }

  ip_allocation_policy {}

  remove_default_node_pool = true
  initial_node_count       = 1

  workload_identity_config {
    workload_pool = "${var.project}.svc.id.goog"
  }

  monitoring_config {
    enable_components = [ "SYSTEM_COMPONENTS", "APISERVER", "CONTROLLER_MANAGER", "SCHEDULER" ]

    managed_prometheus {
      enabled = true
    }
  }
}

resource "google_container_node_pool" "private_cluster_node_pool" {
  provider = google-beta
  project = "${var.project}"

  name     = "private-cluster-node-pool"
  location = "asia-east1"
  cluster  = google_container_cluster.private_cluster.name

  node_count = 1

  node_config {
    machine_type = "n1-standard-1"
    oauth_scopes = [
      "https://www.googleapis.com/auth/cloud-platform"
    ]

    metadata = {
      disable-legacy-endpoints = "true"
    }

    tags = ["no-external-ip"]
  }
}

resource "google_compute_network" "vpc_network" {
  name = "gke-network"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "subnet" {
  name          = "subnet"
  ip_cidr_range = "192.168.64.0/24"
  region        = "asia-east1"
  network       = google_compute_network.vpc_network.self_link
}

resource "google_compute_instance" "squid_proxy" {
  name         = "squid-proxy"
  machine_type = "n1-standard-1"
  zone         = "asia-east1-a"

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2004-lts"
    }
  }

  network_interface {
    network    = google_compute_network.vpc_network.name
    subnetwork = google_compute_subnetwork.subnet.name

    access_config {
    }
  }

  metadata_startup_script = <<-EOT
    #! /bin/bash
    sudo apt-get update
    sudo apt-get install -y squid
    sudo sed -i 's/http_access deny all/http_access allow all/' /etc/squid/squid.conf
    sudo systemctl restart squid
  EOT

  service_account {
    scopes = [
      "https://www.googleapis.com/auth/cloud-platform"
    ]
  }

  tags = ["squid-proxy"]
}

resource "google_compute_firewall" "no_external_ip_firewall" {
  name    = "no-external-ip-firewall"
  network = google_compute_network.vpc_network.self_link
  priority = 65535

  source_ranges = ["0.0.0.0/0"]

  target_tags = ["no-external-ip"]

  deny {
    protocol = "icmp"
  }

  deny {
    protocol = "tcp"
  }

  deny {
    protocol = "udp"
  }
}

resource "google_compute_firewall" "allow_ports_firewall" {
  name    = "allow-squid"
  network = google_compute_network.vpc_network.name

  allow {
    protocol = "tcp"
    ports    = ["3128"]
  }

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["0.0.0.0/0"]
  target_tags = ["squid-proxy"]

  description = "Allow traffic on port 3128 for Squid proxy from the GKE cluster subnet"
}

resource "google_compute_firewall" "allow_proxy_to_pod" {
  name    = "allow-proxy-to-pod"
  network = google_compute_network.vpc_network.name

  allow {
    protocol = "tcp"
    ports    = ["8080"]
  }

  allow {
    protocol = "tcp"
    ports    = ["80"]
  }

  source_ranges = ["192.168.1.0/24"]

  description = "Allow traffic from proxy subnet to GKE Pods on port 8080"
}

variable "project" {
  default = "causal-hour-418204"
  type = string
}

gcloud iam service-accounts add-iam-policy-binding collector@causal-hour-418204.iam.gserviceaccount.com \ --member="serviceAccount:causal-hour-418204.svc.id.goog[gmp-system/collector]" \ --role="roles/iam.workloadIdentityUser" \ --project=causal-hour-418204

gcloud projects add-iam-policy-binding causal-hour-418204 \ --member="serviceAccount:collector@causal-hour-418204.iam.gserviceaccount.com" \ --role="roles/monitoring.metricWriter"

kubectl annotate serviceaccount collector --namespace gmp-system \ iam.gke.io/gcp-service-account=collector@causal-hour-418204.iam.gserviceaccount.com

gcloud iam service-accounts create prometheus-ui --project=causal-hour-418204

gcloud iam service-accounts add-iam-policy-binding prometheus-ui@causal-hour-418204.iam.gserviceaccount.com \ --member="serviceAccount:causal-hour-418204.svc.id.goog[monitoring/prometheus-ui]" \ --role="roles/iam.workloadIdentityUser" \ --project=causal-hour-418204

gcloud projects add-iam-policy-binding causal-hour-418204 \ --member="serviceAccount:prometheus-ui@causal-hour-418204.iam.gserviceaccount.com" \ --role="roles/monitoring.viewer"

kubectl annotate serviceaccount prometheus-ui --namespace monitoring \ iam.gke.io/gcp-service-account=prometheus-ui@causal-hour-418204.iam.gserviceaccount.com


- Deploy Node_exporter

apiVersion: v1 kind: Namespace metadata: name: monitoring

apiVersion: v1 kind: ServiceAccount metadata: name: node-exporter namespace: monitoring

kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: psp-node-exporter labels: app: node-exporter rules:

Originally posted by @zking2000 in https://github.com/zking2000/NotePad/issues/18