Feat/Kubernetes Private Cluster

.gitignore

@@ -295,6 +295,8 @@ override.tf.json
 .terraformrc
 terraform.rc
 terraform-*-plan*
+tfplan
+*.tfplan
 
 # DeepEval
 .deepeval/

terraform/infrastructure/envs/dev/main.tf

@@ -23,9 +23,30 @@ module "dev" {
   region             = var.region
   network_cidr       = "10.2.0.0/15"
   create_gke_subnets = true
-  node_cidr         = "10.2.0.0/23"
-  ilb_cidr          = "10.2.2.0/23"
-  master_cidr       = "10.2.4.0/28"
-  pod_cidr          = "10.3.0.0/17"
-  service_cidr      = "10.3.128.0/17"
+  node_cidr          = "10.2.0.0/23"
+  ilb_cidr           = "10.2.2.0/23"
+  master_cidr        = "10.2.4.0/28"
+  pod_cidr           = "10.3.0.0/17"
+  service_cidr       = "10.3.128.0/17"
+}
+
+module "gke_dev" {
+  source = "../../modules/kubernetes/gcp"
+
+  project_id             = var.project_id
+  environment            = "dev"
+  region                 = var.region
+  vpc_name               = module.dev.vpc_name
+  nodes_subnet_self_link = module.dev.subnet_self_links["nodes"]
+  master_cidr            = "10.2.4.0/28"
+  node_cidr              = "10.2.0.0/23"
+  pod_cidr               = "10.3.0.0/17"
+  service_cidr           = "10.3.128.0/17"
+  wireguard_cidr         = var.wireguard_cidr
+  machine_type           = "e2-medium"
+  min_node_count         = 1
+  max_node_count         = 2
+  deletion_protection    = false
+
+  depends_on = [module.dev]
 }

terraform/infrastructure/envs/dev/outputs.tf

@@ -13,3 +13,11 @@ output "subnet_ids" {
 output "secondary_ranges" {
   value = module.dev.secondary_ranges
 }
+
+output "cluster_name" {
+  value = module.gke_dev.cluster_name
+}
+output "cluster_endpoint" {
+  value     = module.gke_dev.cluster_endpoint
+  sensitive = true
+}

terraform/infrastructure/envs/dev/variables.tf

@@ -7,3 +7,9 @@ variable "region" {
   description = "GCP region"
   type        = string
 }
+
+variable "wireguard_cidr" {
+  description = "WireGuard VPN CIDR for GKE master authorized networks"
+  type        = string
+  default     = "10.0.0.0/24"
+}

terraform/infrastructure/envs/prd/main.tf

@@ -23,9 +23,30 @@ module "prd" {
   region             = var.region
   network_cidr       = "10.6.0.0/15"
   create_gke_subnets = true
-  node_cidr         = "10.6.0.0/23"
-  ilb_cidr          = "10.6.2.0/23"
-  master_cidr       = "10.6.4.0/28"
-  pod_cidr          = "10.7.0.0/17"
-  service_cidr      = "10.7.128.0/17"
+  node_cidr          = "10.6.0.0/23"
+  ilb_cidr           = "10.6.2.0/23"
+  master_cidr        = "10.6.4.0/28"
+  pod_cidr           = "10.7.0.0/17"
+  service_cidr       = "10.7.128.0/17"
+}
+
+module "gke_prd" {
+  source = "../../modules/kubernetes/gcp"
+
+  project_id             = var.project_id
+  environment            = "prd"
+  region                 = var.region
+  vpc_name               = module.prd.vpc_name
+  nodes_subnet_self_link = module.prd.subnet_self_links["nodes"]
+  master_cidr            = "10.6.4.0/28"
+  node_cidr              = "10.6.0.0/23"
+  pod_cidr               = "10.7.0.0/17"
+  service_cidr           = "10.7.128.0/17"
+  wireguard_cidr         = var.wireguard_cidr
+  machine_type           = "e2-standard-4"
+  min_node_count         = 2
+  max_node_count         = 5
+  deletion_protection    = true
+
+  depends_on = [module.prd]
 }

terraform/infrastructure/envs/prd/outputs.tf

@@ -13,3 +13,11 @@ output "subnet_ids" {
 output "secondary_ranges" {
   value = module.prd.secondary_ranges
 }
+
+output "cluster_name" {
+  value = module.gke_prd.cluster_name
+}
+output "cluster_endpoint" {
+  value     = module.gke_prd.cluster_endpoint
+  sensitive = true
+}

terraform/infrastructure/envs/prd/variables.tf

@@ -7,3 +7,9 @@ variable "region" {
   description = "GCP region"
   type        = string
 }
+
+variable "wireguard_cidr" {
+  description = "WireGuard VPN CIDR for GKE master authorized networks"
+  type        = string
+  default     = "10.0.0.0/24"
+}

terraform/infrastructure/envs/stg/main.tf

@@ -23,9 +23,30 @@ module "stg" {
   region             = var.region
   network_cidr       = "10.4.0.0/15"
   create_gke_subnets = true
-  node_cidr         = "10.4.0.0/23"
-  ilb_cidr          = "10.4.2.0/23"
-  master_cidr       = "10.4.4.0/28"
-  pod_cidr          = "10.5.0.0/17"
-  service_cidr      = "10.5.128.0/17"
+  node_cidr          = "10.4.0.0/23"
+  ilb_cidr           = "10.4.2.0/23"
+  master_cidr        = "10.4.4.0/28"
+  pod_cidr           = "10.5.0.0/17"
+  service_cidr       = "10.5.128.0/17"
+}
+
+module "gke_stg" {
+  source = "../../modules/kubernetes/gcp"
+
+  project_id             = var.project_id
+  environment            = "stg"
+  region                 = var.region
+  vpc_name               = module.stg.vpc_name
+  nodes_subnet_self_link = module.stg.subnet_self_links["nodes"]
+  master_cidr            = "10.4.4.0/28"
+  node_cidr              = "10.4.0.0/23"
+  pod_cidr               = "10.5.0.0/17"
+  service_cidr           = "10.5.128.0/17"
+  wireguard_cidr         = var.wireguard_cidr
+  machine_type           = "e2-standard-2"
+  min_node_count         = 1
+  max_node_count         = 3
+  deletion_protection    = false
+
+  depends_on = [module.stg]
 }

terraform/infrastructure/envs/stg/outputs.tf

@@ -13,3 +13,11 @@ output "subnet_ids" {
 output "secondary_ranges" {
   value = module.stg.secondary_ranges
 }
+
+output "cluster_name" {
+  value = module.gke_stg.cluster_name
+}
+output "cluster_endpoint" {
+  value     = module.gke_stg.cluster_endpoint
+  sensitive = true
+}

terraform/infrastructure/envs/stg/variables.tf

@@ -7,3 +7,9 @@ variable "region" {
   description = "GCP region"
   type        = string
 }
+
+variable "wireguard_cidr" {
+  description = "WireGuard VPN CIDR for GKE master authorized networks"
+  type        = string
+  default     = "10.0.0.0/24"
+}

terraform/infrastructure/main.tf

@@ -36,11 +36,11 @@ module "dev" {
   region             = var.region
   network_cidr       = "10.2.0.0/15"
   create_gke_subnets = true
-  node_cidr         = "10.2.0.0/23"
-  ilb_cidr          = "10.2.2.0/23"
-  master_cidr       = "10.2.4.0/28"
-  pod_cidr          = "10.3.0.0/17"
-  service_cidr      = "10.3.128.0/17"
+  node_cidr          = "10.2.0.0/23"
+  ilb_cidr           = "10.2.2.0/23"
+  master_cidr        = "10.2.4.0/28"
+  pod_cidr           = "10.3.0.0/17"
+  service_cidr       = "10.3.128.0/17"
 }
 
 # stg VPC
@@ -52,11 +52,11 @@ module "stg" {
   region             = var.region
   network_cidr       = "10.4.0.0/15"
   create_gke_subnets = true
-  node_cidr         = "10.4.0.0/23"
-  ilb_cidr          = "10.4.2.0/23"
-  master_cidr       = "10.4.4.0/28"
-  pod_cidr          = "10.5.0.0/17"
-  service_cidr      = "10.5.128.0/17"
+  node_cidr          = "10.4.0.0/23"
+  ilb_cidr           = "10.4.2.0/23"
+  master_cidr        = "10.4.4.0/28"
+  pod_cidr           = "10.5.0.0/17"
+  service_cidr       = "10.5.128.0/17"
 }
 
 # prd VPC
@@ -68,11 +68,11 @@ module "prd" {
   region             = var.region
   network_cidr       = "10.6.0.0/15"
   create_gke_subnets = true
-  node_cidr         = "10.6.0.0/23"
-  ilb_cidr          = "10.6.2.0/23"
-  master_cidr       = "10.6.4.0/28"
-  pod_cidr          = "10.7.0.0/17"
-  service_cidr      = "10.7.128.0/17"
+  node_cidr          = "10.6.0.0/23"
+  ilb_cidr           = "10.6.2.0/23"
+  master_cidr        = "10.6.4.0/28"
+  pod_cidr           = "10.7.0.0/17"
+  service_cidr       = "10.7.128.0/17"
 }
 
 # VPC Peering: WireGuard <-> Dev (bidirectional)
@@ -113,3 +113,67 @@ resource "google_compute_network_peering" "prd_to_wireguard" {
   network      = module.prd.vpc_self_link
   peer_network = module.wireguard.vpc_self_link
 }
+
+# GKE private clusters (dev, stg, prd)
+module "gke_dev" {
+  source = "./modules/kubernetes/gcp"
+
+  project_id             = var.project_id
+  environment            = "dev"
+  region                 = var.region
+  vpc_name               = module.dev.vpc_name
+  nodes_subnet_self_link = module.dev.subnet_self_links["nodes"]
+  master_cidr            = "10.2.4.0/28"
+  node_cidr              = "10.2.0.0/23"
+  pod_cidr               = "10.3.0.0/17"
+  service_cidr           = "10.3.128.0/17"
+  wireguard_cidr         = var.wireguard_cidr
+  machine_type           = "e2-medium"
+  min_node_count         = 1
+  max_node_count         = 2
+  deletion_protection    = false
+
+  depends_on = [module.dev]
+}
+
+module "gke_stg" {
+  source = "./modules/kubernetes/gcp"
+
+  project_id             = var.project_id
+  environment            = "stg"
+  region                 = var.region
+  vpc_name               = module.stg.vpc_name
+  nodes_subnet_self_link = module.stg.subnet_self_links["nodes"]
+  master_cidr            = "10.4.4.0/28"
+  node_cidr              = "10.4.0.0/23"
+  pod_cidr               = "10.5.0.0/17"
+  service_cidr           = "10.5.128.0/17"
+  wireguard_cidr         = var.wireguard_cidr
+  machine_type           = "e2-standard-2"
+  min_node_count         = 1
+  max_node_count         = 3
+  deletion_protection    = false
+
+  depends_on = [module.stg]
+}
+
+module "gke_prd" {
+  source = "./modules/kubernetes/gcp"
+
+  project_id             = var.project_id
+  environment            = "prd"
+  region                 = var.region
+  vpc_name               = module.prd.vpc_name
+  nodes_subnet_self_link = module.prd.subnet_self_links["nodes"]
+  master_cidr            = "10.6.4.0/28"
+  node_cidr              = "10.6.0.0/23"
+  pod_cidr               = "10.7.0.0/17"
+  service_cidr           = "10.7.128.0/17"
+  wireguard_cidr         = var.wireguard_cidr
+  machine_type           = "e2-standard-4"
+  min_node_count         = 2
+  max_node_count         = 5
+  deletion_protection    = true
+
+  depends_on = [module.prd]
+}

terraform/infrastructure/modules/kubernetes/azure/main.tf

@@ -0,0 +1,11 @@
+# TODO: Azure AKS private cluster module (future implementation)
+# See design: private API server, workload identity, node pools, integration with existing VNet.
+
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 3.0"
+    }
+  }
+}

terraform/infrastructure/modules/kubernetes/azure/outputs.tf

@@ -0,0 +1,4 @@
+# TODO: Expected outputs for AKS module (future implementation)
+# - cluster_id, cluster_name, cluster_fqdn (private)
+# - kube_config (or kube_config_raw), cluster_identity
+# - private_fqdn, private_dns_zone_id

terraform/infrastructure/modules/kubernetes/azure/variables.tf

@@ -0,0 +1,6 @@
+# TODO: Expected variables for AKS module (future implementation)
+# - subscription_id, resource_group_name, location
+# - vnet_name, vnet_resource_group, subnet_id (cluster subnet from network module)
+# - environment (dev, stg, prd)
+# - kubernetes_version, node_count, vm_size
+# - workload_identity, user_assigned_identity_id (for AKS + Private DNS)

terraform/infrastructure/modules/kubernetes/gcp/cluster.tf

@@ -0,0 +1,39 @@
+resource "google_container_cluster" "cluster" {
+  name     = "gke-${var.environment}"
+  location = var.region
+  project  = var.project_id
+
+  network    = var.vpc_name
+  subnetwork = var.nodes_subnet_self_link
+
+  remove_default_node_pool = true
+  initial_node_count       = 1
+
+  private_cluster_config {
+    enable_private_endpoint = true
+    enable_private_nodes    = true
+    master_ipv4_cidr_block  = var.master_cidr
+  }
+
+  master_authorized_networks_config {
+    cidr_blocks {
+      cidr_block   = var.wireguard_cidr
+      display_name = "wireguard-vpn"
+    }
+  }
+
+  workload_identity_config {
+    workload_pool = "${var.project_id}.svc.id.goog"
+  }
+
+  ip_allocation_policy {
+    cluster_secondary_range_name  = var.pod_range_name
+    services_secondary_range_name = var.service_range_name
+  }
+
+  release_channel {
+    channel = var.release_channel
+  }
+
+  deletion_protection = var.deletion_protection
+}