Skip to content

Commit a590cd8

Browse files
glasntglasnt
authored
Merge branch 'main' into main
2 parents e72e98e + 91eb5b9 commit a590cd8

File tree

10 files changed

+633
-80
lines changed

10 files changed

+633
-80
lines changed

‎bigquery/bigquery_create_connection_cloud_resource/main.tf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
# [START bigquery_create_connection_cloud_resource_iam]
18+
# [START bigquery_create_connection_cloud_resource]
19+
20+
# This queries the provider for project information.
21+
data "google_project" "default" {}
22+
23+
# This creates a cloud resource connection in the US region named my_cloud_resource_connection.
24+
# Note: The cloud resource nested object has only one output field - serviceAccountId.
25+
resource "google_bigquery_connection" "default" {
26+
connection_id = "my_cloud_resource_connection"
27+
project = data.google_project.default.project_id
28+
location = "US"
29+
cloud_resource {}
30+
}
31+
# [END bigquery_create_connection_cloud_resource]
32+
33+
## This grants IAM role access to the service account of the connection created in the previous step.
34+
resource "google_project_iam_member" "connectionPermissionGrant" {
35+
project = data.google_project.default.project_id
36+
role = "roles/storage.objectViewer"
37+
member = "serviceAccount:${google_bigquery_connection.default.cloud_resource[0].service_account_id}"
38+
}
39+
# [END bigquery_create_connection_cloud_resource_iam]

‎gke/autopilot/iap/main.tf‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
# The kubernetes_manifest resource can only be used with pre-existing clusters.
18+
# To create the cluster in advance run:
19+
# `terraform apply -target=google_container_cluster.default`
20+
resource "google_container_cluster" "default" {
21+
name = "gke-autopilot-basic"
22+
location = "us-central1"
23+
24+
enable_autopilot = true
25+
26+
# Set `deletion_protection` to `true` will ensure that one cannot
27+
# accidentally delete this instance by use of Terraform.
28+
deletion_protection = false
29+
}
30+
31+
# Required for internal ingress
32+
resource "google_compute_subnetwork" "default" {
33+
name = "proxy-subnetwork"
34+
ip_cidr_range = "10.2.0.0/16"
35+
region = google_container_cluster.default.location
36+
network = "default"
37+
purpose = "REGIONAL_MANAGED_PROXY"
38+
role = "ACTIVE"
39+
}
40+
41+
# Required for internal ingress
42+
resource "google_compute_address" "default" {
43+
name = "hello-app-ip"
44+
address_type = "INTERNAL"
45+
region = google_container_cluster.default.location
46+
purpose = "SHARED_LOADBALANCER_VIP"
47+
}
48+
49+
data "google_client_config" "default" {}
50+
51+
provider "kubernetes" {
52+
host = "https://${google_container_cluster.default.endpoint}"
53+
token = data.google_client_config.default.access_token
54+
cluster_ca_certificate = base64decode(google_container_cluster.default.master_auth[0].cluster_ca_certificate)
55+
}
56+
57+
# [START gke_autopilot_iap_deployment]
58+
resource "kubernetes_deployment_v1" "default" {
59+
metadata {
60+
name = "hello-app-deployment"
61+
}
62+
63+
spec {
64+
selector {
65+
match_labels = {
66+
app = "hello-app"
67+
}
68+
}
69+
70+
template {
71+
metadata {
72+
labels = {
73+
app = "hello-app"
74+
}
75+
}
76+
77+
spec {
78+
container {
79+
image = "us-docker.pkg.dev/google-samples/containers/gke/hello-app:2.0"
80+
name = "hello-app-container"
81+
82+
port {
83+
container_port = 8080
84+
name = "hello-app-svc"
85+
}
86+
87+
security_context {
88+
allow_privilege_escalation = false
89+
privileged = false
90+
read_only_root_filesystem = false
91+
92+
capabilities {
93+
add = []
94+
drop = ["NET_RAW"]
95+
}
96+
}
97+
98+
liveness_probe {
99+
http_get {
100+
path = "/"
101+
port = "hello-app-svc"
102+
103+
http_header {
104+
name = "X-Custom-Header"
105+
value = "Awesome"
106+
}
107+
}
108+
109+
initial_delay_seconds = 3
110+
period_seconds = 3
111+
}
112+
}
113+
114+
security_context {
115+
run_as_non_root = true
116+
117+
seccomp_profile {
118+
type = "RuntimeDefault"
119+
}
120+
}
121+
122+
# Toleration is currently required to prevent perpetual diff:
123+
# https://github.com/hashicorp/terraform-provider-kubernetes/pull/2380
124+
toleration {
125+
effect = "NoSchedule"
126+
key = "kubernetes.io/arch"
127+
operator = "Equal"
128+
value = "amd64"
129+
}
130+
}
131+
}
132+
}
133+
134+
lifecycle {
135+
ignore_changes = [
136+
metadata[0].annotations["autopilot.gke.io/resource-adjustment"],
137+
metadata[0].annotations["autopilot.gke.io/warden-version"]
138+
]
139+
}
140+
}
141+
# [END gke_autopilot_iap_deployment]
142+
143+
# [START gke_autopilot_iap_service]
144+
resource "kubernetes_service_v1" "default" {
145+
metadata {
146+
name = "hello-app-service"
147+
annotations = {
148+
"cloud.google.com/backend-config" = "{\"ports\": {\"80\":\"${kubernetes_manifest.backendconfig.manifest.metadata.name}\"}}"
149+
"cloud.google.com/neg" = "{\"ingress\": true}"
150+
}
151+
}
152+
153+
spec {
154+
type = "ClusterIP"
155+
156+
selector = {
157+
app = kubernetes_deployment_v1.default.spec[0].selector[0].match_labels.app
158+
}
159+
160+
port {
161+
port = 80
162+
protocol = kubernetes_deployment_v1.default.spec[0].template[0].spec[0].container[0].port[0].protocol
163+
target_port = kubernetes_deployment_v1.default.spec[0].template[0].spec[0].container[0].port[0].container_port
164+
}
165+
}
166+
167+
lifecycle {
168+
ignore_changes = [
169+
metadata[0].annotations["cloud.google.com/neg-status"]
170+
]
171+
}
172+
173+
depends_on = [time_sleep.wait_service_cleanup]
174+
}
175+
# [END gke_autopilot_iap_service]
176+
177+
# [START gke_autopilot_iap_ingress]
178+
resource "kubernetes_ingress_v1" "default" {
179+
metadata {
180+
name = "hello-app-ingress"
181+
annotations = {
182+
"kubernetes.io/ingress.class" = "gce-internal" # Remove to create an external
183+
"ingress.gcp.kubernetes.io/pre-shared-cert" = google_compute_region_ssl_certificate.default.name
184+
"kubernetes.io/ingress.regional-static-ip-name" = google_compute_address.default.name
185+
}
186+
}
187+
188+
spec {
189+
rule {
190+
http {
191+
path {
192+
path = "/"
193+
path_type = "Prefix"
194+
backend {
195+
service {
196+
name = kubernetes_service_v1.default.metadata[0].name
197+
port {
198+
number = 80
199+
}
200+
}
201+
}
202+
}
203+
}
204+
}
205+
}
206+
207+
depends_on = [
208+
time_sleep.wait_service_cleanup,
209+
google_compute_subnetwork.default,
210+
google_compute_region_ssl_certificate.default
211+
]
212+
}
213+
# [END gke_autopilot_iap_ingress]
214+
215+
# [START gke_autopilot_iap_backendconfig]
216+
resource "kubernetes_manifest" "backendconfig" {
217+
manifest = {
218+
apiVersion = "cloud.google.com/v1"
219+
kind = "BackendConfig"
220+
221+
metadata = {
222+
name = "backendconfig"
223+
namespace = "default"
224+
}
225+
226+
spec = {
227+
iap = {
228+
enabled = true
229+
}
230+
timeoutSec = 40
231+
connectionDraining = {
232+
drainingTimeoutSec = 60
233+
}
234+
}
235+
}
236+
237+
depends_on = [time_sleep.wait_service_cleanup]
238+
}
239+
# [END gke_autopilot_iap_backendconfig]
240+
241+
# self-signed cert for internal ingress
242+
resource "google_compute_region_ssl_certificate" "default" {
243+
name_prefix = "iap-certificate-"
244+
private_key = tls_private_key.default.private_key_pem
245+
certificate = tls_self_signed_cert.default.cert_pem
246+
region = google_container_cluster.default.location
247+
lifecycle {
248+
create_before_destroy = true
249+
}
250+
}
251+
252+
resource "tls_private_key" "default" {
253+
algorithm = "RSA"
254+
}
255+
256+
resource "tls_self_signed_cert" "default" {
257+
private_key_pem = tls_private_key.default.private_key_pem
258+
259+
validity_period_hours = 12
260+
early_renewal_hours = 3
261+
262+
allowed_uses = [
263+
"key_encipherment",
264+
"digital_signature",
265+
"server_auth",
266+
]
267+
268+
dns_names = ["localhost"]
269+
270+
subject {
271+
common_name = "localhost"
272+
organization = "terrraform-docs-samples"
273+
}
274+
}
275+
276+
# Provide time for service cleanup
277+
resource "time_sleep" "wait_service_cleanup" {
278+
depends_on = [google_container_cluster.default]
279+
280+
destroy_duration = "180s"
281+
}

‎gke/autopilot/iap/test.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# The kubernetes_manifest resource can only be used with pre-existing clusters.
16+
apiVersion: blueprints.cloud.google.com/v1alpha1
17+
kind: BlueprintTest
18+
metadata:
19+
name: gke_autopilot_iap
20+
spec:
21+
skip: true

0 commit comments

Comments
 (0)