Skip to content

Commit 6dd46d1

Browse files
nvnmandadhinvnmandadhi
authored
chore: add gke island cluster anywhere in GCP design (terraform-google-modules#1967)
1 parent 329c08f commit 6dd46d1

File tree

9 files changed

+650
-0
lines changed

9 files changed

+650
-0
lines changed

‎examples/island_cluster_anywhere_in_gcp_design/README.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# GKE island cluster anywhere in GCP design
2+
3+
This example provisions a cluster in an island VPC allowing reuse of the IP address space for multiple clusters across different GCP organizations.
4+
5+
## Deploy
6+
7+
1. Create NCC hub.
8+
2. Update `ncc_hub_project_id`, `ncc_hub_name`, `network_name` and gke spokes in `terraform.tfvars`.
9+
3. Run `terraform apply`.
10+
11+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
12+
## Inputs
13+
14+
| Name | Description | Type | Default | Required |
15+
|------|-------------|------|---------|:--------:|
16+
| gke\_spokes | n/a | `any` | n/a | yes |
17+
| ingress\_ip\_addrs\_subnet\_cidr | Subnet to use for reserving internal ip addresses for the ILBs. | `string` | n/a | yes |
18+
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | `list(object({ cidr_block = string, display_name = string }))` | n/a | yes |
19+
| ncc\_hub\_name | n/a | `string` | n/a | yes |
20+
| ncc\_hub\_project\_id | n/a | `string` | n/a | yes |
21+
| net\_attachment\_subnet\_cidr | Subnet for the router PSC interface network attachment in island network. | `string` | n/a | yes |
22+
| node\_locations | n/a | `list(string)` | n/a | yes |
23+
| primary\_net\_name | Primary VPC network name. | `string` | n/a | yes |
24+
| primary\_subnet | Subnet to use in primary network to deploy the router. | `string` | n/a | yes |
25+
| proxy\_subnet\_cidr | CIDR for the regional managed proxy subnet. | `string` | n/a | yes |
26+
| region | n/a | `string` | n/a | yes |
27+
| router\_machine\_type | n/a | `string` | n/a | yes |
28+
| secondary\_ranges | n/a | `map(string)` | n/a | yes |
29+
| subnet\_cidr | Primary subnet CIDR used by the cluster. | `string` | n/a | yes |
30+
31+
## Outputs
32+
33+
| Name | Description |
34+
|------|-------------|
35+
| cluster\_ids | n/a |
36+
37+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/island_cluster_anywhere_in_gcp_design/main.tf

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "random_id" "rand" {
18+
byte_length = 4
19+
}
20+
21+
resource "google_service_account" "gke-sa" {
22+
for_each = { for k, v in var.gke_spokes : k => v }
23+
24+
account_id = "gke-sa-${random_id.rand.hex}"
25+
project = each.value["project_id"]
26+
}
27+
28+
module "gke" {
29+
source = "terraform-google-modules/kubernetes-engine/google//modules/beta-private-cluster"
30+
version = "~> 31.0"
31+
32+
for_each = { for k, v in var.gke_spokes : k => v }
33+
34+
name = each.value["cluster_name"]
35+
project_id = each.value["project_id"]
36+
region = var.region
37+
release_channel = "RAPID"
38+
zones = var.node_locations
39+
network = module.net[each.key].network_name
40+
subnetwork = "${each.value["cluster_name"]}-${var.region}-snet"
41+
ip_range_pods = "${each.value["cluster_name"]}-${var.region}-snet-pods"
42+
ip_range_services = "${each.value["cluster_name"]}-${var.region}-snet-services"
43+
enable_private_endpoint = true
44+
enable_private_nodes = true
45+
datapath_provider = "ADVANCED_DATAPATH"
46+
monitoring_enable_managed_prometheus = false
47+
enable_shielded_nodes = true
48+
master_global_access_enabled = false
49+
master_ipv4_cidr_block = var.secondary_ranges["master_cidr"]
50+
master_authorized_networks = var.master_authorized_networks
51+
deletion_protection = false
52+
remove_default_node_pool = true
53+
disable_default_snat = true
54+
gateway_api_channel = "CHANNEL_STANDARD"
55+
56+
node_pools = [
57+
{
58+
name = "default"
59+
machine_type = "e2-highcpu-2"
60+
min_count = 1
61+
max_count = 100
62+
local_ssd_count = 0
63+
spot = true
64+
local_ssd_ephemeral_count = 0
65+
disk_size_gb = 100
66+
disk_type = "pd-standard"
67+
image_type = "COS_CONTAINERD"
68+
logging_variant = "DEFAULT"
69+
auto_repair = true
70+
auto_upgrade = true
71+
service_account = google_service_account.gke-sa[each.key].email
72+
initial_node_count = 1
73+
enable_secure_boot = true
74+
},
75+
]
76+
77+
node_pools_tags = {
78+
all = ["gke-${random_id.rand.hex}"]
79+
}
80+
81+
node_pools_oauth_scopes = {
82+
all = [
83+
"https://www.googleapis.com/auth/logging.write",
84+
"https://www.googleapis.com/auth/monitoring",
85+
]
86+
}
87+
88+
timeouts = {
89+
create = "15m"
90+
update = "15m"
91+
delete = "15m"
92+
}
93+
}

‎examples/island_cluster_anywhere_in_gcp_design/manifests/k8s.yaml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: apps/v1
16+
kind: Deployment
17+
metadata:
18+
name: whereami
19+
spec:
20+
replicas: 3
21+
selector:
22+
matchLabels:
23+
app: whereami
24+
template:
25+
metadata:
26+
labels:
27+
app: whereami
28+
spec:
29+
containers:
30+
- name: whereami
31+
image: us-docker.pkg.dev/google-samples/containers/gke/whereami:v1.2.19
32+
ports:
33+
- name: http
34+
containerPort: 8080
35+
resources:
36+
requests:
37+
cpu: "50m"
38+
memory: 128Mi
39+
limits:
40+
cpu: "100m"
41+
memory: 256Mi
42+
readinessProbe:
43+
httpGet:
44+
path: /healthz
45+
port: 8080
46+
scheme: HTTP
47+
initialDelaySeconds: 5
48+
timeoutSeconds: 1
49+
---
50+
apiVersion: v1
51+
kind: Service
52+
metadata:
53+
name: whereami
54+
spec:
55+
type: ClusterIP
56+
selector:
57+
app: whereami
58+
ports:
59+
- port: 80
60+
targetPort: 8080
61+
protocol: TCP
62+
---
63+
kind: Gateway
64+
apiVersion: gateway.networking.k8s.io/v1beta1
65+
metadata:
66+
name: l7-ilb
67+
spec:
68+
gatewayClassName: gke-l7-rilb
69+
listeners:
70+
- name: http
71+
protocol: HTTP
72+
port: 80
73+
addresses:
74+
- type: NamedAddress
75+
value: gke-spoke-1-l7-rilb-ip
76+
---
77+
kind: HTTPRoute
78+
apiVersion: gateway.networking.k8s.io/v1beta1
79+
metadata:
80+
name: whereami
81+
spec:
82+
parentRefs:
83+
- kind: Gateway
84+
name: l7-ilb
85+
rules:
86+
- backendRefs:
87+
- name: whereami
88+
port: 80

0 commit comments

Comments
 (0)