Skip to content

Commit 5d25e15

Browse files
AlexBulankouAlexBulankou
authored
chore: Adding examples to accompany GCP blog that highlights GKE ACM features (terraform-google-modules#973)
* Adding examples to accompany GCP blog that highlights GKE ACM features * Addressing comments * Addressing comments * Addressing comments * Addressing comments * Addressing comments * Addressing comments * Addressing comments * Addressing comments * Addressing comments
1 parent e00286f commit 5d25e15

30 files changed

+1284
-0
lines changed

‎examples/acm-terraform-blog-part1/README.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Enable ACM features with Terraform - Part 1
2+
3+
This is Part1 of the tutorial to accompany a short series of blog articles explaining how to enable [Anthos Config Management (ACM)](https://cloud.google.com/anthos/config-management) with Terraform.
4+
5+
In this tutorial, we'll explain how to use Teraform to create a cluster and manage its config from git via [Config Sync](https://cloud.google.com/anthos-config-management/docs/config-sync-overview).
6+
7+
[Next part](../acm-terraform-blog-part2) will build on that to add guard rails for the cluster via [Policy Controller](https://cloud.google.com/anthos-config-management/docs/concepts/policy-controller). We will focus on enabling an ongoing audit of cluster resources using the Policy Controller's built in [Policy Library](http://cloud/anthos-config-management/docs/reference/constraint-template-library) and a bundle of constraints enforcings [CIS Kubernetes Benchmark v.1.5.1](https://cloud.google.com/kubernetes-engine/docs/concepts/cis-benchmarks).
8+
9+
Subsequent articles will discuss other aspects of ACM to manage your GCP infrastrcuture.
10+
11+
## Enable Config Sync on the cluster with Terraform
12+
13+
1. Clone this repo
14+
1. Set variables that will be used in multiple commands:
15+
16+
```bash
17+
FOLDER_ID = [FOLDER]
18+
BILLING_ACCOUNT = [BILLING_ACCOUNT]
19+
PROJECT_ID = [PROJECT_ID]
20+
```
21+
22+
1. Create project:
23+
24+
```bash
25+
gcloud auth login
26+
gcloud projects create $PROJECT_ID --name=$PROJECT_ID --folder=$FOLDER_ID
27+
gcloud alpha billing projects link $PROJECT_ID --billing-account $BILLING_ACCOUNT
28+
gcloud config set project $PROJECT_ID
29+
```
30+
31+
1. Create cluster using terraform using defaults other than the project:
32+
33+
```bash
34+
# obtain user access credentials to use for Terraform commands
35+
gcloud auth application-default login
36+
37+
# continue in /terraform directory
38+
cd terraform
39+
40+
terraform init
41+
terraform plan -var=project=$PROJECT_ID
42+
terraform apply -var=project=$PROJECT_ID
43+
```
44+
NOTE: if you get an error due to default network not being present, run `gcloud compute networks create default --subnet-mode=auto` and retry the commands.
45+
46+
1. To verify things have sync'ed, you can use `gcloud` to check status:
47+
48+
```bash
49+
gcloud alpha container hub config-management status --project $PROJECT_ID
50+
```
51+
52+
In the output, notice that the `Status` will eventually show as `SYNCED` and the `Last_Synced_Token` will match the repo hash.
53+
54+
1. To see wordpress itself, you can use the kubectl proxy to connect to the service:
55+
56+
```bash
57+
# get values from cluster that was created
58+
export CLUSTER_ZONE=$(terraform output -raw cluster_location)
59+
export CLUSTER_NAME=$(terraform output -raw cluster_name)
60+
61+
# then get creditials for it and proxy to the wordpress service to see it running
62+
gcloud container clusters get-credentials $CLUSTER_NAME --zone $CLUSTER_ZONE --project $PROJECT_ID
63+
kubectl proxy --port 8888 &
64+
65+
# curl or use the browser
66+
curl http://127.0.0.1:8888/api/v1/namespaces/default/services/wordpress/proxy/wp-admin/install.php
67+
68+
```
69+
70+
1. Finally, let's clean up. First, don't forget to foreground the proxy again to kill it. Also, apply `terraform destroy` to remove the GCP resources that were deployed to the project.
71+
72+
```bash
73+
fg # ctrl-c
74+
75+
terraform destroy -var=project=$PROJECT_ID
76+
```

‎examples/acm-terraform-blog-part1/config-root/wordpress-bundle.yaml

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# Copyright 2021 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: v1
16+
kind: ConfigMap
17+
metadata:
18+
name: wp-config
19+
data:
20+
### We're using a ConfigMap for simplicity, but in real life one should
21+
### use a secret manager or other best practice for this database password.
22+
MYSQL_ROOT_PASSWORD: "wp_user"
23+
---
24+
apiVersion: v1
25+
kind: Service
26+
metadata:
27+
name: wordpress-mysql
28+
labels:
29+
app: wordpress
30+
spec:
31+
ports:
32+
- port: 3306
33+
selector:
34+
app: wordpress
35+
tier: mysql
36+
clusterIP: None
37+
---
38+
apiVersion: v1
39+
kind: PersistentVolumeClaim
40+
metadata:
41+
name: mysql-pvc
42+
labels:
43+
app: wordpress
44+
spec:
45+
accessModes:
46+
- ReadWriteOnce
47+
resources:
48+
requests:
49+
storage: 5Gi
50+
---
51+
apiVersion: apps/v1
52+
kind: Deployment
53+
metadata:
54+
name: wordpress-mysql
55+
labels:
56+
app: wordpress
57+
spec:
58+
selector:
59+
matchLabels:
60+
app: wordpress
61+
tier: mysql
62+
strategy:
63+
type: Recreate
64+
template:
65+
metadata:
66+
labels:
67+
app: wordpress
68+
tier: mysql
69+
spec:
70+
containers:
71+
- image: mariadb:latest
72+
name: mysql
73+
env:
74+
- name: MYSQL_ROOT_PASSWORD
75+
valueFrom:
76+
configMapKeyRef:
77+
name: wp-config
78+
key: MYSQL_ROOT_PASSWORD
79+
ports:
80+
- containerPort: 3306
81+
name: mysql
82+
volumeMounts:
83+
- name: mysql-persistent-storage
84+
mountPath: /var/lib/mysql
85+
volumes:
86+
- name: mysql-persistent-storage
87+
persistentVolumeClaim:
88+
claimName: mysql-pvc
89+
---
90+
apiVersion: v1
91+
kind: Service
92+
metadata:
93+
name: wordpress
94+
labels:
95+
app: wordpress
96+
spec:
97+
ports:
98+
- port: 80
99+
selector:
100+
app: wordpress
101+
tier: frontend
102+
---
103+
apiVersion: v1
104+
kind: PersistentVolumeClaim
105+
metadata:
106+
name: wp-pvc
107+
labels:
108+
app: wordpress
109+
spec:
110+
accessModes:
111+
- ReadWriteOnce
112+
resources:
113+
requests:
114+
storage: 5Gi
115+
---
116+
apiVersion: apps/v1
117+
kind: Deployment
118+
metadata:
119+
name: wordpress
120+
labels:
121+
app: wordpress
122+
spec:
123+
selector:
124+
matchLabels:
125+
app: wordpress
126+
tier: frontend
127+
strategy:
128+
type: Recreate
129+
template:
130+
metadata:
131+
labels:
132+
app: wordpress
133+
tier: frontend
134+
spec:
135+
containers:
136+
- image: wordpress:4.8-apache
137+
name: wordpress
138+
env:
139+
- name: WORDPRESS_DB_HOST
140+
value: wordpress-mysql
141+
- name: WORDPRESS_DB_PASSWORD
142+
valueFrom:
143+
configMapKeyRef:
144+
name: wp-config
145+
key: MYSQL_ROOT_PASSWORD
146+
ports:
147+
- containerPort: 80
148+
name: wordpress
149+
volumeMounts:
150+
- name: wordpress-persistent-storage
151+
mountPath: /var/www/html
152+
volumes:
153+
- name: wordpress-persistent-storage
154+
persistentVolumeClaim:
155+
claimName: wp-pvc

‎examples/acm-terraform-blog-part1/terraform/gke.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "enabled_google_apis" {
18+
source = "terraform-google-modules/project-factory/google//modules/project_services"
19+
version = "~> 10.0"
20+
21+
project_id = var.project
22+
disable_services_on_destroy = false
23+
24+
activate_apis = [
25+
"compute.googleapis.com",
26+
"container.googleapis.com",
27+
"gkehub.googleapis.com",
28+
"anthosconfigmanagement.googleapis.com"
29+
]
30+
}
31+
32+
module "gke" {
33+
source = "terraform-google-modules/kubernetes-engine/google"
34+
version = "~> 16.0"
35+
project_id = module.enabled_google_apis.project_id
36+
name = "sfl-acm-part1"
37+
region = var.region
38+
zones = [var.zone]
39+
initial_node_count = 4
40+
network = "default"
41+
subnetwork = "default"
42+
ip_range_pods = ""
43+
ip_range_services = ""
44+
}

‎examples/acm-terraform-blog-part1/terraform/main.tf

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/**
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "google_gke_hub_membership" "membership" {
18+
provider = google-beta
19+
membership_id = "membership-hub"
20+
endpoint {
21+
gke_cluster {
22+
resource_link = "//container.googleapis.com/${module.gke.cluster_id}"
23+
}
24+
}
25+
}
26+
27+
resource "google_gke_hub_feature" "configmanagement_acm_feature" {
28+
name = "configmanagement"
29+
location = "global"
30+
provider = google-beta
31+
}
32+
33+
resource "google_gke_hub_feature_membership" "feature_member" {
34+
provider = google-beta
35+
location = "global"
36+
feature = "configmanagement"
37+
membership = google_gke_hub_membership.membership.membership_id
38+
configmanagement {
39+
version = "1.8.0"
40+
config_sync {
41+
source_format = "unstructured"
42+
git {
43+
sync_repo = var.sync_repo
44+
sync_branch = var.sync_branch
45+
policy_dir = var.policy_dir
46+
secret_type = "none"
47+
}
48+
}
49+
}
50+
depends_on = [
51+
google_gke_hub_feature.configmanagement_acm_feature
52+
]
53+
}

‎examples/acm-terraform-blog-part1/terraform/outputs.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "cluster_location" {
18+
value = module.gke.location
19+
}
20+
21+
output "cluster_name" {
22+
value = module.gke.name
23+
}

‎examples/acm-terraform-blog-part1/terraform/providers.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_providers {
19+
google-beta = {
20+
source = "hashicorp/google-beta"
21+
version = "3.73.0"
22+
}
23+
}
24+
}
25+
provider "google-beta" {
26+
project = var.project
27+
region = var.region
28+
zone = var.zone
29+
}

0 commit comments

Comments
 (0)