osinfra-io / terraform-google-kubernetes-engine

Terraform example module for Google Cloud Platform Kubernetes Engine cluster.

Google Cloud Platform - Kubernetes Engine Terraform Module

GitHub Actions:

Infracost:

💵 Monthly estimates based on Infracost baseline costs.

Repository Description

Terraform example module for a Google Cloud Platform Kubernetes engine cluster.

Note

We do not recommend consuming this module like you might a public module. It is a baseline, something you can fork, potentially maintain, and modify to fit your organization's needs. Using public modules vs. writing your own has various drivers and trade-offs that your organization should evaluate.

🔩 Usage

Tip

You can check the tests/fixtures directory for example configurations. These fixtures set up the system for testing by providing all the necessary initial code, thus creating good examples on which to base your configurations.

Google project services must be enabled before using this module. As a best practice, these should be defined in the terraform-google-project module. The following services are required:

• container.googleapis.com
• cloudkms.googleapis.com
• cloudresourcemanager.googleapis.com
• gkehub.googleapis.com (Only needed if the project is a GKE Fleet host project)
• multiclusteringress.googleapis.com (Only needed if the project is a GKE Fleet host project)
• multiclusterservicediscovery.googleapis.com
• trafficdirector.googleapis.com

NOTE: The autoscaling profile feature requires the google-beta provider. Include this provider in your root module required_providers block if you use GitHub Dependabot.

Development

Our focus is on the core fundamental practice of platform engineering, Infrastructure as Code.

Open Source Infrastructure (as Code) is a development model for infrastructure that focuses on open collaboration and applying relative lessons learned from software development practices that organizations can use internally at scale. - Open Source Infrastructure (as Code)

To avoid slowing down stream-aligned teams, we want to open up the possibility for contributions. The Open Source Infrastructure (as Code) model allows team members external to the platform team to contribute with only a slight increase in cognitive load. This section is for developers who want to contribute to this repository, describing the tools used, the skills, and the knowledge required, along with Terraform documentation.

See the documentation for setting up a local development environment here.

🛠️ Tools

• helm
• infracost
• pre-commit
• pre-commit-terraform
• terraform-docs

📋 Skills and Knowledge

Links to documentation and other resources required to develop and iterate in this repository successfully.

• istio
  • istio on gke
• kubernetes engine
  • multi cluster ingress
  • node pools
  • RBAC
  • workload identity
• shared vpc
  • cluster creation

🔍 Tests

You'll need to be a member of the platform-contributors Google Group to run the tests. This group manages access to Testing/Sandbox folder in the resource hierarchy. You can request access to this group by opening an issue here.

terraform init

terraform test

📓 Terraform Documentation

A child module automatically inherits default (un-aliased) provider configurations from its parent. The provider versions below are informational only and do not need to align with the provider configurations from its parent.

Requirements

No requirements.

Providers

Name	Version
google	5.36.0
random	3.6.2

Modules

No modules.

Resources

Name	Type
google_compute_global_address.istio_gateway_mci	resource
google_compute_managed_ssl_certificate.istio_gateway_mci	resource
google_compute_ssl_policy.default	resource
google_dns_record_set.istio_gateway_mci	resource
google_project_iam_member.container_deployer	resource
google_project_iam_member.gke_hub_service_agent	resource
google_project_iam_member.host_project_network_viewer	resource
google_project_iam_member.multi_cluster_service_agent	resource
google_project_iam_member.service_project_network_viewer	resource
google_service_account.kubernetes_workload_identity	resource
google_service_account_iam_member.workload_identity	resource
random_id.this	resource
google_project.fleet_host	data source

Inputs

Name	Description	Type	Default	Required
gke_fleet_host_project_id	The project ID of the GKE Hub host project	string	""	no
istio_gateway_dns	Map of attributes for the Istio gateway domain names, it is also used to create the managed certificate resource	map(object({ managed_zone = string project = string }))	{}	no
namespaces	A map of namespaces with the Google service account used for the namespace administrator and whether Istio injection is enabled or disabled	map(object({ google_service_account = string istio_injection = optional(string, "disabled") }))	{}	no
project	The ID of the project in which the resource belongs	string	n/a	yes

Outputs

Name	Description
container_deployer_service_accounts	The service accounts for the container deployer
gke_fleet_host_project_number	The project number of the fleet host project
istio_gateway_mci_global_address	The IP address for the Istio Gateway multi-cluster ingress
istio_gateway_mci_ssl_certificate_name	The name of the SSL certificate for the Istio Gateway multi-cluster ingress
workload_identity_service_account_emails	The email addresses of the service accounts for the Kubernetes namespace workload identity

📓 Terraform Regional Documentation

• regional
• regional/istio
• regional/mci
• regional/onboarding