-
Notifications
You must be signed in to change notification settings - Fork 33
/
Copy pathgke.tf
105 lines (87 loc) · 2.76 KB
/
gke.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
# DEPRECATION WARNING: This code has been deprecated
# The maintained & current code can be found at src/mlstacks/terraform/
# under the same relative location.
data "google_client_config" "default" {}
module "gke" {
depends_on = [
google_project_service.compute_engine_api
]
source = "terraform-google-modules/kubernetes-engine/google"
project_id = local.project_id
name = "${local.prefix}-${local.gke.cluster_name}"
region = local.region
zones = ["${local.region}-a", "${local.region}-b", "${local.region}-c"]
network = module.vpc.network_name
subnetwork = module.vpc.subnets_names[0]
ip_range_pods = "gke-pods"
ip_range_services = "gke-services"
http_load_balancing = false
network_policy = false
horizontal_pod_autoscaling = true
filestore_csi_driver = false
node_pools = [
{
name = "default-node-pool"
machine_type = "e2-medium"
node_locations = "${local.region}-b"
min_count = 1
max_count = 3
local_ssd_count = 0
disk_size_gb = 100
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
auto_repair = true
auto_upgrade = true
service_account = google_service_account.gke-service-account.email
preemptible = false
initial_node_count = 1
},
]
node_pools_oauth_scopes = {
all = []
default-node-pool = [
"https://www.googleapis.com/auth/cloud-platform",
]
}
node_pools_labels = {
all = {}
default-node-pool = {
default-node-pool = true
}
}
}
# service account for GKE nodes
resource "google_service_account" "gke-service-account" {
account_id = "${local.prefix}-${local.gke.service_account_name}"
project = local.project_id
display_name = "Terraform GKE SA"
}
resource "google_project_iam_binding" "container-registry" {
project = local.project_id
role = "roles/containerregistry.ServiceAgent"
members = [
"serviceAccount:${google_service_account.gke-service-account.email}",
]
}
resource "google_project_iam_binding" "secret-manager" {
project = local.project_id
role = "roles/secretmanager.admin"
members = [
"serviceAccount:${google_service_account.gke-service-account.email}",
]
}
resource "google_project_iam_binding" "cloudsql" {
project = local.project_id
role = "roles/cloudsql.admin"
members = [
"serviceAccount:${google_service_account.gke-service-account.email}",
]
}
resource "google_project_iam_binding" "storageadmin" {
project = local.project_id
role = "roles/storage.admin"
members = [
"serviceAccount:${google_service_account.gke-service-account.email}",
]
}