@rulebricks/cli 1.9.0

package/terraform/gcp/main.tf

@@ -0,0 +1,369 @@
+# Google Cloud GKE Cluster for Rulebricks
+# Meets minimum requirements: 4 nodes, 8 vCPU, 16GB RAM per node
+
+terraform {
+  required_version = ">= 1.0.0"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 5.0"
+    }
+    google-beta = {
+      source  = "hashicorp/google-beta"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}
+
+provider "google-beta" {
+  project = var.project_id
+  region  = var.region
+}
+
+# Variables
+variable "cluster_name" {
+  description = "Name of the GKE cluster"
+  type        = string
+  default     = "rulebricks-cluster"
+}
+
+variable "project_id" {
+  description = "GCP project ID"
+  type        = string
+}
+
+variable "region" {
+  description = "GCP region"
+  type        = string
+  default     = "us-central1"
+}
+
+variable "tier" {
+  description = "Performance tier: small, medium, large"
+  type        = string
+  default     = "small"
+}
+
+variable "kubernetes_version" {
+  description = "Kubernetes version"
+  type        = string
+  default     = "1.29"
+}
+
+variable "enable_external_dns" {
+  description = "Enable service account for external-dns (Cloud DNS)"
+  type        = bool
+  default     = false
+}
+
+variable "enable_gcs_logging" {
+  description = "Enable service account for Vector GCS logging"
+  type        = bool
+  default     = false
+}
+
+variable "logging_gcs_bucket" {
+  description = "GCS bucket name for Vector logs"
+  type        = string
+  default     = ""
+}
+
+# Tier configurations
+# Using Axion C4A (ARM64) instances for compatibility with arm64 container images
+locals {
+  tier_configs = {
+    small = {
+      node_count    = 4
+      machine_type  = "c4a-standard-2"  # 2 vCPU, 8GB (Google Axion ARM64)
+      min_nodes     = 4
+      max_nodes     = 4
+      disk_size     = 50
+    }
+    medium = {
+      node_count    = 4
+      machine_type  = "c4a-standard-4"  # 4 vCPU, 16GB (Google Axion ARM64)
+      min_nodes     = 4
+      max_nodes     = 8
+      disk_size     = 100
+    }
+    large = {
+      node_count    = 5
+      machine_type  = "c4a-standard-8"  # 8 vCPU, 32GB (Google Axion ARM64)
+      min_nodes     = 5
+      max_nodes     = 16
+      disk_size     = 200
+    }
+  }
+
+  config = local.tier_configs[var.tier]
+}
+
+# Enable required APIs
+resource "google_project_service" "compute" {
+  service            = "compute.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "container" {
+  service            = "container.googleapis.com"
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "dns" {
+  count              = var.enable_external_dns ? 1 : 0
+  service            = "dns.googleapis.com"
+  disable_on_destroy = false
+}
+
+# VPC Network
+resource "google_compute_network" "vpc" {
+  name                    = "${var.cluster_name}-vpc"
+  auto_create_subnetworks = false
+
+  depends_on = [google_project_service.compute]
+}
+
+# Subnet
+resource "google_compute_subnetwork" "subnet" {
+  name          = "${var.cluster_name}-subnet"
+  region        = var.region
+  network       = google_compute_network.vpc.name
+  ip_cidr_range = "10.0.0.0/16"
+
+  secondary_ip_range {
+    range_name    = "pods"
+    ip_cidr_range = "10.1.0.0/16"
+  }
+
+  secondary_ip_range {
+    range_name    = "services"
+    ip_cidr_range = "10.2.0.0/16"
+  }
+
+  private_ip_google_access = true
+}
+
+# Cloud Router for NAT
+resource "google_compute_router" "router" {
+  name    = "${var.cluster_name}-router"
+  region  = var.region
+  network = google_compute_network.vpc.id
+}
+
+# Cloud NAT
+resource "google_compute_router_nat" "nat" {
+  name                               = "${var.cluster_name}-nat"
+  router                             = google_compute_router.router.name
+  region                             = var.region
+  nat_ip_allocate_option             = "AUTO_ONLY"
+  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
+}
+
+# GKE Cluster
+resource "google_container_cluster" "cluster" {
+  provider = google-beta
+
+  name     = var.cluster_name
+  location = var.region
+
+  # Use VPC-native cluster
+  network    = google_compute_network.vpc.name
+  subnetwork = google_compute_subnetwork.subnet.name
+
+  # Remove default node pool
+  remove_default_node_pool = true
+  initial_node_count       = 1
+
+  # Cluster configuration
+  min_master_version = var.kubernetes_version
+
+  # Enable Workload Identity
+  workload_identity_config {
+    workload_pool = "${var.project_id}.svc.id.goog"
+  }
+
+  # IP allocation policy for VPC-native
+  ip_allocation_policy {
+    cluster_secondary_range_name  = "pods"
+    services_secondary_range_name = "services"
+  }
+
+  # Private cluster config
+  private_cluster_config {
+    enable_private_nodes    = true
+    enable_private_endpoint = false
+    master_ipv4_cidr_block  = "172.16.0.0/28"
+  }
+
+  # Master authorized networks
+  master_authorized_networks_config {
+    cidr_blocks {
+      cidr_block   = "0.0.0.0/0"
+      display_name = "All"
+    }
+  }
+
+  # Release channel
+  release_channel {
+    channel = "REGULAR"
+  }
+
+  # Enable network policy
+  network_policy {
+    enabled  = true
+    provider = "CALICO"
+  }
+
+  addons_config {
+    http_load_balancing {
+      disabled = false
+    }
+    horizontal_pod_autoscaling {
+      disabled = false
+    }
+    gce_persistent_disk_csi_driver_config {
+      enabled = true
+    }
+  }
+
+  depends_on = [google_project_service.container]
+}
+
+# Node Pool
+resource "google_container_node_pool" "primary" {
+  name     = "rulebricks-nodes"
+  location = var.region
+  cluster  = google_container_cluster.cluster.name
+
+  node_count = var.tier == "small" ? local.config.node_count : null
+
+  dynamic "autoscaling" {
+    for_each = var.tier != "small" ? [1] : []
+    content {
+      min_node_count = local.config.min_nodes
+      max_node_count = local.config.max_nodes
+    }
+  }
+
+  node_config {
+    preemptible  = false
+    machine_type = local.config.machine_type
+    disk_size_gb = local.config.disk_size
+    disk_type    = "pd-ssd"
+
+    oauth_scopes = [
+      "https://www.googleapis.com/auth/cloud-platform"
+    ]
+
+    labels = {
+      environment = "rulebricks"
+      tier        = var.tier
+    }
+
+    workload_metadata_config {
+      mode = "GKE_METADATA"
+    }
+  }
+
+  management {
+    auto_repair  = true
+    auto_upgrade = true
+  }
+}
+
+# ============================================
+# External DNS Service Account (Cloud DNS)
+# ============================================
+resource "google_service_account" "external_dns" {
+  count        = var.enable_external_dns ? 1 : 0
+  account_id   = "${var.cluster_name}-external-dns"
+  display_name = "External DNS for Rulebricks"
+  description  = "Service account for external-dns to manage Cloud DNS records"
+}
+
+resource "google_project_iam_member" "external_dns" {
+  count   = var.enable_external_dns ? 1 : 0
+  project = var.project_id
+  role    = "roles/dns.admin"
+  member  = "serviceAccount:${google_service_account.external_dns[0].email}"
+}
+
+resource "google_service_account_iam_member" "external_dns_workload_identity" {
+  count              = var.enable_external_dns ? 1 : 0
+  service_account_id = google_service_account.external_dns[0].name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "serviceAccount:${var.project_id}.svc.id.goog[rulebricks/external-dns]"
+}
+
+# ============================================
+# Vector GCS Logging Service Account
+# ============================================
+resource "google_service_account" "vector" {
+  count        = var.enable_gcs_logging ? 1 : 0
+  account_id   = "${var.cluster_name}-vector"
+  display_name = "Vector for Rulebricks"
+  description  = "Service account for Vector to write logs to GCS"
+}
+
+resource "google_storage_bucket_iam_member" "vector_gcs" {
+  count  = var.enable_gcs_logging && var.logging_gcs_bucket != "" ? 1 : 0
+  bucket = var.logging_gcs_bucket
+  role   = "roles/storage.objectCreator"
+  member = "serviceAccount:${google_service_account.vector[0].email}"
+}
+
+resource "google_service_account_iam_member" "vector_workload_identity" {
+  count              = var.enable_gcs_logging ? 1 : 0
+  service_account_id = google_service_account.vector[0].name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "serviceAccount:${var.project_id}.svc.id.goog[rulebricks/vector]"
+}
+
+# Outputs
+output "cluster_name" {
+  value       = google_container_cluster.cluster.name
+  description = "GKE cluster name"
+}
+
+output "cluster_endpoint" {
+  value       = google_container_cluster.cluster.endpoint
+  description = "GKE cluster endpoint"
+  sensitive   = true
+}
+
+output "cluster_ca_certificate" {
+  value       = google_container_cluster.cluster.master_auth[0].cluster_ca_certificate
+  description = "Base64 encoded cluster CA certificate"
+  sensitive   = true
+}
+
+output "region" {
+  value       = var.region
+  description = "GCP region"
+}
+
+output "project_id" {
+  value       = var.project_id
+  description = "GCP project ID"
+}
+
+output "kubeconfig_command" {
+  value       = "gcloud container clusters get-credentials ${var.cluster_name} --region ${var.region} --project ${var.project_id}"
+  description = "Command to update kubeconfig"
+}
+
+output "external_dns_service_account" {
+  value       = var.enable_external_dns ? google_service_account.external_dns[0].email : ""
+  description = "GCP service account email for external-dns"
+}
+
+output "vector_service_account" {
+  value       = var.enable_gcs_logging ? google_service_account.vector[0].email : ""
+  description = "GCP service account email for Vector"
+}