From b34abc44ec36060738dbbc41fd1f7347c18a1d5e Mon Sep 17 00:00:00 2001 From: Damon Date: Thu, 10 Aug 2023 10:00:59 -0700 Subject: [PATCH] Refactor terraform GKE and add bitnami kafka module (#27949) * Refactor GKE and kafka-cluster * Add cloudresourcemanager to required services * Add additional required services * Move cloudresourcemanager to documented prerequisite --- .test-infra/kafka/bitnami/README.md | 113 ++++++ .test-infra/kafka/bitnami/kafka.tf | 114 ++++++ .../02-network => kafka/bitnami}/provider.tf | 11 +- .../google-kubernetes-engine/README.md | 44 ++- ...provider.tf => apache-beam-testing.tfvars} | 8 +- .../{modules/03-cluster => }/cluster.tf | 27 +- .../google-kubernetes-engine/main.tf | 73 ---- .../modules/01-setup/README.md | 26 -- .../modules/01-setup/iam.tf | 39 -- .../modules/01-setup/output.tf | 22 -- .../modules/01-setup/variables.tf | 32 -- .../modules/02-network/README.md | 26 -- .../modules/02-network/nat.tf | 43 -- .../modules/02-network/network.tf | 65 ---- .../modules/02-network/output.tf | 37 -- .../modules/02-network/services.tf | 23 -- .../modules/02-network/variables.tf | 44 --- .../modules/03-cluster/README.md | 22 -- .../modules/03-cluster/services.tf | 23 -- .../modules/03-cluster/variables.tf | 53 --- .../modules/04-bastion/README.md | 22 -- .../modules/04-bastion/compute.tf | 64 --- .../modules/04-bastion/data.tf | 44 --- .../modules/04-bastion/provider.tf | 22 -- .../modules/04-bastion/services.tf | 23 -- .../modules/04-bastion/tinyproxy.conf | 368 ------------------ .../modules/04-bastion/variables.tf | 67 ---- .../01-setup/services.tf => prerequisites.tf} | 27 +- .../{modules/01-setup => }/provider.tf | 0 .../google-kubernetes-engine/variables.tf | 17 +- 30 files changed, 312 insertions(+), 1187 deletions(-) create mode 100644 .test-infra/kafka/bitnami/README.md create mode 100644 .test-infra/kafka/bitnami/kafka.tf rename .test-infra/{terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network => kafka/bitnami}/provider.tf (85%) rename .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/{modules/03-cluster/provider.tf => apache-beam-testing.tfvars} (88%) rename .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/{modules/03-cluster => }/cluster.tf (64%) delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/main.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/README.md delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/iam.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/output.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/variables.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/README.md delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/nat.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/network.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/output.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/services.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/variables.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/README.md delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/services.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/variables.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/README.md delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/compute.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/data.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/provider.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/services.tf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/tinyproxy.conf delete mode 100644 .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/variables.tf rename .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/{modules/01-setup/services.tf => prerequisites.tf} (60%) rename .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/{modules/01-setup => }/provider.tf (100%) diff --git a/.test-infra/kafka/bitnami/README.md b/.test-infra/kafka/bitnami/README.md new file mode 100644 index 000000000000..0e9ae249d646 --- /dev/null +++ b/.test-infra/kafka/bitnami/README.md @@ -0,0 +1,113 @@ + + +# Overview + +This module provisions a Bitnami Kafka Cluster based on its +[helm chart](https://github.com/bitnami/charts/tree/main/bitnami/kafka). +It uses the [terraform helm provider](https://registry.terraform.io/providers/hashicorp/helm/latest/docs) +Therefore, you DO NOT need helm to apply this module. + +# Requirements + +- [terraform](https://terraform.io) +- Connection to a kubernetes cluster (See: [.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/google-kubernetes-engine](../../terraform/google-cloud-platform/google-kubernetes-engine) in this repository) +- [kubectl](https://kubernetes.io/docs/reference/kubectl/) cli + +# Usage + +Simply follow standard terraform workflow to apply this module. + +``` +terraform init +terraform apply +``` + +# Special note about GKE Autopilot + +When applying this module to +[Google Kubernetes Engine (GKE) Autopilot](https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview) +you will see an "Unschedulable" status. This is because, GKE Autopilot +needs time to scale up the node. After some time, the kubernetes cluster +will provision the kafka cluster when these compute resources are available. + +# Debugging and Troubleshooting + +This module deploys a kafka client on the cluster to help with debugging and +troubleshooting. + +## Query the kafka client pod name + +Run the following command to query the pod name. + +``` +kubectl get po -l app=kafka-client +``` + +You should see something similar to the following: +``` +NAME READY STATUS RESTARTS AGE +kafka-client-cdc7c8885-nmcjc 1/1 Running 0 4m12s +``` + +## Get a shell to the running container + +Run the following command to shell into the running container. + +``` +kubectl exec --stdin --tty kafka-client-cdc7c8885-nmcjc -- /bin/bash +``` + +## Execute kafka commands + +The container executes using the latest [bitnami/kafka](https://hub.docker.com/r/bitnami/kafka/) +image. It has installed all the necessary `kafka-*.sh` scripts in its path. + +In all of the commands, you can use the flag: `--bootstrap-server kafka:9092` +because the pod is in the same kubernetes cluster and takes advantage +of its domain name service (DNS). The bitnami helm operator creates a Kubernetes +service called `kafka` that exposes port `9092`. + +### Get the cluster-id + +The following command gives you the cluster ID and validates you can connect to +the cluster. + +``` +kafka-cluster.sh cluster-id --bootstrap-server kafka:9092 +``` + +### Create a topic + +The following command creates a Kafka topic. + +``` +kafka-topics.sh --create --topic some-topic --partitions 3 --replication-factor 3 --bootstrap-server kafka:9092 +``` + +### Get information about a topic + +The following command queries information about a topic +(assuming the name `some-topic`). + +``` +kafka-topics.sh --describe --topic some-topic --bootstrap-server kafka:9092 +``` + +See https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/ diff --git a/.test-infra/kafka/bitnami/kafka.tf b/.test-infra/kafka/bitnami/kafka.tf new file mode 100644 index 000000000000..d9330f19ec15 --- /dev/null +++ b/.test-infra/kafka/bitnami/kafka.tf @@ -0,0 +1,114 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +// Provision the kafka cluster using the Bitnami helm chart. +resource "helm_release" "kafka" { + wait = false + repository = "https://charts.bitnami.com/bitnami" + chart = "kafka" + name = "kafka" + set { + name = "listeners.client.protocol" + value = "PLAINTEXT" + } + set { + name = "listeners.interbroker.protocol" + value = "PLAINTEXT" + } + set { + name = "listeners.external.protocol" + value = "PLAINTEXT" + } + set { + name = "externalAccess.enabled" + value = "true" + } + set { + name = "externalAccess.autoDiscovery.enabled" + value = "true" + } + set { + name = "rbac.create" + value = "true" + } + set { + name = "service.annotations" + value = yamlencode({"networking.gke.io/load-balancer-type": "Internal" }) + } + set { + name = "externalAccess.service.broker.ports.external" + value = "9094" + } + set { + name = "externalAccess.service.controller.containerPorts.external" + value = "9094" + } + set_list { + name = "externalAccess.controller.service.loadBalancerAnnotations" + value = [ + yamlencode({"networking.gke.io/load-balancer-type": "Internal" }), + yamlencode({"networking.gke.io/load-balancer-type": "Internal" }), + yamlencode({"networking.gke.io/load-balancer-type": "Internal" }), + ] + } + set_list { + name = "externalAccess.broker.service.loadBalancerAnnotations" + value = [ + yamlencode({"networking.gke.io/load-balancer-type": "Internal" }), + yamlencode({"networking.gke.io/load-balancer-type": "Internal" }), + yamlencode({"networking.gke.io/load-balancer-type": "Internal" }), + ] + } +} + +// Provision a kafka client to validate and debug the cluster. +resource "kubernetes_deployment" "kafka_client" { + wait_for_rollout = false + metadata { + name = "kafka-client" + labels = { + app = "kafka-client" + } + } + spec { + selector { + match_labels = { + app = "kafka-client" + } + } + template { + metadata { + labels = { + app = "kafka-client" + } + } + spec { + container { + name = "kafka-client" + image = "bitnami/kafka:latest" + image_pull_policy = "IfNotPresent" + command = ["/bin/bash"] + args = [ + "-c", + "while true; do sleep 2; done", + ] + } + } + } + } +} \ No newline at end of file diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/provider.tf b/.test-infra/kafka/bitnami/provider.tf similarity index 85% rename from .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/provider.tf rename to .test-infra/kafka/bitnami/provider.tf index e070d8408d96..8bb92dcf219a 100644 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/provider.tf +++ b/.test-infra/kafka/bitnami/provider.tf @@ -16,7 +16,12 @@ * limitations under the License. */ -// Setup Google Cloud provider -provider "google" { - project = var.project +provider "kubernetes" { + config_path = "~/.kube/config" +} + +provider "helm" { + kubernetes { + config_path = "~/.kube/config" + } } diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/README.md b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/README.md index 80db3c8a77f1..2affc2e66b8e 100644 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/README.md +++ b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/README.md @@ -19,38 +19,52 @@ # Overview -This module provisions a private Google Kubernetes Engine cluster. +This module provisions a private Google Kubernetes Engine cluster in the +Google Cloud Platform (GCP). # Requirements and Usage See [Google Cloud Platform requirements](../../google-cloud-platform/README.md) -for details on requirements -and usage. +for details on requirements and usage. -## 1. Create vars.tfvars +# Prerequisites + +This module assumes the following pre-existing resources: + +- [Cloud Resource Manager API Enabled](https://pantheon.corp.google.com/apis/library/cloudresourcemanager.googleapis.com) +- [Virtual Private Cloud (VPC) network and subnetwork](https://cloud.google.com/vpc/docs/create-modify-vpc-networks) +- [GCP Service Account](https://cloud.google.com/iam/docs/service-accounts-create) + +# Step 1. Create vars.tfvars + +## If you are provisioning in `apache-beam-testing`: + +You can skip this step and follow the next instruction. For security reasons, +the `service_account_id` was omitted. + +## If you are provisioning in a custom GCP project: Create a `vars.tfvars` file in [.test-infra/terraform/google-cloud-platform/google-kubernetes-engine](.). Edit with your IDE terraform plugin installed and it will autocomplete the variable names. -## 2. Initialize and apply the terraform module. +# Step 2. Initialize and apply the terraform module. + +## If you are provisioning in `apache-beam-testing`: ``` terraform init -terraform plan -var-file=vars.tfvars -terraform apply -var-file=vars.tfvars +terraform apply -var-file=apache-beam-testing.tfvars ``` -# Special Instructions - -This module also provisions a bastion host needed to connect to the private -cluster. To connect to the kubernetes -cluster, do so through the bastion host by following directions starting at -[Connect to your cluster from the remote client](https://cloud.google.com/kubernetes-engine/docs/tutorials/private-cluster-bastion#connect). +You will be prompted for any remaining variables. -To find the bastion host, run: +## If you are provisioning in a custom GCP project: ``` -gcloud compute instances list --filter=name:bastion +terraform init +terraform apply -var-file=vars.tfvars ``` + +You will be prompted for any remaining variables. diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/provider.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/apache-beam-testing.tfvars similarity index 88% rename from .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/provider.tf rename to .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/apache-beam-testing.tfvars index e070d8408d96..f1105e180f70 100644 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/provider.tf +++ b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/apache-beam-testing.tfvars @@ -16,7 +16,7 @@ * limitations under the License. */ -// Setup Google Cloud provider -provider "google" { - project = var.project -} +project = "apache-beam-testing" +network = "default" +subnetwork = "default" +region = "us-central1" diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/cluster.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/cluster.tf similarity index 64% rename from .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/cluster.tf rename to .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/cluster.tf index db4f3954d9f4..90c6ac793389 100644 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/cluster.tf +++ b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/cluster.tf @@ -16,27 +16,22 @@ * limitations under the License. */ -// Provisions regional private Google Kubernetes Engine cluster +resource "random_string" "postfix" { + length = 6 + upper = false + special = false +} + resource "google_container_cluster" "default" { - depends_on = [google_project_service.container] - name = var.cluster_name + depends_on = [google_project_service.required] + name = "${var.cluster_name_prefix}-${random_string.postfix.result}" location = var.region enable_autopilot = true - network = var.network.id - subnetwork = var.subnetwork.id - cluster_autoscaling { - auto_provisioning_defaults { - service_account = var.kubernetes_node_service_account.email - oauth_scopes = ["https://www.googleapis.com/auth/cloud-platform"] - } - } + network = data.google_compute_network.default.id + subnetwork = data.google_compute_subnetwork.default.id master_authorized_networks_config {} private_cluster_config { - enable_private_endpoint = true enable_private_nodes = true - master_global_access_config { - enabled = true - } + enable_private_endpoint = false } - ip_allocation_policy {} } diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/main.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/main.tf deleted file mode 100644 index 4a4713de48eb..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/main.tf +++ /dev/null @@ -1,73 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -resource "random_string" "postfix" { - length = 8 - upper = false - special = false -} - -locals { - common_resource_name = "${var.resource_name_prefix}-${random_string.postfix.result}" -} - -// Provision minimally necessary environment to provision a Google Kubernetes engine. -module "setup" { - source = "./modules/01-setup" - - project = var.project - kubernetes_node_service_account_id = local.common_resource_name - region = var.region -} - -// Provision Google Cloud Virtual Provide Cloud (VPC) network and related resources. -module "network" { - source = "./modules/02-network" - - kubernetes_node_service_account = module.setup.kubernetes_node_service_account - network_base_name = local.common_resource_name - project = var.project - region = var.region - subnetwork_cidr_range = var.subnetwork_cidr_range -} - -// Provision Google Kubernetes Engine cluster. -module "cluster" { - source = "./modules/03-cluster" - - cluster_name = local.common_resource_name - kubernetes_node_service_account = module.setup.kubernetes_node_service_account - network = module.network.network - subnetwork = module.network.subnetwork - project = var.project - region = var.region -} - -// Provision bastion host for remote private GKE cluster connectivity. -module "bastion" { - source = "./modules/04-bastion" - - bastion_compute_machine_type = var.bastion_compute_machine_type - kubernetes_node_service_account = module.setup.kubernetes_node_service_account - network = module.network.network - subnetwork = module.network.subnetwork - project = var.project - region = var.region - router = module.network.router - nat = module.network.nat -} \ No newline at end of file diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/README.md b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/README.md deleted file mode 100644 index 018b30f89748..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/README.md +++ /dev/null @@ -1,26 +0,0 @@ - - -# Overview - -This module sets up the Google Cloud minimally necessary environment to -provision a Google Kubernetes engine. - -- Service Account with Kubernetes Engine Node Service Account role -- Required Project service APIs diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/iam.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/iam.tf deleted file mode 100644 index a23c2180ce98..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/iam.tf +++ /dev/null @@ -1,39 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Provision a service account to bind to the Kubernetes cluster node -resource "google_service_account" "kubernetes_node_service_account" { - account_id = var.kubernetes_node_service_account_id - display_name = var.kubernetes_node_service_account_id - description = "The service account bound to the Kubernetes node" -} - -// Provision IAM roles for the kubernetes node service account -resource "google_project_iam_member" "kubernetes_node_service_account_roles" { - depends_on = [google_project_service.required_services] - - // provision as toset to make it easier to add new IAM roles in the future - for_each = toset([ - "roles/container.nodeServiceAccount", - ]) - - role = each.key - member = "serviceAccount:${google_service_account.kubernetes_node_service_account.email}" - project = var.project - -} \ No newline at end of file diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/output.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/output.tf deleted file mode 100644 index 3030c9a250eb..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/output.tf +++ /dev/null @@ -1,22 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Export the provisioned service account. -output "kubernetes_node_service_account" { - value = google_service_account.kubernetes_node_service_account -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/variables.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/variables.tf deleted file mode 100644 index 291bf0a8bf26..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/variables.tf +++ /dev/null @@ -1,32 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -variable "project" { - type = string - description = "The Google Cloud Platform (GCP) project within which resources are provisioned" -} - -variable "region" { - type = string - description = "The Google Cloud Platform (GCP) region in which to provision resources" -} - -variable "kubernetes_node_service_account_id" { - type = string - description = "The Google Cloud Platform Service Account to be used by the node VMs created by GKE Autopilot" -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/README.md b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/README.md deleted file mode 100644 index 15b39251434b..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/README.md +++ /dev/null @@ -1,26 +0,0 @@ - - -# Overview - -This module sets up the Google Cloud Virtual Provide Cloud (VPC) network and -related resources. - -- Provision a custom network and subnetwork -- Provision Cloud NAT and Router diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/nat.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/nat.tf deleted file mode 100644 index 7f573a9d3184..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/nat.tf +++ /dev/null @@ -1,43 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// For security, provision the Kubernetes node using private IP addresses. -// The recommendation in this context is to additionally provision -// a Cloud NAT and Router so that private IP only compute engine instances -// (created as a result of Google Kubernetes Engine node pool) can access -// resources outside the Google Virtual Private Cloud -// See https://cloud.google.com/nat/docs/overview -resource "google_compute_router_nat" "default" { - name = "${google_compute_router.default.name}-nat" - nat_ip_allocate_option = "AUTO_ONLY" - region = google_compute_router.default.region - router = google_compute_router.default.name - source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES" - log_config { - enable = true - filter = "ERRORS_ONLY" - } -} - -// Required by the Cloud NAT. -// See https://cloud.google.com/network-connectivity/docs/router. -resource "google_compute_router" "default" { - name = "${google_compute_subnetwork.default.name}-${var.region}-router" - network = google_compute_subnetwork.default.network - region = google_compute_subnetwork.default.region -} \ No newline at end of file diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/network.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/network.tf deleted file mode 100644 index 6a8a78bf80da..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/network.tf +++ /dev/null @@ -1,65 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Provision virtual custom 02-network -resource "google_compute_network" "default" { - depends_on = [google_project_service.compute] - name = var.network_base_name - auto_create_subnetworks = false -} - -// Provision subnetwork of the virtual custom 02-network -resource "google_compute_subnetwork" "default" { - name = google_compute_network.default.name - ip_cidr_range = var.subnetwork_cidr_range - network = google_compute_network.default.name - private_ip_google_access = true - region = var.region -} - -// Provision firewall rule for internal 02-network traffic only -resource "google_compute_firewall" "default" { - name = "allow-${google_compute_network.default.name}-internal" - network = google_compute_network.default.name - - allow { - protocol = "tcp" - } - - source_service_accounts = [ - var.kubernetes_node_service_account.email - ] -} - -// Provision firewall rule for SSH ingress from identity aware proxy -// See https://cloud.google.com/iap/docs/using-tcp-forwarding#create-firewall-rule -resource "google_compute_firewall" "iap" { - name = "allow-${google_compute_network.default.name}-ssh-ingress-from-iap" - network = google_compute_network.default.name - - allow { - protocol = "tcp" - ports = [ - 22, - ] - } - - source_ranges = [ - "35.235.240.0/20", - ] -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/output.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/output.tf deleted file mode 100644 index b48c1fa0c243..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/output.tf +++ /dev/null @@ -1,37 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Export the provisioned VPC network. -output "network" { - value = google_compute_network.default -} - -// Export the provisioned VPC subnetwork. -output "subnetwork" { - value = google_compute_subnetwork.default -} - -// Export the provisioned VPC NAT. -output "nat" { - value = google_compute_router_nat.default -} - -// Export the provisioned VPC NAT router. -output "router" { - value = google_compute_router.default -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/services.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/services.tf deleted file mode 100644 index 5ec40dc6a429..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/services.tf +++ /dev/null @@ -1,23 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Required for depends_on implicit declaration -resource "google_project_service" "compute" { - service = "compute.googleapis.com" - disable_on_destroy = false -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/variables.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/variables.tf deleted file mode 100644 index 9157a478e3e0..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/02-network/variables.tf +++ /dev/null @@ -1,44 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -variable "project" { - type = string - description = "The Google Cloud Platform (GCP) project within which resources are provisioned" -} - -variable "region" { - type = string - description = "The Google Cloud Platform (GCP) region in which to provision resources" -} - -variable "subnetwork_cidr_range" { - type = string - description = "The address range for this subnet, in CIDR notation. Use a standard private VPC network address range: for example, 10.0.0.0/9." -} - -variable "network_base_name" { - type = string - description = "The name basis for network resources." -} - -variable "kubernetes_node_service_account" { - type = object({ - email = string - }) - description = "The Google Cloud Platform Service Account bound to the GKE node" -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/README.md b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/README.md deleted file mode 100644 index 2e60183f105a..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/README.md +++ /dev/null @@ -1,22 +0,0 @@ - - -# Overview - -This module provisions the private Google Kubernetes Engine cluster. diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/services.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/services.tf deleted file mode 100644 index 1cde6ccf4d41..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/services.tf +++ /dev/null @@ -1,23 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Required for depends_on implicit declaration -resource "google_project_service" "container" { - service = "container.googleapis.com" - disable_on_destroy = false -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/variables.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/variables.tf deleted file mode 100644 index 55b2bc8cf67f..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/03-cluster/variables.tf +++ /dev/null @@ -1,53 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -variable "project" { - type = string - description = "The Google Cloud Platform (GCP) project within which resources are provisioned" -} - -variable "region" { - type = string - description = "The Google Cloud Platform (GCP) region in which to provision resources" -} - -variable "kubernetes_node_service_account" { - type = object({ - email = string - }) - description = "The Google Cloud Platform Service Account bound to the GKE node" -} - -variable "network" { - type = object({ - id = string - }) - description = "The Google Cloud Platform Virtual Cloud network within which we provision the kubernetes node" -} - -variable "subnetwork" { - type = object({ - id = string - }) - description = "The Google Cloud Platform Virtual Cloud subnetwork within which we provision the kubernetes node" -} - -variable "cluster_name" { - type = string - description = "The name of the Google Kubernetes engine cluster." -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/README.md b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/README.md deleted file mode 100644 index 2e60183f105a..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/README.md +++ /dev/null @@ -1,22 +0,0 @@ - - -# Overview - -This module provisions the private Google Kubernetes Engine cluster. diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/compute.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/compute.tf deleted file mode 100644 index bfdf8ce31dee..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/compute.tf +++ /dev/null @@ -1,64 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Generate a postfix for resource naming. -resource "random_string" "postfix" { - length = 6 - upper = false - special = false -} - -locals { - tinyproxy_content = file("${path.module}/tinyproxy.conf") -} - -// Query available zones in the region. -// Provision bastion host for private cluster connectivity. -// See https://cloud.google.com/kubernetes-engine/docs/tutorials/private-cluster-bastion -resource "google_compute_instance" "bastion" { - depends_on = [data.google_compute_router.default] - machine_type = var.bastion_compute_machine_type - name = "bastion-${random_string.postfix.result}" - zone = data.google_compute_zones.available.names[0] - service_account { - scopes = [ - "https://www.googleapis.com/auth/cloud-platform" - ] - email = var.kubernetes_node_service_account.email - } - boot_disk { - initialize_params { - image = "debian-cloud/debian-11" - } - } - network_interface { - network = data.google_compute_network.default.id - subnetwork = data.google_compute_subnetwork.default.id - } - - metadata_startup_script = < /etc/tinyproxy/tinyproxy.conf -${local.tinyproxy_content} -TP - -sudo service tinyproxy restart -EOF -} \ No newline at end of file diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/data.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/data.tf deleted file mode 100644 index 12163f9453b4..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/data.tf +++ /dev/null @@ -1,44 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -data "google_compute_zones" "available" { - depends_on = [google_project_service.compute] - region = var.region -} - -// Query the Virtual Private Cloud (VPC) network. -data "google_compute_network" "default" { - depends_on = [google_project_service.compute] - name = var.network.name -} - -// Query the Virtual Private Cloud (VPC) subnetwork. -data "google_compute_subnetwork" "default" { - depends_on = [google_project_service.compute] - name = var.subnetwork.name - region = var.region -} - -// Query the Virtual Private Cloud (VPC) router NAT. -// The bastion host requires this. -data "google_compute_router" "default" { - depends_on = [google_project_service.compute] - name = var.router.name - network = data.google_compute_network.default.name - region = data.google_compute_subnetwork.default.region -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/provider.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/provider.tf deleted file mode 100644 index e070d8408d96..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/provider.tf +++ /dev/null @@ -1,22 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Setup Google Cloud provider -provider "google" { - project = var.project -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/services.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/services.tf deleted file mode 100644 index 5ec40dc6a429..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/services.tf +++ /dev/null @@ -1,23 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Required for depends_on implicit declaration -resource "google_project_service" "compute" { - service = "compute.googleapis.com" - disable_on_destroy = false -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/tinyproxy.conf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/tinyproxy.conf deleted file mode 100644 index 032c2dadb0cf..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/tinyproxy.conf +++ /dev/null @@ -1,368 +0,0 @@ -# -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License. -# -## -## tinyproxy.conf -- tinyproxy daemon configuration file -## -## This example tinyproxy.conf file contains example settings -## with explanations in comments. For decriptions of all -## parameters, see the tinproxy.conf(5) manual page. -## - -# -# User/Group: This allows you to set the user and group that will be -# used for tinyproxy after the initial binding to the port has been done -# as the root user. Either the user or group name or the UID or GID -# number may be used. -# -User tinyproxy -Group tinyproxy - -# -# Port: Specify the port which tinyproxy will listen on. Please note -# that should you choose to run on a port lower than 1024 you will need -# to start tinyproxy using root. -# -Port 8888 - -# -# Listen: If you have multiple interfaces this allows you to bind to -# only one. If this is commented out, tinyproxy will bind to all -# interfaces present. -# -#Listen 192.168.0.1 - -# -# Bind: This allows you to specify which interface will be used for -# outgoing connections. This is useful for multi-home'd machines where -# you want all traffic to appear outgoing from one particular interface. -# -#Bind 192.168.0.1 - -# -# BindSame: If enabled, tinyproxy will bind the outgoing connection to the -# ip address of the incoming connection. -# -#BindSame yes - -# -# Timeout: The maximum number of seconds of inactivity a connection is -# allowed to have before it is closed by tinyproxy. -# -Timeout 600 - -# -# ErrorFile: Defines the HTML file to send when a given HTTP error -# occurs. You will probably need to customize the location to your -# particular install. The usual locations to check are: -# /usr/local/share/tinyproxy -# /usr/share/tinyproxy -# /etc/tinyproxy -# -#ErrorFile 404 "/usr/share/tinyproxy/404.html" -#ErrorFile 400 "/usr/share/tinyproxy/400.html" -#ErrorFile 503 "/usr/share/tinyproxy/503.html" -#ErrorFile 403 "/usr/share/tinyproxy/403.html" -#ErrorFile 408 "/usr/share/tinyproxy/408.html" - -# -# DefaultErrorFile: The HTML file that gets sent if there is no -# HTML file defined with an ErrorFile keyword for the HTTP error -# that has occured. -# -DefaultErrorFile "/usr/share/tinyproxy/default.html" - -# -# StatHost: This configures the host name or IP address that is treated -# as the stat host: Whenever a request for this host is received, -# Tinyproxy will return an internal statistics page instead of -# forwarding the request to that host. The default value of StatHost is -# tinyproxy.stats. -# -#StatHost "tinyproxy.stats" -# - -# -# StatFile: The HTML file that gets sent when a request is made -# for the stathost. If this file doesn't exist a basic page is -# hardcoded in tinyproxy. -# -StatFile "/usr/share/tinyproxy/stats.html" - -# -# LogFile: Allows you to specify the location where information should -# be logged to. If you would prefer to log to syslog, then disable this -# and enable the Syslog directive. These directives are mutually -# exclusive. If neither Syslog nor LogFile are specified, output goes -# to stdout. -# -LogFile "/var/log/tinyproxy/tinyproxy.log" - -# -# Syslog: Tell tinyproxy to use syslog instead of a logfile. This -# option must not be enabled if the Logfile directive is being used. -# These two directives are mutually exclusive. -# -#Syslog On - -# -# LogLevel: Warning -# -# Set the logging level. Allowed settings are: -# Critical (least verbose) -# Error -# Warning -# Notice -# Connect (to log connections without Info's noise) -# Info (most verbose) -# -# The LogLevel logs from the set level and above. For example, if the -# LogLevel was set to Warning, then all log messages from Warning to -# Critical would be output, but Notice and below would be suppressed. -# -LogLevel Info - -# -# PidFile: Write the PID of the main tinyproxy thread to this file so it -# can be used for signalling purposes. -# If not specified, no pidfile will be written. -# -PidFile "/run/tinyproxy/tinyproxy.pid" - -# -# XTinyproxy: Tell Tinyproxy to include the X-Tinyproxy header, which -# contains the client's IP address. -# -#XTinyproxy Yes - -# -# Upstream: -# -# Turns on upstream proxy support. -# -# The upstream rules allow you to selectively route upstream connections -# based on the host/domain of the site being accessed. -# -# Syntax: upstream type (user:pass@)ip:port ("domain") -# Or: upstream none "domain" -# The parts in parens are optional. -# Possible types are http, socks4, socks5, none -# -# For example: -# # connection to test domain goes through testproxy -# upstream http testproxy:8008 ".test.domain.invalid" -# upstream http testproxy:8008 ".our_testbed.example.com" -# upstream http testproxy:8008 "192.168.128.0/255.255.254.0" -# -# # upstream proxy using basic authentication -# upstream http user:pass@testproxy:8008 ".test.domain.invalid" -# -# # no upstream proxy for internal websites and unqualified hosts -# upstream none ".internal.example.com" -# upstream none "www.example.com" -# upstream none "10.0.0.0/8" -# upstream none "192.168.0.0/255.255.254.0" -# upstream none "." -# -# # connection to these boxes go through their DMZ firewalls -# upstream http cust1_firewall:8008 "testbed_for_cust1" -# upstream http cust2_firewall:8008 "testbed_for_cust2" -# -# # default upstream is internet firewall -# upstream http firewall.internal.example.com:80 -# -# You may also use SOCKS4/SOCKS5 upstream proxies: -# upstream socks4 127.0.0.1:9050 -# upstream socks5 socksproxy:1080 -# -# The LAST matching rule wins the route decision. As you can see, you -# can use a host, or a domain: -# name matches host exactly -# .name matches any host in domain "name" -# . matches any host with no domain (in 'empty' domain) -# IP/bits matches network/mask -# IP/mask matches network/mask -# -#Upstream http some.remote.proxy:port - -# -# MaxClients: This is the absolute highest number of threads which will -# be created. In other words, only MaxClients number of clients can be -# connected at the same time. -# -MaxClients 100 - -# -# MinSpareServers/MaxSpareServers: These settings set the upper and -# lower limit for the number of spare servers which should be available. -# -# If the number of spare servers falls below MinSpareServers then new -# server processes will be spawned. If the number of servers exceeds -# MaxSpareServers then the extras will be killed off. -# -MinSpareServers 5 -MaxSpareServers 20 - -# -# StartServers: The number of servers to start initially. -# -StartServers 10 - -# -# MaxRequestsPerChild: The number of connections a thread will handle -# before it is killed. In practise this should be set to 0, which -# disables thread reaping. If you do notice problems with memory -# leakage, then set this to something like 10000. -# -MaxRequestsPerChild 0 - -# -# Allow: Customization of authorization controls. If there are any -# access control keywords then the default action is to DENY. Otherwise, -# the default action is ALLOW. -# -# The order of the controls are important. All incoming connections are -# tested against the controls based on order. -# -Allow 127.0.0.1 -Allow localhost -#Allow 192.168.0.0/16 -#Allow 172.16.0.0/12 -#Allow 10.0.0.0/8 - -# BasicAuth: HTTP "Basic Authentication" for accessing the proxy. -# If there are any entries specified, access is only granted for authenticated -# users. -#BasicAuth user password - -# -# AddHeader: Adds the specified headers to outgoing HTTP requests that -# Tinyproxy makes. Note that this option will not work for HTTPS -# traffic, as Tinyproxy has no control over what headers are exchanged. -# -#AddHeader "X-My-Header" "Powered by Tinyproxy" - -# -# ViaProxyName: The "Via" header is required by the HTTP RFC, but using -# the real host name is a security concern. If the following directive -# is enabled, the string supplied will be used as the host name in the -# Via header; otherwise, the server's host name will be used. -# -ViaProxyName "tinyproxy" - -# -# DisableViaHeader: When this is set to yes, Tinyproxy does NOT add -# the Via header to the requests. This virtually puts Tinyproxy into -# stealth mode. Note that RFC 2616 requires proxies to set the Via -# header, so by enabling this option, you break compliance. -# Don't disable the Via header unless you know what you are doing... -# -#DisableViaHeader Yes - -# -# Filter: This allows you to specify the location of the filter file. -# -#Filter "/etc/tinyproxy/filter" - -# -# FilterURLs: Filter based on URLs rather than domains. -# -#FilterURLs On - -# -# FilterExtended: Use POSIX Extended regular expressions rather than -# basic. -# -#FilterExtended On - -# -# FilterCaseSensitive: Use case sensitive regular expressions. -# -#FilterCaseSensitive On - -# -# FilterDefaultDeny: Change the default policy of the filtering system. -# If this directive is commented out, or is set to "No" then the default -# policy is to allow everything which is not specifically denied by the -# filter file. -# -# However, by setting this directive to "Yes" the default policy becomes -# to deny everything which is _not_ specifically allowed by the filter -# file. -# -#FilterDefaultDeny Yes - -# -# Anonymous: If an Anonymous keyword is present, then anonymous proxying -# is enabled. The headers listed are allowed through, while all others -# are denied. If no Anonymous keyword is present, then all headers are -# allowed through. You must include quotes around the headers. -# -# Most sites require cookies to be enabled for them to work correctly, so -# you will need to allow Cookies through if you access those sites. -# -#Anonymous "Host" -#Anonymous "Authorization" -#Anonymous "Cookie" - -# -# ConnectPort: This is a list of ports allowed by tinyproxy when the -# CONNECT method is used. To disable the CONNECT method altogether, set -# the value to 0. If no ConnectPort line is found, all ports are -# allowed. -# -# The following two ports are used by SSL. -# -ConnectPort 443 -ConnectPort 563 - -# -# Configure one or more ReversePath directives to enable reverse proxy -# support. With reverse proxying it's possible to make a number of -# sites appear as if they were part of a single site. -# -# If you uncomment the following two directives and run tinyproxy -# on your own computer at port 8888, you can access Google using -# http://localhost:8888/google/ and Wired News using -# http://localhost:8888/wired/news/. Neither will actually work -# until you uncomment ReverseMagic as they use absolute linking. -# -#ReversePath "/google/" "http://www.google.com/" -#ReversePath "/wired/" "http://www.wired.com/" - -# -# When using tinyproxy as a reverse proxy, it is STRONGLY recommended -# that the normal proxy is turned off by uncommenting the next directive. -# -#ReverseOnly Yes - -# -# Use a cookie to track reverse proxy mappings. If you need to reverse -# proxy sites which have absolute links you must uncomment this. -# -#ReverseMagic Yes - -# -# The URL that's used to access this reverse proxy. The URL is used to -# rewrite HTTP redirects so that they won't escape the proxy. If you -# have a chain of reverse proxies, you'll need to put the outermost -# URL here (the address which the end user types into his/her browser). -# -# If not set then no rewriting occurs. -# -#ReverseBaseURL "http://localhost:8888/" diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/variables.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/variables.tf deleted file mode 100644 index 66a65720a831..000000000000 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/04-bastion/variables.tf +++ /dev/null @@ -1,67 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -variable "project" { - type = string - description = "The Google Cloud Platform (GCP) project within which resources are provisioned" -} - -variable "region" { - type = string - description = "The Google Cloud Platform (GCP) region in which to provision resources" -} - -variable "kubernetes_node_service_account" { - type = object({ - email = string - }) - description = "The Google Cloud Platform Service Account bound to the GKE node" -} - -variable "network" { - type = object({ - name = string - }) - description = "The Google Cloud Platform Virtual Cloud network within which we provision the kubernetes node" -} - -variable "subnetwork" { - type = object({ - name = string - }) - description = "The Google Cloud Platform Virtual Cloud subnetwork within which we provision the kubernetes node" -} - -variable "bastion_compute_machine_type" { - type = string - description = "The machine type of the Bastion host. See gcloud compute machine-types list for available types" -} - -variable "router" { - type = object({ - name = string - }) - description = "The Google Cloud Platform Virtual Cloud router" -} - -variable "nat" { - type = object({ - name = string - }) - description = "The Google Cloud Platform Virtual Cloud router NAT" -} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/services.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/prerequisites.tf similarity index 60% rename from .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/services.tf rename to .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/prerequisites.tf index 2d2d398ee56a..d17998fa9188 100644 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/services.tf +++ b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/prerequisites.tf @@ -16,13 +16,30 @@ * limitations under the License. */ -// Provision the required Google Cloud services -resource "google_project_service" "required_services" { +resource "google_project_service" "required" { for_each = toset([ "container", - "compute", + "iam", ]) - service = "${each.key}.googleapis.com" disable_on_destroy = false -} \ No newline at end of file +} + +// Query the VPC network to make sure it exists. +data "google_compute_network" "default" { + depends_on = [google_project_service.required] + name = var.network +} + +// Query the VPC subnetwork to make sure it exists in the region specified. +data "google_compute_subnetwork" "default" { + depends_on = [google_project_service.required] + name = var.subnetwork + region = var.region +} + +// Query the Service Account. +data "google_service_account" "default" { + depends_on = [google_project_service.required] + account_id = var.service_account_id +} diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/provider.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/provider.tf similarity index 100% rename from .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/modules/01-setup/provider.tf rename to .test-infra/terraform/google-cloud-platform/google-kubernetes-engine/provider.tf diff --git a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/variables.tf b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/variables.tf index aa43c4ff9596..40dc0f0a8d5a 100644 --- a/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/variables.tf +++ b/.test-infra/terraform/google-cloud-platform/google-kubernetes-engine/variables.tf @@ -26,17 +26,22 @@ variable "region" { description = "The Google Cloud Platform (GCP) region in which to provision resources" } -variable "resource_name_prefix" { +variable "cluster_name_prefix" { type = string - description = "The basis to name all provisioned resources i.e. service account, network, cluster, etc." + description = "The prefix to assign the provisioned Google Kubernetes Engine (GKE) cluster; a random string is appended to this value" } -variable "subnetwork_cidr_range" { +variable "network" { type = string - description = "The address range for this subnet, in CIDR notation. Use a standard private VPC network address range: for example, 10.128.0.0/20" + description = "The Google Cloud Virtual Private Cloud (VPC) network name" } -variable "bastion_compute_machine_type" { +variable "subnetwork" { type = string - description = "The machine type of the Bastion host. See gcloud compute machine-types list for available types, for example e2-standard-2" + description = "The Google Cloud Virtual Private Cloud (VPC) subnetwork name" +} + +variable "service_account_id" { + type = string + description = "The ID of the service account bound to the Google Kubernetes Engine (GKE) cluster" }