├── BinAuthz
    ├── AlwaysDeny_policy.yaml
    ├── DR_AlwaysDeny_policy.yaml
    ├── deployment.yaml
    └── readme.md
├── CloudArmor
    ├── backend-config.yaml
    ├── deployment.yaml
    ├── ingress.yaml
    ├── readme.md
    └── service.yaml
├── CloudSQL
    ├── README.md
    ├── main.tf
    ├── output.tf
    └── variables.tf
├── Create Master Terraform Project and Service Account
    ├── README.md
    ├── backend.tf
    └── gcp_tf_prep.sh
├── Create Project
    ├── README.md
    ├── gcp_tf_IaC.sh
    └── project.tf
├── MIG
    ├── README.md
    ├── apache-mig-glb
    │   ├── README.md
    │   ├── main.tf
    │   └── variables.tf
    ├── apache
    │   ├── README.md
    │   ├── instance_template_and_mig_apache.tf
    │   └── variables.tf
    └── old
    │   └── instance_template_and_mig.tf
├── README.md
├── consul
    ├── README.md
    ├── consul.tf
    └── master.yml
├── consul_vars
    ├── README.md
    ├── consul_with_vars.tf
    ├── master.yml
    └── variables.tf
├── dataflow
    └── wc.maven
├── gce
    ├── README.md
    ├── compute.tf
    └── glusterfs.tf
├── gcs-backend
    ├── README.md
    ├── example_referencing.txt
    └── gcs.tf
├── gke
    ├── README.md
    ├── gke.tf
    └── variables.tf
├── http-https-redirect
    └── myimage
    │   ├── Dockerfile.template
    │   ├── Makefile
    │   ├── README.md
    │   ├── global.conf
    │   └── http.conf
├── log_purge
    ├── gcs.txt
    └── stackdriver.txt
├── nginx-ingress-controller
    ├── nginx-ingress-controller.yaml
    └── nginx-ingress-default-backend.yaml
├── packer
    ├── README.md
    ├── apache.json
    ├── docker.json
    ├── gcp_v1.json
    ├── gcp_v2.json
    ├── gcp_v3.json
    ├── glusterfs.json
    └── provisioner.sh
├── private_catalog
    ├── README.md
    ├── final_preksm
    │   ├── private_catalog.jinja
    │   └── private_catalog.jinja.schema
    ├── private_catalog.jinja
    ├── private_catalog.jinja.schema
    └── private_catalog.yaml
├── prometheus
    ├── clusterRole.yaml
    ├── config-map.yaml
    ├── metrics.png
    ├── patch.sh
    ├── prometheus-deployment.yaml
    └── readme.md
├── vault
    ├── README.md
    ├── config.json
    ├── master.yml
    ├── variables.tf
    └── vault.tf
└── vpc
    ├── README.md
    └── custom_vpc.tf


/BinAuthz/AlwaysDeny_policy.yaml:
--------------------------------------------------------------------------------
 1 | admissionWhitelistPatterns:
 2 | - namePattern: gcr.io/google_containers/*
 3 | - namePattern: gcr.io/google-containers/*
 4 | - namePattern: k8s.gcr.io/*
 5 | - namePattern: gcr.io/stackdriver-agents/*
 6 | defaultAdmissionRule:
 7 |   enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
 8 |   evaluationMode: ALWAYS_DENY
 9 | name: projects/PROJECT_ID/policy
10 | 


--------------------------------------------------------------------------------
/BinAuthz/DR_AlwaysDeny_policy.yaml:
--------------------------------------------------------------------------------
 1 | admissionWhitelistPatterns:
 2 | - namePattern: gcr.io/google_containers/*
 3 | - namePattern: gcr.io/google-containers/*
 4 | - namePattern: k8s.gcr.io/*
 5 | - namePattern: gcr.io/stackdriver-agents/*
 6 | defaultAdmissionRule:
 7 |   enforcementMode: DRYRUN_AUDIT_LOG_ONLY
 8 |   evaluationMode: ALWAYS_DENY
 9 | name: projects/PROJECT_ID/policy
10 | 


--------------------------------------------------------------------------------
/BinAuthz/deployment.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: apps/v1
 2 | kind: Deployment
 3 | metadata:
 4 |   name: binauthz-nginx-deployment
 5 |   labels:
 6 |     app: nginx
 7 | spec:
 8 |   replicas: 3
 9 |   selector:
10 |     matchLabels:
11 |       app: nginx
12 |   template:
13 |     metadata:
14 |       labels:
15 |         app: nginx
16 |     spec:
17 |       containers:
18 |       - name: nginx
19 |         image: nginx:1.7.9
20 |         ports:
21 |         - containerPort: 80
22 | 


--------------------------------------------------------------------------------
/BinAuthz/readme.md:
--------------------------------------------------------------------------------
 1 | # View current policy to YAML
 2 | gcloud container binauthz policy export > old-policy.yaml<br>
 3 | gcloud container binauthz policy export > policy.yaml
 4 | #
 5 | # Check and edit policy.yaml<br>Change ALWAYS_ALLOW to ALWAYS_DENY
 6 | nano policy.yaml
 7 | #
 8 | # Import your new policy
 9 | gcloud container binauthz policy import policy.yaml
10 | #
11 | # Testing the policy (Deployment will fail)
12 | kubectl apply -f deployment.yaml
13 | #
14 | # Change ENFORCED_BLOCK_AND_AUDIT_LOG to DRYRUN_AUDIT_LOG_ONLY
15 | nano policy.yaml
16 | #
17 | # Dry-Run the policy (Deployment will work)
18 | gcloud container binauthz policy import policy.yaml
19 | #
20 | # Look for dry-run in StackDriver Logging (Kubernetes Cluster / Filter: dry-run)
21 | #
22 | # Clean-Up
23 | gcloud container binauthz policy import old-policy.yaml
24 | 


--------------------------------------------------------------------------------
/CloudArmor/backend-config.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: cloud.google.com/v1beta1
 2 | kind: BackendConfig
 3 | metadata:
 4 |   namespace: cloud-armor-how-to
 5 |   name: my-backend-config
 6 | spec:
 7 |   securityPolicy:
 8 |     name: "ca-how-to-security-policy"
 9 |   sessionAffinity:
10 |     affinityType: "GENERATED_COOKIE"
11 |     affinityCookieTtlSec: 50
12 | 


--------------------------------------------------------------------------------
/CloudArmor/deployment.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: apps/v1
 2 | kind: Deployment
 3 | metadata:
 4 |   namespace: cloud-armor-how-to
 5 |   name: my-deployment
 6 | spec:
 7 |   selector:
 8 |     matchLabels:
 9 |       app: hello-app
10 |   replicas: 2
11 |   template:
12 |     metadata:
13 |       labels:
14 |         app: hello-app
15 |     spec:
16 |       containers:
17 |       - name: hello-app-container
18 |         image: gcr.io/google-samples/hello-app:1.0
19 |         ports:
20 |         - containerPort: 8080
21 | 


--------------------------------------------------------------------------------
/CloudArmor/ingress.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: extensions/v1beta1
 2 | kind: Ingress
 3 | metadata:
 4 |   namespace: cloud-armor-how-to
 5 |   name: my-ingress
 6 |   annotations:
 7 |     kubernetes.io/ingress.global-static-ip-name: "cloud-armor-how-to-address"
 8 |     ingress.kubernetes.io/affinity: 'cookie'
 9 | spec:
10 |   backend:
11 |     serviceName: my-service
12 |     servicePort: 80
13 | 


--------------------------------------------------------------------------------
/CloudArmor/readme.md:
--------------------------------------------------------------------------------
 1 | # Create Namespace
 2 | kubectl create namespace cloud-armor-how-to
 3 | #
 4 | # Deploy Workload
 5 | kubectl apply -f deployment.yaml
 6 | #
 7 | # Create CA Policy and Rules
 8 | gcloud beta compute security-policies create ca-how-to-security-policy --description "policy for Google Cloud Armor how-to topic"<br>
 9 | gcloud beta compute security-policies rules create 1000 --security-policy ca-how-to-security-policy --description "Deny traffic from 192.0.2.0/24." --src-ip-ranges "192.0.2.0/24" --action "deny-404"
10 | #
11 | # Create BackendConfig that says which policy to use
12 | kubectl apply -f backend-config.yaml
13 | #
14 | # Check Deployment and CA policy in UI
15 | #
16 | # Create Service with Annotation to BackEndconfig thus making the link between the BES and the CA Policy
17 | kubectl apply -f service.yaml
18 | #
19 | # Reserve External IP and give it a name
20 | gcloud compute addresses create cloud-armor-how-to-address --global
21 | #
22 | # Create Ingress that point to my BES and uses the reserved external IP via Annotation.
23 | kubectl create -f ingress.yaml
24 | #
25 | # Check CA Policy Target in UI
26 | #
27 | # Clean Up
28 | kubectl delete ingress my-ingress --namespace cloud-armor-how-to<br>
29 | kubectl delete service my-service --namespace cloud-armor-how-to<br>
30 | kubectl delete backendconfig my-backend-config --namespace cloud-armor-how-to<br>
31 | kubectl delete deployment my-deployment --namespace cloud-armor-how-to<br>
32 | kubectl delete namespace cloud-armor-how-to<br>
33 | gcloud compute addresses delete cloud-armor-how-to-address --global<br>
34 | gcloud beta compute security-policies delete ca-how-to-security-policy
35 | 


--------------------------------------------------------------------------------
/CloudArmor/service.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: v1
 2 | kind: Service
 3 | metadata:
 4 |   namespace: cloud-armor-how-to
 5 |   name: my-service
 6 |   labels:
 7 |     app: hello-app
 8 |   annotations:
 9 |     beta.cloud.google.com/backend-config: '{"ports": {"80":"my-backend-config"}}'
10 |     cloud.google.com/load-balancer-type: "Internal"
11 | spec:
12 |   type: LoadBalancer
13 |   selector:
14 |     app: hello-app
15 |   ports:
16 |   - port: 80
17 |     protocol: TCP
18 |     targetPort: 8080
19 | 


--------------------------------------------------------------------------------
/CloudSQL/README.md:
--------------------------------------------------------------------------------
1 | # gcp/CloudSQL
2 | Terraform script sample to deploy a non-HA CloudSQL instance.
3 | 
4 | Script uses a GCP service account and a JSON file with your account token and info in variables.tf
5 | 


--------------------------------------------------------------------------------
/CloudSQL/main.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${var.credentials}"
 3 |   project = "${var.project}"
 4 |   region  = "${var.region}"
 5 | }
 6 | 
 7 | resource "google_sql_database_instance" "master" {
 8 |   name             = "${var.name}"
 9 |   project          = "${var.project}"
10 |   region           = "${var.region}"
11 |   database_version = "${var.database_version}"
12 | 
13 |   settings {
14 |     tier                        = "${var.tier}"
15 |     activation_policy           = "${var.activation_policy}"
16 |     authorized_gae_applications = ["${var.authorized_gae_applications}"]
17 |     disk_autoresize             = "${var.disk_autoresize}"
18 |     backup_configuration        = ["${var.backup_configuration}"]
19 |     ip_configuration            = ["${var.ip_configuration}"]
20 |     location_preference         = ["${var.location_preference}"]
21 |     maintenance_window          = ["${var.maintenance_window}"]
22 |     disk_size                   = "${var.disk_size}"
23 |     disk_type                   = "${var.disk_type}"
24 |     pricing_plan                = "${var.pricing_plan}"
25 |     replication_type            = "${var.replication_type}"
26 |   }
27 | 
28 |   replica_configuration = ["${var.replica_configuration}"]
29 | }
30 | 
31 | resource "google_sql_database" "default" {
32 |   name      = "${var.db_name}"
33 |   project   = "${var.project}"
34 |   instance  = "${google_sql_database_instance.master.name}"
35 |   charset   = "${var.db_charset}"
36 |   collation = "${var.db_collation}"
37 | }
38 | 
39 | resource "random_id" "user-password" {
40 |   byte_length = 8
41 | }
42 | 
43 | resource "google_sql_user" "default" {
44 |   name     = "${var.user_name}"
45 |   project  = "${var.project}"
46 |   instance = "${google_sql_database_instance.master.name}"
47 |   host     = "${var.user_host}"
48 |   password = "${var.user_password == "" ? random_id.user-password.hex : var.user_password}"
49 | }
50 | 


--------------------------------------------------------------------------------
/CloudSQL/output.tf:
--------------------------------------------------------------------------------
 1 | /*
 2 |  * Copyright 2017 Google Inc.
 3 |  *
 4 |  * Licensed under the Apache License, Version 2.0 (the "License");
 5 |  * you may not use this file except in compliance with the License.
 6 |  * You may obtain a copy of the License at
 7 |  *
 8 |  *   http://www.apache.org/licenses/LICENSE-2.0
 9 |  *
10 |  * Unless required by applicable law or agreed to in writing, software
11 |  * distributed under the License is distributed on an "AS IS" BASIS,
12 |  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 |  * See the License for the specific language governing permissions and
14 |  * limitations under the License.
15 |  */
16 | 
17 | output instance_name {
18 |   description = "The name of the database instance"
19 |   value       = "${google_sql_database_instance.master.name}"
20 | }
21 | 
22 | output instance_address {
23 |   description = "The IPv4 address of the master database instnace"
24 |   value       = "${google_sql_database_instance.master.ip_address.0.ip_address}"
25 | }
26 | 
27 | output instance_address_time_to_retire {
28 |   description = "The time the master instance IP address will be retired. RFC 3339 format."
29 |   value       = "${google_sql_database_instance.master.ip_address.0.time_to_retire}"
30 | }
31 | 
32 | output self_link {
33 |   description = "Self link to the master instance"
34 |   value       = "${google_sql_database_instance.master.self_link}"
35 | }
36 | 
37 | output generated_user_password {
38 |   description = "The auto generated default user password if no input password was provided"
39 |   value       = "${random_id.user-password.hex}"
40 |   sensitive   = true
41 | }
42 | 


--------------------------------------------------------------------------------
/CloudSQL/variables.tf:
--------------------------------------------------------------------------------
  1 | variable "credentials"      { default = "../terraform.json" }
  2 | variable "project"          { default = "terraform-sandbox-194417" }
  3 | variable "region"           { default = "northamerica-northeast1" }
  4 | variable "zone"             { default = "northamerica-northeast1-a" }
  5 | #
  6 | variable name {
  7 |   description = "Name for the database instance. Must be unique and cannot be reused for up to one week."
  8 | }
  9 | 
 10 | variable database_version {
 11 |   description = "The version of of the database. For example, `MYSQL_5_6` or `POSTGRES_9_6`."
 12 |   default     = "MYSQL_5_7"
 13 | }
 14 | 
 15 | variable tier {
 16 |   description = "The machine tier (First Generation) or type (Second Generation). See this page for supported tiers and pricing: https://cloud.google.com/sql/pricing"
 17 |   default     = "db-f1-micro"
 18 | }
 19 | 
 20 | variable db_name {
 21 |   description = "Name of the default database to create"
 22 |   default     = "default"
 23 | }
 24 | 
 25 | variable db_charset {
 26 |   description = "The charset for the default database"
 27 |   default     = ""
 28 | }
 29 | 
 30 | variable db_collation {
 31 |   description = "The collation for the default database. Example for MySQL databases: 'utf8', and Postgres: 'en_US.UTF8'"
 32 |   default     = ""
 33 | }
 34 | 
 35 | variable user_name {
 36 |   description = "The name of the default user"
 37 |   default     = "default"
 38 | }
 39 | 
 40 | variable user_host {
 41 |   description = "The host for the default user"
 42 |   default     = "%"
 43 | }
 44 | 
 45 | variable user_password {
 46 |   description = "The password for the default user. If not set, a random one will be generated and available in the generated_user_password output variable."
 47 |   default     = ""
 48 | }
 49 | 
 50 | variable activation_policy {
 51 |   description = "This specifies when the instance should be active. Can be either `ALWAYS`, `NEVER` or `ON_DEMAND`."
 52 |   default     = "ALWAYS"
 53 | }
 54 | 
 55 | variable authorized_gae_applications {
 56 |   description = "A list of Google App Engine (GAE) project names that are allowed to access this instance."
 57 |   type        = "list"
 58 |   default     = []
 59 | }
 60 | 
 61 | variable disk_autoresize {
 62 |   description = "Second Generation only. Configuration to increase storage size automatically."
 63 |   default     = true
 64 | }
 65 | 
 66 | variable disk_size {
 67 |   description = "Second generation only. The size of data disk, in GB. Size of a running instance cannot be reduced but can be increased."
 68 |   default     = 10
 69 | }
 70 | 
 71 | variable disk_type {
 72 |   description = "Second generation only. The type of data disk: `PD_SSD` or `PD_HDD`."
 73 |   default     = "PD_SSD"
 74 | }
 75 | 
 76 | variable pricing_plan {
 77 |   description = "First generation only. Pricing plan for this instance, can be one of `PER_USE` or `PACKAGE`."
 78 |   default     = "PER_USE"
 79 | }
 80 | 
 81 | variable replication_type {
 82 |   description = "Replication type for this instance, can be one of `ASYNCHRONOUS` or `SYNCHRONOUS`."
 83 |   default     = "SYNCHRONOUS"
 84 | }
 85 | 
 86 | variable backup_configuration {
 87 |   description = "The backup_configuration settings subblock for the database setings"
 88 |   type        = "map"
 89 |   default     = {}
 90 | }
 91 | 
 92 | variable ip_configuration {
 93 |   description = "The ip_configuration settings subblock"
 94 |   type        = "list"
 95 |   default     = [{}]
 96 | }
 97 | 
 98 | variable location_preference {
 99 |   description = "The location_preference settings subblock"
100 |   type        = "list"
101 |   default     = []
102 | }
103 | 
104 | variable maintenance_window {
105 |   description = "The maintenance_window settings subblock"
106 |   type        = "list"
107 |   default     = []
108 | }
109 | 
110 | variable replica_configuration {
111 |   description = "The optional replica_configuration block for the database instance"
112 |   type        = "list"
113 |   default     = []
114 | }
115 | 
116 | 


--------------------------------------------------------------------------------
/Create Master Terraform Project and Service Account/README.md:
--------------------------------------------------------------------------------
1 | # gcp/Create Master Terraform Project and Service Account
2 | Shell and Terraform script to create an admin project for Terraform and also create a service account for automation of future GCP related tasks.
3 | 
4 | Scripts uses a GCP service account and a JSON file with your account token.
5 | 


--------------------------------------------------------------------------------
/Create Master Terraform Project and Service Account/backend.tf:
--------------------------------------------------------------------------------
 1 | // GCS backend for .tfstate file
 2 | 
 3 | terraform {
 4 |  backend "gcs" {
 5 |    bucket  = "<user>-terraform-admin"
 6 |    path    = "/terraform.tfstate"
 7 |    project = "<user>-terraform-admin"
 8 |  }
 9 | }
10 | 


--------------------------------------------------------------------------------
/Create Master Terraform Project and Service Account/gcp_tf_prep.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | #
 3 | # Enter your GCP info in here
 4 | export TF_VAR_org_id=your_org_id
 5 | export TF_VAR_billing_account=your_billing_account_id
 6 | export TF_ADMIN=your_user-terraform-admin
 7 | export TF_CREDS=your_tf_admin_creds.JSON
 8 | #
 9 | # CREATE TF ADMIN PROJECT
10 | gcloud projects create ${TF_ADMIN} --organization ${TF_VAR_org_id} --set-as-default
11 | gcloud beta billing projects link ${TF_ADMIN} --billing-account ${TF_VAR_billing_account}
12 | #
13 | # CREATE TF service account
14 | gcloud iam service-accounts create terraform --display-name "Terraform admin account"
15 | gcloud iam service-accounts keys create ${TF_CREDS} --iam-account terraform@${TF_ADMIN}.iam.gserviceaccount.com
16 | #
17 | # Grant the service account permission to view the Admin Project and manage Cloud Storage:
18 | gcloud projects add-iam-policy-binding ${TF_ADMIN} --member serviceAccount:terraform@${TF_ADMIN}.iam.gserviceaccount.com --role roles/viewer
19 | gcloud projects add-iam-policy-binding ${TF_ADMIN} --member serviceAccount:terraform@${TF_ADMIN}.iam.gserviceaccount.com --role roles/storage.admin
20 | #
21 | # Any actions that Terraform performs require that the API be enabled to do so. In this guide, Terraform requires the following:
22 | gcloud services enable cloudresourcemanager.googleapis.com
23 | gcloud services enable cloudbilling.googleapis.com
24 | gcloud services enable iam.googleapis.com
25 | gcloud services enable compute.googleapis.com
26 | #
27 | #Add organization/folder-level permissions
28 | #Grant the service account permission to create projects and assign billing accounts:
29 | gcloud organizations add-iam-policy-binding ${TF_VAR_org_id} --member serviceAccount:terraform@${TF_ADMIN}.iam.gserviceaccount.com --role roles/resourcemanager.projectCreator
30 | gcloud organizations add-iam-policy-binding ${TF_VAR_org_id} --member serviceAccount:terraform@${TF_ADMIN}.iam.gserviceaccount.com --role roles/billing.user
31 | #
32 | # If your billing account is owned by another organization, then make sure the service account email has been added as a Billing Account User to the billing account permissions.
33 | #
34 | # Create the remote backend bucket in Cloud Storage and the backend.tf file for storage of the terraform.tfstate file:
35 | gsutil mb -p ${TF_ADMIN} gs://${TF_ADMIN}
36 | cat > backend.tf <<EOF
37 | terraform {
38 |  backend "gcs" {
39 |    bucket  = "${TF_ADMIN}"
40 |    path    = "/terraform.tfstate"
41 |    project = "${TF_ADMIN}"
42 |  }
43 | }
44 | EOF
45 | #
46 | # Enable versioning for said remote bucket:
47 | gsutil versioning set on gs://${TF_ADMIN}
48 | #
49 | # Configure your environment for the Google Cloud Terraform provider:
50 | export GOOGLE_APPLICATION_CREDENTIALS=${TF_CREDS}
51 | export GOOGLE_PROJECT=${TF_ADMIN}
52 | #
53 | # initialize the backend:
54 | terraform init
55 | #
56 | 


--------------------------------------------------------------------------------
/Create Project/README.md:
--------------------------------------------------------------------------------
1 | # gcp/Create Project
2 | Shell and Terraform script to create a new GCP Project linked to your billing account.
3 | 
4 | Scripts uses a GCP service account and a JSON file with your account token and ENV VARS
5 | 


--------------------------------------------------------------------------------
/Create Project/gcp_tf_IaC.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | #
 3 | export TF_VAR_project_name=my_new_project
 4 | export TF_VAR_region=northamerica-northeast1
 5 | export TF_VAR_zone=northamerica-northeast1-a
 6 | export TF_VAR_network=foobar
 7 | #
 8 | terraform plan -out my_plan
 9 | #
10 | 


--------------------------------------------------------------------------------
/Create Project/project.tf:
--------------------------------------------------------------------------------
 1 | variable "project_name" {}
 2 | variable "billing_account" {}
 3 | variable "org_id" {}
 4 | variable "region" {}
 5 | 
 6 | provider "google" {
 7 |   region = "${var.region}"
 8 | }
 9 | 
10 | resource "random_id" "id" {
11 |   byte_length = 4
12 |   prefix      = "${var.project_name}-"
13 | }
14 | 
15 | resource "google_project" "project" {
16 |   name            = "${var.project_name}"
17 |   project_id      = "${random_id.id.hex}"
18 |   billing_account = "${var.billing_account}"
19 |   org_id          = "${var.org_id}"
20 | }
21 | 
22 | resource "google_project_services" "project" {
23 |   project = "${google_project.project.project_id}"
24 | 
25 |   services = [
26 |     "compute.googleapis.com",
27 |   ]
28 | }
29 | 
30 | output "project_id" {
31 |   value = "${google_project.project.project_id}"
32 | }
33 | 


--------------------------------------------------------------------------------
/MIG/README.md:
--------------------------------------------------------------------------------
 1 | # gcp/MIG
 2 | Terraform script to create a an instance template, an instance group with a minimum of 3 running instances.  
 3 | It also opens port 80 and 443 in firewall rules for default network.
 4 | 
 5 | Scripts uses a GCP service account and a JSON file with your GCP creds.
 6 | 
 7 | 
 8 | -- apache folder contains basic template and Managed Instance Group
 9 | 
10 | -- apache-mig-glb folder contains a more complexe config. It contains everything from the apache folder but spreads the MIG in 3 zones and fronts everything with a Global Load Balancer
11 | 


--------------------------------------------------------------------------------
/MIG/apache-mig-glb/README.md:
--------------------------------------------------------------------------------
1 | # gcp/MIG/apache-mig-glb
2 | Terraform script to create a an instance template from a Packer built image followed by the creation of an instance group with a minimum of 3 Apache Server (no public IP) with a burst to 5 instances running.  It also opens port 80 and 443 in firewall rules for default network and is fronted by a Global LoadBalancer.  
3 | 
4 | Scripts uses a GCP service account and a JSON file with your account token and VARS defined in variables.tf
5 | 
6 | Once all is setup, hit the Load Balancer Public IP
7 | 
8 | The Golden Image used for template creation can be created with Packer and this script: https://github.com/sveronneau/gcp/blob/master/packer/apache.json
9 | 


--------------------------------------------------------------------------------
/MIG/apache-mig-glb/main.tf:
--------------------------------------------------------------------------------
  1 | #
  2 | # Credentials
  3 | provider "google" {
  4 |   credentials = "${var.credentials}"
  5 |   project = "${var.project}"
  6 |   region  = "${var.region}"
  7 | }
  8 | #
  9 | # Backend Services
 10 | resource "google_compute_backend_service" "rbs" {
 11 |   name             = "${var.be_name}"
 12 |   port_name        = "${var.be_port_name}"
 13 |   protocol         = "${var.be_protocol}"
 14 |   timeout_sec      = "${var.be_timeout}"
 15 |   session_affinity = "${var.be_session_affinity}"
 16 | 
 17 |   backend {
 18 |     group = "${google_compute_region_instance_group_manager.rmig.instance_group}"
 19 |   }
 20 | 
 21 |   health_checks = ["${google_compute_http_health_check.default.self_link}"]
 22 | }
 23 | 
 24 | resource "google_compute_http_health_check" "default" {
 25 |   name               = "${var.hc_name}"
 26 |   request_path       = "/"
 27 |   check_interval_sec = 1
 28 |   timeout_sec        = 1
 29 | }
 30 | #
 31 | # Regional MIG
 32 | resource "google_compute_region_instance_group_manager" "rmig" {
 33 |   name               = "${var.rmig_name}"
 34 |   instance_template  = "${google_compute_instance_template.cit.self_link}"
 35 |   base_instance_name = "${var.base_instance_name}"
 36 |   region             = "${var.region}"
 37 |   target_size        = 3
 38 | 
 39 |   named_port {
 40 |     name = "http"
 41 |     port = 80
 42 |   }
 43 | 
 44 |   named_port {
 45 |     name = "https"
 46 |     port = 443
 47 |   }
 48 | 
 49 |   auto_healing_policies {
 50 |     health_check      = "${google_compute_http_health_check.default.self_link}"
 51 |     initial_delay_sec = 300
 52 |   }
 53 | }
 54 | #
 55 | # Template creation
 56 | resource "google_compute_instance_template" "cit" {
 57 |   name_prefix = "${var.prefix}"
 58 |   description = "${var.desc}"
 59 |   project = "${var.project}"
 60 |   region  = "${var.region}"
 61 |   tags = ["${var.tags}"]
 62 |   instance_description = "${var.desc_inst}"
 63 |   machine_type = "${var.machine_type}"
 64 |   can_ip_forward = false // Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false.
 65 | 
 66 |   scheduling {
 67 |     automatic_restart   = true
 68 |     on_host_maintenance = "MIGRATE"
 69 |   }
 70 | 
 71 |   // Create a new boot disk from an image (Lets use one created by Packer)
 72 |   disk {
 73 |     source_image = "${var.source_image}"
 74 |     auto_delete  = true
 75 |     boot = true
 76 |   }
 77 | 
 78 |   metadata {
 79 |     startup-script = <<SCRIPT
 80 |     INT_IP="$(ip route get 8.8.8.8 | awk '{print $NF; exit}')"
 81 |     EXT_IP="$(curl -s ipinfo.io/ip)"
 82 |     sudo cat <<EOF > /var/www/html/index.html
 83 |     <html>
 84 |     <body>
 85 |     <title>Apache Server - $(hostname)</title>
 86 |     <img src="https://cloud.google.com/_static/9abbcf9aa7/images/cloud/gcp-logo.svg" alt="Google Cloud" height="51" width="400"><br><br>
 87 |     <img src="https://www.datocms-assets.com/2885/1506457192-blog-packer-list.svg" alt="Packer" height="100" width="100">
 88 |     <img src="https://www.datocms-assets.com/2885/1506457071-blog-terraform-list.svg" alt="Terraform" height="100" width="100">
 89 |     <img src="https://blog-en.openalfa.com/iconos/logos/apache_httpd.jpg" alt="Apache" height="100" width="100">
 90 |     <p><b>Hostname:</b> $(hostname)<br><b>Internal IP:</b> $INT_IP<br><b>External IP:</b> $EXT_IP</p>
 91 |     <p>A <b>Packer</b> built, <b>Terraform</b> deployed, <b>GCP</b> Auto Scalling, Managed Instance Group with Load Balancer serving <b>Apache Web Server</b></p>
 92 |     </body>
 93 |     </html>
 94 | SCRIPT
 95 |   }
 96 | 
 97 |   network_interface {
 98 |     network = "${var.network}"
 99 |     #
100 |     # Give a Public IP to instance(s)
101 |     #access_config {
102 |     #  // Ephemeral IP
103 |     #}
104 |   }
105 | 
106 |   service_account {
107 |     scopes = ["userinfo-email", "compute-ro", "storage-ro"]
108 |   }
109 | 
110 |   lifecycle {
111 |     create_before_destroy = true
112 |   }
113 | }
114 | #
115 | # Compute Healthcheck
116 | resource "google_compute_health_check" "default" {
117 |   name               = "${var.hc_name}"
118 |   check_interval_sec = 1
119 |   timeout_sec        = 1
120 | 
121 |   tcp_health_check {
122 |     port = "${var.hc_port}"
123 |   }
124 | }
125 | #
126 | # Regional MIG AutoScaler
127 | resource "google_compute_region_autoscaler" "cras" {
128 |   name   = "${var.rmig_as_name}"
129 |   region = "${var.region}"
130 |   target = "${google_compute_region_instance_group_manager.rmig.self_link}"
131 | 
132 |   autoscaling_policy = {
133 |     max_replicas    = 5
134 |     min_replicas    = 3
135 |     cooldown_period = 60
136 |     cpu_utilization {
137 |       target = 0.5
138 |     }
139 |   }
140 | }
141 | #
142 | # Global Forwarding Rule
143 | resource "google_compute_global_forwarding_rule" "gfr" {
144 |   name       = "${var.gfr_name}"
145 |   target     = "${google_compute_target_http_proxy.thp.self_link}"
146 |   port_range = "${var.gfr_portrange}"
147 | }
148 | resource "google_compute_target_http_proxy" "thp" {
149 |   name        = "${var.thp_name}"
150 |   url_map     = "${google_compute_url_map.urlmap.self_link}"
151 | }
152 | resource "google_compute_url_map" "urlmap" {
153 |   name            = "${var.urlmap_name}"
154 |   default_service = "${google_compute_backend_service.rbs.self_link}"
155 | }
156 | #
157 | # Firewall rules for specific Tags
158 | resource "google_compute_firewall" "default" {
159 |   name    = "${var.network}-${var.fwr_name}"
160 |   network = "${var.network}"
161 |   project = "${var.project}"
162 | 
163 |   allow {
164 |     protocol = "tcp"
165 |     ports    = ["80", "443"]
166 |   }
167 | }
168 | 


--------------------------------------------------------------------------------
/MIG/apache-mig-glb/variables.tf:
--------------------------------------------------------------------------------
 1 | # Creds and default location
 2 | variable "credentials" { default = "your_account.json" } // Change with you service account .json file
 3 | variable "project"     { default = "your_project_id" } // Your GCP Project ID
 4 | variable "region"      { default = "northamerica-northeast1" }
 5 | variable "zone"        { default = "northamerica-northeast1-a" }
 6 | #
 7 | # Instance Template
 8 | variable "prefix"       { default = "apache-" }
 9 | variable "desc"         { default = "This template is used to create Apache server instances." }
10 | variable "tags"         { default = "webserver" }
11 | variable "desc_inst"    { default = "Apache Web server instance" }
12 | variable "machine_type" { default =  "n1-standard-1" }
13 | variable "source_image" { default =  "apache" } //This is the family tag used when building the Golden Image with Packer.
14 | variable "network"      { default =  "default" }
15 | #
16 | # Managed Instace Group
17 | variable "rmig_name"          { default =  "apache-rmig" }
18 | variable "base_instance_name" { default =  "apache" }
19 | variable "target_size"        { default =  "3" }
20 | #
21 | # Healthcheck
22 | variable "hc_name" { default = "apache-healthcheck" }
23 | variable "hc_port" { default = "80" }
24 | #
25 | # Backend
26 | variable "be_name"              { default = "http-backend" }
27 | variable "be_protocol"          { default = "HTTP" }
28 | variable "be_port_name"         { default = "http" }
29 | variable "be_timeout"           { default = "10" }
30 | variable "be_session_affinity"  { default = "NONE" }
31 | #
32 | # RMIG Autoscaler
33 | variable "rmig_as_name" { default = "rmig-as" }
34 | #
35 | # Global Forwarding Rule
36 | variable "gfr_name"      { default = "website-forwarding-rule" }
37 | variable "gfr_portrange" { default = "80" }
38 | variable "thp_name"      { default = "http-proxy" }
39 | variable "urlmap_name"   { default = "http-lb-url-map" }
40 | #
41 | # Firewall Rules
42 | variable "fwr_name" { default = "allow-http-https" }
43 | 


--------------------------------------------------------------------------------
/MIG/apache/README.md:
--------------------------------------------------------------------------------
1 | # gcp/MIG/apache
2 | Terraform script to create a an instance template from a Packer built image followed by the creation of an instance group with a minimum of 3 Apache Server with a burst to 5 instances running.  It also opens port 80 and 443 in firewall rules for default network for target with the tag webserver.
3 | 
4 | Scripts uses a GCP service account and a JSON file with your account token and VARS defined in variables.tf
5 | 
6 | The Golden Image used for template creation can be created with Packer and this script: https://github.com/sveronneau/gcp/blob/master/packer/apache.json
7 | 


--------------------------------------------------------------------------------
/MIG/apache/instance_template_and_mig_apache.tf:
--------------------------------------------------------------------------------
  1 | provider "google" {
  2 |   credentials = "${var.credentials}"
  3 |   project = "${var.project}"
  4 |   region  = "${var.region}"
  5 | }
  6 | #
  7 | # Template creation
  8 | resource "google_compute_instance_template" "instance_template" {
  9 |   name_prefix = "${var.prefix}"
 10 |   description = "${var.desc}"
 11 |   project = "${var.project}"
 12 |   region  = "${var.region}"
 13 |   tags = ["${var.tags}"]
 14 |   instance_description = "${var.desc_inst}"
 15 |   machine_type = "${var.machine_type}"
 16 |   can_ip_forward = false // Whether to allow sending and receiving of packets with non-matching source or destination IPs. This defaults to false.
 17 | 
 18 |   scheduling {
 19 |     automatic_restart   = true
 20 |     on_host_maintenance = "MIGRATE"
 21 |   }
 22 | 
 23 |   // Create a new boot disk from an image (Lets use one created by Packer)
 24 |   disk {
 25 |     source_image = "${var.source_image}"
 26 |     auto_delete  = true
 27 |     boot = true
 28 |   }
 29 | 
 30 |   metadata {
 31 |     startup-script = <<SCRIPT
 32 |     INT_IP="$(ip route get 8.8.8.8 | awk '{print $NF; exit}')"
 33 |     EXT_IP="$(curl -s ipinfo.io/ip)"
 34 |     sudo cat <<EOF > /var/www/html/index.html
 35 |     <html>
 36 |     <body>
 37 |     <title>Apache Server - $(hostname)</title>
 38 |     <img src="https://cloud.google.com/_static/9abbcf9aa7/images/cloud/gcp-logo.svg" alt="Google Cloud" height="51" width="400"><br><br>
 39 |     <img src="https://www.datocms-assets.com/2885/1506457192-blog-packer-list.svg" alt="Packer" height="100" width="100">
 40 |     <img src="https://www.datocms-assets.com/2885/1506457071-blog-terraform-list.svg" alt="Terraform" height="100" width="100">
 41 |     <img src="https://blog-en.openalfa.com/iconos/logos/apache_httpd.jpg" alt="Apache" height="100" width="100">
 42 |     <p><b>Hostname:</b> $(hostname)<br><b>Internal IP:</b> $INT_IP<br><b>External IP:</b> $EXT_IP</p>
 43 |     <p>A <b>Packer</b> built, <b>Terraform</b> deployed, <b>GCP</b> Auto Scalling, Managed Instance Group with Load Balancer serving <b>Apache Web Server</b></p>
 44 |     </body>
 45 |     </html>
 46 | SCRIPT
 47 |   }
 48 | 
 49 |   network_interface {
 50 |     network = "${var.network}"
 51 |     #
 52 |     # Give a Public IP to instance(s)
 53 |     access_config {
 54 |       // Ephemeral IP
 55 |     }
 56 |   }
 57 | 
 58 |   service_account {
 59 |     scopes = ["userinfo-email", "compute-ro", "storage-ro"]
 60 |   }
 61 | 
 62 |   lifecycle {
 63 |     create_before_destroy = true
 64 |   }
 65 | }
 66 | #
 67 | # HealthCheck
 68 | resource "google_compute_health_check" "autohealing" {
 69 |   name                = "autohealing-health-check"
 70 |   check_interval_sec  = 5
 71 |   timeout_sec         = 5
 72 |   healthy_threshold   = 2
 73 |   unhealthy_threshold = 10                         # 50 seconds
 74 | 
 75 |   http_health_check {
 76 |     request_path = "/"
 77 |     port         = "80"
 78 |   }
 79 | }
 80 | #
 81 | # MIG creation
 82 | resource "google_compute_instance_group_manager" "instance_group_manager" {
 83 |   instance_template = "${google_compute_instance_template.instance_template.self_link}" // points to self since we are creating it in the same script
 84 |   name = "${var.mig_name}"
 85 |   base_instance_name = "${var.base_instance_name}"
 86 |   project = "${var.project}"
 87 |   zone = "${var.zone}"
 88 |   target_size = "${var.target_size}"
 89 | 
 90 |   named_port {
 91 |     name = "http"
 92 |     port = 80
 93 |   }
 94 | 
 95 |   named_port {
 96 |     name = "https"
 97 |     port = 443
 98 |   }
 99 | 
100 |   auto_healing_policies {
101 |     health_check      = "${google_compute_health_check.autohealing.self_link}"
102 |     initial_delay_sec = 300
103 |   }
104 | }
105 | #
106 | # MIG AutoScaler
107 | resource "google_compute_autoscaler" "my_autoscaler" {
108 |   name   = "mig-scaler"
109 |   zone = "${var.zone}"
110 |   target = "${google_compute_instance_group_manager.instance_group_manager.self_link}"
111 | 
112 |   autoscaling_policy = {
113 |     max_replicas    = 5
114 |     min_replicas    = 3
115 |     cooldown_period = 60
116 | 
117 |     cpu_utilization {
118 |       target = 0.5
119 |     }
120 |   }
121 | }
122 | #
123 | # Firewall rules for specific Tags
124 | resource "google_compute_firewall" "default" {
125 |   name    = "${var.network}-${var.fwr_name}"
126 |   network = "${var.network}"
127 |   project = "${var.project}"
128 | 
129 |   allow {
130 |     protocol = "tcp"
131 |     ports    = ["80", "443"]
132 |   }
133 |   target_tags = ["${var.tags}"]
134 | }
135 | 


--------------------------------------------------------------------------------
/MIG/apache/variables.tf:
--------------------------------------------------------------------------------
 1 | # Creds and default location
 2 | variable "credentials" { default = "your_account.json" } // Change with you service account .json file
 3 | variable "project"     { default = "your_project_id" } // Your GCP Project ID
 4 | variable "region"      { default = "northamerica-northeast1" }
 5 | variable "zone"        { default = "northamerica-northeast1-a" }
 6 | #
 7 | # Instance Template
 8 | variable "prefix"       { default = "apache-" }
 9 | variable "desc"         { default = "This template is used to create Apache server instances." }
10 | variable "tags"         { default = "webserver" }
11 | variable "desc_inst"    { default = "Apache Web server instance" }
12 | variable "machine_type" { default =  "n1-standard-1" }
13 | variable "source_image" { default =  "apache" } //This is the family tag used when building the Golden Image with Packer.
14 | variable "network"      { default =  "default" }
15 | #
16 | # Managed Instace Group
17 | variable "mig_name"           { default =  "apache-mig" }
18 | variable "base_instance_name" { default =  "apache" }
19 | variable "target_size"        { default =  "3" }
20 | #
21 | # Firewall Rules
22 | variable "fwr_name" { default = "allow-http-https" }
23 | 


--------------------------------------------------------------------------------
/MIG/old/instance_template_and_mig.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${file("gcp_service_account.json")}"
 3 |   project = "your_gcp_project"
 4 |   region  = "northamerica-northeast1"
 5 | }
 6 | 
 7 | # data "terraform_remote_state" "foo" {
 8 | #   backend = "gcs"
 9 | #   config {
10 | #     credentials = "your_json_creds"
11 | #     bucket      = "your_state_pucket"
12 | #     prefix      = "terraform/state/MIG"
13 | #   }
14 | # }
15 | 
16 | resource "google_compute_instance_template" "instance_template" {
17 |   name_prefix = "nginx-"
18 |   description = "This template is used to create nginx server instances."
19 |   project = "your_gcp_project"
20 |   region      = "northamerica-northeast1"
21 | 
22 |   tags = ["nginx"]
23 | 
24 |   labels = {
25 |     environment = "dev"
26 |   }
27 | 
28 |   instance_description = "description assigned to instances"
29 |   machine_type         = "n1-standard-1"
30 |   can_ip_forward       = false
31 | 
32 |   scheduling {
33 |     automatic_restart   = true
34 |     on_host_maintenance = "MIGRATE"
35 |   }
36 | 
37 |   // Create a new boot disk from an image (Lets use one created by Packer)
38 |   disk {
39 |     source_image = "nginx" //image family tag works here
40 |     auto_delete  = true
41 |     boot         = true
42 |   }
43 | 
44 |   // Use an existing disk resource in RO mode since this is a MIG
45 | #  disk {
46 | #    source      = "my_existing_disknginx"
47 | #    auto_delete = false
48 | #    boot        = false
49 | #  }
50 | 
51 |   network_interface {
52 |     network = "default"
53 |   }
54 | 
55 |   metadata {
56 |     foo = "bar"
57 |   }
58 | 
59 |   service_account {
60 |     scopes = ["userinfo-email", "compute-ro", "storage-ro"]
61 |   }
62 | 
63 |   lifecycle {
64 |     create_before_destroy = true
65 |   }
66 | 
67 | }
68 | 
69 | resource "google_compute_instance_group_manager" "instance_group_manager" {
70 |   name               = "instance-group-manager"
71 |   instance_template  = "${google_compute_instance_template.instance_template.self_link}"
72 |   base_instance_name = "instance-group-manager"
73 |   zone               = "northamerica-northeast1-a"
74 |   project            = "your_gcp_project"
75 |   target_size        = "3"
76 | 
77 |   named_port {
78 |     name = "http"
79 |     port = 80
80 |   }
81 | 
82 |   named_port {
83 |     name = "https"
84 |     port = 443
85 |   }
86 | }
87 | 
88 | resource "google_compute_firewall" "default" {
89 |   name    = "tf-allow-http-https"
90 |   network = "default"
91 |   project = "your_gcp_project"
92 | 
93 |   allow {
94 |     protocol = "tcp"
95 |     ports    = ["80", "443"]
96 |   }
97 |   target_tags = ["nginx"]
98 | }
99 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # gcp
 2 | Collection of Packer, Terraform, Consul, Ansible and other GCP related sample scripts.
 3 | All Terraform and Packer scripts uses a GCP service account and a JSON file with your account token.  It assumes you've set the proper roles to your service account.
 4 | 
 5 | * consul - The blog post folder
 6 | *
 7 | * consul_vars - introducing variables.tf file to consul
 8 | * Create Master TF Project and SA
 9 | * Create Project
10 | * gce (Compute engine)
11 | * gcs-backend (enable gcs backend for terraform state file)
12 | * gke (Kubernetes engine)
13 | * MIG (Managed Instance Group)
14 | * packer
15 | * vault
16 | * vpc and firewall
17 | * CloudSQL
18 | 


--------------------------------------------------------------------------------
/consul/README.md:
--------------------------------------------------------------------------------
1 | # gcp/consul
2 | Terraform and Ansible script to deploy Consul 1.0.7 (non-configured single instance) within a GCP instance.
3 | 
4 | Requirements: Terraform and Ansible locally installed. GCP project, Service Account JSON file and Project wide SSH Key.
5 | 
6 | Steps available at : https://www.cloudops.com/2018/02/how-to-deploy-consul-in-gcp-using-terraform-your-first-step-towards-devops-automation/
7 | 


--------------------------------------------------------------------------------
/consul/consul.tf:
--------------------------------------------------------------------------------
 1 | // Configure the Google Cloud provider
 2 | 
 3 | provider "google" {
 4 |   credentials = "${file("gcp_service_account.json")}"
 5 |   project = "your_gcp_project"
 6 |   region  = "northamerica-northeast1"
 7 | }
 8 | 
 9 | resource "google_compute_instance" "ansible" {
10 |   count        = "1"
11 |   project      = "your_gcp_project"
12 |   zone         = "northamerica-northeast1-a"
13 |   name         = "consul-node-${count.index}"
14 |   machine_type = "f1-micro"
15 | 
16 |   boot_disk {
17 |     initialize_params {
18 |       image = "ubuntu-1604-lts"
19 |     }
20 |   }
21 | 
22 | # This is where we configure the instance with ansible-playbook
23 |   provisioner "local-exec" {
24 |     command = "sleep 90; ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u your_key_username --private-key ./my_private_key -i '${google_compute_instance.ansible.network_interface.0.access_config.0.assigned_nat_ip}', master.yml"
25 |   }
26 | 
27 |   network_interface {
28 |     network       = "default"
29 | 
30 |     access_config {
31 |       // Ephemeral IP
32 |     }
33 |   }
34 | 
35 |   service_account {
36 |     scopes = ["userinfo-email", "compute-ro", "storage-ro"]
37 |   }
38 | }
39 | 


--------------------------------------------------------------------------------
/consul/master.yml:
--------------------------------------------------------------------------------
 1 | - hosts: all
 2 |   become: true
 3 | 
 4 |   tasks:
 5 |     - name: Install the unzip package
 6 |       apt:
 7 |         name: unzip
 8 |         state: present
 9 | 
10 |     - name: Download and extract Consul in /bin
11 |       unarchive:
12 |         src: https://releases.hashicorp.com/consul/1.0.7/consul_1.0.7_linux_amd64.zip
13 |         dest: /bin/
14 |         remote_src: yes
15 | 
16 |     - name: Make default config directory
17 |       command: sudo mkdir /etc/consul.d
18 | 
19 |     - name: Launch Consul.
20 |       shell: nohup /bin/consul agent -dev </dev/null >/dev/null 2>&1 &
21 | 


--------------------------------------------------------------------------------
/consul_vars/README.md:
--------------------------------------------------------------------------------
1 | # gcp/consul_vars
2 | Terraform and Ansible script to deploy Consul 1.0.7 (non-configured single instance) within a GCP instance.
3 | 
4 | Requirements: Terraform and Ansible locally installed. GCP project, Service Account JSON file and Project wide SSH Key.
5 | 
6 | Steps available at : https://www.cloudops.com/2018/02/how-to-deploy-consul-in-gcp-using-terraform-your-first-step-towards-devops-automation/
7 | 
8 | IMPORTANT: This version puts all variables in the variables.tf file.
9 | 


--------------------------------------------------------------------------------
/consul_vars/consul_with_vars.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${var.credentials}"
 3 |   project = "${var.project}"
 4 |   region  = "${var.region}"
 5 | }
 6 | 
 7 | resource "google_compute_instance" "ansible" {
 8 |   count        = "1"
 9 |   project      = "${var.project}"
10 |   zone         = "${var.zone}"
11 |   name         = "consul-node-${count.index}"
12 |   machine_type = "f1-micro"
13 | 
14 |   boot_disk {
15 |     initialize_params {
16 |       image = "ubuntu-1604-lts"
17 |     }
18 |   }
19 | 
20 | # This is where we configure the instance with ansible-playbook
21 |   provisioner "local-exec" {
22 |     command = "sleep 90; ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u your_sshkey_user --private-key your_private_key -i '${google_compute_instance.ansible.network_interface.0.access_config.0.assigned_nat_ip}', master.yml"  }
23 | 
24 |   network_interface {
25 |     network       = "default"
26 | 
27 |     access_config {
28 |       // Ephemeral IP
29 |     }
30 |   }
31 | 
32 |   service_account {
33 |     scopes = ["userinfo-email", "compute-ro", "storage-ro"]
34 |   }
35 | }
36 | 


--------------------------------------------------------------------------------
/consul_vars/master.yml:
--------------------------------------------------------------------------------
 1 | - hosts: all
 2 |   become: true
 3 | 
 4 |   tasks:
 5 |     - name: Install the unzip package
 6 |       apt:
 7 |         name: unzip
 8 |         state: present
 9 | 
10 |     - name: Download and extract Consul in /bin
11 |       unarchive:
12 |         src: https://releases.hashicorp.com/consul/1.0.7/consul_1.0.7_linux_amd64.zip
13 |         dest: /bin/
14 |         remote_src: yes
15 | 
16 |     - name: Make default config directory
17 |       command: sudo mkdir /etc/consul.d
18 | 
19 |     - name: Launch Consul.
20 |       shell: nohup /bin/consul agent -dev </dev/null >/dev/null 2>&1 &
21 | 


--------------------------------------------------------------------------------
/consul_vars/variables.tf:
--------------------------------------------------------------------------------
1 | variable "credentials" { default = "your_account.json" }
2 | variable "project"     { default = "your_project_id" }
3 | variable "region"      { default = "northamerica-northeast1" }
4 | variable "zone"        { default = "northamerica-northeast1-a" }
5 | 


--------------------------------------------------------------------------------
/dataflow/wc.maven:
--------------------------------------------------------------------------------
 1 | mvn compile exec:java \
 2 | -Dexec.mainClass=com.google.cloud.teleport.templates.WordCount \
 3 | -Dexec.cleanupDaemonThreads=false \
 4 | -Dexec.args=" \
 5 | --project=stacyv-sandbox \
 6 | --stagingLocation=gs://bucket_name/staging \
 7 | --tempLocation=gs://bucket_name/temp \
 8 | --templateLocation=gs://bucket_name/templates/wc.json \
 9 | --runner=DataflowRunner"
10 | 


--------------------------------------------------------------------------------
/gce/README.md:
--------------------------------------------------------------------------------
1 | # gcp/gce
2 | Terraform script sample to deploy 5 instances with a second disk attached to it and installs traceroute in them ounce deployed.
3 | 
4 | Scripts uses a GCP service account and a JSON file with your account token and ENV VARS
5 | 


--------------------------------------------------------------------------------
/gce/compute.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${file("gcp_service_account.json")}"
 3 |   project = "your_gcp_project"
 4 |   region  = "northamerica-northeast1"
 5 | }
 6 | 
 7 | data "google_compute_zones" "available" {}
 8 | 
 9 | variable "node_count" {
10 |   default = "5"
11 | }
12 | 
13 | resource "google_compute_disk" "seconddisk" {
14 |     count   = "${var.node_count}"
15 |     project = "${google_project_services.project.project}"
16 |     name    = "compute-datadisk-${count.index}"
17 |     type    = "pd-standard"
18 |     zone    = "${data.google_compute_zones.available.names[0]}"
19 |     size    = "5"
20 | }
21 | 
22 | resource "google_compute_instance" "default" {
23 |   count        = "${var.node_count}"
24 |   project      = "${google_project_services.project.project}"
25 |   zone         = "${data.google_compute_zones.available.names[0]}"
26 |   name         = "compute-node-${count.index}"
27 |   machine_type = "f1-micro"
28 | 
29 |   tags = ["foo", "bar"]
30 | 
31 |   boot_disk {
32 |     initialize_params {
33 |       image = "ubuntu-1604-lts"
34 |     }
35 |   }
36 | 
37 |   attached_disk {
38 |     source      = "${element(google_compute_disk.seconddisk.*.self_link, count.index)}"
39 |     device_name = "seconddisk"
40 |   }
41 | 
42 |   network_interface {
43 |     //network       = "foobar"
44 |     subnetwork    = "subnet-na-east1"
45 |     //network      = "${google_compute_network.custom-subnet.id}"
46 |     //subnetwork   = "${google_compute_subnetwork.subnet1a.id}"
47 |     subnetwork_project = "${google_project_services.project.project}"
48 | 
49 |     access_config {
50 |       // Ephemeral IP
51 |     }
52 |   }
53 | 
54 |   metadata {
55 |     foo = "bar"
56 |   }
57 | 
58 |   metadata_startup_script = "sudo apt-get install traceroute"
59 | 
60 |   service_account {
61 |     scopes = ["userinfo-email", "compute-ro", "storage-ro"]
62 |   }
63 | }
64 | 
65 | output "instance_id" {
66 |   value = "${google_compute_instance.default.*.self_link}"
67 | }
68 | 
69 | output "public_ip" {
70 |    value = ["${google_compute_instance.default.*.network_interface.0.access_config.0.assigned_nat_ip}"]
71 | }
72 | 


--------------------------------------------------------------------------------
/gce/glusterfs.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${file("gcp_service_account.json")}"
 3 |   project = "your_gcp_project"
 4 |   region  = "northamerica-northeast1"
 5 | }
 6 | 
 7 | data "google_compute_zones" "available" {}
 8 | 
 9 | variable "node_count" {
10 |   default = "3"
11 | }
12 | 
13 | resource "google_compute_disk" "seconddisk" {
14 |     count   = "${var.node_count}"
15 |     project = "your_gcp_project"
16 |     name    = "glusterfs-datadisk-${count.index}"
17 |     type    = "pd-ssd"
18 |     zone    = "${data.google_compute_zones.available.names[0]}"
19 |     size    = "80"
20 | }
21 | 
22 | resource "google_compute_instance" "default" {
23 |   count        = "${var.node_count}"
24 |   project      = "your_gcp_project"
25 |   zone         = "${data.google_compute_zones.available.names[0]}"
26 |   name         = "glusterfs-node-${count.index}"
27 |   machine_type = "n1-standard-1"
28 | 
29 |   tags = ["glusterfs", "xmldation"]
30 | 
31 |   boot_disk {
32 |     initialize_params {
33 |       image = "glusterfs"
34 |     }
35 |   }
36 | 
37 |   attached_disk {
38 |     source      = "${element(google_compute_disk.seconddisk.*.self_link, count.index)}"
39 |     device_name = "seconddisk"
40 |   }
41 | 
42 |   network_interface {
43 |     network       = "default"
44 |     //subnetwork    = "default"
45 |     //network      = "${google_compute_network.custom-subnet.id}"
46 |     //subnetwork   = "${google_compute_subnetwork.subnet1a.id}"
47 |     //subnetwork_project = "${google_project_services.project.project}"
48 | 
49 |     //access_config {  // remove this to enable public ip assignation
50 |       // Ephemeral IP
51 |     //}
52 |   }
53 | 
54 |   metadata {
55 |     foo = "glusterfs"
56 |   }
57 | 
58 |   service_account {
59 |     scopes = ["userinfo-email", "compute-ro", "storage-ro"]
60 |   }
61 | }
62 | 
63 | output "instance_id" {
64 |   value = "${google_compute_instance.default.*.self_link}"
65 | }
66 | 
67 | output "public_ip" {
68 |    value = ["${google_compute_instance.default.*.network_interface.0.access_config.0.assigned_nat_ip}"]
69 | }
70 | 


--------------------------------------------------------------------------------
/gcs-backend/README.md:
--------------------------------------------------------------------------------
1 | # gcp/gcs-backend
2 | Terraform script sample to enable GCS as a backend for tfstate file.
3 | 
4 | Make sure you create a bucker prior execution and also activate versioning on that bucket.
5 | 
6 | * gsutil versioning set on gs://your_terraform_state_bucket
7 | 
8 | Scripts uses a GCP service account and a JSON file with your account token.
9 | 


--------------------------------------------------------------------------------
/gcs-backend/example_referencing.txt:
--------------------------------------------------------------------------------
 1 | Include this in your TF file to reference to the GCS backend.
 2 | 
 3 | data "terraform_remote_state" "foo" {
 4 |   backend = "gcs"
 5 |   config {
 6 |     credentials = "path_to_your_json_file"
 7 |     bucket  = "your_bucket_name"
 8 |     prefix  = "your_prefix"
 9 |   }
10 | }
11 | 


--------------------------------------------------------------------------------
/gcs-backend/gcs.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${file("path_to_your_json_file")}"
 3 |   project     = "your_project"
 4 |   region      = "northamerica-northeast1"
 5 | }
 6 | 
 7 | terraform {
 8 |   backend "gcs" {
 9 |     credentials = "path_to_your_json_file"
10 |     bucket  = "your_bucket_name" // Needs to exist prior execution of script
11 |     prefix  = "terraform/tfstate"
12 |   }
13 | }
14 | 


--------------------------------------------------------------------------------
/gke/README.md:
--------------------------------------------------------------------------------
1 | # gcp/gke
2 | Terraform script sample to deploy a 3 node cluster (latest version available) in 1 zone
3 | 
4 | Scripts uses a GCP service account and a JSON file with your account token.
5 | 


--------------------------------------------------------------------------------
/gke/gke.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${var.credentials}"
 3 |   project = "${var.project}"
 4 |   region  = "${var.region}"
 5 | }
 6 | 
 7 | data "google_container_engine_versions" "canada" {
 8 |   zone = "${var.zone}"
 9 | }
10 | 
11 | // Store state file in memory and the rest is encrypted in flight and at rest in GCS
12 | # data "terraform_remote_state" "foo" {
13 | #   backend = "gcs"
14 | #   config {
15 | #     credentials = "your_json_creds"
16 | #     bucket      = "your_state_pucket"
17 | #     prefix      = "terraform/state/gke_cluster_name"
18 | #   }
19 | # }
20 | 
21 | resource "google_container_cluster" "primary" {
22 |   name               = "${var.gke_cluster_name}"
23 |   zone               = "${var.zone}"
24 |   // Get the latest version all the time
25 |   #node_version       = "${data.google_container_engine_versions.canada.latest_node_version}"
26 |   #min_master_version = "${data.google_container_engine_versions.canada.latest_node_version}"
27 |   //
28 |   node_version       = "${var.gke_cluster_node_version}"
29 |   min_master_version = "${var.gke_cluster_min_master_version}"
30 |   //
31 |   initial_node_count = "${var.gke_cluster_node_count}"
32 | 
33 | #  additional_zones = [
34 | #    "northamerica-northeast1-b",
35 | #    "northamerica-northeast1-c",
36 | #  ]
37 | 
38 | // DONT USE THIS IN PROD IF STATE FILE IS LOCAL (plain-text JSON)
39 |   master_auth {
40 |     username = "${var.gke_cluster_user}"
41 |     password = "${var.gke_cluster_pwd}"
42 |   }
43 | 
44 |   node_config {
45 |     oauth_scopes = [
46 |       "https://www.googleapis.com/auth/compute",
47 |       "https://www.googleapis.com/auth/devstorage.read_only",
48 |       "https://www.googleapis.com/auth/logging.write",
49 |       "https://www.googleapis.com/auth/monitoring",
50 |     ]
51 | 
52 |     labels {
53 |       foo = "first_gke_app"
54 |     }
55 | 
56 |     tags = ["test", "build1"]
57 |   }
58 | }
59 | 
60 | # The following outputs allow authentication and connectivity to the GKE Cluster.
61 | output "client_certificate" {
62 |   value = "${google_container_cluster.primary.master_auth.0.client_certificate}"
63 | }
64 | 
65 | output "client_key" {
66 |   value = "${google_container_cluster.primary.master_auth.0.client_key}"
67 | }
68 | 
69 | output "cluster_ca_certificate" {
70 |   value = "${google_container_cluster.primary.master_auth.0.cluster_ca_certificate}"
71 | }
72 | 


--------------------------------------------------------------------------------
/gke/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "credentials" { default = "your_account.json" }
 2 | variable "project"     { default = "your_project_id" }
 3 | variable "region"      { default = "northamerica-northeast1" }
 4 | variable "zone"        { default = "northamerica-northeast1-a" }
 5 | variable "gke_cluster_name" { default = "yourclustername" }
 6 | variable "gke_cluster_user" { default = "your_cluster_user" }
 7 | variable "gke_cluster_pwd"  { default = "your_cluster_pwd" }
 8 | variable "gke_cluster_node_count"  { default = "3" }
 9 | variable "gke_cluster_node_version"       { default = "1.8.7-gke.1" }
10 | variable "gke_cluster_min_master_version" { default = "1.8.7-gke.1" }
11 | 


--------------------------------------------------------------------------------
/http-https-redirect/myimage/Dockerfile.template:
--------------------------------------------------------------------------------
 1 | # NOTE: Don't modify this file directly - see Makefile
 2 | 
 3 | FROM alpine:{{ .AlpineVersion }}
 4 | 
 5 | LABEL git.commithash="{{ .GitCommit }}"
 6 | 
 7 | RUN apk --update --no-cache add nginx
 8 | 
 9 | COPY global.conf /etc/nginx/modules/global.conf
10 | COPY http.conf /etc/nginx/conf.d/default.conf
11 | 
12 | EXPOSE 80
13 | 
14 | CMD /usr/sbin/nginx
15 | 


--------------------------------------------------------------------------------
/http-https-redirect/myimage/Makefile:
--------------------------------------------------------------------------------
 1 | DOCKER_BASE=realkinetic/http-to-https
 2 | DOCKER_TAG=1.0
 3 | $(eval GIT_COMMIT = $(shell git rev-parse HEAD))
 4 | 
 5 | ALPINE_VERSION=3.8
 6 | 
 7 | default: build
 8 | 
 9 | clean:
10 | 	rm -f Dockerfile
11 | 
12 | Dockerfile: Dockerfile.template
13 | 	sed \
14 | 		-e 's!{{ .AlpineVersion }}!'"$(ALPINE_VERSION)"'!g' \
15 | 		-e 's!{{ .Version }}!'"$(DOCKER_TAG)"'!g' \
16 | 		-e 's!{{ .GitCommit }}!'"$(GIT_COMMIT)"'!g' \
17 | 		Dockerfile.template > Dockerfile
18 | 
19 | build: Dockerfile
20 | 	docker build -t $(DOCKER_BASE):$(DOCKER_TAG) .
21 | 
22 | run: build
23 | 	docker run -it -p80:80 --rm $(DOCKER_BASE):$(DOCKER_TAG)
24 | 
25 | debug: build
26 | 	docker run -it -p80:80 --rm $(DOCKER_BASE):$(DOCKER_TAG) /bin/sh
27 | 
28 | push: build
29 | 	docker push $(DOCKER_BASE):$(DOCKER_TAG)
30 | 


--------------------------------------------------------------------------------
/http-https-redirect/myimage/README.md:
--------------------------------------------------------------------------------
 1 | HTTP to HTTPS
 2 | =============
 3 | 
 4 | The web is moving to TLS. This is a Docker container that forces browser
 5 | redirection from HTTP to HTTPS for all hosts that hit it.
 6 | 
 7 | HTTP code 307 is used to redirect browsers so that the HTTP method does not
 8 | change (which would happen with old clients using 301/302).
 9 | 
10 | Running:
11 | --------
12 | 
13 | ``docker run --rm -p80:80 -d realkinetic/http-to-https:latest``.
14 | 
15 | Building
16 | --------
17 | 
18 | ``make build``
19 | 


--------------------------------------------------------------------------------
/http-https-redirect/myimage/global.conf:
--------------------------------------------------------------------------------
1 | daemon off;
2 | error_log stderr;
3 | pid /run/nginx.pid;
4 | 


--------------------------------------------------------------------------------
/http-https-redirect/myimage/http.conf:
--------------------------------------------------------------------------------
 1 | access_log /dev/stdout;
 2 | 
 3 | server {
 4 |   listen 80 default_server;
 5 |   listen [::]:80 default_server;
 6 |   server_name _;
 7 | 
 8 |   return 307 https://$host$request_uri;
 9 | }
10 | 


--------------------------------------------------------------------------------
/log_purge/gcs.txt:
--------------------------------------------------------------------------------
 1 | 1) List all buckets
 2 |    gsutil ls ; echo ; echo
 3 | 
 4 | 2) List all buckets with their generation #
 5 |    for i in $(gsutil ls); do
 6 |       gsutil ls -a -r "$i**"
 7 |    done
 8 | 
 9 | 3a) Purge all objects per generation number
10 |     gsutil rm gs://bucket/object#generation
11 | 
12 | 3b) Purge an entire bucket of all objects and versions
13 |     gsutil rm -r gs://bucket
14 | 


--------------------------------------------------------------------------------
/log_purge/stackdriver.txt:
--------------------------------------------------------------------------------
 1 | This script will list a log type in StackDriver and will loop to purge them all.
 2 | 
 3 | gcloud beta logging logs list ; echo ; echo
 4 | for i in $(gcloud beta logging logs list); do
 5 |    if [ $i != "NAME" ]
 6 |    then
 7 |      gcloud beta logging logs delete "$i" --verbosity critical
 8 |    fi
 9 | done
10 | 


--------------------------------------------------------------------------------
/nginx-ingress-controller/nginx-ingress-controller.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: v1
 2 | kind: Service
 3 | metadata:
 4 |   creationTimestamp: 2018-11-07T13:05:33Z
 5 |   labels:
 6 |     app: nginx-ingress
 7 |     chart: nginx-ingress-0.18.1
 8 |     component: controller
 9 |     heritage: Tiller
10 |     release: nginx-ingress
11 |   name: nginx-ingress-controller
12 |   namespace: default
13 |   resourceVersion: "236122"
14 |   selfLink: /api/v1/namespaces/default/services/nginx-ingress-controller
15 |   uid: cf8d2189-e28d-11e8-92cc-42010a840158
16 | spec:
17 |   clusterIP: 10.0.7.22
18 |   externalTrafficPolicy: Cluster
19 |   loadBalancerIP: 35.195.57.244
20 |   ports:
21 |   - name: http
22 |     nodePort: 30923
23 |     port: 80
24 |     protocol: TCP
25 |     targetPort: 80
26 |   - name: https
27 |     nodePort: 31529
28 |     port: 443
29 |     protocol: TCP
30 |     targetPort: 443
31 |   selector:
32 |     app: nginx-ingress
33 |     component: controller
34 |     release: nginx-ingress
35 |   sessionAffinity: None
36 |   type: LoadBalancer
37 | status:
38 |   loadBalancer:
39 |     ingress:
40 |     - ip: 35.195.57.244
41 | 


--------------------------------------------------------------------------------
/nginx-ingress-controller/nginx-ingress-default-backend.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: v1
 2 | kind: Service
 3 | metadata:
 4 |   creationTimestamp: 2018-11-07T13:05:33Z
 5 |   labels:
 6 |     app: nginx-ingress
 7 |     chart: nginx-ingress-0.18.1
 8 |     component: default-backend
 9 |     heritage: Tiller
10 |     release: nginx-ingress
11 |   name: nginx-ingress-default-backend
12 |   namespace: default
13 |   resourceVersion: "235953"
14 |   selfLink: /api/v1/namespaces/default/services/nginx-ingress-default-backend
15 |   uid: cf8f28f4-e28d-11e8-92cc-42010a840158
16 | spec:
17 |   clusterIP: 10.0.7.74
18 |   ports:
19 |   - port: 80
20 |     protocol: TCP
21 |     targetPort: 8080
22 |   selector:
23 |     app: nginx-ingress
24 |     component: default-backend
25 |     release: nginx-ingress
26 |   sessionAffinity: None
27 |   type: ClusterIP
28 | status:
29 |   loadBalancer: {}
30 | 


--------------------------------------------------------------------------------
/packer/README.md:
--------------------------------------------------------------------------------
 1 | # gcp/packer
 2 | Packer script for image baking on GCP
 3 | 
 4 | * V1 = Install packages from the packer file
 5 | * V2 = Install packages from provisioner.sh
 6 | * V3 = Install packages from provisioner.sh and uses the image_family to avoid mentioning image version.
 7 | * apache = Image baking with Apache Server (requires apache.json and prep_apache.sh file)
 8 | * glusterfs = Image baking with GlusterFS
 9 | 
10 | Scripts uses a GCP service account and a JSON file with your account token.
11 | 


--------------------------------------------------------------------------------
/packer/apache.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "variables": {
 3 |         "gcloud_account_json": "your_account_file.json",
 4 |         "gcloud_project_id": "your_project_id"
 5 |   },
 6 |   "builders": [
 7 |     {
 8 |       "type": "googlecompute",
 9 |       "account_file": "{{user `gcloud_account_json`}}",
10 |       "project_id": "{{user `gcloud_project_id`}}",
11 |       "ssh_username":"ubuntu",
12 |       "source_image_family": "ubuntu-1604-lts",
13 |       "image_name": "apache-golden-{{timestamp}}",
14 |       "zone": "northamerica-northeast1-a",
15 |       "machine_type":"n1-standard-1",
16 |       "disk_size": "40",
17 |       "on_host_maintenance":"TERMINATE",
18 |       "image_family":"apache"
19 |     }
20 |   ],
21 |   "provisioners": [
22 |       {
23 |            "type": "shell",
24 |            "inline": [
25 |                 "sudo apt-get clean",
26 |                 "sudo apt-get update",
27 |                 "sudo apt-get -y upgrade",
28 |                 "sudo apt-get -y install apache2 htop stress",
29 |                 "sudo ufw allow 'Apache Full'"
30 |            ]
31 |       }
32 |   ]
33 | }
34 | 


--------------------------------------------------------------------------------
/packer/docker.json:
--------------------------------------------------------------------------------
1 | {
2 | 
3 | }
4 | 


--------------------------------------------------------------------------------
/packer/gcp_v1.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "variables": {
 3 |         "gcloud_account_json": "{{env `HOME`}}/.gcloud/account.json",
 4 |         "gcloud_project_id": "your_project_id"
 5 |   },
 6 |   "builders": [
 7 |     {
 8 |       "type": "googlecompute",
 9 |       "account_file": "{{user `gcloud_account_json`}}",
10 |       "project_id": "{{user `gcloud_project_id`}}",
11 |       "ssh_username":"ubuntu",
12 |       "source_image": "ubuntu-1404-trusty-v20160602",
13 |       "zone": "northamerica-northeast1-a",
14 |       "image_name": "packer-demo-{{timestamp}}"
15 |     }
16 |   ],
17 |   "provisioners": [
18 |       {
19 |            "type": "shell",
20 |            "inline": [
21 |                 "sudo apt-get clean",
22 |                 "sudo apt-get update",
23 |                 "sudo apt-get -y upgrade",
24 |                 "sudo apt-get -y install nginx",
25 |                 "echo 'This instance was provisioned by Packer' > /usr/share/nginx/html/index.html"
26 |            ]
27 |       }
28 | 
29 |   ]
30 | }
31 | 


--------------------------------------------------------------------------------
/packer/gcp_v2.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "variables": {
 3 |         "gcloud_account_json": "{{env `HOME`}}/.gcloud/account.json",
 4 |         "gcloud_project_id": "your_project_id"
 5 |   },
 6 |   "builders": [
 7 |     {
 8 |       "type": "googlecompute",
 9 |       "account_file": "{{user `gcloud_account_json`}}",
10 |       "project_id": "{{user `gcloud_project_id`}}",
11 |       "ssh_username":"ubuntu",
12 |       "source_image": "ubuntu-1404-trusty-v20180122",
13 |       "zone": "northamerica-northeast1-a",
14 |       "image_name": "packer-demo-{{timestamp}}"
15 |     }
16 |   ],
17 |   "provisioners": [
18 |       {
19 |            "type":"shell",
20 |            "script":"provisioner.sh"
21 |       }
22 | 
23 |   ]
24 | }
25 | 


--------------------------------------------------------------------------------
/packer/gcp_v3.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "variables": {
 3 |         "gcloud_account_json": "{{env `HOME`}}/.gcloud/account.json",
 4 |         "gcloud_project_id": "your_project_id"
 5 |   },
 6 |   "builders": [
 7 |     {
 8 |       "type": "googlecompute",
 9 |       "account_file": "{{user `gcloud_account_json`}}",
10 |       "project_id": "{{user `gcloud_project_id`}}",
11 |       "ssh_username":"ubuntu",
12 |       "source_image_family": "ubuntu-1604-lts",
13 |       "image_name":"packer-ubuntu-nginx",
14 |       "zone": "northamerica-northeast1-a",
15 |       "preemptible":"true",
16 |       "machine_type":"n1-standard-8",
17 |       "on_host_maintenance":"TERMINATE",
18 |       "image_family":"nginx"
19 |     }
20 |   ],
21 |   "provisioners": [
22 |       {
23 |            "type":"shell",
24 |            "script":"provisioner.sh"
25 |       }
26 | 
27 |   ]
28 | }
29 | 


--------------------------------------------------------------------------------
/packer/glusterfs.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "variables": {
 3 |         "gcloud_account_json": "your_account_file.json",
 4 |         "gcloud_project_id": "your_project_id"
 5 |   },
 6 |   "builders": [
 7 |     {
 8 |       "type": "googlecompute",
 9 |       "account_file": "{{user `gcloud_account_json`}}",
10 |       "project_id": "{{user `gcloud_project_id`}}",
11 |       "ssh_username":"packer",
12 |       "source_image_family": "centos-7",
13 |       "zone": "northamerica-northeast1-a",
14 |       "image_name": "glusterfs-golden-{{timestamp}}",
15 |       "machine_type":"n1-standard-1",
16 |       "disk_size": "40",
17 |       "on_host_maintenance":"TERMINATE",
18 |       "image_family":"glusterfs"
19 |     }
20 |   ],
21 |   "provisioners": [
22 |       {
23 |            "type": "shell",
24 |            "inline": [
25 |               "sudo yum -y search centos-release-gluster",
26 |               "sudo yum -y install centos-release-gluster313",
27 |               "sudo yum -y install glusterfs gluster-cli glusterfs-libs glusterfs-server htop",
28 |               "sudo systemctl enable glusterd.service",
29 |               "sudo service glusterd  restart"
30 |            ]
31 |       }
32 | 
33 |   ]
34 | }
35 | 


--------------------------------------------------------------------------------
/packer/provisioner.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash -x
 2 | set -eu -o pipefail
 3 | 
 4 | sudo apt-get clean
 5 | sudo apt-get update
 6 | sudo apt-get upgrade -y
 7 | 
 8 | PKGS="build-essential htop nginx"
 9 | 
10 | sudo apt-get install $PKGS -y
11 | 
12 | sleep 30s
13 | 
14 | sudo sh -c "echo 'This instance was provisioned by some Packer magic!' > /usr/share/nginx/html/index.html"
15 | 
16 | 


--------------------------------------------------------------------------------
/private_catalog/README.md:
--------------------------------------------------------------------------------
 1 | Sample code to deploy simple VM in deployement manager via the Privat Catalog.  This VM will have no external IP and as OS_LOGIN and OS_LOGIN_2FA enabled via metadata
 2 | 
 3 | Zip the 2 files together under the name private_catalog.zip to use in GCP Private Catalog
 4 | 
 5 | To limit a user access rights while giving them acces to the catalog, you'll need to assign the following roles:
 6 | 
 7 | * Compute OS Login
 8 | * Compute Viewer
 9 | * Service Account User
10 | * IAP-secured Tunnel User
11 | * A CUSTOM ROLE WITH THE FOLLOWING ROLES
12 |   * compute.instances.setMetadata
13 |   * compute.instances.start
14 |   * compute.instances.stop
15 |   * deploymentmanager.deployments.create
16 |   * deploymentmanager.deployments.delete
17 |   * deploymentmanager.deployments.get
18 |   * deploymentmanager.deployments.list
19 |   * deploymentmanager.deployments.stop
20 | 


--------------------------------------------------------------------------------
/private_catalog/final_preksm/private_catalog.jinja:
--------------------------------------------------------------------------------
  1 | # Creates a Persistent VM with external data and swap drives both with CMEK.  We also used of shared VPC and labels.
  2 | 
  3 | resources:
  4 | - type: compute.v1.disk
  5 |   name: disk-{{ env["deployment"] }}-data
  6 |   properties:
  7 |     sizeGb: 30
  8 |     zone: northamerica-northeast1-c
  9 |     #diskEncryptionKey:
 10 |     #  kmsKeyName: "projects/{{ properties["kms_project_id"] }}/locations/global/keyRings/{{ properties["keyring"] }}/cryptoKeys/{{ properties["cyptokey"] }}"
 11 | 
 12 | - type: compute.v1.disk
 13 |   name: disk-{{ env["deployment"] }}-swap
 14 |   properties:
 15 |     sizeGb: 5
 16 |     zone: northamerica-northeast1-c
 17 |     #diskEncryptionKey:
 18 |     #  kmsKeyName: "projects/{{ properties["kms_project_id"] }}/locations/global/keyRings/{{ properties["keyring"] }}/cryptoKeys/{{ properties["cyptokey"] }}"
 19 | 
 20 | - type: compute.v1.instance
 21 |   name: vm-ds-{{ env["deployment"] }}
 22 |   properties:
 23 |     zone: northamerica-northeast1-c
 24 |     machineType: https://www.googleapis.com/compute/v1/projects/{{ env["project"] }}/zones/northamerica-northeast1-c/machineTypes/{{ properties["machinetype"] }}
 25 |     labels:
 26 |       vm-type: 'my-little-vm-pc'
 27 |     metadata:
 28 |       items:
 29 |       - key: enable-oslogin
 30 |         value: "TRUE"
 31 |       - key: enable-oslogin-2fa
 32 |         value: "TRUE"
 33 |       - key: startup-script
 34 |         value: |
 35 |           #!/bin/bash
 36 |           if sudo blkid /dev/sdc;then
 37 |               exit
 38 |           else
 39 |               sudo mkfs.ext4 -m 0 -F -E lazy_itable_init=0,lazy_journal_init=0,discard /dev/sdc; \
 40 |               echo UUID=`sudo blkid -s UUID -o value /dev/sdc` /swap ext4 discard,defaults,nofail 0 2 | sudo tee -a /etc/fstab
 41 | 
 42 |               echo -e "n\n\n\n\n\nw\n" | sudo fdisk /dev/sdc
 43 |               sudo mkswap /dev/sdc1
 44 |               sudo swapon /dev/sdc1
 45 |               echo UUID=`sudo blkid -s UUID -o value /dev/sdc1` none swap defaults 0 0 | sudo tee -a /etc/fstab
 46 |           fi
 47 | 
 48 |           if sudo blkid /dev/sdb;then
 49 |               exit
 50 |           else
 51 |               sudo mkfs.ext4 -m 0 -F -E lazy_itable_init=0,lazy_journal_init=0,discard /dev/sdb; \
 52 |               sudo mkdir -p /data
 53 |               sudo mount -o discard,defaults /dev/sdb /data
 54 |               echo UUID=`sudo blkid -s UUID -o value /dev/sdb` /data ext4 discard,defaults,nofail 0 2 | sudo tee -a /etc/fstab
 55 |           fi
 56 | 
 57 |     #serviceAccounts:
 58 |     #  - email: private-compute-sa@{{ env["project"] }}.iam.gserviceaccount.com
 59 |     #    scopes:
 60 |     #    - https://www.googleapis.com/auth/devstorage.read_only
 61 |     #    - https://www.googleapis.com/auth/logging.write
 62 |     #    - https://www.googleapis.com/auth/monitoring.write
 63 |     #    - https://www.googleapis.com/auth/servicecontrol
 64 |     #    - https://www.googleapis.com/auth/service.management.readonly
 65 |     #    - https://www.googleapis.com/auth/trace.append
 66 | 
 67 |     disks:
 68 |     - deviceName: vm-ds-{{ env["deployment"] }}
 69 |       type: PERSISTENT
 70 |       boot: true
 71 |       autoDelete: true
 72 |       #diskEncryptionKey:
 73 |       #  kmsKeyName: "projects/{{ properties["kms_project_id"] }}/locations/global/keyRings/{{ properties["keyring"] }}/cryptoKeys/{{ properties["cyptokey"] }}"
 74 |       initializeParams:
 75 |         diskName: disk-{{ env["deployment"] }}
 76 |         sourceImage: "projects/ubuntu-os-cloud/global/images/family/ubuntu-1804-lts"
 77 | 
 78 |     - deviceName: disk-{{ env["deployment"] }}-data
 79 |       boot: false
 80 |       autoDelete: true
 81 |       source: $(ref.disk-{{ env["deployment"] }}-data.selfLink)
 82 | 
 83 |     - deviceName: disk-{{ env["deployment"] }}-swap
 84 |       boot: false
 85 |       autoDelete: true
 86 |       source: $(ref.disk-{{ env["deployment"] }}-swap.selfLink)
 87 | 
 88 |     networkInterfaces:
 89 |     - subnetwork: https://www.googleapis.com/compute/v1/projects/tj4h-shared/regions/northamerica-northeast1/subnetworks/default
 90 | 
 91 |       # Access Config required to give the instance a public IP address
 92 |       #accessConfigs:
 93 |       #- name: External NAT
 94 |       #  type: ONE_TO_ONE_NAT
 95 | 
 96 |   #accessControl:
 97 |   #  gcpIamPolicy:
 98 |   #    bindings:
 99 |   #    - role: projects/{{ env["project"] }}/roles/tj4h-shared-custom
100 |   #      members:
101 |   #      - "user:{{ env["username"] }}"
102 | 
103 | # Declare outputs here
104 | outputs:
105 | - name: cliCommand
106 |   description: CMD LOGIN VM
107 |   value: gcloud beta compute ssh vm-ds-{{ env["deployment"] }} --internal-ip --zone northamerica-northeast1-c -- -L 2222:localhost:3389
108 | - name: machineType
109 |   description: CMD Start VM
110 |   value: gcloud compute instances start vm-ds-{{ env["deployment"] }} --zone northamerica-northeast1-c
111 | - name: machineType
112 |   description: CMD Stop VM
113 |   value: gcloud compute instances stop vm-ds-{{ env["deployment"] }} --zone northamerica-northeast1-c
114 | 


--------------------------------------------------------------------------------
/private_catalog/final_preksm/private_catalog.jinja.schema:
--------------------------------------------------------------------------------
 1 | info:
 2 |   title: Single Google Compute Engine Machine
 3 |   description: Creates a virtual machine based on name, machine type, zone, subnetwork, custom CentOS packages, keyring and key selection. Use the DEFAULT value to set the value used in the template.
 4 | 
 5 | required:
 6 |   - machinetype
 7 | 
 8 | properties:
 9 |   machinetype:
10 |     title: Machine type
11 |     type: string
12 |     default: g1-small
13 |     enum:
14 |       - n1-standard-1
15 |       - n1-standard-2
16 |       - n1-standard-4
17 |       - n1-highmem-2
18 |       - n1-highmem-4
19 |       - n1-highmem-8
20 |       - n1-highcpu-2
21 |       - n1-highcpu-4
22 |       - n1-highcpu-8
23 |       - f1-micro
24 |       - g1-small
25 | 
26 | #  kms_project_id:
27 | #    description: KMS Project ID
28 | #    type: string
29 | #    default: tj4h-project1
30 | #  keyring:
31 | #    description: Global KeyRing
32 | #    type: string
33 | #    default: one_ring_to_rule_them_all
34 | #  cyptokey:
35 | #    description: CryptoKey
36 | #    type: string
37 | #    default: my_precious
38 | 


--------------------------------------------------------------------------------
/private_catalog/private_catalog.jinja:
--------------------------------------------------------------------------------
  1 | # Creates a Persistent VM with external data and swap drives both with CMEK.  We also used of shared VPC and labels.
  2 | 
  3 | resources:
  4 | - type: compute.v1.disk
  5 |   name: disk-{{ env["deployment"] }}-data
  6 |   properties:
  7 |     sizeGb: 30
  8 |     zone: {{ properties["xpn_zone"] }}
  9 |     diskEncryptionKey:
 10 |       kmsKeyName: "projects/{{ properties["kms_project_id"] }}/locations/global/keyRings/{{ properties["keyring"] }}/cryptoKeys/{{ properties["cyptokey"] }}"
 11 | 
 12 | - type: compute.v1.disk
 13 |   name: disk-{{ env["deployment"] }}-swap
 14 |   properties:
 15 |     sizeGb: 5
 16 |     zone: {{ properties["xpn_zone"] }}
 17 |     diskEncryptionKey:
 18 |       kmsKeyName: "projects/{{ properties["kms_project_id"] }}/locations/global/keyRings/{{ properties["keyring"] }}/cryptoKeys/{{ properties["cyptokey"] }}"
 19 | 
 20 | - type: compute.v1.instance
 21 |   name: vm-ds-{{ env["deployment"] }}
 22 |   accessControl:
 23 |     gcpIamPolicy:
 24 |       bindings:
 25 |       - role: roles/compute.osLogin
 26 |         members:
 27 |         - "users:"{{ env["username"] }}"
 28 | 
 29 |   properties:
 30 |     serviceAccounts:
 31 |     - email: {{ env['project_number'] }}-compute@developer.gserviceaccount.com
 32 |       scopes:
 33 |       - https://www.googleapis.com/auth/devstorage.read_only
 34 |       - https://www.googleapis.com/auth/logging.write
 35 |       - https://www.googleapis.com/auth/monitoring.write
 36 |       - https://www.googleapis.com/auth/servicecontrol
 37 |       - https://www.googleapis.com/auth/service.management.readonly
 38 |       - https://www.googleapis.com/auth/trace.append
 39 |     zone: {{ properties["xpn_zone"] }}
 40 |     machineType: https://www.googleapis.com/compute/v1/projects/{{ env["project"] }}/zones/{{ properties["xpn_zone"] }}/machineTypes/{{ properties["machinetype"] }}
 41 |     labels:
 42 |       vm-type: 'ai-user-work-vm'
 43 |     metadata:
 44 |       items:
 45 |       - key: enable-oslogin
 46 |         value: "TRUE"
 47 |       - key: enable-oslogin-2fa
 48 |         value: "TRUE"
 49 |       - key: startup-script
 50 |         value: |
 51 |           #!/bin/bash
 52 |           yum install -y {{ properties["packages"] }}
 53 |           if sudo blkid /dev/sdc;then
 54 |               exit
 55 |           else
 56 |               sudo mkfs.ext4 -m 0 -F -E lazy_itable_init=0,lazy_journal_init=0,discard /dev/sdc; \
 57 |               echo UUID=`sudo blkid -s UUID -o value /dev/sdc` /swap ext4 discard,defaults,nofail 0 2 | sudo tee -a /etc/fstab
 58 | 
 59 |               echo -e "n\n\n\n\n\nw\n" | sudo fdisk /dev/sdc
 60 |               sudo mkswap /dev/sdc1
 61 |               sudo swapon /dev/sdc1
 62 |               echo UUID=`sudo blkid -s UUID -o value /dev/sdc1` none swap defaults 0 0 | sudo tee -a /etc/fstab
 63 |           fi
 64 | 
 65 |           if sudo blkid /dev/sdb;then
 66 |               exit
 67 |           else
 68 |               sudo mkfs.ext4 -m 0 -F -E lazy_itable_init=0,lazy_journal_init=0,discard /dev/sdb; \
 69 |               sudo mkdir -p /data
 70 |               sudo mount -o discard,defaults /dev/sdb /data
 71 |               echo UUID=`sudo blkid -s UUID -o value /dev/sdb` /data ext4 discard,defaults,nofail 0 2 | sudo tee -a /etc/fstab
 72 |           fi
 73 | 
 74 |     disks:
 75 |     - deviceName: boot
 76 |       type: PERSISTENT
 77 |       boot: true
 78 |       autoDelete: true
 79 |       diskEncryptionKey:
 80 |         kmsKeyName: "projects/{{ properties["kms_project_id"] }}/locations/global/keyRings/{{ properties["keyring"] }}/cryptoKeys/{{ properties["cyptokey"] }}"
 81 |       initializeParams:
 82 |         diskName: disk-{{ env["deployment"] }}
 83 |         sourceImage: "projects/{{ properties["image_project_id"] }}/global/images/family/{{ properties["image_family"] }}"
 84 | 
 85 |     - deviceName: disk-{{ env["deployment"] }}-data
 86 |       boot: false
 87 |       autoDelete: true
 88 |       source: $(ref.disk-{{ env["deployment"] }}-data.selfLink)
 89 | 
 90 |     - deviceName: disk-{{ env["deployment"] }}-swap
 91 |       boot: false
 92 |       autoDelete: true
 93 |       source: $(ref.disk-{{ env["deployment"] }}-swap.selfLink)
 94 | 
 95 |     networkInterfaces:
 96 |     - subnetwork: https://www.googleapis.com/compute/v1/projects/{{ properties["xpn_project_id"] }}/regions/{{ properties["xpn_region"] }}/subnetworks/{{ properties["xpn_subnetwork"] }}
 97 | 
 98 |       # Access Config required to give the instance a public IP address
 99 |       #accessConfigs:
100 |       #- name: External NAT
101 |       #  type: ONE_TO_ONE_NAT
102 | 
103 | # Declare outputs here
104 | outputs:
105 | - name: cliCommand
106 |   description: YOUR LOGIN INFO
107 |   value: gcloud beta compute ssh vm-ds-{{ env["deployment"] }} --tunnel-through-iap --zone {{ properties["xpn_zone"] }} -- -L 2222:localhost:3389
108 | 


--------------------------------------------------------------------------------
/private_catalog/private_catalog.jinja.schema:
--------------------------------------------------------------------------------
 1 | info:
 2 |   title: Single Google Compute Engine Machine
 3 |   description: Creates a virtual machine based on name, machine type, zone, subnetwork, custom CentOS packages, keyring and key selection. Use the DEFAULT value to set the value used in the template.
 4 | 
 5 | required:
 6 |   - machinetype
 7 |   - xpn_zone
 8 |   - xpn_subnetwork
 9 | 
10 | properties:
11 |   machinetype:
12 |     title: Machine type
13 |     type: string
14 |     default: n1-standard-4
15 |     enum:
16 |       - n1-highcpu-4
17 |       - n1-highmem-2
18 |       - n1-standard-1
19 |       - n1-standard-2
20 |       - n1-standard-4
21 |       - n1-highmem-4
22 |       - n1-highmem-8
23 |       - n1-highcpu-2
24 |       - n1-highcpu-8
25 |       - f1-micro
26 |       - g1-small
27 |   image_project_id:
28 |     title: Image Family Project ID
29 |     type: string
30 |     default: tj4h-project2
31 |   image_family:
32 |     title: Image Family
33 |     type: string
34 |     default: ds-vm
35 |   xpn_project_id:
36 |     title: VPC Project ID
37 |     type: string
38 |     default: tj4h-shared-services
39 |   xpn_subnetwork:
40 |     title: VPC
41 |     type: string
42 |     default: tj4h-shared-services-xpn1-subnet1
43 |   xpn_zone:
44 |     title: VPC Zone
45 |     type: string
46 |     default: northamerica-northeast1-c
47 |   xpn_region:
48 |     title: VPC Region
49 |     type: string
50 |     default: northamerica-northeast1
51 |   packages:
52 |     title: Install CentOS7 packages (separate them by a space)
53 |     type: string
54 |   kms_project_id:
55 |     description: KMS Project ID
56 |     type: string
57 |     default: tj4h-project1
58 |   keyring:
59 |     description: Global KeyRing
60 |     type: string
61 |     default: one_ring_to_rule_them_all
62 |   cyptokey:
63 |     description: CryptoKey
64 |     type: string
65 |     default: my_precious
66 | 


--------------------------------------------------------------------------------
/private_catalog/private_catalog.yaml:
--------------------------------------------------------------------------------
 1 | # Copyright 2017 Google Inc. All rights reserved.
 2 | #
 3 | # Licensed under the Apache License, Version 2.0 (the "License");
 4 | # you may not use this file except in compliance with the License.
 5 | # You may obtain a copy of the License at
 6 | #
 7 | #     http://www.apache.org/licenses/LICENSE-2.0
 8 | #
 9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 | 
15 | configVersion: v1
16 | 
17 | imports:
18 | - path: private_catalog.jinja
19 | 
20 | resources:
21 | - name: private_catalog
22 |   type: private_catalog.jinja
23 |   properties:
24 |     machinetype: n1-standard-4
25 |     image_project_id: tj4h-project2
26 |     image_family: ds-vm
27 |     xpn_project_id: tj4h-shared-services
28 |     xpn_subnetwork: tj4h-shared-services-xpn1-subnet1
29 |     xpn_zone: northamerica-northeast1-c
30 |     xpn_region: northamerica-northeast1
31 |     kms_project_id: tj4h-project1
32 |     keyring: one_ring_to_rule_them_all
33 |     cryptokey: my_precious
34 | 


--------------------------------------------------------------------------------
/prometheus/clusterRole.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: rbac.authorization.k8s.io/v1beta1
 2 | kind: ClusterRole
 3 | metadata:
 4 |   name: prometheus
 5 | rules:
 6 | - apiGroups: [""]
 7 |   resources:
 8 |   - nodes
 9 |   - nodes/proxy
10 |   - services
11 |   - endpoints
12 |   - pods
13 |   verbs: ["get", "list", "watch"]
14 | - apiGroups:
15 |   - extensions
16 |   resources:
17 |   - ingresses
18 |   verbs: ["get", "list", "watch"]
19 | - nonResourceURLs: ["/metrics"]
20 |   verbs: ["get"]
21 | ---
22 | apiVersion: rbac.authorization.k8s.io/v1beta1
23 | kind: ClusterRoleBinding
24 | metadata:
25 |   name: prometheus
26 | roleRef:
27 |   apiGroup: rbac.authorization.k8s.io
28 |   kind: ClusterRole
29 |   name: prometheus
30 | subjects:
31 | - kind: ServiceAccount
32 |   name: default
33 |   namespace: prometheus
34 | 


--------------------------------------------------------------------------------
/prometheus/config-map.yaml:
--------------------------------------------------------------------------------
  1 | apiVersion: v1
  2 | kind: ConfigMap
  3 | metadata:
  4 |   name: prometheus-server-conf
  5 |   labels:
  6 |     name: prometheus-server-conf
  7 |   namespace: prometheus
  8 | data:
  9 |   prometheus.rules: |-
 10 |     groups:
 11 |     - name: devopscube demo alert
 12 |       rules:
 13 |       - alert: High Pod Memory
 14 |         expr: sum(container_memory_usage_bytes) > 1
 15 |         for: 1m
 16 |         labels:
 17 |           severity: slack
 18 |         annotations:
 19 |           summary: High Memory Usage
 20 |   prometheus.yml: |-
 21 |     global:
 22 |       scrape_interval: 5s
 23 |       evaluation_interval: 5s
 24 |     rule_files:
 25 |       - /etc/prometheus/prometheus.rules
 26 |     alerting:
 27 |       alertmanagers:
 28 |       - scheme: http
 29 |         static_configs:
 30 |         - targets:
 31 |           - "alertmanager.monitoring.svc:9093"
 32 | 
 33 |     scrape_configs:
 34 |       - job_name: 'kubernetes-apiservers'
 35 | 
 36 |         kubernetes_sd_configs:
 37 |         - role: endpoints
 38 |         scheme: https
 39 | 
 40 |         tls_config:
 41 |           ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 42 |         bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 43 | 
 44 |         relabel_configs:
 45 |         - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
 46 |           action: keep
 47 |           regex: default;kubernetes;https
 48 | 
 49 |       - job_name: 'kubernetes-nodes'
 50 | 
 51 |         scheme: https
 52 | 
 53 |         tls_config:
 54 |           ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
 55 |         bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
 56 | 
 57 |         kubernetes_sd_configs:
 58 |         - role: node
 59 | 
 60 |         relabel_configs:
 61 |         - action: labelmap
 62 |           regex: __meta_kubernetes_node_label_(.+)
 63 |         - target_label: __address__
 64 |           replacement: kubernetes.default.svc:443
 65 |         - source_labels: [__meta_kubernetes_node_name]
 66 |           regex: (.+)
 67 |           target_label: __metrics_path__
 68 |           replacement: /api/v1/nodes/${1}/proxy/metrics
 69 | 
 70 |       
 71 |       - job_name: 'kubernetes-pods'
 72 | 
 73 |         kubernetes_sd_configs:
 74 |         - role: pod
 75 | 
 76 |         relabel_configs:
 77 |         - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
 78 |           action: keep
 79 |           regex: true
 80 |         - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
 81 |           action: replace
 82 |           target_label: __metrics_path__
 83 |           regex: (.+)
 84 |         - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
 85 |           action: replace
 86 |           regex: ([^:]+)(?::\d+)?;(\d+)
 87 |           replacement: $1:$2
 88 |           target_label: __address__
 89 |         - action: labelmap
 90 |           regex: __meta_kubernetes_pod_label_(.+)
 91 |         - source_labels: [__meta_kubernetes_namespace]
 92 |           action: replace
 93 |           target_label: kubernetes_namespace
 94 |         - source_labels: [__meta_kubernetes_pod_name]
 95 |           action: replace
 96 |           target_label: kubernetes_pod_name
 97 | 
 98 |       - job_name: 'kubernetes-cadvisor'
 99 | 
100 |         scheme: https
101 | 
102 |         tls_config:
103 |           ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
104 |         bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
105 | 
106 |         kubernetes_sd_configs:
107 |         - role: node
108 | 
109 |         relabel_configs:
110 |         - action: labelmap
111 |           regex: __meta_kubernetes_node_label_(.+)
112 |         - target_label: __address__
113 |           replacement: kubernetes.default.svc:443
114 |         - source_labels: [__meta_kubernetes_node_name]
115 |           regex: (.+)
116 |           target_label: __metrics_path__
117 |           replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
118 |       
119 |       - job_name: 'kubernetes-service-endpoints'
120 | 
121 |         kubernetes_sd_configs:
122 |         - role: endpoints
123 | 
124 |         relabel_configs:
125 |         - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
126 |           action: keep
127 |           regex: true
128 |         - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scheme]
129 |           action: replace
130 |           target_label: __scheme__
131 |           regex: (https?)
132 |         - source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
133 |           action: replace
134 |           target_label: __metrics_path__
135 |           regex: (.+)
136 |         - source_labels: [__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
137 |           action: replace
138 |           target_label: __address__
139 |           regex: ([^:]+)(?::\d+)?;(\d+)
140 |           replacement: $1:$2
141 |         - action: labelmap
142 |           regex: __meta_kubernetes_service_label_(.+)
143 |         - source_labels: [__meta_kubernetes_namespace]
144 |           action: replace
145 |           target_label: kubernetes_namespace
146 |         - source_labels: [__meta_kubernetes_service_name]
147 |           action: replace
148 |           target_label: kubernetes_name
149 | 


--------------------------------------------------------------------------------
/prometheus/metrics.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/sveronneau/gcp/91b4704256313d5f88a2eec558eb2d600cc4a641/prometheus/metrics.png


--------------------------------------------------------------------------------
/prometheus/patch.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | 
 3 | set -e
 4 | set -u
 5 | 
 6 | usage() {
 7 |   echo -e "Usage: $0 <deployment|statefulset> <name>\n"
 8 | }
 9 | 
10 | if [  $# -le 1 ]; then
11 |   usage
12 |   exit 1
13 | fi
14 | 
15 | # Override to use a different Docker image name for the sidecar.
16 | export SIDECAR_IMAGE_NAME=${SIDECAR_IMAGE_NAME:-'gcr.io/stackdriver-prometheus/stackdriver-prometheus-sidecar'}
17 | 
18 | kubectl -n "${KUBE_NAMESPACE}" patch "$1" "$2" --type strategic --patch "
19 | spec:
20 |   template:
21 |     spec:
22 |       containers:
23 |       - name: sidecar
24 |         image: ${SIDECAR_IMAGE_NAME}:${SIDECAR_IMAGE_TAG}
25 |         imagePullPolicy: Always
26 |         args:
27 |         - \"--stackdriver.project-id=${GCP_PROJECT}\"
28 |         - \"--prometheus.wal-directory=${DATA_DIR}/wal\"
29 |         - \"--stackdriver.kubernetes.location=${GCP_REGION}\"
30 |         - \"--stackdriver.kubernetes.cluster-name=${KUBE_CLUSTER}\"
31 |         #- \"--stackdriver.generic.location=${GCP_REGION}\"
32 |         #- \"--stackdriver.generic.namespace=${KUBE_CLUSTER}\"
33 |         ports:
34 |         - name: sidecar
35 |           containerPort: 9091
36 |         volumeMounts:
37 |         - name: ${DATA_VOLUME}
38 |           mountPath: ${DATA_DIR}
39 | "
40 | 


--------------------------------------------------------------------------------
/prometheus/prometheus-deployment.yaml:
--------------------------------------------------------------------------------
 1 | apiVersion: extensions/v1beta1
 2 | kind: Deployment
 3 | metadata:
 4 |   name: prometheus-deployment
 5 |   namespace: prometheus
 6 | spec:
 7 |   replicas: 1
 8 |   template:
 9 |     metadata:
10 |       labels:
11 |         app: prometheus-server
12 |     spec:
13 |       containers:
14 |         - name: prometheus
15 |           image: prom/prometheus:v2.12.0
16 |           args:
17 |             - "--config.file=/etc/prometheus/prometheus.yml"
18 |             - "--storage.tsdb.path=/prometheus/"
19 |           ports:
20 |             - containerPort: 9090
21 |           volumeMounts:
22 |             - name: prometheus-config-volume
23 |               mountPath: /etc/prometheus/
24 |             - name: prometheus-storage-volume
25 |               mountPath: /prometheus/
26 |       volumes:
27 |         - name: prometheus-config-volume
28 |           configMap:
29 |             defaultMode: 420
30 |             name: prometheus-server-conf
31 |   
32 |         - name: prometheus-storage-volume
33 |           emptyDir: {}
34 | 


--------------------------------------------------------------------------------
/prometheus/readme.md:
--------------------------------------------------------------------------------
 1 | <b>---Installing a Prometheus PoC from GCP CloudShell---</b>
 2 | 
 3 | <b>Make yourself cluster-admin</b>
 4 | 
 5 | ACCOUNT=$(gcloud info --format='value(config.account)')<br>
 6 | kubectl create clusterrolebinding owner-cluster-admin-binding --clusterrole cluster-admin --user $ACCOUNT
 7 | 
 8 | <b>Create a Prometheus namespace</b><br>
 9 | kubectl create namespace prometheus
10 | 
11 | <b>Give the namespace cluster-reader permission</b><br>
12 | wget \ https://raw.githubusercontent.com/sveronneau/gcp/master/prometheus/clusterRole.yaml <br>
13 | kubectl create -f clusterRole.yaml<br>
14 | 
15 | <b>Create the configMap</b><br>
16 | wget \ https://raw.githubusercontent.com/sveronneau/gcp/master/prometheus/config-map.yaml <br>
17 | kubectl create -f configMap.yaml -n prometheus
18 | 
19 | <b>Create the Deployment</b><br>
20 | Get the latest version information from https://github.com/prometheus/prometheus/releases/ <br>
21 | wget https://raw.githubusercontent.com/sveronneau/gcp/master/prometheus/prometheus-deployment.yaml <br>
22 | 
23 | <b>Change the version in the YAML file to reflect the latest version</b><br>
24 | kubectl create -f prometheus-deployment.yaml -n prometheus<br>
25 | kubectl get pods -n prometheus<br>
26 | kubectl port-forward prometheus-deployment-your_pod_info 8080:9090 -n prometheus<br>
27 | Open Web preview in CloudShell
28 | 
29 | <b>Install Stackdriver Collector</b><br>
30 | export KUBE_NAMESPACE=prometheus<br>
31 | export KUBE_CLUSTER=my cluster-name<br>
32 | export GCP_REGION=my region<br>
33 | export GCP_PROJECT=my project ID<br>
34 | export DATA_DIR=/prometheus/<br>
35 | export DATA_VOLUME=prometheus-storage-volume<br>
36 | export SIDECAR_IMAGE_TAG=0.6.0<br>
37 | wget https://raw.githubusercontent.com/sveronneau/gcp/master/prometheus/patch.sh <br>
38 | chmod 775 patch.sh <br>
39 | sh ./patch.sh deployment prometheus-deployment <br>
40 | kubectl get pods -n prometheus <br>
41 | 
42 | <b>You can now explore those metrics in Stackdriver</b><br>
43 | https://github.com/sveronneau/gcp/blob/master/prometheus/metrics.png
44 | 


--------------------------------------------------------------------------------
/vault/README.md:
--------------------------------------------------------------------------------
 1 | # gcp/vault
 2 | Terraform and Ansible script to deploy Vault 0.10.1 (Vanilla-configured, single instance, Initialized) within a GCP instance.
 3 | 
 4 | Requirements: Terraform and Ansible locally installed. GCP project, Service Account JSON file and Project wide SSH Key.
 5 | 
 6 | Ounce deployed, Vault will be Initialized. You can check the status with the following steps:
 7 | 
 8 | * SSH to your instance
 9 | * export VAULT_ADDR=http://127.0.0.1:8200 (Change IP to be your private IP)
10 | * vault status
11 | * Define a firewall rule to allow ingress on 8200
12 | * http://public_IP:8200/ui
13 | 


--------------------------------------------------------------------------------
/vault/config.json:
--------------------------------------------------------------------------------
 1 | ui = true
 2 | 
 3 | listener "tcp" {
 4 |   address     = "127.0.0.1:8200" #Change this to your internal private IP
 5 |   tls_disable = 1
 6 | }
 7 | 
 8 | storage "file" {
 9 |   path = "/etc/vault.d/data"
10 | }
11 | 


--------------------------------------------------------------------------------
/vault/master.yml:
--------------------------------------------------------------------------------
 1 | - hosts: all
 2 |   become: true
 3 | 
 4 |   tasks:
 5 |     - name: Install the unzip package
 6 |       apt:
 7 |         name: unzip
 8 |         state: present
 9 | 
10 |     - name: Download and extract Vault in /bin
11 |       unarchive:
12 |         src: https://releases.hashicorp.com/vault/0.10.1/vault_0.10.1_linux_amd64.zip
13 |         dest: /bin/
14 |         remote_src: yes
15 | 
16 |     - name: Make default config and data directory
17 |       file:
18 |         path: /etc/vault.d/data
19 |         state: directory
20 |         owner: root
21 |         group: root
22 |         mode: 0755
23 |         recurse: yes
24 | 
25 |     - name: Copy default Vault config file
26 |       copy:
27 |         src: config.json
28 |         dest: /etc/vault.d/config.json
29 |         owner: root
30 |         group: root
31 |         mode: 0644
32 | 
33 |     - name: Launch Vault
34 |       become: true
35 |       become_user: root
36 |       shell: nohup /bin/vault server -config /etc/vault.d/config.json </dev/null >/dev/null 2>&1 &
37 | 
38 |     - name: Initialize Vault
39 |       become: true
40 |       become_user: root
41 |       shell: VAULT_ADDR=http://127.0.0.1:8200 /bin/vault operator init
42 | 


--------------------------------------------------------------------------------
/vault/variables.tf:
--------------------------------------------------------------------------------
1 | variable "credentials" { default = "your_account.json" }
2 | variable "project"     { default = "your_project_id" }
3 | variable "region"      { default = "northamerica-northeast1" }
4 | variable "zone"        { default = "northamerica-northeast1-a" }
5 | 


--------------------------------------------------------------------------------
/vault/vault.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${var.credentials}"
 3 |   project = "${var.project}"
 4 |   region  = "${var.region}"
 5 | }
 6 | 
 7 | resource "google_compute_instance" "ansible" {
 8 |   count        = "1"
 9 |   project      = "${var.project}"
10 |   zone         = "${var.zone}"
11 |   name         = "vault-node-${count.index}"
12 |   machine_type = "f1-micro"
13 | 
14 |   boot_disk {
15 |     initialize_params {
16 |       image = "ubuntu-1604-lts"
17 |     }
18 |   }
19 | 
20 | # This is where we configure the instance with ansible-playbook
21 |   provisioner "local-exec" {
22 |     command = "sleep 90; ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook -u your_sshkey_user --private-key your_private_key -i '${google_compute_instance.ansible.network_interface.0.access_config.0.assigned_nat_ip}', master.yml"  }
23 | 
24 |   network_interface {
25 |     network       = "default"
26 | 
27 |     access_config { //commenting this section will remove private IP assignment
28 |       // Ephemeral IP
29 |     }
30 |   }
31 | 
32 |   service_account {
33 |     scopes = ["userinfo-email", "compute-ro", "storage-ro"]
34 |   }
35 | }
36 | 


--------------------------------------------------------------------------------
/vpc/README.md:
--------------------------------------------------------------------------------
1 | # gcp/vpc
2 | Terraform script to create a custom VCP and define firewall rules attached to it.
3 | 
4 | Scripts uses a GCP service account and a JSON file with your account token and ENV VARS
5 | 


--------------------------------------------------------------------------------
/vpc/custom_vpc.tf:
--------------------------------------------------------------------------------
 1 | provider "google" {
 2 |   credentials = "${file("gcp_service_account.json")}"
 3 |   project = "your_gcp_project"
 4 |   region  = "northamerica-northeast1"
 5 | }
 6 | 
 7 | resource "google_compute_network" "default" {
 8 |   name                    = "foobar"
 9 |   description             = "TF created VPC"
10 |   auto_create_subnetworks = "false"
11 |   project                 = "${google_project_services.project.project}"
12 | }
13 | 
14 | resource "google_compute_subnetwork" "subnet_na_e1" {
15 |   name          = "subnet-na-east1"
16 |   description   = "TF created Subnet"
17 |   ip_cidr_range = "10.0.0.0/16"
18 |   network       = "${google_compute_network.default.self_link}"
19 |   region        = "northamerica-northeast1"
20 |   project = "your_gcp_project"
21 | }
22 | 
23 | resource "google_compute_firewall" "default" {
24 |   name    = "test-firewall"
25 |   network = "foobar"
26 |   project = "your_gcp_project"
27 | 
28 |   allow {
29 |     protocol = "icmp"
30 |   }
31 | 
32 |   allow {
33 |     protocol = "tcp"
34 |     ports    = ["22", "80", "8080", "1000-2000"]
35 |   }
36 | 
37 |   source_tags = ["web"]
38 | }
39 | 


--------------------------------------------------------------------------------