Adding initial GitHub Actions
This commit is contained in:
Corneil du Plessis
19
scripts/terraform/stream-apps-gh-runners/kube-admin.yaml
Normal file
19
scripts/terraform/stream-apps-gh-runners/kube-admin.yaml
Normal file
@@ -0,0 +1,19 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: admin-user
|
||||
namespace: kube-system
|
||||
---
|
||||
# Create ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: admin-user
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: admin-user
|
||||
namespace: kube-system
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: Config
|
||||
preferences:
|
||||
colors: true
|
||||
current-context: ${cluster_name}
|
||||
contexts:
|
||||
- context:
|
||||
cluster: ${cluster_name}
|
||||
user: ${cluster_name}
|
||||
name: ${cluster_name}
|
||||
clusters:
|
||||
- cluster:
|
||||
server: https://${endpoint}
|
||||
certificate-authority-data: ${cluster_ca}
|
||||
name: ${cluster_name}
|
||||
users:
|
||||
- name: ${cluster_name}
|
||||
user:
|
||||
client-certificate-data: ${client_cert}
|
||||
client-key-data: ${client_cert_key}
|
||||
172
scripts/terraform/stream-apps-gh-runners/main.tf
Normal file
172
scripts/terraform/stream-apps-gh-runners/main.tf
Normal file
@@ -0,0 +1,172 @@
|
||||
variable "cluster_name" {
|
||||
default = "scdf-empty"
|
||||
}
|
||||
variable "region" {
|
||||
default = "us-central1"
|
||||
}
|
||||
|
||||
variable "project" {
|
||||
default = "spring-cloud-dataflow-148214"
|
||||
}
|
||||
variable "disk_size" {
|
||||
default = 10
|
||||
}
|
||||
|
||||
variable "node_count" {
|
||||
default = 1
|
||||
}
|
||||
|
||||
variable "max_cluster_cpu" {
|
||||
default = 96
|
||||
}
|
||||
variable "max_cluster_memory" {
|
||||
default = 192
|
||||
}
|
||||
|
||||
variable "machine_type" {
|
||||
default = "e2-standard-4"
|
||||
}
|
||||
variable "kubernetes_version" {
|
||||
default = "1.23"
|
||||
}
|
||||
variable "gcp_creds_json_file" {
|
||||
}
|
||||
variable "node_port" {
|
||||
default = "30000"
|
||||
}
|
||||
variable "service_account" {
|
||||
default = "scdf-gke-admin@spring-cloud-dataflow-148214.iam.gserviceaccount.com"
|
||||
}
|
||||
variable "port_name" {
|
||||
default = "http"
|
||||
}
|
||||
variable "pods_per_node" {
|
||||
default = "50"
|
||||
}
|
||||
provider "google" {
|
||||
project = var.project
|
||||
region = var.region
|
||||
credentials = var.gcp_creds_json_file
|
||||
}
|
||||
|
||||
resource "google_compute_network" "vpc" {
|
||||
auto_create_subnetworks = false
|
||||
delete_default_routes_on_create = false
|
||||
description = "Compute Network for GKE nodes"
|
||||
name = "${var.cluster_name}-vpc"
|
||||
}
|
||||
|
||||
resource "google_compute_subnetwork" "scdf" {
|
||||
name = "${var.cluster_name}-subnet"
|
||||
ip_cidr_range = "10.255.0.0/20"
|
||||
region = var.region
|
||||
network = google_compute_network.vpc.id
|
||||
secondary_ip_range {
|
||||
range_name = local.cluster_secondary_range_name
|
||||
ip_cidr_range = "10.0.0.0/20"
|
||||
}
|
||||
|
||||
secondary_ip_range {
|
||||
range_name = local.services_secondary_range_name
|
||||
ip_cidr_range = "10.64.0.0/20"
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_container_node_pool" "nodes" {
|
||||
name = "${var.cluster_name}-node-pool"
|
||||
cluster = google_container_cluster.primary.id
|
||||
node_count = var.node_count
|
||||
node_config {
|
||||
machine_type = var.machine_type
|
||||
service_account = var.service_account
|
||||
oauth_scopes = [
|
||||
"https://www.googleapis.com/auth/compute",
|
||||
"https://www.googleapis.com/auth/devstorage.read_only",
|
||||
"https://www.googleapis.com/auth/logging.write",
|
||||
"https://www.googleapis.com/auth/trace.append",
|
||||
"https://www.googleapis.com/auth/monitoring",
|
||||
]
|
||||
|
||||
labels = {
|
||||
env = var.cluster_name
|
||||
}
|
||||
disk_size_gb = var.disk_size
|
||||
disk_type = "pd-ssd"
|
||||
image_type = "UBUNTU_CONTAINERD"
|
||||
tags = ["scdf-node", var.cluster_name, "${var.cluster_name}-node"]
|
||||
}
|
||||
management {
|
||||
auto_upgrade = false
|
||||
auto_repair = true
|
||||
}
|
||||
# autoscaling {
|
||||
# min_node_count = 1
|
||||
# max_node_count = var.node_count
|
||||
# }
|
||||
timeouts {
|
||||
create = "20m"
|
||||
update = "10m"
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_container_cluster" "primary" {
|
||||
name = var.cluster_name
|
||||
location = var.region
|
||||
network = google_compute_network.vpc.name
|
||||
subnetwork = google_compute_subnetwork.scdf.name
|
||||
node_locations = ["${var.region}-c"] # "${var.region}-a", "${var.region}-b",
|
||||
initial_node_count = 1
|
||||
remove_default_node_pool = true
|
||||
default_max_pods_per_node = var.pods_per_node
|
||||
release_channel {
|
||||
channel = "UNSPECIFIED"
|
||||
}
|
||||
addons_config {
|
||||
http_load_balancing {
|
||||
disabled = false
|
||||
}
|
||||
horizontal_pod_autoscaling {
|
||||
disabled = false
|
||||
}
|
||||
}
|
||||
ip_allocation_policy {
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_compute_firewall" "scdf-fw" {
|
||||
name = "${var.cluster_name}-firewall"
|
||||
network = google_compute_network.vpc.name
|
||||
|
||||
allow {
|
||||
protocol = "tcp"
|
||||
ports = ["80", "443", "22", "6080", "10250", "9443", "30000-32767"]
|
||||
}
|
||||
|
||||
target_tags = ["${var.cluster_name}-node"]
|
||||
source_ranges = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
|
||||
data "google_container_cluster" "information" {
|
||||
name = google_container_cluster.primary.name
|
||||
location = google_container_cluster.primary.location
|
||||
|
||||
depends_on = [
|
||||
google_compute_network.vpc
|
||||
]
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
host = google_container_cluster.primary.endpoint
|
||||
token = data.google_client_config.primary.access_token
|
||||
cluster_ca_certificate = base64decode(google_container_cluster.primary.master_auth.0.cluster_ca_certificate)
|
||||
config_path = "~/.kube/config"
|
||||
client_key = base64decode(google_container_cluster.primary.master_auth.0.client_key)
|
||||
}
|
||||
|
||||
locals {
|
||||
cluster_secondary_range_name = "${var.cluster_name}-cluster-secondary-range"
|
||||
services_secondary_range_name = "${var.cluster_name}-services-secondary-range"
|
||||
}
|
||||
|
||||
data "google_client_config" "primary" {}
|
||||
19
scripts/terraform/stream-apps-gh-runners/output.tf
Normal file
19
scripts/terraform/stream-apps-gh-runners/output.tf
Normal file
@@ -0,0 +1,19 @@
|
||||
output "region" {
|
||||
value = var.region
|
||||
description = "GCloud Region"
|
||||
}
|
||||
|
||||
output "project_id" {
|
||||
value = var.project
|
||||
description = "GCloud Project ID"
|
||||
}
|
||||
|
||||
output "kubernetes_cluster_name" {
|
||||
value = google_container_cluster.primary.name
|
||||
description = "GKE Cluster Name"
|
||||
}
|
||||
|
||||
output "kubernetes_cluster_host" {
|
||||
value = google_container_cluster.primary.endpoint
|
||||
description = "GKE Cluster Host"
|
||||
}
|
||||
10
scripts/terraform/stream-apps-gh-runners/terraform.tfvars
Normal file
10
scripts/terraform/stream-apps-gh-runners/terraform.tfvars
Normal file
@@ -0,0 +1,10 @@
|
||||
cluster_name="stream-apps-gh-runners"
|
||||
region="us-central1"
|
||||
gcp_creds_json_file="/home/pcorneil/.gcloud/gcp_creds.json"
|
||||
node_count=1
|
||||
kubernetes_version="1.23.8-gke.400"
|
||||
machine_type="c2d-standard-2"
|
||||
disk_size=100
|
||||
max_cluster_memory=192
|
||||
max_cluster_cpu=24
|
||||
|
||||
85
scripts/terraform/tf-apply.sh
Executable file
85
scripts/terraform/tf-apply.sh
Executable file
@@ -0,0 +1,85 @@
|
||||
#!/usr/bin/env bash
|
||||
SCDIR=$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")
|
||||
SCDIR=$(realpath $SCDIR)
|
||||
PROJECT_DIR=$(realpath $SCDIR/../..)
|
||||
|
||||
if [ "$1" == "" ]; then
|
||||
echo "Require folder for terraform files"
|
||||
exit 1
|
||||
fi
|
||||
(return 0 2>/dev/null) && sourced=1 || sourced=0
|
||||
function check_env() {
|
||||
eval ev='$'$1
|
||||
if [ "$ev" == "" ]; then
|
||||
echo "$1 not defined"
|
||||
if ((sourced != 0)); then
|
||||
return 1
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
check_env CLUSTER_NAME "$CLUSTER_NAME"
|
||||
check_env REGION "$REGION"
|
||||
check_env GCP_CRED_JSON_FILE "$GCP_CRED_JSON_FILE"
|
||||
|
||||
K8S="${K8S//\-/.}"
|
||||
VERSIONS_JSON=$(cat $PROJECT_DIR/config/k8s-versions.json)
|
||||
if [ "$K8S" == "" ]; then
|
||||
K8S=$(echo "$VERSIONS_JSON" | jq '.default_version' | sed 's/\"//g')
|
||||
echo "Choosing default K8S=$K8S"
|
||||
fi
|
||||
K8S_VERSION=$(echo "$VERSIONS_JSON" | jq ".versions | map(select(.k8s == \"$K8S\")) | .[].k8s_version" | sed 's/\"//g')
|
||||
if [ "$K8S_VERSION" == "" ]; then
|
||||
echo "Unsupported version: $K8S"
|
||||
exit 1
|
||||
fi
|
||||
echo "K8S=$K8S => $K8S_VERSION"
|
||||
|
||||
TF_DIR="$SCDIR/$1/$K8S"
|
||||
if [ ! -d "$TF_DIR" ]; then
|
||||
TF_DIR="$SCDIR/$1"
|
||||
fi
|
||||
if [ ! -d "$TF_DIR" ]; then
|
||||
echo "Directory not found $TF_DIR"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
pushd $TF_DIR >/dev/null
|
||||
echo "cluster_name=\"$CLUSTER_NAME\"" >terraform.tfvars
|
||||
echo "region=\"$REGION\"" >>terraform.tfvars
|
||||
echo "gcp_creds_json_file=\"$GCP_CRED_JSON_FILE\"" >>terraform.tfvars
|
||||
|
||||
if [ "$NODES" != "" ]; then
|
||||
echo "node_count=$NODES" >>terraform.tfvars
|
||||
fi
|
||||
|
||||
echo "kubernetes_version=\"$K8S_VERSION\"" >>terraform.tfvars
|
||||
if [ "$MACHINE_TYPE" != "" ]; then
|
||||
echo "machine_type=\"$MACHINE_TYPE\"" >>terraform.tfvars
|
||||
fi
|
||||
if [ "$DISK_SIZE" != "" ]; then
|
||||
echo "disk_size=$DISK_SIZE" >>terraform.tfvars
|
||||
fi
|
||||
if [ "$MAX_MEMORY" != "" ]; then
|
||||
echo "max_cluster_memory=$MAX_MEMORY" >>terraform.tfvars
|
||||
fi
|
||||
if [ "$MAX_CPU" != "" ]; then
|
||||
echo "max_cluster_cpu=$MAX_CPU" >>terraform.tfvars
|
||||
fi
|
||||
if [ "$PODS_PER_NODE" != "" ]; then
|
||||
echo "pods_per_node=$PODS_PER_NODE" >>terraform.tfvars
|
||||
fi
|
||||
echo "" >>terraform.tfvars
|
||||
if [ ! -f ".terraform.lock.hcl" ] || [ ! -d ".terraform" ]; then
|
||||
terraform init
|
||||
fi
|
||||
echo "Terraform parameters:"
|
||||
cat ./terraform.tfvars
|
||||
echo "Validating Terraform for $CLUSTER_NAME"
|
||||
set -e
|
||||
terraform validate -no-color
|
||||
echo "Applying Terraform for $CLUSTER_NAME"
|
||||
terraform apply -no-color -auto-approve -refresh=true -input=false -state="${CLUSTER_NAME}.tfstate"
|
||||
popd >/dev/null
|
||||
44
scripts/terraform/tf-destroy.sh
Executable file
44
scripts/terraform/tf-destroy.sh
Executable file
@@ -0,0 +1,44 @@
|
||||
#!/usr/bin/env bash
|
||||
SCDIR=$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")
|
||||
SCDIR=$(realpath $SCDIR)
|
||||
|
||||
if [ "$1" == "" ]; then
|
||||
echo "Require folder for terraform files"
|
||||
exit 1
|
||||
fi
|
||||
(return 0 2>/dev/null) && sourced=1 || sourced=0
|
||||
function check_env() {
|
||||
eval ev='$'$1
|
||||
if [ "$ev" == "" ]; then
|
||||
echo "$1 not defined"
|
||||
if (( sourced != 0 )); then
|
||||
return 1
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
K8S="${K8S//\-/.}"
|
||||
check_env CLUSTER_NAME "$CLUSTER_NAME"
|
||||
check_env REGION "$REGION"
|
||||
check_env GCP_CRED_JSON_FILE "$GCP_CRED_JSON_FILE"
|
||||
TF_DIR="$SCDIR/$1/$K8S"
|
||||
if [ ! -d "$TF_DIR" ]; then
|
||||
TF_DIR="$SCDIR/$1"
|
||||
fi
|
||||
if [ ! -d "$TF_DIR" ]; then
|
||||
echo "Directory not found $TF_DIR"
|
||||
fi
|
||||
|
||||
pushd $TF_DIR > /dev/null
|
||||
echo "cluster_name=\"$CLUSTER_NAME\"" > terraform.tfvars
|
||||
echo "region=\"$REGION\"" >> terraform.tfvars
|
||||
echo "gcp_creds_json_file=\"$GCP_CRED_JSON_FILE\"" >> terraform.tfvars
|
||||
echo "" >> terraform.tfvars
|
||||
if [ ! -f ".terraform.lock.hcl" ] || [ ! -d ".terraform" ]; then
|
||||
terraform init
|
||||
fi
|
||||
echo "Terraform parameters:$(cat ./terraform.tfvars)"
|
||||
echo "Destroying $CLUSTER_NAME"
|
||||
terraform destroy -auto-approve -refresh=true -no-color -input=false -state="${CLUSTER_NAME}.tfstate"
|
||||
popd > /dev/null
|
||||
Reference in New Issue
Block a user