【GKE】GKE × Terraformで基本的なk8s環境を構築する

.
├── main.tf ...インフラ構成を記述
├── output.tf ...クラスター名を出力
├── kubeconfig-dev...kubeconfigファイル（apply後に生成）
├── secret.json ...サービスアカウントの鍵json
├── terraform.tfvars ...環境に依存する値や機密性の高い値を変数化（※.gitignore推奨）
└── variables.tf ...変数定義

# provider setting
terraform {
  required_version = "= 1.2.4"
    required_providers {
    google = {
      source  = "hashicorp/google"
      version = "4.31.0"
    }
  }
}

provider "google" {
  credentials = file("./secret.json")

  project = var.gcp_project_id
  region  = var.gcp_region
  zone    = "${var.gcp_region}-a"
}

# network
module "vpc" {
  source       = "terraform-google-modules/network/google"
  version      = "~> 4.0"
  project_id   = var.gcp_project_id
  network_name = "${var.network}-${var.env_name}"
  subnets = [
    {
      subnet_name   = "${var.subnetwork}-${var.env_name}"
      subnet_ip     = "10.10.0.0/16"
      subnet_region = var.gcp_region
    },
  ]
  secondary_ranges = {
    "${var.subnetwork}-${var.env_name}" = [
      {
        range_name    = var.ip_range_pods_name
        ip_cidr_range = "10.20.0.0/16"
      },
      {
        range_name    = var.ip_range_services_name
        ip_cidr_range = "10.30.0.0/16"
      },
    ]
  }
}

# gke
module "gke" {
  source                 = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster"
  project_id             = var.gcp_project_id
  name                   = "${var.cluster_name}-${var.env_name}"
  regional               = true
  region                 = var.gcp_region
  network                = module.vpc.network_name
  subnetwork             = module.vpc.subnets_names[0]
  ip_range_pods          = var.ip_range_pods_name
  ip_range_services      = var.ip_range_services_name
  node_pools = [
    {
      name                      = "node-pool"
      machine_type              = "n2-standard-2"
      node_locations            = "${var.gcp_region}-a" # 複数のゾーンを指定できる
      min_count                 = 1
      max_count                 = 2
      disk_size_gb              = 30
    },
  ]
}

# gke auth
module "gke_auth" {
  source = "terraform-google-modules/kubernetes-engine/google//modules/auth"
  depends_on   = [module.gke]
  project_id   = var.gcp_project_id
  location     = module.gke.location
  cluster_name = module.gke.name
}

# kubeconfig
resource "local_file" "kubeconfig" {
  content  = module.gke_auth.kubeconfig_raw
  filename = "kubeconfig-${var.env_name}"
}

gcp_project_id="your-project-id"
gcp_region="your-region1"

# from terraform.tfvars
variable gcp_project_id {
  description = "GCP project id"
}
variable gcp_region {
  description = "GCP region"
}

# others
variable "cluster_name" {
  description = "name of gke cluster"
  default     = "dev-cluster"
}
variable "env_name" {
  description = "name of environment"
  default     = "dev"
}
variable "network" {
  description = "name of VPC"
  default     = "dev-gek-network"
}
variable "subnetwork" {
  description = "name of subnetwork"
  default     = "dev-gke-subnet"
}
variable "ip_range_pods_name" {
  description = "name of secondary ip range used in pods"
  default     = "ip-range-pods"
}
variable "ip_range_services_name" {
  description = "name of secondary ip range used in services"
  default     = "ip-range-services"
}

output "cluster_name" {
  description = "cluster name"
  value       = module.gke.name
}

# モジュールのセットアップ
$ terraform init

# ドライランを実施し、作成されるリソースを確認する
$ terraform plan

# 実際にリソースを作成する
$ terraform apply

# kubectlコマンドが対象のクラスターを見にいくように下記を実施します。
$ export KUBECONFIG="${PWD}/kubeconfig-dev"

# クラスターにアクセスしnodeを確認する
$ kubectl get nodes
NAME                                        STATUS ROLES  AGE   VERSION
gke-dev-cluster-dev-node-pool-a9c02cfb-tpf8 Ready  <none> 5m55s v1.24.3-gke.900

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-nginx
spec:
  selector:
    matchLabels:
      name: hello-nginx
  template:
    metadata:
      labels:
        name: hello-nginx
    spec:
      containers:
        - name: app
          image: nginx:alpine # nginxイメージ
          ports:
            - containerPort: 80

# デプロイ
$ kubectl apply -f deployment.yml

# 確認
$ kubectl get pods
NAME                         READY STATUS  RESTARTS AGE
hello-nginx-5dd8f754fd-dbzgd 1/1   Running 0        4m39s

# 8080ポートへマッピング
$ kubectl port-forward hello-nginx-5dd8f754fd-dbzgd 8080:80

apiVersion: v1
kind: Service
metadata:
  name: hello-nginx
spec:
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 80
  selector:
    name: hello-nginx

# ロードバランサーの作成
$ kubectl apply -f loadbalancer.yml

# 確認
$ kubectl get services
NAME        TYPE         CLUSTER-IP    EXTERNAL-IP  PORT(S)      AGE
hello-nginx LoadBalancer 10.30.195.150 34.85.90.129 80:31792/TCP 48s

$ terraform destroy