2023-12-18 04:15:54 -05:00
|
|
|
terraform {
|
|
|
|
required_providers {
|
|
|
|
constellation = {
|
|
|
|
source = "edgelesssys/constellation"
|
2024-01-04 04:00:21 -05:00
|
|
|
version = "0.0.0" // replace with the version you want to use
|
2023-12-18 04:15:54 -05:00
|
|
|
}
|
|
|
|
random = {
|
|
|
|
source = "hashicorp/random"
|
2024-06-27 03:14:10 -04:00
|
|
|
version = "3.6.2"
|
2023-12-18 04:15:54 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
locals {
|
2024-01-04 10:25:24 -05:00
|
|
|
name = "constell"
|
2024-01-13 07:13:10 -05:00
|
|
|
image_version = "vX.Y.Z"
|
2024-01-04 10:25:24 -05:00
|
|
|
kubernetes_version = "vX.Y.Z"
|
|
|
|
microservice_version = "vX.Y.Z"
|
|
|
|
csp = "gcp"
|
2024-07-22 07:29:27 -04:00
|
|
|
attestation_variant = "gcp-sev-snp"
|
2024-01-04 10:25:24 -05:00
|
|
|
region = "europe-west3"
|
|
|
|
zone = "europe-west3-b"
|
|
|
|
project_id = "constellation-331613"
|
2024-01-13 07:13:10 -05:00
|
|
|
control_plane_count = 3
|
|
|
|
worker_count = 2
|
2024-02-05 09:46:57 -05:00
|
|
|
instance_type = "n2d-standard-4"
|
2024-04-16 12:13:47 -04:00
|
|
|
cc_technology = "SEV"
|
2023-12-18 04:15:54 -05:00
|
|
|
|
|
|
|
master_secret = random_bytes.master_secret.hex
|
|
|
|
master_secret_salt = random_bytes.master_secret_salt.hex
|
|
|
|
measurement_salt = random_bytes.measurement_salt.hex
|
|
|
|
}
|
|
|
|
|
|
|
|
resource "random_bytes" "master_secret" {
|
|
|
|
length = 32
|
|
|
|
}
|
|
|
|
|
|
|
|
resource "random_bytes" "master_secret_salt" {
|
|
|
|
length = 32
|
|
|
|
}
|
|
|
|
|
|
|
|
resource "random_bytes" "measurement_salt" {
|
|
|
|
length = 32
|
|
|
|
}
|
|
|
|
|
|
|
|
module "gcp_iam" {
|
|
|
|
// replace $VERSION with the Constellation version you want to use, e.g., v2.14.0
|
|
|
|
source = "https://github.com/edgelesssys/constellation/releases/download/$VERSION/terraform-module.zip//terraform-module/iam/gcp"
|
|
|
|
project_id = local.project_id
|
2024-03-04 07:48:30 -05:00
|
|
|
service_account_id = "${local.name}-sa"
|
2023-12-18 04:15:54 -05:00
|
|
|
zone = local.zone
|
|
|
|
region = local.region
|
|
|
|
}
|
|
|
|
|
|
|
|
module "gcp_infrastructure" {
|
|
|
|
// replace $VERSION with the Constellation version you want to use, e.g., v2.14.0
|
|
|
|
source = "https://github.com/edgelesssys/constellation/releases/download/$VERSION/terraform-module.zip//terraform-module/gcp"
|
|
|
|
name = local.name
|
|
|
|
node_groups = {
|
|
|
|
control_plane_default = {
|
|
|
|
role = "control-plane"
|
2024-02-05 09:46:57 -05:00
|
|
|
instance_type = local.instance_type
|
2023-12-18 04:15:54 -05:00
|
|
|
disk_size = 30
|
|
|
|
disk_type = "pd-ssd"
|
2024-01-13 07:13:10 -05:00
|
|
|
initial_count = local.control_plane_count
|
2023-12-18 04:15:54 -05:00
|
|
|
zone = local.zone
|
|
|
|
},
|
|
|
|
worker_default = {
|
|
|
|
role = "worker"
|
2024-02-05 09:46:57 -05:00
|
|
|
instance_type = local.instance_type
|
2023-12-18 04:15:54 -05:00
|
|
|
disk_size = 30
|
|
|
|
disk_type = "pd-ssd"
|
2024-01-13 07:13:10 -05:00
|
|
|
initial_count = local.worker_count
|
2023-12-18 04:15:54 -05:00
|
|
|
zone = local.zone
|
|
|
|
}
|
|
|
|
}
|
2023-12-27 11:04:35 -05:00
|
|
|
image_id = data.constellation_image.bar.image.reference
|
|
|
|
debug = false
|
|
|
|
zone = local.zone
|
|
|
|
region = local.region
|
|
|
|
project = local.project_id
|
|
|
|
internal_load_balancer = false
|
2024-04-16 12:13:47 -04:00
|
|
|
cc_technology = local.cc_technology
|
2023-12-18 04:15:54 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
data "constellation_attestation" "foo" {
|
|
|
|
csp = local.csp
|
|
|
|
attestation_variant = local.attestation_variant
|
|
|
|
image = data.constellation_image.bar.image
|
|
|
|
}
|
|
|
|
|
|
|
|
data "constellation_image" "bar" {
|
|
|
|
csp = local.csp
|
|
|
|
attestation_variant = local.attestation_variant
|
2024-01-13 07:13:10 -05:00
|
|
|
version = local.image_version
|
2023-12-18 04:15:54 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
resource "constellation_cluster" "gcp_example" {
|
2024-01-04 10:25:24 -05:00
|
|
|
csp = local.csp
|
|
|
|
name = module.gcp_infrastructure.name
|
|
|
|
uid = module.gcp_infrastructure.uid
|
|
|
|
image = data.constellation_image.bar.image
|
|
|
|
attestation = data.constellation_attestation.foo.attestation
|
|
|
|
kubernetes_version = local.kubernetes_version
|
|
|
|
constellation_microservice_version = local.microservice_version
|
|
|
|
init_secret = module.gcp_infrastructure.init_secret
|
|
|
|
master_secret = local.master_secret
|
|
|
|
master_secret_salt = local.master_secret_salt
|
|
|
|
measurement_salt = local.measurement_salt
|
|
|
|
out_of_cluster_endpoint = module.gcp_infrastructure.out_of_cluster_endpoint
|
|
|
|
in_cluster_endpoint = module.gcp_infrastructure.in_cluster_endpoint
|
|
|
|
api_server_cert_sans = module.gcp_infrastructure.api_server_cert_sans
|
2023-12-18 04:15:54 -05:00
|
|
|
gcp = {
|
|
|
|
project_id = module.gcp_infrastructure.project
|
|
|
|
service_account_key = module.gcp_iam.service_account_key
|
|
|
|
}
|
|
|
|
network_config = {
|
|
|
|
ip_cidr_node = module.gcp_infrastructure.ip_cidr_node
|
|
|
|
ip_cidr_service = "10.96.0.0/12"
|
|
|
|
ip_cidr_pod = module.gcp_infrastructure.ip_cidr_pod
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
output "kubeconfig" {
|
|
|
|
value = constellation_cluster.gcp_example.kubeconfig
|
|
|
|
sensitive = true
|
|
|
|
description = "KubeConfig for the Constellation cluster."
|
|
|
|
}
|