gcp: unofficial support for internal LBs (#826)

hack/terraform/gcp/internal-loadbalancer/modules/instance_group/main.tf

@@ -0,0 +1,106 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "4.46.0"
+    }
+  }
+}
+
+locals {
+  role_dashed = var.role == "ControlPlane" ? "control-plane" : "worker"
+  name        = "${var.name}-${local.role_dashed}"
+}
+
+resource "google_compute_instance_template" "template" {
+  name         = local.name
+  machine_type = var.instance_type
+  tags         = ["constellation-${var.uid}"] // Note that this is also applied as a label 
+  labels       = merge(var.labels, { constellation-role = local.role_dashed })
+
+  confidential_instance_config {
+    enable_confidential_compute = true
+  }
+
+  disk {
+    disk_size_gb = 10
+    source_image = var.image_id
+    auto_delete  = true
+    boot         = true
+    mode         = "READ_WRITE"
+  }
+
+  disk {
+    disk_size_gb = var.disk_size
+    disk_type    = var.disk_type
+    auto_delete  = true
+    device_name  = "state-disk" // This name is used by disk mapper to find the disk
+    boot         = false
+    mode         = "READ_WRITE"
+    type         = "PERSISTENT"
+  }
+
+  metadata = {
+    kube-env                       = var.kube_env
+    constellation-init-secret-hash = var.init_secret_hash
+    serial-port-enable             = var.debug ? "TRUE" : "FALSE"
+  }
+
+  network_interface {
+    network    = var.network
+    subnetwork = var.subnetwork
+    alias_ip_range {
+      ip_cidr_range         = "/24"
+      subnetwork_range_name = var.name
+    }
+  }
+
+  scheduling {
+    on_host_maintenance = "TERMINATE"
+  }
+
+  service_account {
+    scopes = [
+      "https://www.googleapis.com/auth/compute",
+      "https://www.googleapis.com/auth/servicecontrol",
+      "https://www.googleapis.com/auth/service.management.readonly",
+      "https://www.googleapis.com/auth/devstorage.read_only",
+      "https://www.googleapis.com/auth/logging.write",
+      "https://www.googleapis.com/auth/monitoring.write",
+      "https://www.googleapis.com/auth/trace.append",
+      "https://www.googleapis.com/auth/cloud-platform",
+    ]
+  }
+
+  shielded_instance_config {
+    enable_secure_boot          = true
+    enable_vtpm                 = true
+    enable_integrity_monitoring = true
+  }
+}
+
+resource "google_compute_instance_group_manager" "instance_group_manager" {
+  name               = local.name
+  description        = "Instance group manager for Constellation"
+  base_instance_name = local.name
+  target_size        = var.instance_count
+
+  version {
+    instance_template = google_compute_instance_template.template.id
+  }
+
+  dynamic "named_port" {
+    for_each = toset(var.named_ports)
+    content {
+      name = named_port.value.name
+      port = named_port.value.port
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [
+      target_size, # required. autoscaling modifies the instance count externally
+      version,     # required. update procedure modifies the instance template externally
+    ]
+  }
+}

hack/terraform/gcp/internal-loadbalancer/modules/instance_group/outputs.tf

@@ -0,0 +1,3 @@
+output "instance_group" {
+  value = google_compute_instance_group_manager.instance_group_manager.instance_group
+}

hack/terraform/gcp/internal-loadbalancer/modules/instance_group/variables.tf

@@ -0,0 +1,77 @@
+variable "name" {
+  type        = string
+  description = "Base name of the instance group."
+}
+
+variable "role" {
+  type        = string
+  description = "The role of the instance group. Has to be 'ControlPlane' or 'Worker'."
+}
+
+variable "uid" {
+  type        = string
+  description = "UID of the cluster. This is used for tags."
+}
+
+variable "labels" {
+  type        = map(string)
+  default     = {}
+  description = "Labels to apply to the instance group."
+}
+
+variable "instance_type" {
+  type        = string
+  description = "Instance type for the nodes."
+}
+
+variable "instance_count" {
+  type        = number
+  description = "Number of instances in the instance group."
+}
+
+variable "image_id" {
+  type        = string
+  description = "Image ID for the nodes."
+}
+
+variable "disk_size" {
+  type        = number
+  description = "Disk size for the nodes, in GB."
+}
+
+variable "disk_type" {
+  type        = string
+  description = "Disk type for the nodes. Has to be 'pd-standard' or 'pd-ssd'."
+}
+
+variable "network" {
+  type        = string
+  description = "Name of the network to use."
+}
+
+variable "subnetwork" {
+  type        = string
+  description = "Name of the subnetwork to use."
+}
+
+variable "kube_env" {
+  type        = string
+  description = "Kubernetes env."
+}
+
+variable "init_secret_hash" {
+  type        = string
+  description = "Hash of the init secret."
+}
+
+variable "named_ports" {
+  type        = list(object({ name = string, port = number }))
+  default     = []
+  description = "Named ports for the instance group."
+}
+
+variable "debug" {
+  type        = bool
+  default     = false
+  description = "Enable debug mode. This will enable serial port access on the instances."
+}

hack/terraform/gcp/internal-loadbalancer/modules/internal_loadbalancer/main.tf

@@ -0,0 +1,75 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "4.46.0"
+    }
+  }
+}
+
+locals {
+  name = "${var.name}-${var.port_name}"
+}
+
+# forwarding rule
+resource "google_compute_forwarding_rule" "forwarding" {
+  name                  = local.name
+  network               = var.network
+  subnetwork            = var.backend_subnet
+  region                = var.region
+  ip_address            = var.ip_address
+  ip_protocol           = "TCP"
+  load_balancing_scheme = "INTERNAL_MANAGED"
+  port_range            = var.port
+  allow_global_access   = true
+  target                = google_compute_region_target_tcp_proxy.proxy.id
+  labels                = var.frontend_labels
+}
+
+resource "google_compute_region_backend_service" "backend" {
+  name                  = local.name
+  region                = var.region
+  port_name             = var.port_name
+  protocol              = "TCP"
+  load_balancing_scheme = "INTERNAL_MANAGED"
+
+  backend {
+    group           = var.backend_instance_group
+    balancing_mode  = "UTILIZATION"
+    capacity_scaler = 1.0
+  }
+
+
+  health_checks = [google_compute_region_health_check.health.id]
+  timeout_sec   = 240
+}
+
+resource "google_compute_region_target_tcp_proxy" "proxy" {
+  provider        = google-beta
+  name            = local.name
+  region          = var.region
+  backend_service = google_compute_region_backend_service.backend.id
+}
+
+resource "google_compute_region_health_check" "health" {
+  name               = local.name
+  region             = var.region
+  check_interval_sec = 1
+  timeout_sec        = 1
+
+  dynamic "tcp_health_check" {
+    for_each = var.health_check == "TCP" ? [1] : []
+    content {
+      port = var.port
+    }
+  }
+
+  dynamic "https_health_check" {
+    for_each = var.health_check == "HTTPS" ? [1] : []
+    content {
+      host         = ""
+      port         = var.port
+      request_path = "/readyz"
+    }
+  }
+}

hack/terraform/gcp/internal-loadbalancer/modules/internal_loadbalancer/variables.tf

@@ -0,0 +1,54 @@
+variable "name" {
+  type        = string
+  description = "Base name of the load balancer."
+}
+
+variable "region" {
+  type        = string
+  description = "The region where the load balancer will be created."
+}
+
+variable "network" {
+  type        = string
+  description = "The network to which all network resources will be attached."
+}
+
+variable "backend_subnet" {
+  type        = string
+  description = "The subnet to which all backend network resources will be attached."
+}
+
+variable "health_check" {
+  type        = string
+  description = "The type of the health check. 'HTTPS' or 'TCP'."
+  validation {
+    condition     = contains(["HTTPS", "TCP"], var.health_check)
+    error_message = "Health check must be either 'HTTPS' or 'TCP'."
+  }
+}
+
+variable "port" {
+  type        = string
+  description = "The port on which to listen for incoming traffic."
+}
+
+variable "port_name" {
+  type        = string
+  description = "Name of backend port. The same name should appear in the instance groups referenced by this service."
+}
+
+variable "backend_instance_group" {
+  type        = string
+  description = "The URL of the instance group resource from which the load balancer will direct traffic."
+}
+
+variable "ip_address" {
+  type        = string
+  description = "The IP address that this forwarding rule serves."
+}
+
+variable "frontend_labels" {
+  type        = map(string)
+  default     = {}
+  description = "Labels to apply to the forwarding rule."
+}