terraform: Terraform module for AWS (#2503)

terraform/infrastructure/gcp/modules/instance_group/main.tf

@@ -0,0 +1,153 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "4.83.0"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "3.5.1"
+    }
+  }
+}
+
+locals {
+  group_uid       = random_id.uid.hex
+  name            = "${var.base_name}-${var.role}-${local.group_uid}"
+  state_disk_name = "state-disk"
+}
+
+resource "random_id" "uid" {
+  byte_length = 4
+}
+
+resource "google_compute_instance_template" "template" {
+  name         = local.name
+  machine_type = var.instance_type
+  tags         = ["constellation-${var.uid}"] // Note that this is also applied as a label
+  labels = merge(var.labels, {
+    constellation-role       = var.role,
+    constellation-node-group = var.node_group_name,
+  })
+
+  confidential_instance_config {
+    enable_confidential_compute = true
+  }
+
+  disk {
+    disk_size_gb = 10
+    source_image = var.image_id
+    auto_delete  = true
+    boot         = true
+    mode         = "READ_WRITE"
+  }
+
+  disk {
+    disk_size_gb = var.disk_size
+    disk_type    = var.disk_type
+    auto_delete  = true
+    device_name  = local.state_disk_name // This name is used by disk mapper to find the disk
+    boot         = false
+    mode         = "READ_WRITE"
+    type         = "PERSISTENT"
+  }
+
+  metadata = {
+    kube-env                       = var.kube_env
+    constellation-init-secret-hash = var.init_secret_hash
+    serial-port-enable             = var.debug ? "TRUE" : "FALSE"
+  }
+
+  network_interface {
+    network    = var.network
+    subnetwork = var.subnetwork
+    alias_ip_range {
+      ip_cidr_range         = "/24"
+      subnetwork_range_name = var.alias_ip_range_name
+    }
+  }
+
+  scheduling {
+    on_host_maintenance = "TERMINATE"
+  }
+
+  service_account {
+    scopes = [
+      "https://www.googleapis.com/auth/compute",
+      "https://www.googleapis.com/auth/servicecontrol",
+      "https://www.googleapis.com/auth/service.management.readonly",
+      "https://www.googleapis.com/auth/devstorage.read_only",
+      "https://www.googleapis.com/auth/logging.write",
+      "https://www.googleapis.com/auth/monitoring.write",
+      "https://www.googleapis.com/auth/trace.append",
+      "https://www.googleapis.com/auth/cloud-platform",
+    ]
+  }
+
+  shielded_instance_config {
+    enable_secure_boot          = false
+    enable_vtpm                 = true
+    enable_integrity_monitoring = true
+  }
+
+  lifecycle {
+    ignore_changes = [
+      name, # required. legacy instance templates used different naming scheme
+      tags,
+      labels,
+      disk, # required. update procedure modifies the instance template externally
+      metadata,
+      network_interface,
+      scheduling,
+      service_account,
+      shielded_instance_config,
+    ]
+  }
+}
+
+resource "google_compute_instance_group_manager" "instance_group_manager" {
+  provider           = google-beta
+  name               = local.name
+  description        = "Instance group manager for Constellation"
+  base_instance_name = local.name
+  zone               = var.zone
+  target_size        = var.initial_count
+
+  dynamic "stateful_disk" {
+    for_each = var.role == "control-plane" ? [1] : []
+    content {
+      device_name = local.state_disk_name
+      delete_rule = "ON_PERMANENT_INSTANCE_DELETION"
+    }
+  }
+
+  dynamic "stateful_internal_ip" {
+    for_each = var.role == "control-plane" ? [1] : []
+    content {
+      interface_name = "nic0"
+      delete_rule    = "ON_PERMANENT_INSTANCE_DELETION"
+    }
+  }
+
+  version {
+    instance_template = google_compute_instance_template.template.id
+  }
+
+  dynamic "named_port" {
+    for_each = toset(var.named_ports)
+    content {
+      name = named_port.value.name
+      port = named_port.value.port
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [
+      name,               # required. legacy instance templates used different naming scheme
+      base_instance_name, # required. legacy instance templates used different naming scheme
+      target_size,        # required. autoscaling modifies the instance count externally
+      version,            # required. update procedure modifies the instance template externally
+    ]
+  }
+}

terraform/infrastructure/gcp/modules/instance_group/outputs.tf

@@ -0,0 +1,3 @@
+output "instance_group" {
+  value = google_compute_instance_group_manager.instance_group_manager.instance_group
+}

terraform/infrastructure/gcp/modules/instance_group/variables.tf

@@ -0,0 +1,101 @@
+variable "base_name" {
+  type        = string
+  description = "Base name of the instance group."
+}
+
+variable "node_group_name" {
+  type        = string
+  description = "Constellation name for the node group (used for configuration and CSP-independent naming)."
+}
+
+variable "role" {
+  type        = string
+  description = "The role of the instance group."
+  validation {
+    condition     = contains(["control-plane", "worker"], var.role)
+    error_message = "The role has to be 'control-plane' or 'worker'."
+  }
+}
+
+variable "uid" {
+  type        = string
+  description = "UID of the cluster. This is used for tags."
+}
+
+variable "labels" {
+  type        = map(string)
+  default     = {}
+  description = "Labels to apply to the instance group."
+}
+
+variable "instance_type" {
+  type        = string
+  description = "Instance type for the nodes."
+}
+
+variable "initial_count" {
+  type        = number
+  description = "Number of instances in the instance group."
+}
+
+variable "image_id" {
+  type        = string
+  description = "Image ID for the nodes."
+}
+
+variable "disk_size" {
+  type        = number
+  description = "Disk size for the nodes, in GB."
+}
+
+variable "disk_type" {
+  type        = string
+  description = "Disk type for the nodes. Has to be 'pd-standard' or 'pd-ssd'."
+}
+
+variable "network" {
+  type        = string
+  description = "Name of the network to use."
+}
+
+variable "subnetwork" {
+  type        = string
+  description = "Name of the subnetwork to use."
+}
+
+variable "kube_env" {
+  type        = string
+  description = "Kubernetes env."
+}
+
+variable "init_secret_hash" {
+  type        = string
+  description = "Hash of the init secret."
+}
+
+variable "named_ports" {
+  type        = list(object({ name = string, port = number }))
+  default     = []
+  description = "Named ports for the instance group."
+}
+
+variable "debug" {
+  type        = bool
+  default     = false
+  description = "Enable debug mode. This will enable serial port access on the instances."
+}
+
+variable "alias_ip_range_name" {
+  type        = string
+  description = "Name of the alias IP range to use."
+}
+
+variable "zone" {
+  type        = string
+  description = "Zone to deploy the instance group in."
+}
+
+variable "custom_endpoint" {
+  type        = string
+  description = "Custom endpoint to use for the Kubernetes apiserver. If not set, the default endpoint will be used."
+}