TerraformでGKEプライベートクラスタと踏み台VMを作成してみた

resource "google_container_cluster" "primary" {
  name     = var.cluster_name
  location = var.zone

  network    = google_compute_network.vpc.name
  subnetwork = google_compute_subnetwork.gke.name

  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = true
    master_ipv4_cidr_block  = var.master_ipv4_cidr_block
  }

  master_authorized_networks_config {
    cidr_blocks {
      cidr_block   = var.bastion_subnet_cidr
      display_name = "bastion-subnet"
    }
  }

  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }
}

resource "google_service_account" "bastion" {
  account_id   = "${var.bastion_instance_name}-sa"
  display_name = "Bastion for private GKE access"
}

# container.clusterAdminはnodes.listを含まないため、kubectl get nodesがForbiddenになる。
resource "google_project_iam_member" "bastion_gke" {
  project = var.project_id
  role    = "roles/container.admin"
  member  = "serviceAccount:${google_service_account.bastion.email}"
}

resource "google_compute_instance" "bastion" {
  name         = var.bastion_instance_name
  machine_type = var.bastion_machine_type
  zone         = var.zone
  tags         = ["bastion"]

  network_interface {
    subnetwork = google_compute_subnetwork.bastion.id
    # 外部IPなし。IAP経由でのみSSH
  }

  service_account {
    email  = google_service_account.bastion.email
    scopes = ["https://www.googleapis.com/auth/cloud-platform"]
  }

  metadata_startup_script = <<-EOT
    #!/bin/bash
    set -euxo pipefail
    apt-get update
    apt-get install -y kubectl google-cloud-cli-gke-gcloud-auth-plugin
  EOT
}

cd Advanced-Examples/11-gke-private-bastion
cp terraform.tfvars.example terraform.tfvars

project_id = "your-project-id"
iap_member = "user:you@example.com"

terraform init
terraform fmt -check
terraform validate
terraform plan
terraform apply

Apply complete! Resources: 25 added, 0 changed, 0 destroyed.

Outputs:

artifact_registry_nginx_image = "asia-northeast1-docker.pkg.dev/YOUR_PROJECT_ID/tf-adv-gke-bastion-repo/nginx:latest"
bastion_name = "tf-adv-gke-bastion-vm"
cluster_name = "tf-adv-gke-bastion"
private_endpoint = "172.16.4.2"
workload_pool = "YOUR_PROJECT_ID.svc.id.goog"

gcloud compute ssh "$(terraform output -raw bastion_name)" \
  --zone="$(terraform output -raw zone)" \
  --tunnel-through-iap \
  --project="$(terraform output -raw project_id)"

# 踏み台の中で実行
gcloud container clusters get-credentials "$(terraform output -raw cluster_name)" \
  --zone="$(terraform output -raw zone)" \
  --project="$(terraform output -raw project_id)"
kubectl get nodes -o wide

NAME                                                  STATUS   ROLES    AGE   VERSION               INTERNAL-IP
gke-tf-adv-gke-basti-tf-adv-gke-basti-2f6addf8-hrtp   Ready    <none>   84s   v1.35.7-gke.1027000   10.40.0.3

# ローカル（Dockerが使える環境）で実行
gcloud auth configure-docker "$(terraform output -raw region)-docker.pkg.dev" --quiet
docker pull nginx:latest
docker tag nginx:latest "$(terraform output -raw artifact_registry_nginx_image)"
docker push "$(terraform output -raw artifact_registry_nginx_image)"

sed "s|__IMAGE__|$(terraform output -raw artifact_registry_nginx_image)|" \
  k8s/nginx-deployment.yaml > /tmp/nginx-deployment.yaml
gcloud compute scp /tmp/nginx-deployment.yaml \
  "$(terraform output -raw bastion_name):/tmp/nginx-deployment.yaml" \
  --zone="$(terraform output -raw zone)" --tunnel-through-iap \
  --project="$(terraform output -raw project_id)"

# 踏み台の中で実行
kubectl apply -f /tmp/nginx-deployment.yaml
kubectl get pods -l app=nginx -o wide

NAME                     READY   STATUS    RESTARTS   AGE   IP
nginx-6b9766b7d9-mk8z8   1/1     Running   0          9s    10.41.0.13

kubectl port-forward deployment/nginx 8080:80 &
curl -sS -o /dev/null -w "HTTP %{http_code}\n" http://localhost:8080

HTTP 200

terraform destroy

Destroy complete! Resources: 25 destroyed.