osinfra-io/google-cloud-networking

Infrastructure as Code (IaC) example for Google Cloud Platform networking resources.

google-cloud-networking's Issues

Enable Infracost template and sync usage file with pre-commit

We learned we could simplify developers' management of usage files.

Tasks

Beta Give feedback

1. Add Infracost template
2. Pre-commit should sync usage file

• https://www.infracost.io/docs/features/config_file

Add backend.tf symbolic link

Description

Add symlink in the global directory.

Acceptance

• Symbolic link added

Implementation Notes

Additional Context

Fix production dns zone names

Tasks

Beta Give feedback

1. Clear description for each DNS zone
2. Production domain names do not start with a "." or a "-"

Manage IAM roles for Kubernetes clusters

# Compute Subnetwork IAM Member Resource
# https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_subnetwork_iam

resource "google_compute_subnetwork_iam_member" "this" {
  for_each = toset(
    [
      "serviceAccount:${var.project_number}@cloudservices.gserviceaccount.com",
      "serviceAccount:service-${var.project_number}@container-engine-robot.iam.gserviceaccount.com"
    ]
  )

  member     = each.key
  project    = var.host_project_id
  region     = var.region
  role       = "roles/compute.networkUser"
  subnetwork = local.subnet
}

Allow service accounts to create DNS records

Service accounts that run workflows must be able to create DNS records. A good example of this is when dealing with Kubernetes ingress, we will want to wait for the load balancer and then assign an A record to the IP address provided.

Move code to a "global" directory structure

Description

Standardizing on a directory structure for global resources or "run once" and regional resources or "run many" aligns with our GitHub Actions and helps support things like multi-region deployments.

Acceptance

• Standard directory structure in place

Implementation Notes

Additional Context

Create IAM binding granting the fleet host project MCS service account the MCS Service Agent role

https://cloud.google.com/kubernetes-engine/docs/how-to/msc-setup-with-shared-vpc-networks#two-service-projects-iam