Infrastructure Automation - GCP Professional Cloud DevOps Engineer¶

terraform {
  required_version = ">= 1.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
    google-beta = {
      source  = "hashicorp/google-beta"
      version = "~> 5.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
  zone    = var.zone
}

provider "google-beta" {
  project = var.project_id
  region  = var.region
  zone    = var.zone
}

provider "google" {
  alias   = "production"
  project = "prod-project-12345"
  region  = "us-central1"
}

provider "google" {
  alias   = "development"
  project = "dev-project-67890"
  region  = "us-west1"
}

# Use specific provider
resource "google_compute_network" "prod_vpc" {
  provider                = google.production
  name                    = "production-vpc"
  auto_create_subnetworks = false
}

provider "google" {
  impersonate_service_account = "terraform@my-project.iam.gserviceaccount.com"
  scopes = [
    "https://www.googleapis.com/auth/cloud-platform",
    "https://www.googleapis.com/auth/userinfo.email",
  ]
}

# variables.tf
variable "project_id" {
  description = "GCP Project ID"
  type        = string
}

variable "region" {
  description = "Default region"
  type        = string
  default     = "us-central1"
}

variable "environment" {
  description = "Environment (dev, staging, prod)"
  type        = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}

variable "instance_count" {
  description = "Number of instances to create"
  type        = number
  default     = 1
}

variable "labels" {
  description = "Labels to apply to resources"
  type        = map(string)
  default     = {}
}

# main.tf
terraform {
  required_version = ">= 1.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
  backend "gcs" {
    bucket = "terraform-state-bucket"
    prefix = "prod"
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# VPC Network
resource "google_compute_network" "vpc" {
  name                    = "${var.environment}-vpc"
  auto_create_subnetworks = false
  routing_mode            = "REGIONAL"

  lifecycle {
    prevent_destroy = true
  }
}

# Subnet
resource "google_compute_subnetwork" "subnet" {
  name          = "${var.environment}-subnet-${var.region}"
  ip_cidr_range = "10.0.1.0/24"
  region        = var.region
  network       = google_compute_network.vpc.id

  secondary_ip_range {
    range_name    = "pods"
    ip_cidr_range = "10.4.0.0/14"
  }

  secondary_ip_range {
    range_name    = "services"
    ip_cidr_range = "10.0.32.0/20"
  }

  log_config {
    aggregation_interval = "INTERVAL_10_MIN"
    flow_sampling        = 0.5
    metadata             = "INCLUDE_ALL_METADATA"
  }
}

# Firewall Rules
resource "google_compute_firewall" "allow_internal" {
  name    = "${var.environment}-allow-internal"
  network = google_compute_network.vpc.name

  allow {
    protocol = "tcp"
    ports    = ["0-65535"]
  }

  allow {
    protocol = "udp"
    ports    = ["0-65535"]
  }

  allow {
    protocol = "icmp"
  }

  source_ranges = ["10.0.0.0/8"]
}

resource "google_compute_firewall" "allow_ssh_iap" {
  name    = "${var.environment}-allow-ssh-iap"
  network = google_compute_network.vpc.name

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  # IAP IP ranges
  source_ranges = ["35.235.240.0/20"]
}

# outputs.tf
output "network_name" {
  description = "The name of the VPC network"
  value       = google_compute_network.vpc.name
}

output "network_id" {
  description = "The ID of the VPC network"
  value       = google_compute_network.vpc.id
}

output "subnet_name" {
  description = "The name of the subnet"
  value       = google_compute_subnetwork.subnet.name
}

output "subnet_cidr" {
  description = "The CIDR of the subnet"
  value       = google_compute_subnetwork.subnet.ip_cidr_range
}

# Instance Template
resource "google_compute_instance_template" "web_template" {
  name_prefix  = "web-template-"
  machine_type = "e2-medium"
  region       = var.region

  disk {
    source_image = "projects/debian-cloud/global/images/family/debian-11"
    auto_delete  = true
    boot         = true
    disk_size_gb = 20
    disk_type    = "pd-standard"
  }

  network_interface {
    network    = google_compute_network.vpc.id
    subnetwork = google_compute_subnetwork.subnet.id

    access_config {
      // Ephemeral public IP
    }
  }

  metadata = {
    enable-oslogin = "TRUE"
    startup-script = file("${path.module}/scripts/startup.sh")
  }

  service_account {
    email  = google_service_account.instance_sa.email
    scopes = ["cloud-platform"]
  }

  labels = merge(var.labels, {
    environment = var.environment
    managed_by  = "terraform"
  })

  lifecycle {
    create_before_destroy = true
  }
}

# Managed Instance Group
resource "google_compute_region_instance_group_manager" "web_mig" {
  name               = "${var.environment}-web-mig"
  base_instance_name = "web"
  region             = var.region

  version {
    instance_template = google_compute_instance_template.web_template.id
  }

  target_size = var.instance_count

  named_port {
    name = "http"
    port = 8080
  }

  auto_healing_policies {
    health_check      = google_compute_health_check.http_health_check.id
    initial_delay_sec = 300
  }

  update_policy {
    type                         = "PROACTIVE"
    minimal_action               = "REPLACE"
    max_surge_fixed              = 3
    max_unavailable_fixed        = 0
    instance_redistribution_type = "PROACTIVE"
  }
}

# Autoscaler
resource "google_compute_region_autoscaler" "web_autoscaler" {
  name   = "${var.environment}-web-autoscaler"
  region = var.region
  target = google_compute_region_instance_group_manager.web_mig.id

  autoscaling_policy {
    max_replicas    = 10
    min_replicas    = 2
    cooldown_period = 60

    cpu_utilization {
      target = 0.7
    }

    metric {
      name   = "pubsub.googleapis.com/subscription/num_undelivered_messages"
      target = 100
      type   = "GAUGE"
    }
  }
}

# Health Check
resource "google_compute_health_check" "http_health_check" {
  name               = "${var.environment}-http-health-check"
  check_interval_sec = 10
  timeout_sec        = 5

  http_health_check {
    port         = 8080
    request_path = "/health"
  }
}

# GKE Cluster
resource "google_container_cluster" "primary" {
  name     = "${var.environment}-gke-cluster"
  location = var.region

  # We can't create a cluster with no node pool defined, but we want to only use
  # separately managed node pools. So we create the smallest possible default
  # node pool and immediately delete it.
  remove_default_node_pool = true
  initial_node_count       = 1

  network    = google_compute_network.vpc.name
  subnetwork = google_compute_subnetwork.subnet.name

  # IP allocation for pods and services
  ip_allocation_policy {
    cluster_secondary_range_name  = "pods"
    services_secondary_range_name = "services"
  }

  # Workload Identity
  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }

  # Network Policy
  network_policy {
    enabled  = true
    provider = "CALICO"
  }

  # Master authorized networks
  master_authorized_networks_config {
    cidr_blocks {
      cidr_block   = "10.0.0.0/8"
      display_name = "internal"
    }
  }

  # Private cluster configuration
  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = false
    master_ipv4_cidr_block  = "172.16.0.0/28"
  }

  # Maintenance window
  maintenance_policy {
    daily_maintenance_window {
      start_time = "03:00"
    }
  }

  # Logging and monitoring
  logging_config {
    enable_components = ["SYSTEM_COMPONENTS", "WORKLOADS"]
  }

  monitoring_config {
    enable_components = ["SYSTEM_COMPONENTS"]
    managed_prometheus {
      enabled = true
    }
  }

  # Security features
  binary_authorization {
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
  }

  resource_labels = var.labels
}

# Node Pool
resource "google_container_node_pool" "primary_nodes" {
  name       = "${var.environment}-node-pool"
  location   = var.region
  cluster    = google_container_cluster.primary.name
  node_count = var.instance_count

  autoscaling {
    min_node_count = 1
    max_node_count = 10
  }

  management {
    auto_repair  = true
    auto_upgrade = true
  }

  node_config {
    preemptible  = false
    machine_type = "e2-standard-4"

    disk_size_gb = 100
    disk_type    = "pd-standard"

    # Google recommends custom service accounts with minimal permissions
    service_account = google_service_account.gke_nodes_sa.email
    oauth_scopes = [
      "https://www.googleapis.com/auth/cloud-platform"
    ]

    labels = var.labels

    metadata = {
      disable-legacy-endpoints = "true"
    }

    shielded_instance_config {
      enable_secure_boot          = true
      enable_integrity_monitoring = true
    }

    workload_metadata_config {
      mode = "GKE_METADATA"
    }
  }

  upgrade_settings {
    max_surge       = 1
    max_unavailable = 0
  }
}

# Cloud SQL Instance
resource "google_sql_database_instance" "postgres" {
  name             = "${var.environment}-postgres-instance"
  database_version = "POSTGRES_14"
  region           = var.region

  settings {
    tier              = "db-custom-2-7680"
    availability_type = "REGIONAL"
    disk_type         = "PD_SSD"
    disk_size         = 100
    disk_autoresize   = true

    backup_configuration {
      enabled                        = true
      point_in_time_recovery_enabled = true
      start_time                     = "02:00"
      transaction_log_retention_days = 7

      backup_retention_settings {
        retained_backups = 30
        retention_unit   = "COUNT"
      }
    }

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.vpc.id
      require_ssl     = true
    }

    maintenance_window {
      day          = 7  # Sunday
      hour         = 3
      update_track = "stable"
    }

    insights_config {
      query_insights_enabled  = true
      query_string_length     = 1024
      record_application_tags = true
      record_client_address   = true
    }

    database_flags {
      name  = "max_connections"
      value = "100"
    }

    database_flags {
      name  = "log_checkpoints"
      value = "on"
    }
  }

  deletion_protection = true
}

# Database
resource "google_sql_database" "database" {
  name     = "application_db"
  instance = google_sql_database_instance.postgres.name
}

# User
resource "google_sql_user" "app_user" {
  name     = "app_user"
  instance = google_sql_database_instance.postgres.name
  password = random_password.db_password.result
}

resource "random_password" "db_password" {
  length  = 32
  special = true
}

# Store password in Secret Manager
resource "google_secret_manager_secret" "db_password" {
  secret_id = "${var.environment}-db-password"

  replication {
    automatic = true
  }
}

resource "google_secret_manager_secret_version" "db_password_version" {
  secret      = google_secret_manager_secret.db_password.id
  secret_data = random_password.db_password.result
}

resource "google_storage_bucket" "data_bucket" {
  name          = "${var.project_id}-${var.environment}-data"
  location      = var.region
  storage_class = "STANDARD"

  uniform_bucket_level_access = true

  versioning {
    enabled = true
  }

  lifecycle_rule {
    condition {
      age = 30
    }
    action {
      type          = "SetStorageClass"
      storage_class = "NEARLINE"
    }
  }

  lifecycle_rule {
    condition {
      age = 90
    }
    action {
      type          = "SetStorageClass"
      storage_class = "COLDLINE"
    }
  }

  lifecycle_rule {
    condition {
      age = 365
    }
    action {
      type = "Delete"
    }
  }

  encryption {
    default_kms_key_name = google_kms_crypto_key.bucket_key.id
  }

  logging {
    log_bucket = google_storage_bucket.logs_bucket.name
  }

  labels = var.labels
}

# IAM binding for bucket
resource "google_storage_bucket_iam_member" "bucket_admin" {
  bucket = google_storage_bucket.data_bucket.name
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:${google_service_account.app_sa.email}"
}

terraform {
  backend "gcs" {
    bucket  = "my-terraform-state-bucket"
    prefix  = "terraform/state"

    # Optional: Enable encryption
    encryption_key = "your-kms-key"
  }
}

bucket  = "prod-terraform-state"
prefix  = "prod/network"

# GCS automatically provides state locking
# No additional configuration needed for basic locking

# To enable encryption and versioning
resource "google_storage_bucket" "terraform_state" {
  name          = "my-terraform-state"
  location      = "US"
  storage_class = "STANDARD"

  uniform_bucket_level_access = true

  versioning {
    enabled = true
  }

  lifecycle_rule {
    condition {
      num_newer_versions = 10
    }
    action {
      type = "Delete"
    }
  }

  encryption {
    default_kms_key_name = google_kms_crypto_key.terraform_key.id
  }
}

# Grant permissions
resource "google_storage_bucket_iam_member" "terraform_state" {
  bucket = google_storage_bucket.terraform_state.name
  role   = "roles/storage.objectAdmin"
  member = "serviceAccount:terraform@my-project.iam.gserviceaccount.com"
}

locals {
  environment = terraform.workspace

  # Environment-specific configurations
  instance_counts = {
    default    = 1
    dev        = 1
    staging    = 2
    production = 5
  }

  machine_types = {
    default    = "e2-micro"
    dev        = "e2-small"
    staging    = "e2-medium"
    production = "e2-standard-4"
  }
}

resource "google_compute_instance_template" "app" {
  name_prefix  = "${local.environment}-app-"
  machine_type = local.machine_types[local.environment]

  # ...
}

resource "google_compute_region_instance_group_manager" "app" {
  name       = "${local.environment}-app-mig"
  target_size = local.instance_counts[local.environment]

  # ...
}

# Workspace-specific state files
terraform {
  backend "gcs" {
    bucket = "terraform-state-bucket"
    prefix = "env/${terraform.workspace}"
  }
}

# Get latest image
data "google_compute_image" "debian" {
  family  = "debian-11"
  project = "debian-cloud"
}

# Get existing network
data "google_compute_network" "default" {
  name = "default"
}

# Get project information
data "google_project" "project" {
  project_id = var.project_id
}

# Get service account
data "google_service_account" "default" {
  account_id = "default-sa"
}

# Get secret from Secret Manager
data "google_secret_manager_secret_version" "db_password" {
  secret  = "database-password"
  version = "latest"
}

# Use data sources in resources
resource "google_compute_instance" "web" {
  name         = "web-server"
  machine_type = "e2-medium"

  boot_disk {
    initialize_params {
      image = data.google_compute_image.debian.self_link
    }
  }

  network_interface {
    network = data.google_compute_network.default.id
  }

  service_account {
    email  = data.google_service_account.default.email
    scopes = ["cloud-platform"]
  }

  metadata = {
    db_password = data.google_secret_manager_secret_version.db_password.secret_data
  }
}

resource "google_compute_instance" "web" {
  name         = "web-server"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      image = "projects/debian-cloud/global/images/family/debian-11"
    }
  }

  network_interface {
    network = google_compute_network.vpc.id
    access_config {}
  }

  metadata = {
    startup-script = file("${path.module}/scripts/startup.sh")

    # Or inline
    # startup-script = <<-EOF
    #   #!/bin/bash
    #   apt-get update
    #   apt-get install -y nginx
    # EOF

    # Custom metadata
    app-version = "v1.2.3"
    environment = "production"
  }

  metadata_startup_script = file("${path.module}/scripts/startup.sh")
}

variable "project_id" {
  type    = string
  default = "my-gcp-project"
}

variable "zone" {
  type    = string
  default = "us-central1-a"
}

variable "image_family" {
  type    = string
  default = "web-server"
}

source "googlecompute" "web_server" {
  project_id          = var.project_id
  zone                = var.zone
  source_image_family = "debian-11"
  ssh_username        = "packer"
  image_name          = "web-server-${formatdate("YYYY-MM-DD-hhmm", timestamp())}"
  image_family        = var.image_family
  image_description   = "Golden image for web servers"
  disk_size           = 20
  disk_type           = "pd-ssd"
  machine_type        = "e2-medium"

  labels = {
    environment = "production"
    created_by  = "packer"
  }

  tags = ["packer"]
}

build {
  sources = ["source.googlecompute.web_server"]

  provisioner "shell" {
    inline = [
      "sudo apt-get update",
      "sudo apt-get upgrade -y",
      "sudo apt-get install -y nginx docker.io git python3-pip google-cloud-ops-agent",
      "sudo systemctl enable nginx",
      "sudo systemctl enable docker",
      "sudo systemctl enable google-cloud-ops-agent"
    ]
  }

  provisioner "file" {
    sources     = ["files/nginx.conf", "files/app.conf"]
    destination = "/tmp/"
  }

  provisioner "shell" {
    scripts = [
      "scripts/configure-nginx.sh",
      "scripts/install-app.sh",
      "scripts/cleanup.sh"
    ]
  }

  provisioner "ansible" {
    playbook_file = "ansible/configure.yml"
    extra_arguments = [
      "--extra-vars",
      "environment=production"
    ]
  }

  post-processor "manifest" {
    output     = "manifest.json"
    strip_path = true
  }
}

variable "active_version" {
  description = "Active deployment version (blue or green)"
  type        = string
  default     = "blue"
}

locals {
  blue_weight  = var.active_version == "blue" ? 100 : 0
  green_weight = var.active_version == "green" ? 100 : 0
}

# Blue instance group
resource "google_compute_region_instance_group_manager" "blue" {
  name               = "app-mig-blue"
  base_instance_name = "app-blue"
  region             = var.region

  version {
    instance_template = google_compute_instance_template.blue.id
  }

  target_size = var.active_version == "blue" ? var.instance_count : 0
}

# Green instance group
resource "google_compute_region_instance_group_manager" "green" {
  name               = "app-mig-green"
  base_instance_name = "app-green"
  region             = var.region

  version {
    instance_template = google_compute_instance_template.green.id
  }

  target_size = var.active_version == "green" ? var.instance_count : 0
}

# Load balancer backend
resource "google_compute_backend_service" "app" {
  name = "app-backend"

  backend {
    group           = google_compute_region_instance_group_manager.blue.instance_group
    balancing_mode  = "UTILIZATION"
    capacity_scaler = local.blue_weight / 100
  }

  backend {
    group           = google_compute_region_instance_group_manager.green.instance_group
    balancing_mode  = "UTILIZATION"
    capacity_scaler = local.green_weight / 100
  }

  health_checks = [google_compute_health_check.app.id]
}

variable "canary_percentage" {
  description = "Percentage of traffic to route to canary"
  type        = number
  default     = 10
}

resource "google_compute_backend_service" "app" {
  name = "app-backend"

  # Stable version
  backend {
    group           = google_compute_region_instance_group_manager.stable.instance_group
    balancing_mode  = "UTILIZATION"
    capacity_scaler = (100 - var.canary_percentage) / 100
  }

  # Canary version
  backend {
    group           = google_compute_region_instance_group_manager.canary.instance_group
    balancing_mode  = "UTILIZATION"
    capacity_scaler = var.canary_percentage / 100
  }

  health_checks = [google_compute_health_check.app.id]
}