Chore/add cd

.github/workflows/iac-scheduled.yml

@@ -0,0 +1,38 @@
+name: Terraform Scheduled Workflow
+
+# Usually on-merge to main you would apply the changes that were modified.
+# This is just a simple example of the TF that can be created or destroyed on schedule or manually.
+
+on:
+  workflow_dispatch:
+    inputs:
+      action:
+        description: 'Create or Destroy'
+        required: true
+        default: 'null'
+        type: choice
+        options:
+        - apply
+        - destroy
+
+jobs:
+  terraform-apply-or-destroy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Install Terraform
+        uses: hashicorp/setup-terraform@v1
+
+      - name: Terraform init
+        working-directory: iac
+        run: terraform init
+        env:
+          GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
+
+      - name: Terraform ${{ inputs.action }}
+        working-directory: iac
+        run: terraform ${{ inputs.action }} -auto-approve
+        env:
+          GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}

.gitignore

@@ -53,3 +53,47 @@ Thumbs.db
 *.flv
 *.mov
 *.wmv
+
+# Secret key for local TF apply
+**google_sa_key.json
+
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Ignore provider binaries
+./iac/.terraform/provders/*
+
+# Ignore any "sa_key" files
+*sa_key.json

README.md

@@ -49,7 +49,9 @@ Hopefully this makes it easier to follow the path I have taken. I have also outl
    - [ ] Register the service with the Artifact Database
 
 3. CD (Continuous Delivery): Deploying the Applications
-   - [ ] Establish some baseline/basic IaC for environments
+   - [X] Establish some baseline/basic IaC for environments
+           - Created a very basic development environment using a Google Kubernetes Engine cluster in Autopilot mode. Leveraged my personal project (artifact-flow) using the free tier in us-west-1 for both the bucket for TF state and the cluster itself. Added a very basic github workflow for the creation and destruction of the infrastructure via CI. Usually this infrastructure wouldn't be within this repository and on-merge of the separate IaC repository the TF would be planned and applied automatically.
+           - https://github.com/johnrwatson/si-assessment-ie3/pull/6
    - [ ] Automatic validation environment for development branches
    - [ ] Development environment establishment with Artifact metadata validation
 

iac/gcs-state.tf.bkp

@@ -0,0 +1,19 @@
+# ---------------------------------------------------
+# This is the gcs bucket with the state in it for terraform
+# DO NOT DELETE THIS
+# ---------------------------------------------------
+resource "google_storage_bucket" "default" {
+  name          = "si-assessment-ie3-tfstate"
+  force_destroy = false
+  location      = "US"
+  storage_class = "STANDARD"
+  versioning {
+    enabled = true
+  }
+  labels = {
+    "product"     = "si-assessment",
+    "environment" = "development",
+    "terraform"   = "true",
+  }
+}
+# ---------------------------------------------------

iac/gke.tf

@@ -0,0 +1,32 @@
+resource "google_container_cluster" "k8s" {
+  provider   = google
+  name       = "si-assessment-ie3"
+  location   = "us-west1"
+  network    = google_compute_network.vpc_network.self_link
+  subnetwork = google_compute_subnetwork.public_subnet.self_link
+
+  resource_labels = {
+    "product"     = "si-assessment-ie3",
+    "environment" = "development",
+    "terraform"   = "true",
+  }
+
+  logging_service    = "logging.googleapis.com/kubernetes"
+  monitoring_service = "monitoring.googleapis.com/kubernetes"
+
+  # Enable Autopilot for this cluster
+  enable_autopilot = true
+
+  # Configuration options for the Release channel feature, which provide more control over automatic upgrades of your GKE clusters.
+  release_channel {
+    channel = "REGULAR"
+  }
+  ip_allocation_policy {}
+  maintenance_policy {
+    recurring_window {
+      end_time   = "1970-01-01T20:00:00Z"
+      recurrence = "FREQ=WEEKLY;BYDAY=SU"
+      start_time = "1970-01-01T08:00:00Z"
+    }
+  }
+}

iac/main.tf

@@ -0,0 +1,14 @@
+#export GOOGLE_APPLICATION_CREDENTIALS={{path}}
+
+provider "google" {
+  project = "artifact-flow"
+  region  = "us-west1"
+  zone    = "us-west1-c"
+}
+
+terraform {
+  backend "gcs" {
+    bucket = "si-assessment-ie3-platform-tfstate"
+    prefix = "terraform/state"
+  }
+}

iac/vpc.tf

@@ -0,0 +1,34 @@
+# VPC network
+resource "google_compute_network" "vpc_network" {
+  name                    = "si-assessment-ie3"
+  auto_create_subnetworks = false
+}
+
+# Public subnet
+resource "google_compute_subnetwork" "public_subnet" {
+  name          = "si-assessment-ie3-public"
+  region        = "us-west1"
+  network       = google_compute_network.vpc_network.self_link
+  ip_cidr_range = "10.0.1.0/24"
+}
+
+# Private subnet
+resource "google_compute_subnetwork" "private_subnet" {
+  name          = "si-assessment-ie3-private"
+  region        = "us-west1"
+  network       = google_compute_network.vpc_network.self_link
+  ip_cidr_range = "10.0.2.0/24"
+}
+
+# Firewall rule for allowing SSH access to instances in the public subnet
+resource "google_compute_firewall" "public_subnet_firewall" {
+  name          = "si-assessment-ie3-public-subnet-firewall"
+  network       = google_compute_network.vpc_network.self_link
+  source_ranges = ["213.31.7.48/32"] # Replace with your desired IP range
+  target_tags   = ["si-assessment-ie3-public-subnet"]
+
+  allow {
+    protocol = "tcp"
+    ports    = ["0-65535"]
+  }
+}