Skip to content

Instantly share code, notes, and snippets.

View firewall_bonus.tf
## Allow incoming access to our instance via
## port 22, from the IAP servers
resource "google_compute_firewall" "inbound-ip-ssh" {
name = "allow-incoming-access-from-iap"
project = var.project_id
network = "default"
direction = "INGRESS"
allow {
protocol = "tcp"
View iam_compute.tf
# Define the required roles to access the VM
locals {
compute_roles = [
"roles/compute.viewer",
"roles/compute.osLogin",
]
}
# Apply the roles to a user account
resource "google_project_iam_member" "assign-roles" {
View iam.tf
# Create a conditional IAM rule that grants access to establish an IAP tunnel
# IF the user is connecting from an authorised network defined in the access
# list
resource "google_iap_tunnel_iam_member" "allow-remote-access-to-iap" {
project = "<your-project-id>"
role = "roles/iap.tunnelResourceAccessor"
member = "user:calum.hunter@the.cloud"
condition {
title = "allow_remote_access_to_iap"
View access_level.tf
# Creates an Access Level
# This access level will be used in
# a conditional IAM policy to restrict access
# to authorised users coming from authorised networks
resource "google_access_context_manager_access_level" "access-level" {
parent = "accessPolicies/<access-policy-id>"
name = "accessPolicies/<access-policy-id>/accessLevels/<my_access_level_name>"
title = "secure-iap-access-level"
description = "This access level lists the authorised network addresses"
View firewall.tf
## Allow incoming access to our instance via
## port 22, from the IAP servers
resource "google_compute_firewall" "inbound-ip-ssh" {
name = "allow-incoming-ssh-from-iap"
project = var.project_id
network = "default"
direction = "INGRESS"
allow {
protocol = "tcp"
View vm.tf
# Create an instance
resource "google_compute_instance" "my-instance" {
project = var.project_id
name = "my-instance-01"
machine_type = "e2-standard-2"
zone = var.zone
boot_disk {
initialize_params {
image = "debian-cloud/debian-9"
View gist:6ea1c80d31568dcd114367e864c3f3f1
// Manage DNS
// Create a private route53 zone
resource "aws_route53_zone" "this" {
name = "${var.dns_zone_name}"
vpc_id = "${var.vpc_id}"
}
// Create a dns record for the jenkins master private ip
resource "aws_route53_record" "master" {
zone_id = "${aws_route53_zone.this.id}"
View k8s_notes.md

K8s notes

Cluster basics

Master

provides an API, Scheduler, UI, controller and a KV store, all information and state is stored in -> etcd

control plane

Worker Nodes

View gist:866487f370bed4e6e0bf1bc2157b8a14
# define the network interfaces in a count block for the vm's you want to assign them to
resource "azurerm_network_interface" "network-interface" {
name = "interface-number-${count.index}"
count = 3
# ...
}
# The above resource will generate three network interfaces
@calum-github
calum-github / get_ami_codes.sh
Last active Sep 27, 2018
Get a list of AWS AMI codes for CentOS 7 Linux
View get_ami_codes.sh
#!/bin/bash
# Get latest AMI codes for CentOS 7 from AWS
region="ap-southeast-2"
product_code="aw0evgkw8e5c1q413zgy5pjce"
aws ec2 describe-images \
--region "$region" \
--owners aws-marketplace \