x-yuri

Cloud SQL and private IPs (Incorrect Service Networking config for instance: PROJECT_ID:test-sql:SERVICE_NETWORKING_NOT_ENABLED)

main.tf:

provider "google" {
  project = "PROJECT_ID"
}

x-yuri

google_sql_user and type = "CLOUD_IAM_SERVICE_ACCOUNT"

main.tf:

provider "google" {
  project = "PROJECT_ID"
}

resource "google_sql_database_instance" "test-sql" {

x-yuri

GKE and Cloud SQL

main.tf:

provider "google" {
  project = "PROJECT_ID"
}

data "google_project" "project" {}

x-yuri

GCP: replacing the main network interface with a bridge

The terraform file and the first commands can be found here.

# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever

x-yuri

GKE: endpoint publicity

Access to cluster endpoints
Creating a private cluster

main.tf

provider "google" {
  project = "PROJECT_ID"

x-yuri

terraform creates VMs without an account

main.tf:

provider "google" {
  project = "PROJECT_ID"
}

resource "google_compute_instance" "test-ce" {

x-yuri

GCE: OS Login access permissions

main.tf:

provider "google" {
  project = "PROJECT_ID"
}

data "google_project" "project" {}

x-yuri

GCE: metadata-managed access permissions

main.tf:

provider "google" {
  project = "PROJECT_ID"
}

data "google_project" "project" {}

x-yuri

GCE: make gcloud compute ssh use instance metadata

main.tf:

provider "google" {
  project = "PROJECT_ID"
}

resource "google_compute_instance" "test-ce" {

x-yuri

GCE: IAP

main.tf:

provider "google" {
  project = "PROJECT_ID"
}

resource "google_compute_instance" "test-ce" {