Add bastion host.

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-networks/networks/bastion.tf

@@ -0,0 +1,57 @@
+# Copyright 2020 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# $ gcloud compute ssh bastion-vm --zone=<var.zone> --project=<var.project_id>
+# $ mysql -h <sql_internal_ip> -u root
+module "bastion" {
+  source = "terraform-google-modules/bastion-host/google"
+
+  name           = "bastion-vm"
+  host_project   = var.project_id
+  project        = var.project_id
+  region         = var.region
+  zone           = var.zone
+  network        = module.private.network_self_link
+  subnet         = module.private.subnets["${var.region}/${local.bastion_subnet_name}"].self_link
+  image_family   = "ubuntu-1804-lts"
+  members        = var.bastion_users
+  startup_script = <<EOF
+#!/bin/bash
+dpkg -l mysql-client-core-5.7
+if [ $? -eq 0 ]; then
+  echo "mysql-client already installed"
+else
+  sudo apt-get -y update
+  sudo apt-get -y install mysql-client-core-5.7
+fi
+EOF
+}
+
+# NAT to allow bastion-VM to connect to the Internet to install `mysql-client-core-5.7`.
+module "bastion_router" {
+  source  = "terraform-google-modules/cloud-router/google"
+  name    = "bastion-router"
+  region  = var.region
+  project = var.project_id
+  network = module.private.network_name
+  nats = [{
+    name                               = "bastion-nat"
+    source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
+    subnetworks = [{
+      name                     = module.private.subnets["${var.region}/${local.bastion_subnet_name}"].self_link
+      source_ip_ranges_to_nat  = ["PRIMARY_IP_RANGE"]
+      secondary_ip_range_names = []
+    }]
+  }]
+}

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-networks/networks/main.tf

@@ -4,21 +4,33 @@ terraform {
 
 locals {
   gke_clusters_subnet_name = "gke-clusters-subnet"
+  bastion_subnet_name      = "bastion-subnet"
 }
 
 module "private" {
   source  = "terraform-google-modules/network/google"
-  version = "~> 2.0"
+  version = "~> 2.2"
 
   project_id   = var.project_id
   network_name = "private"
 
-  # Multiple clusters can be in the same network and subnet.
   subnets = [
     {
-      subnet_name      = local.gke_clusters_subnet_name
+      # Multiple clusters can be in the same network and subnet.
+      subnet_name = local.gke_clusters_subnet_name
+      # 10.0.0.0 --> 10.0.127.255
       subnet_ip        = "10.0.0.0/17"
-      subnet_region    = var.gke_region
+      subnet_region    = var.region
+      subnet_flow_logs = "true"
+
+      # Needed for access to Cloud SQL.
+      subnet_private_access = "true"
+    },
+    {
+      subnet_name = local.bastion_subnet_name
+      # 10.0.128.0 --> 10.0.128.255
+      subnet_ip        = "10.0.128.0/24"
+      subnet_region    = var.region
       subnet_flow_logs = "true"
 
       # Needed for access to Cloud SQL.

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-networks/networks/shared_vpc.tf

@@ -11,7 +11,7 @@ resource "google_compute_shared_vpc_service_project" "service_projects" {
 locals {
   gke_service_projects          = [for p in var.service_projects : p if p.has_gke]
   gke_service_project_id_to_num = { for p in local.gke_service_projects : p.id => p.num }
-  gke_subnet                    = module.private.subnets["${var.gke_region}/${local.gke_clusters_subnet_name}"]
+  gke_subnet                    = module.private.subnets["${var.region}/${local.gke_clusters_subnet_name}"]
 }
 
 resource "google_project_iam_member" "k8s_host_service_agent_users" {
@@ -29,7 +29,6 @@ resource "google_compute_subnetwork_iam_member" "k8s_network_users" {
   member     = "serviceAccount:service-${each.value}@container-engine-robot.iam.gserviceaccount.com"
 }
 
-
 resource "google_compute_subnetwork_iam_member" "google_apis_network_users" {
   for_each   = local.gke_service_project_id_to_num
   subnetwork = local.gke_subnet.id

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-networks/networks/terraform.tfvars

@@ -1,3 +1,7 @@
 project_id       = "heroes-hat-dev-networks"
-gke_region       = "us-east1"
+region           = "us-east1"
+zone             = "us-east1-b"
 gke_network_name = "heroes-hat-dev-apps-network"
+bastion_users = [
+  "group:rocketturtle-gcp-admin@rocketturtle.net",
+]

Terraform/org/folder.fda-my-studies/project.heroes-hat-dev-networks/networks/variables.tf

@@ -2,8 +2,13 @@ variable "project_id" {
   type = string
 }
 
-variable "gke_region" {
-  description = "The region where the network and subnets will be created for the GKE clusters"
+variable "region" {
+  description = "The region where the network and subnets will be created for the GKE clusters and bastion host"
+  type        = string
+}
+
+variable "zone" {
+  description = "The zone where to create the bastion host"
   type        = string
 }
 
@@ -19,3 +24,8 @@ variable "service_projects" {
     has_gke : bool
   }))
 }
+
+variable "bastion_users" {
+  description = "List of IAM resources to allow access to the bastion VM instance"
+  default     = []
+}