Gcp (#1)

* GCP network

* Add worker templates

* Region group

* Cosmetic

* GCP nat for workers

* Network

* Google services

* Deploy talos

gcp-zonal/.gitignore

@@ -0,0 +1,6 @@
+#
+_cfgs/
+templates/controlplane.yaml
+*.patch
+#
+gcloud.json

gcp-zonal/Makefile

@@ -0,0 +1,29 @@
+
+create-lb:
+	terraform init
+	terraform apply -auto-approve -target=google_compute_address.api
+
+create-config:
+	talosctl gen config --output-dir _cfgs --with-docs=false --with-examples=false talos-k8s-hezner https://127.0.0.1:6443
+
+create-templates:
+	@yq ea -P '. as $$item ireduce ({}; . * $$item )' _cfgs/controlplane.yaml templates/controlplane.yaml.tpl > templates/controlplane.yaml
+	@echo 'podSubnets: "10.32.0.0/12"'        > _cfgs/tfstate.vars
+	@echo 'serviceSubnets: "10.200.0.0/22"'  >> _cfgs/tfstate.vars
+	@yq eval '.cluster.network.dnsDomain' _cfgs/init.yaml | awk '{ print "domain: "$$1}'       >> _cfgs/tfstate.vars
+	@yq eval '.cluster.clusterName' _cfgs/init.yaml       | awk '{ print "cluster_name: "$$1}' >> _cfgs/tfstate.vars
+	@yq eval '.machine.token'  _cfgs/init.yaml            | awk '{ print "tokenmachine: "$$1}' >> _cfgs/tfstate.vars
+	@yq eval '.cluster.token'  _cfgs/init.yaml            | awk '{ print "token: "$$1}'        >> _cfgs/tfstate.vars
+	@yq eval '.cluster.ca.crt' _cfgs/init.yaml            | awk '{ print "ca: "$$1}'           >> _cfgs/tfstate.vars
+
+	@yq eval -j '{"kubernetes": .}' _cfgs/tfstate.vars > terraform.tfvars.json
+
+create-controlplane:
+	terraform apply -target=null_resource.controlplane
+
+create-infrastructure:
+	cd modules/worker && terraform init
+	terraform apply
+
+templates-update:
+	helm template --namespace=kube-system   --version=1.10.3  -f deployments/cilium.yaml cilium cilium/cilium > deployments/cilium_result.yaml

gcp-zonal/auth.tf

@@ -0,0 +1,14 @@
+
+provider "google" {
+  project     = var.project_id
+  region      = var.region
+  credentials = "gcloud.json"
+}
+
+provider "google-beta" {
+  project     = var.project_id
+  region      = var.region
+  credentials = "gcloud.json"
+}
+
+data "google_client_config" "default" {}

gcp-zonal/common.tf

@@ -0,0 +1,29 @@
+
+data "google_client_openid_userinfo" "terraform" {}
+
+resource "google_os_login_ssh_public_key" "terraform" {
+  project = var.project_id
+  user    = data.google_client_openid_userinfo.terraform.email
+  key     = file("~/.ssh/terraform.pub")
+}
+
+# resource "google_compute_image" "talos" {
+#   name        = "talos"
+#   description = "Talos v0.11.3"
+
+#   raw_disk {
+#     source = "https://github.com/talos-systems/talos/releases/download/v0.11.3/gcp-amd64.tar.gz"
+#   }
+
+#   guest_os_features {
+#     type = "VIRTIO_SCSI_MULTIQUEUE"
+#   }
+#   guest_os_features {
+#     type = "MULTI_IP_SUBNET"
+#   }
+# }
+
+data "google_compute_image" "talos" {
+  project = var.project_id
+  family  = "talos"
+}

gcp-zonal/database.tf

@@ -0,0 +1,49 @@
+
+
+# resource "random_id" "db_name" {
+#   byte_length = 4
+# }
+
+# resource "google_sql_database_instance" "default" {
+#   project             = var.project_id
+#   name                = "${var.cluster_name}-db-${random_id.db_name.hex}"
+#   database_version    = "POSTGRES_12"
+#   region              = var.region
+#   deletion_protection = false
+
+#   settings {
+#     tier = "db-f1-micro"
+#     # availability_type = "REGIONAL"
+
+#     disk_size = 10
+#     disk_type = "PD_HDD"
+
+#     ip_configuration {
+#       ipv4_enabled    = false
+#       private_network = google_compute_network.network.id
+#       require_ssl     = true
+#     }
+
+#     backup_configuration {
+#       enabled = false
+#     }
+
+#     location_preference {
+#       zone = var.zones[0]
+#     }
+#   }
+
+#   timeouts {
+#     create = "15m"
+#     update = "15m"
+#     delete = "15m"
+#   }
+
+#   lifecycle {
+#     ignore_changes = [
+#       settings[0].disk_size
+#     ]
+#   }
+
+#   depends_on = [google_service_networking_connection.private_vpc_connection]
+# }

gcp-zonal/deployments/cilium.yaml

@@ -0,0 +1,60 @@
+---
+
+k8sServiceHost: "172.16.0.231"
+k8sServicePort: "6443"
+
+agent:
+  enabled: true
+
+operator:
+  enabled: true
+  replicas: 1
+  prometheus:
+    enabled: false
+
+identityAllocationMode: crd
+
+cni:
+  install: true
+
+ipam:
+  mode: "kubernetes"
+
+tunnel: "vxlan"
+autoDirectNodeRoutes: false
+
+hostFirewall: true
+kubeProxyReplacement: strict
+
+healthChecking: true
+
+ipv4:
+  enabled: true
+ipv6:
+  enabled: false
+hostServices:
+  enabled: false
+hostPort:
+  enabled: true
+nodePort:
+  enabled: false
+externalIPs:
+  enabled: true
+
+k8s:
+  requireIPv4PodCIDR: true
+  requireIPv6PodCIDR: false
+
+prometheus:
+  enabled: true
+
+encryption:
+  enabled: false
+
+resources:
+  # limits:
+  #   cpu: 4000m
+  #   memory: 4Gi
+  requests:
+    cpu: 100m
+    memory: 128Mi

gcp-zonal/deployments/cilium_result.yaml

@@ -0,0 +1,844 @@
+---
+# Source: cilium/templates/cilium-agent-serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "cilium"
+  namespace: kube-system
+---
+# Source: cilium/templates/cilium-operator-serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: "cilium-operator"
+  namespace: kube-system
+---
+# Source: cilium/templates/cilium-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cilium-config
+  namespace: kube-system
+data:
+
+  # Identity allocation mode selects how identities are shared between cilium
+  # nodes by setting how they are stored. The options are "crd" or "kvstore".
+  # - "crd" stores identities in kubernetes as CRDs (custom resource definition).
+  #   These can be queried with:
+  #     kubectl get ciliumid
+  # - "kvstore" stores identities in a kvstore, etcd or consul, that is
+  #   configured below. Cilium versions before 1.6 supported only the kvstore
+  #   backend. Upgrades from these older cilium versions should continue using
+  #   the kvstore by commenting out the identity-allocation-mode below, or
+  #   setting it to "kvstore".
+  identity-allocation-mode: crd
+  cilium-endpoint-gc-interval: "5m0s"
+
+  # If you want to run cilium in debug mode change this value to true
+  debug: "false"
+  # The agent can be put into the following three policy enforcement modes
+  # default, always and never.
+  # https://docs.cilium.io/en/latest/policy/intro/#policy-enforcement-modes
+  enable-policy: "default"
+  # If you want metrics enabled in all of your Cilium agents, set the port for
+  # which the Cilium agents will have their metrics exposed.
+  # This option deprecates the "prometheus-serve-addr" in the
+  # "cilium-metrics-config" ConfigMap
+  # NOTE that this will open the port on ALL nodes where Cilium pods are
+  # scheduled.
+  prometheus-serve-addr: ":9090"
+  # Port to expose Envoy metrics (e.g. "9095"). Envoy metrics listener will be disabled if this
+  # field is not set.
+  proxy-prometheus-port: "9095"
+
+  # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4
+  # address.
+  enable-ipv4: "true"
+
+  # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6
+  # address.
+  enable-ipv6: "false"
+  # Users who wish to specify their own custom CNI configuration file must set
+  # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration.
+  custom-cni-conf: "false"
+  enable-bpf-clock-probe: "true"
+  # If you want cilium monitor to aggregate tracing for packets, set this level
+  # to "low", "medium", or "maximum". The higher the level, the less packets
+  # that will be seen in monitor output.
+  monitor-aggregation: medium
+
+  # The monitor aggregation interval governs the typical time between monitor
+  # notification events for each allowed connection.
+  #
+  # Only effective when monitor aggregation is set to "medium" or higher.
+  monitor-aggregation-interval: 5s
+
+  # The monitor aggregation flags determine which TCP flags which, upon the
+  # first observation, cause monitor notifications to be generated.
+  #
+  # Only effective when monitor aggregation is set to "medium" or higher.
+  monitor-aggregation-flags: all
+  # Specifies the ratio (0.0-1.0) of total system memory to use for dynamic
+  # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
+  bpf-map-dynamic-size-ratio: "0.0025"
+  # bpf-policy-map-max specifies the maximum number of entries in endpoint
+  # policy map (per endpoint)
+  bpf-policy-map-max: "16384"
+  # bpf-lb-map-max specifies the maximum number of entries in bpf lb service,
+  # backend and affinity maps.
+  bpf-lb-map-max: "65536"
+  # bpf-lb-bypass-fib-lookup instructs Cilium to enable the FIB lookup bypass
+  # optimization for nodeport reverse NAT handling.
+  bpf-lb-external-clusterip: "false"
+
+  # Pre-allocation of map entries allows per-packet latency to be reduced, at
+  # the expense of up-front memory allocation for the entries in the maps. The
+  # default value below will minimize memory usage in the default installation;
+  # users who are sensitive to latency may consider setting this to "true".
+  #
+  # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore
+  # this option and behave as though it is set to "true".
+  #
+  # If this value is modified, then during the next Cilium startup the restore
+  # of existing endpoints and tracking of ongoing connections may be disrupted.
+  # As a result, reply packets may be dropped and the load-balancing decisions
+  # for established connections may change.
+  #
+  # If this option is set to "false" during an upgrade from 1.3 or earlier to
+  # 1.4 or later, then it may cause one-time disruptions during the upgrade.
+  preallocate-bpf-maps: "false"
+
+  # Regular expression matching compatible Istio sidecar istio-proxy
+  # container image names
+  sidecar-istio-proxy-image: "cilium/istio_proxy"
+
+  # Name of the cluster. Only relevant when building a mesh of clusters.
+  cluster-name: default
+  # Unique ID of the cluster. Must be unique across all conneted clusters and
+  # in the range of 1 and 255. Only relevant when building a mesh of clusters.
+  cluster-id: ""
+
+  # Encapsulation mode for communication between nodes
+  # Possible values:
+  #   - disabled
+  #   - vxlan (default)
+  #   - geneve
+  tunnel: vxlan
+  # Enables L7 proxy for L7 policy enforcement and visibility
+  enable-l7-proxy: "true"
+
+  # wait-bpf-mount makes init container wait until bpf filesystem is mounted
+  wait-bpf-mount: "false"
+
+  enable-ipv4-masquerade: "true"
+  enable-ipv6-masquerade: "true"
+  enable-bpf-masquerade: "true"
+
+  enable-xt-socket-fallback: "true"
+  install-iptables-rules: "true"
+  install-no-conntrack-iptables-rules: "false"
+
+  auto-direct-node-routes: "false"
+  enable-bandwidth-manager: "false"
+  enable-local-redirect-policy: "false"
+  enable-host-firewall: "true"
+
+  kube-proxy-replacement:  "strict"
+  kube-proxy-replacement-healthz-bind-address: ""
+  enable-health-check-nodeport: "true"
+  node-port-bind-protection: "true"
+  enable-auto-protect-node-port-range: "true"
+  enable-session-affinity: "true"
+  k8s-require-ipv4-pod-cidr: "true"
+  k8s-require-ipv6-pod-cidr: "false"
+  enable-endpoint-health-checking: "true"
+  enable-health-checking: "true"
+  enable-well-known-identities: "false"
+  enable-remote-node-identity: "true"
+  operator-api-serve-addr: "127.0.0.1:9234"
+  # Enable Hubble gRPC service.
+  enable-hubble: "true"
+  # UNIX domain socket for Hubble server to listen to.
+  hubble-socket-path:  "/var/run/cilium/hubble.sock"
+  # An additional address for Hubble server to listen to (e.g. ":4244").
+  hubble-listen-address: ":4244"
+  hubble-disable-tls: "false"
+  hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt
+  hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key
+  hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt
+  ipam: "kubernetes"
+  disable-cnp-status-updates: "true"
+  cgroup-root: "/run/cilium/cgroupv2"
+---
+# Source: cilium/templates/cilium-agent-clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cilium
+rules:
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  - services
+  - nodes
+  - endpoints
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/finalizers
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - delete
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  - nodes/status
+  verbs:
+  - patch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  # Deprecated for removal in v1.10
+  - create
+  - list
+  - watch
+  - update
+
+  # This is used when validating policies in preflight. This will need to stay
+  # until we figure out how to avoid "get" inside the preflight, and then
+  # should be removed ideally.
+  - get
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumnetworkpolicies
+  - ciliumnetworkpolicies/status
+  - ciliumnetworkpolicies/finalizers
+  - ciliumclusterwidenetworkpolicies
+  - ciliumclusterwidenetworkpolicies/status
+  - ciliumclusterwidenetworkpolicies/finalizers
+  - ciliumendpoints
+  - ciliumendpoints/status
+  - ciliumendpoints/finalizers
+  - ciliumnodes
+  - ciliumnodes/status
+  - ciliumnodes/finalizers
+  - ciliumidentities
+  - ciliumidentities/finalizers
+  - ciliumlocalredirectpolicies
+  - ciliumlocalredirectpolicies/status
+  - ciliumlocalredirectpolicies/finalizers
+  - ciliumegressnatpolicies
+  verbs:
+  - '*'
+---
+# Source: cilium/templates/cilium-operator-clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cilium-operator
+rules:
+- apiGroups:
+  - ""
+  resources:
+  # to automatically delete [core|kube]dns pods so that are starting to being
+  # managed by Cilium
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+  - delete
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  # to perform LB IP allocation for BGP
+  - services/status
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  # to perform the translation of a CNP that contains `ToGroup` to its endpoints
+  - services
+  - endpoints
+  # to check apiserver connectivity
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - cilium.io
+  resources:
+  - ciliumnetworkpolicies
+  - ciliumnetworkpolicies/status
+  - ciliumnetworkpolicies/finalizers
+  - ciliumclusterwidenetworkpolicies
+  - ciliumclusterwidenetworkpolicies/status
+  - ciliumclusterwidenetworkpolicies/finalizers
+  - ciliumendpoints
+  - ciliumendpoints/status
+  - ciliumendpoints/finalizers
+  - ciliumnodes
+  - ciliumnodes/status
+  - ciliumnodes/finalizers
+  - ciliumidentities
+  - ciliumidentities/status
+  - ciliumidentities/finalizers
+  - ciliumlocalredirectpolicies
+  - ciliumlocalredirectpolicies/status
+  - ciliumlocalredirectpolicies/finalizers
+  verbs:
+  - '*'
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - create
+  - get
+  - list
+  - update
+  - watch
+# For cilium-operator running in HA mode.
+#
+# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election
+# between multiple running instances.
+# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less
+# common and fewer objects in the cluster watch "all Leases".
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - update
+---
+# Source: cilium/templates/cilium-agent-clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cilium
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cilium
+subjects:
+- kind: ServiceAccount
+  name: "cilium"
+  namespace: kube-system
+---
+# Source: cilium/templates/cilium-operator-clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cilium-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cilium-operator
+subjects:
+- kind: ServiceAccount
+  name: "cilium-operator"
+  namespace: kube-system
+---
+# Source: cilium/templates/cilium-agent-service.yaml
+kind: Service
+apiVersion: v1
+metadata:
+  name: cilium-agent
+  namespace: kube-system
+  annotations:
+    prometheus.io/scrape: 'true'
+    prometheus.io/port: "9095"
+  labels:
+    k8s-app: cilium
+spec:
+  clusterIP: None
+  type: ClusterIP
+  ports:
+  - name: envoy-metrics
+    port: 9095
+    protocol: TCP
+    targetPort: envoy-metrics
+  selector:
+    k8s-app: cilium
+---
+# Source: cilium/templates/cilium-agent-daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    k8s-app: cilium
+  name: cilium
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      k8s-app: cilium
+  updateStrategy:
+    rollingUpdate:
+      maxUnavailable: 2
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        prometheus.io/port: "9090"
+        prometheus.io/scrape: "true"
+        # This annotation plus the CriticalAddonsOnly toleration makes
+        # cilium to be a critical pod in the cluster, which ensures cilium
+        # gets priority scheduling.
+        # https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/
+        scheduler.alpha.kubernetes.io/critical-pod: ""
+      labels:
+        k8s-app: cilium
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/os
+                operator: In
+                values:
+                - linux
+            - matchExpressions:
+              - key: beta.kubernetes.io/os
+                operator: In
+                values:
+                - linux
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: k8s-app
+                operator: In
+                values:
+                - cilium
+            topologyKey: kubernetes.io/hostname
+      containers:
+      - args:
+        - --config-dir=/tmp/cilium/config-map
+        command:
+        - cilium-agent
+        startupProbe:
+          httpGet:
+            host: '127.0.0.1'
+            path: /healthz
+            port: 9876
+            scheme: HTTP
+            httpHeaders:
+            - name: "brief"
+              value: "true"
+          failureThreshold: 105
+          periodSeconds: 2
+          successThreshold: 1
+        livenessProbe:
+          httpGet:
+            host: '127.0.0.1'
+            path: /healthz
+            port: 9876
+            scheme: HTTP
+            httpHeaders:
+            - name: "brief"
+              value: "true"
+          failureThreshold: 10
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 5
+        readinessProbe:
+          httpGet:
+            host: '127.0.0.1'
+            path: /healthz
+            port: 9876
+            scheme: HTTP
+            httpHeaders:
+            - name: "brief"
+              value: "true"
+          failureThreshold: 3
+          periodSeconds: 30
+          successThreshold: 1
+          timeoutSeconds: 5
+        env:
+        - name: K8S_NODE_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: spec.nodeName
+        - name: CILIUM_K8S_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: CILIUM_CLUSTERMESH_CONFIG
+          value: /var/lib/cilium/clustermesh/
+        - name: CILIUM_CNI_CHAINING_MODE
+          valueFrom:
+            configMapKeyRef:
+              key: cni-chaining-mode
+              name: cilium-config
+              optional: true
+        - name: CILIUM_CUSTOM_CNI_CONF
+          valueFrom:
+            configMapKeyRef:
+              key: custom-cni-conf
+              name: cilium-config
+              optional: true
+        - name: KUBERNETES_SERVICE_HOST
+          value: "172.16.0.231"
+        - name: KUBERNETES_SERVICE_PORT
+          value: "6443"
+        image: "quay.io/cilium/cilium:v1.10.3@sha256:8419531c5d3677158802882bdfe2297915c43f2ebe3649551aaac22de9f6d565"
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          postStart:
+            exec:
+              command:
+              - "/cni-install.sh"
+              - "--enable-debug=false"
+              - "--cni-exclusive=true"
+          preStop:
+            exec:
+              command:
+              - /cni-uninstall.sh
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        name: cilium-agent
+        ports:
+        - containerPort: 9090
+          hostPort: 9090
+          name: prometheus
+          protocol: TCP          
+        - containerPort: 9095
+          hostPort: 9095
+          name: envoy-metrics
+          protocol: TCP
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+            - SYS_MODULE
+          privileged: true
+        volumeMounts:
+        - mountPath: /sys/fs/bpf
+          name: bpf-maps
+        - mountPath: /var/run/cilium
+          name: cilium-run
+        - mountPath: /host/opt/cni/bin
+          name: cni-path
+        - mountPath: /host/etc/cni/net.d
+          name: etc-cni-netd
+        - mountPath: /var/lib/cilium/clustermesh
+          name: clustermesh-secrets
+          readOnly: true
+        - mountPath: /tmp/cilium/config-map
+          name: cilium-config-path
+          readOnly: true
+          # Needed to be able to load kernel modules
+        - mountPath: /lib/modules
+          name: lib-modules
+          readOnly: true
+        - mountPath: /run/xtables.lock
+          name: xtables-lock
+        - mountPath: /var/lib/cilium/tls/hubble
+          name: hubble-tls
+          readOnly: true
+      hostNetwork: true
+      initContainers:
+      # Required to mount cgroup2 filesystem on the underlying Kubernetes node.
+      # We use nsenter command with host's cgroup and mount namespaces enabled.
+      - name: mount-cgroup
+        env:
+          - name: CGROUP_ROOT
+            value: /run/cilium/cgroupv2
+          - name: BIN_PATH
+            value: /opt/cni/bin
+        command:
+          - sh
+          - -c
+          # The statically linked Go program binary is invoked to avoid any
+          # dependency on utilities like sh and mount that can be missing on certain
+          # distros installed on the underlying host. Copy the binary to the
+          # same directory where we install cilium cni plugin so that exec permissions
+          # are available.
+          - 'cp /usr/bin/cilium-mount /hostbin/cilium-mount && nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT; rm /hostbin/cilium-mount'
+        image: "quay.io/cilium/cilium:v1.10.3@sha256:8419531c5d3677158802882bdfe2297915c43f2ebe3649551aaac22de9f6d565"
+        imagePullPolicy: IfNotPresent
+        volumeMounts:
+          - mountPath: /hostproc
+            name: hostproc
+          - mountPath: /hostbin
+            name: cni-path
+        securityContext:
+          privileged: true
+      - command:
+        - /init-container.sh
+        env:
+        - name: CILIUM_ALL_STATE
+          valueFrom:
+            configMapKeyRef:
+              key: clean-cilium-state
+              name: cilium-config
+              optional: true
+        - name: CILIUM_BPF_STATE
+          valueFrom:
+            configMapKeyRef:
+              key: clean-cilium-bpf-state
+              name: cilium-config
+              optional: true
+        - name: CILIUM_WAIT_BPF_MOUNT
+          valueFrom:
+            configMapKeyRef:
+              key: wait-bpf-mount
+              name: cilium-config
+              optional: true
+        - name: KUBERNETES_SERVICE_HOST
+          value: "172.16.0.231"
+        - name: KUBERNETES_SERVICE_PORT
+          value: "6443"
+        image: "quay.io/cilium/cilium:v1.10.3@sha256:8419531c5d3677158802882bdfe2297915c43f2ebe3649551aaac22de9f6d565"
+        imagePullPolicy: IfNotPresent
+        name: clean-cilium-state
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+          privileged: true
+        volumeMounts:
+        - mountPath: /sys/fs/bpf
+          name: bpf-maps
+          mountPropagation: HostToContainer
+          # Required to mount cgroup filesystem from the host to cilium agent pod
+        - mountPath: /run/cilium/cgroupv2
+          name: cilium-cgroup
+          mountPropagation: HostToContainer
+        - mountPath: /var/run/cilium
+          name: cilium-run
+        resources:
+          requests:
+            cpu: 100m
+            memory: 100Mi
+      restartPolicy: Always
+      priorityClassName: system-node-critical
+      serviceAccount: "cilium"
+      serviceAccountName: "cilium"
+      terminationGracePeriodSeconds: 1
+      tolerations:
+      - operator: Exists
+      volumes:
+        # To keep state between restarts / upgrades
+      - hostPath:
+          path: /var/run/cilium
+          type: DirectoryOrCreate
+        name: cilium-run
+        # To keep state between restarts / upgrades for bpf maps
+      - hostPath:
+          path: /sys/fs/bpf
+          type: DirectoryOrCreate
+        name: bpf-maps
+      # To mount cgroup2 filesystem on the host
+      - hostPath:
+          path: /proc
+          type: Directory
+        name: hostproc
+      # To keep state between restarts / upgrades for cgroup2 filesystem
+      - hostPath:
+          path: /run/cilium/cgroupv2
+          type: DirectoryOrCreate
+        name: cilium-cgroup
+      # To install cilium cni plugin in the host
+      - hostPath:
+          path:  /opt/cni/bin
+          type: DirectoryOrCreate
+        name: cni-path
+        # To install cilium cni configuration in the host
+      - hostPath:
+          path: /etc/cni/net.d
+          type: DirectoryOrCreate
+        name: etc-cni-netd
+        # To be able to load kernel modules
+      - hostPath:
+          path: /lib/modules
+        name: lib-modules
+        # To access iptables concurrently with other processes (e.g. kube-proxy)
+      - hostPath:
+          path: /run/xtables.lock
+          type: FileOrCreate
+        name: xtables-lock
+        # To read the clustermesh configuration
+      - name: clustermesh-secrets
+        secret:
+          defaultMode: 420
+          optional: true
+          secretName: cilium-clustermesh
+        # To read the configuration from the config map
+      - configMap:
+          name: cilium-config
+        name: cilium-config-path
+      - name: hubble-tls
+        projected:
+          sources:
+          - secret:
+              name: hubble-server-certs
+              items:
+                - key: ca.crt
+                  path: client-ca.crt
+                - key: tls.crt
+                  path: server.crt
+                - key: tls.key
+                  path: server.key
+              optional: true
+---
+# Source: cilium/templates/cilium-operator-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    io.cilium/app: operator
+    name: cilium-operator
+  name: cilium-operator
+  namespace: kube-system
+spec:
+  # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go
+  # for more details.
+  replicas: 1
+  selector:
+    matchLabels:
+      io.cilium/app: operator
+      name: cilium-operator
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+      labels:
+        io.cilium/app: operator
+        name: cilium-operator
+    spec:
+      # In HA mode, cilium-operator pods must not be scheduled on the same
+      # node as they will clash with each other.
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: io.cilium/app
+                operator: In
+                values:
+                - operator
+            topologyKey: kubernetes.io/hostname
+      containers:
+      - args:
+        - --config-dir=/tmp/cilium/config-map
+        - --debug=$(CILIUM_DEBUG)
+        command:
+        - cilium-operator-generic
+        env:
+        - name: K8S_NODE_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: spec.nodeName
+        - name: CILIUM_K8S_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: CILIUM_DEBUG
+          valueFrom:
+            configMapKeyRef:
+              key: debug
+              name: cilium-config
+              optional: true
+        - name: KUBERNETES_SERVICE_HOST
+          value: "172.16.0.231"
+        - name: KUBERNETES_SERVICE_PORT
+          value: "6443"
+        image: "quay.io/cilium/operator-generic:v1.10.3@sha256:337ebf27eae4fbad51cc4baf9110b3ec6753320dd33075bc136e2a1865be5eb5"
+        imagePullPolicy: IfNotPresent
+        name: cilium-operator
+        livenessProbe:
+          httpGet:
+            host: '127.0.0.1'
+            path: /healthz
+            port: 9234
+            scheme: HTTP
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          timeoutSeconds: 3
+        volumeMounts:
+        - mountPath: /tmp/cilium/config-map
+          name: cilium-config-path
+          readOnly: true
+      hostNetwork: true
+      restartPolicy: Always
+      priorityClassName: system-cluster-critical
+      serviceAccount: "cilium-operator"
+      serviceAccountName: "cilium-operator"
+      tolerations:
+      - operator: Exists
+      volumes:
+        # To read the configuration from the config map
+      - configMap:
+          name: cilium-config
+        name: cilium-config-path

gcp-zonal/deployments/kubelet-serving-cert-approver.yaml

@@ -0,0 +1,290 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: kubelet-serving-cert-approver
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: certificates:kubelet-serving-cert-approver
+rules:
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests/approval
+  verbs:
+  - update
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
+- apiGroups:
+  - certificates.k8s.io
+  resourceNames:
+  - kubernetes.io/kubelet-serving
+  resources:
+  - signers
+  verbs:
+  - approve
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: events:kubelet-serving-cert-approver
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: psp:kubelet-serving-cert-approver
+rules:
+- apiGroups:
+  - policy
+  resourceNames:
+  - kubelet-serving-cert-approver
+  resources:
+  - podsecuritypolicies
+  verbs:
+  - use
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: events:kubelet-serving-cert-approver
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: events:kubelet-serving-cert-approver
+subjects:
+- kind: ServiceAccount
+  name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: psp:kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: psp:kubelet-serving-cert-approver
+subjects:
+- kind: ServiceAccount
+  name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: kubelet-serving-cert-approver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: certificates:kubelet-serving-cert-approver
+subjects:
+- kind: ServiceAccount
+  name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+spec:
+  ports:
+  - name: metrics
+    port: 9090
+    protocol: TCP
+    targetPort: metrics
+  selector:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: kubelet-serving-cert-approver
+      app.kubernetes.io/name: kubelet-serving-cert-approver
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: kubelet-serving-cert-approver
+        app.kubernetes.io/name: kubelet-serving-cert-approver
+    spec:
+      tolerations:
+        - key: "node.cloudprovider.kubernetes.io/uninitialized"
+          value: "true"
+          effect: "NoSchedule"
+        - key: "CriticalAddonsOnly"
+          operator: "Exists"
+        - key: "node-role.kubernetes.io/master"
+          effect: NoSchedule
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - preference:
+              matchExpressions:
+              - key: node-role.kubernetes.io/master
+                operator: DoesNotExist
+              - key: node-role.kubernetes.io/control-plane
+                operator: DoesNotExist
+            weight: 100
+      containers:
+      - args:
+        - serve
+        env:
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        image: ghcr.io/alex1989hu/kubelet-serving-cert-approver:main
+        imagePullPolicy: Always
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: health
+          initialDelaySeconds: 6
+        name: cert-approver
+        ports:
+        - containerPort: 8080
+          name: health
+        - containerPort: 9090
+          name: metrics
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: health
+          initialDelaySeconds: 3
+        resources:
+          limits:
+            cpu: 250m
+            memory: 32Mi
+          requests:
+            cpu: 10m
+            memory: 12Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+      priorityClassName: system-cluster-critical
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65534
+        runAsUser: 65534
+      serviceAccountName: kubelet-serving-cert-approver
+      tolerations:
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+        operator: Exists
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
+  labels:
+    app.kubernetes.io/instance: kubelet-serving-cert-approver
+    app.kubernetes.io/name: kubelet-serving-cert-approver
+  name: kubelet-serving-cert-approver
+  namespace: kubelet-serving-cert-approver
+spec:
+  allowPrivilegeEscalation: false
+  forbiddenSysctls:
+  - '*'
+  fsGroup:
+    ranges:
+    - max: 65534
+      min: 65534
+    rule: MustRunAs
+  hostIPC: false
+  hostNetwork: false
+  hostPID: false
+  privileged: false
+  readOnlyRootFilesystem: true
+  requiredDropCapabilities:
+  - ALL
+  runAsUser:
+    ranges:
+    - max: 65534
+      min: 65534
+    rule: MustRunAs
+  seLinux:
+    rule: RunAsAny
+  supplementalGroups:
+    ranges:
+    - max: 65534
+      min: 65534
+    rule: MustRunAs
+  volumes:
+  - downwardAPI
+  - secret

gcp-zonal/deployments/local-path-storage.yaml

@@ -0,0 +1,163 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: local-path-storage
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: local-path-provisioner-service-account
+  namespace: local-path-storage
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: local-path-provisioner-role
+rules:
+  - apiGroups: [ "" ]
+    resources: [ "nodes", "persistentvolumeclaims", "configmaps" ]
+    verbs: [ "get", "list", "watch" ]
+  - apiGroups: [ "" ]
+    resources: [ "endpoints", "persistentvolumes", "pods" ]
+    verbs: [ "*" ]
+  - apiGroups: [ "" ]
+    resources: [ "events" ]
+    verbs: [ "create", "patch" ]
+  - apiGroups: [ "storage.k8s.io" ]
+    resources: [ "storageclasses" ]
+    verbs: [ "get", "list", "watch" ]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: local-path-provisioner-bind
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: local-path-provisioner-role
+subjects:
+  - kind: ServiceAccount
+    name: local-path-provisioner-service-account
+    namespace: local-path-storage
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: local-path-provisioner
+  namespace: local-path-storage
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: local-path-provisioner
+  template:
+    metadata:
+      labels:
+        app: local-path-provisioner
+    spec:
+      tolerations:
+        - key: "CriticalAddonsOnly"
+          operator: "Exists"
+        - key: "node-role.kubernetes.io/master"
+          effect: NoSchedule
+      serviceAccountName: local-path-provisioner-service-account
+      containers:
+        - name: local-path-provisioner
+          image: rancher/local-path-provisioner:v0.0.19
+          imagePullPolicy: IfNotPresent
+          command:
+            - local-path-provisioner
+            - --debug
+            - start
+            - --config
+            - /etc/config/config.json
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/config/
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+      volumes:
+        - name: config-volume
+          configMap:
+            name: local-path-config
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: local-path
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+provisioner: rancher.io/local-path
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: Delete
+
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: local-path-config
+  namespace: local-path-storage
+data:
+  config.json: |-
+    {
+            "nodePathMap":[
+            {
+                    "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
+                    "paths":["/var/local-path-provisioner"]
+            }
+            ]
+    }
+  setup: |-
+    #!/bin/sh
+    while getopts "m:s:p:" opt
+    do
+        case $opt in
+            p)
+            absolutePath=$OPTARG
+            ;;
+            s)
+            sizeInBytes=$OPTARG
+            ;;
+            m)
+            volMode=$OPTARG
+            ;;
+        esac
+    done
+
+    mkdir -m 0777 -p ${absolutePath}
+  teardown: |-
+    #!/bin/sh
+    while getopts "m:s:p:" opt
+    do
+        case $opt in
+            p)
+            absolutePath=$OPTARG
+            ;;
+            s)
+            sizeInBytes=$OPTARG
+            ;;
+            m)
+            volMode=$OPTARG
+            ;;
+        esac
+    done
+
+    rm -rf ${absolutePath}
+  helperPod.yaml: |-
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      name: helper-pod
+    spec:
+      containers:
+      - name: helper-pod
+        image: busybox
+        imagePullPolicy: IfNotPresent

gcp-zonal/deployments/metrics-server.yaml

@@ -0,0 +1,197 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    k8s-app: metrics-server
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: system:aggregated-metrics-reader
+rules:
+- apiGroups:
+  - metrics.k8s.io
+  resources:
+  - pods
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: system:metrics-server
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - nodes
+  - nodes/stats
+  - namespaces
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server-auth-reader
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server:system:auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: system:metrics-server
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:metrics-server
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: kube-system
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server
+  namespace: kube-system
+spec:
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: https
+  selector:
+    k8s-app: metrics-server
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: metrics-server
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      k8s-app: metrics-server
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        k8s-app: metrics-server
+    spec:
+      tolerations:
+        - key: "CriticalAddonsOnly"
+          operator: "Exists"
+        - key: "node-role.kubernetes.io/master"
+          effect: NoSchedule
+      containers:
+      - args:
+        - --cert-dir=/tmp
+        - --secure-port=443
+        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+        - --kubelet-use-node-status-port
+        - --metric-resolution=15s
+        image: k8s.gcr.io/metrics-server/metrics-server:v0.5.0
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /livez
+            port: https
+            scheme: HTTPS
+          periodSeconds: 10
+        name: metrics-server
+        ports:
+        - containerPort: 443
+          name: https
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /readyz
+            port: https
+            scheme: HTTPS
+          initialDelaySeconds: 20
+          periodSeconds: 10
+        resources:
+          requests:
+            cpu: 100m
+            memory: 200Mi
+        securityContext:
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1000
+        volumeMounts:
+        - mountPath: /tmp
+          name: tmp-dir
+      nodeSelector:
+        kubernetes.io/os: linux
+      priorityClassName: system-cluster-critical
+      serviceAccountName: metrics-server
+      volumes:
+      - emptyDir: {}
+        name: tmp-dir
+---
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  labels:
+    k8s-app: metrics-server
+  name: v1beta1.metrics.k8s.io
+spec:
+  group: metrics.k8s.io
+  groupPriorityMinimum: 100
+  insecureSkipTLSVerify: true
+  service:
+    name: metrics-server
+    namespace: kube-system
+  version: v1beta1
+  versionPriority: 100

gcp-zonal/instances-master.tf

@@ -0,0 +1,113 @@
+
+resource "google_compute_address" "controlplane" {
+  count        = lookup(var.controlplane, "count", 0)
+  project      = var.project_id
+  region       = var.region
+  name         = "${var.cluster_name}-master-${count.index + 1}"
+  description  = "Local ${var.cluster_name}-master-${count.index + 1} ip"
+  address_type = "INTERNAL"
+  address      = cidrhost(cidrsubnet(var.network_cidr, 8, 0), 231 + count.index)
+  subnetwork   = "core"
+  purpose      = "GCE_ENDPOINT"
+}
+
+resource "google_compute_instance_from_template" "controlplane" {
+  count = lookup(var.controlplane, "count", 0)
+  name  = "master-${count.index + 1}"
+
+  project = var.project_id
+  zone    = element(var.zones, count.index)
+
+
+  network_interface {
+    network    = var.network
+    network_ip = google_compute_address.controlplane[count.index].address
+    subnetwork = "core"
+    access_config {
+      network_tier = "STANDARD"
+    }
+  }
+
+  source_instance_template = google_compute_instance_template.controlplane.id
+  depends_on = [
+    google_compute_instance_template.controlplane
+  ]
+}
+
+resource "google_compute_instance_template" "controlplane" {
+  name_prefix  = "${var.cluster_name}-master-"
+  project      = var.project_id
+  region       = var.region
+  machine_type = lookup(var.controlplane, "type", "e2-standard-2")
+  # min_cpu_platform = ""
+
+  tags = concat(var.tags, ["${var.cluster_name}-infra", "${var.cluster_name}-master", "${var.cluster_name}-web"])
+  labels = {
+    label = "controlplane"
+  }
+
+  # metadata = {
+  #   ssh-keys = "debian:${file("~/.ssh/terraform.pub")}"
+  # }
+  # metadata_startup_script = "apt-get install -y nginx"
+
+  disk {
+    boot              = true
+    auto_delete       = true
+    disk_size_gb      = 16
+    disk_type         = "pd-ssd"
+    resource_policies = []
+    source_image      = data.google_compute_image.talos.self_link
+    labels            = { label = "controlplane" }
+  }
+
+  network_interface {
+    network    = var.network
+    subnetwork = "core"
+
+    access_config {
+      network_tier = "STANDARD"
+    }
+  }
+
+  scheduling {
+    automatic_restart   = true
+    on_host_maintenance = "MIGRATE"
+  }
+
+  shielded_instance_config {
+    enable_integrity_monitoring = true
+    enable_secure_boot          = false
+    enable_vtpm                 = true
+  }
+
+  lifecycle {
+    create_before_destroy = "true"
+  }
+}
+
+resource "local_file" "controlplane" {
+  count = lookup(var.controlplane, "count", 0)
+  content = templatefile("${path.module}/templates/controlplane.yaml",
+    merge(var.kubernetes, {
+      name           = "master-${count.index + 1}"
+      type           = count.index == 0 ? "init" : "controlplane"
+      ipv4_local     = cidrhost(cidrsubnet(var.network_cidr, 8, 0), 231 + count.index)
+      ipv4           = google_compute_instance_from_template.controlplane[count.index].network_interface[0].access_config[0].nat_ip
+      lbv4_local     = cidrhost(cidrsubnet(var.network_cidr, 8, 0), 230)
+      lbv4           = google_compute_address.api.address
+    })
+  )
+  filename        = "_cfgs/controlplane-${count.index + 1}.yaml"
+  file_permission = "0640"
+
+  depends_on = [google_compute_instance_from_template.controlplane]
+}
+
+resource "null_resource" "controlplane" {
+  count = lookup(var.controlplane, "count", 0)
+  provisioner "local-exec" {
+    command = "sleep 60 && talosctl apply-config --insecure --nodes ${google_compute_instance_from_template.controlplane[count.index].network_interface[0].access_config[0].nat_ip} --file _cfgs/controlplane-${count.index + 1}.yaml"
+  }
+  depends_on = [google_compute_address.api, local_file.controlplane]
+}

gcp-zonal/instances-web.tf

@@ -0,0 +1,123 @@
+
+resource "google_compute_region_instance_group_manager" "web" {
+  name                      = "${var.cluster_name}-web-mig"
+  project                   = var.project_id
+  region                    = var.region
+  distribution_policy_zones = var.zones
+  base_instance_name        = "${var.cluster_name}-web"
+
+  version {
+    instance_template = google_compute_instance_template.web["all"].id
+  }
+
+  target_pools       = [google_compute_target_pool.web.self_link]
+  target_size        = lookup(var.instances["all"], "web_count", 0)
+  wait_for_instances = false
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "google_compute_instance_group_manager" "web" {
+  for_each = { for k, v in var.instances : k => v if contains(var.zones, "${var.region}-${k}") }
+
+  name               = "${var.cluster_name}-web-${each.key}-mig"
+  project            = var.project_id
+  zone               = "${var.region}-${each.key}"
+  base_instance_name = "${var.cluster_name}-web-${each.key}"
+
+  version {
+    instance_template = google_compute_instance_template.web[each.key].id
+  }
+
+  named_port {
+    name = "http"
+    port = 80
+  }
+  named_port {
+    name = "https"
+    port = 443
+  }
+
+  target_pools       = [google_compute_target_pool.web.self_link]
+  target_size        = lookup(each.value, "web_count", 0)
+  wait_for_instances = false
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "google_compute_instance_template" "web" {
+  for_each     = var.instances
+  name_prefix  = "${var.cluster_name}-web-${each.key}-"
+  project      = var.project_id
+  region       = var.region
+  machine_type = lookup(each.value, "web_instance_type", "e2-standard-2")
+  # min_cpu_platform = ""
+
+  tags = concat(var.tags, ["${var.cluster_name}-infra", "${var.cluster_name}-master", "${var.cluster_name}-web"])
+  labels = {
+    label = "web"
+  }
+
+  metadata = {
+    ssh-keys = "debian:${file("~/.ssh/terraform.pub")}"
+  }
+  metadata_startup_script = "apt-get install -y nginx"
+
+  disk {
+    boot         = true
+    auto_delete  = true
+    disk_size_gb = 16
+    disk_type    = "pd-balanced" // pd-ssd
+    source_image = "debian-cloud/debian-10"
+    labels       = { label = "web" }
+  }
+
+  network_interface {
+    network    = var.network
+    subnetwork = "core"
+
+    access_config {
+      network_tier = "STANDARD"
+    }
+  }
+
+  scheduling {
+    automatic_restart   = true
+    on_host_maintenance = "MIGRATE"
+  }
+
+  shielded_instance_config {
+    enable_integrity_monitoring = true
+    enable_secure_boot          = false
+    enable_vtpm                 = true
+  }
+
+  lifecycle {
+    create_before_destroy = "true"
+  }
+}
+
+# module "web" {
+#   source = "./modules/web"
+
+#   for_each = var.instances
+#   location = each.key
+#   labels   = merge(var.tags, { label = "web" })
+#   network  = hcloud_network.main.id
+#   subnet   = hcloud_network_subnet.core.ip_range
+
+#   vm_name           = "web-${each.key}-"
+#   vm_items          = lookup(each.value, "web_count", 0)
+#   vm_type           = lookup(each.value, "web_instance_type", "cx11")
+#   vm_image          = data.hcloud_image.talos.id
+#   vm_ip_start       = (3 + index(var.regions, each.key)) * 10
+#   vm_security_group = [hcloud_firewall.web.id]
+
+#   vm_params = merge(var.kubernetes, {
+#     lbv4 = hcloud_load_balancer_network.api.ip
+#   })
+# }

gcp-zonal/instances-workers.tf

@@ -0,0 +1,89 @@
+
+resource "google_compute_region_instance_group_manager" "worker" {
+  name                      = "${var.cluster_name}-worker-mig"
+  project                   = var.project_id
+  region                    = var.region
+  distribution_policy_zones = var.zones
+  base_instance_name        = "${var.cluster_name}-worker"
+
+  version {
+    instance_template = google_compute_instance_template.worker["all"].id
+  }
+
+  target_pools       = []
+  target_size        = lookup(var.instances["all"], "worker_count", 0)
+  wait_for_instances = false
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "google_compute_instance_group_manager" "worker" {
+  for_each = { for k, v in var.instances : k => v if contains(var.zones, "${var.region}-${k}") }
+
+  name               = "${var.cluster_name}-worker-${each.key}-mig"
+  project            = var.project_id
+  zone               = "${var.region}-${each.key}"
+  base_instance_name = "${var.cluster_name}-worker-${each.key}"
+
+  version {
+    instance_template = google_compute_instance_template.worker[each.key].id
+  }
+
+  target_pools       = []
+  target_size        = lookup(each.value, "worker_count", 0)
+  wait_for_instances = false
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "google_compute_instance_template" "worker" {
+  for_each     = var.instances
+  name_prefix  = "${var.cluster_name}-worker-${each.key}-"
+  project      = var.project_id
+  region       = var.region
+  machine_type = lookup(each.value, "worker_instance_type", "e2-standard-2")
+  # min_cpu_platform = ""
+
+  tags = concat(var.tags, ["${var.cluster_name}-infra", "${var.cluster_name}-master", "${var.cluster_name}-worker"])
+  labels = {
+    label = "worker"
+  }
+
+  metadata = {
+    ssh-keys = "debian:${file("~/.ssh/terraform.pub")}"
+  }
+  metadata_startup_script = "apt-get install -y nginx"
+
+  disk {
+    boot         = true
+    auto_delete  = true
+    disk_size_gb = 16
+    disk_type    = "pd-balanced" // pd-ssd
+    source_image = "debian-cloud/debian-10"
+    labels       = { label = "worker" }
+  }
+
+  network_interface {
+    network    = var.network
+    subnetwork = "core"
+  }
+
+  scheduling {
+    automatic_restart   = true
+    on_host_maintenance = "MIGRATE"
+  }
+
+  shielded_instance_config {
+    enable_integrity_monitoring = true
+    enable_secure_boot          = false
+    enable_vtpm                 = true
+  }
+
+  lifecycle {
+    create_before_destroy = "true"
+  }
+}

gcp-zonal/network-lb.tf

@@ -0,0 +1,64 @@
+
+resource "google_compute_address" "api" {
+  project      = var.project_id
+  region       = var.region
+  name         = "${var.cluster_name}-controlplane"
+  description  = "External ${var.cluster_name}-controlplane lb ip"
+  address_type = "EXTERNAL"
+  network_tier = "STANDARD"
+}
+
+# resource "google_compute_forwarding_rule" "controlplane" {
+#   project               = var.project_id
+#   name                  = "${var.cluster_name}-controlplane"
+#   region                = var.region
+#   target                = google_compute_target_pool.controlplane.self_link
+#   load_balancing_scheme = "EXTERNAL"
+#   # ip_address
+#   port_range            = "80-443"
+#   ip_protocol           = "TCP"
+#   network_tier          = "STANDARD"
+# }
+
+# resource "google_compute_target_pool" "controlplane" {
+#   project = var.project_id
+#   name    = "${var.cluster_name}-controlplane-pool"
+#   region  = var.region
+
+#   instances     = google_compute_instance.controlplane[*].self_link
+#   health_checks = [google_compute_http_health_check.controlplane.id]
+# }
+
+# resource "google_compute_http_health_check" "controlplane" {
+#   name               = "${var.cluster_name}-controlplane-pool"
+#   check_interval_sec = 15
+#   timeout_sec        = 1
+#   request_path       = "/"
+# }
+
+# resource "google_compute_forwarding_rule" "web" {
+#   project               = var.project_id
+#   name                  = "${var.cluster_name}-web"
+#   region                = var.region
+#   target                = google_compute_target_pool.web.self_link
+#   load_balancing_scheme = "EXTERNAL"
+#   # ip_address
+#   port_range   = "80-443"
+#   ip_protocol  = "TCP"
+#   network_tier = "STANDARD"
+# }
+
+resource "google_compute_target_pool" "web" {
+  project = var.project_id
+  name    = "${var.cluster_name}-web-pool"
+  region  = var.region
+
+  health_checks = [google_compute_http_health_check.web.id]
+}
+
+resource "google_compute_http_health_check" "web" {
+  name               = "${var.cluster_name}-web-pool"
+  check_interval_sec = 15
+  timeout_sec        = 1
+  request_path       = "/"
+}

gcp-zonal/network-nat.tf

@@ -0,0 +1,31 @@
+
+resource "google_compute_address" "nat" {
+  project      = var.project_id
+  region       = var.region
+  name         = "${var.cluster_name}-nat"
+  description  = "External ${var.cluster_name}-nat ip"
+  address_type = "EXTERNAL"
+  network_tier = "PREMIUM"
+}
+
+resource "google_compute_router" "core" {
+  name    = "${var.cluster_name}-route"
+  region  = var.region
+  network = var.network
+}
+
+resource "google_compute_router_nat" "core" {
+  name    = "${var.cluster_name}-nat"
+  project = var.project_id
+  region  = var.region
+  router  = google_compute_router.core.name
+
+  nat_ip_allocate_option = "MANUAL_ONLY"
+  nat_ips                = [google_compute_address.nat.self_link]
+
+  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
+  subnetwork {
+    name                    = "core"
+    source_ip_ranges_to_nat = ["PRIMARY_IP_RANGE"]
+  }
+}

gcp-zonal/network-secgroup.tf

@@ -0,0 +1,80 @@
+
+resource "google_compute_firewall" "controlplane" {
+  project       = var.project_id
+  name          = "${var.cluster_name}-controlplane"
+  network       = var.network
+  description   = "Managed by terraform: Allow k8s/talos service"
+  priority      = 1000
+  direction     = "INGRESS"
+  source_ranges = [var.network_cidr]
+  target_tags   = ["${var.cluster_name}-master"]
+
+  allow {
+    protocol = "tcp"
+    ports    = ["6443", "50000", "50001"]
+  }
+}
+
+resource "google_compute_firewall" "controlplane_admin" {
+  project       = var.project_id
+  name          = "${var.cluster_name}-controlplane-admin"
+  network       = var.network
+  description   = "Managed by terraform: Allow admin console"
+  priority      = 1001
+  direction     = "INGRESS"
+  source_ranges = var.whitelist_admin
+  target_tags   = ["${var.cluster_name}-master"]
+
+  allow {
+    protocol = "tcp"
+    ports    = ["22", "6443", "50000"]
+  }
+}
+
+resource "google_compute_firewall" "controlplane_health_check" {
+  project       = var.project_id
+  name          = "${var.cluster_name}-controlplane-health"
+  network       = var.network
+  description   = "Managed by terraform: Allow health check"
+  priority      = 1002
+  direction     = "INGRESS"
+  source_ranges = ["169.254.169.254"]
+  target_tags   = ["${var.cluster_name}-master"]
+
+  allow {
+    protocol = "tcp"
+    ports    = ["6443"]
+  }
+}
+
+resource "google_compute_firewall" "web" {
+  project       = var.project_id
+  name          = "${var.cluster_name}-web"
+  network       = var.network
+  description   = "Managed by terraform: Allow web"
+  priority      = 1000
+  direction     = "INGRESS"
+  source_ranges = var.whitelist_web
+  target_tags   = ["${var.cluster_name}-web"]
+
+  allow {
+    protocol = "tcp"
+    ports    = ["80", "443"]
+  }
+}
+
+resource "google_compute_firewall" "web_health_check" {
+  project       = var.project_id
+  name          = "${var.cluster_name}-web-health"
+  network       = var.network
+  description   = "Managed by terraform: Allow web health check"
+  priority      = 1001
+  direction     = "INGRESS"
+  source_ranges = ["169.254.169.254"]
+  target_tags   = ["${var.cluster_name}-web"]
+
+  allow {
+    protocol = "tcp"
+    ports    = ["80"]
+  }
+}

gcp-zonal/network.tf

@@ -0,0 +1,44 @@
+
+resource "google_compute_network" "network" {
+  name                    = var.network
+  description             = "Project ${var.cluster_name}"
+  project                 = var.project_id
+  routing_mode            = "REGIONAL"
+  mtu                     = 1500
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "core" {
+  name                     = "core"
+  project                  = var.project_id
+  region                   = var.region
+  description              = "Core subnet"
+  network                  = google_compute_network.network.id
+  ip_cidr_range            = cidrsubnet(var.network_cidr, 8, 0)
+  private_ip_google_access = true
+}
+
+resource "google_compute_subnetwork" "private" {
+  name                     = "private"
+  project                  = var.project_id
+  region                   = var.region
+  description              = "Private subnet"
+  network                  = google_compute_network.network.id
+  ip_cidr_range            = cidrsubnet(var.network_cidr, 8, 1)
+  private_ip_google_access = true
+}
+
+resource "google_compute_global_address" "google" {
+  name          = "google-private-ip-address"
+  purpose       = "VPC_PEERING"
+  address       = cidrhost(cidrsubnet(var.network_cidr, 8, 2), 0)
+  address_type  = "INTERNAL"
+  prefix_length = 24
+  network       = google_compute_network.network.id
+}
+
+resource "google_service_networking_connection" "private_vpc_connection" {
+  network                 = google_compute_network.network.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.google.name]
+}

gcp-zonal/registry.tf

@@ -0,0 +1,11 @@
+
+resource "google_container_registry" "registry" {
+  project  = var.project_id
+  location = "EU"
+}
+
+resource "google_storage_bucket_iam_member" "viewer" {
+  bucket = google_container_registry.registry.id
+  role   = "roles/storage.objectViewer"
+  member = "serviceAccount:${data.google_client_openid_userinfo.terraform.email}"
+}

gcp-zonal/templates/controlplane.yaml.tpl

@@ -0,0 +1,69 @@
+version: v1alpha1
+debug: false
+persist: true
+machine:
+  type: ${type}
+  certSANs:
+    - "${lbv4}"
+    - "${lbv4_local}"
+    - "${ipv4}"
+  kubelet:
+    extraArgs:
+      node-ip: "${ipv4_local}"
+      rotate-server-certificates: true
+  network:
+    hostname: "${name}"
+    interfaces:
+      - interface: eth0
+        dhcp: true
+      - interface: eth0
+        cidr: ${lbv4_local}/32
+      - interface: eth0
+        cidr: ${lbv4}/32
+      - interface: dummy0
+        cidr: "169.254.2.53/32"
+      - interface: dummy0
+        cidr: "fd00::169:254:2:53/128"
+  install:
+    disk: /dev/sda
+    bootloader: true
+    wipe: false
+    extraKernelArgs:
+      - elevator=noop
+  sysctls:
+    net.core.somaxconn: 65535
+    net.core.netdev_max_backlog: 4096
+  systemDiskEncryption:
+    ephemeral:
+      provider: luks2
+      keys:
+        - nodeID: {}
+          slot: 0
+cluster:
+  controlPlane:
+    endpoint: https://${lbv4}:6443
+  network:
+    dnsDomain: ${domain}
+    podSubnets: ${format("[%s]",podSubnets)}
+    serviceSubnets: ${format("[%s]",serviceSubnets)}
+    cni:
+      name: custom
+      urls:
+        - https://raw.githubusercontent.com/sergelogvinov/terraform-talos/main/gcp-zonal/deployments/cilium_result.yaml
+  proxy:
+    disabled: true
+    mode: ipvs
+  apiServer:
+    certSANs:
+      - "${lbv4_local}"
+      - "${lbv4}"
+      - "${ipv4}"
+  controllerManager: {}
+  scheduler: {}
+  etcd: {}
+  externalCloudProvider:
+    enabled: true
+    manifests:
+      - https://raw.githubusercontent.com/sergelogvinov/terraform-talos/main/gcp-zonal/deployments/kubelet-serving-cert-approver.yaml
+      - https://raw.githubusercontent.com/sergelogvinov/terraform-talos/main/gcp-zonal/deployments/metrics-server.yaml
+      - https://raw.githubusercontent.com/sergelogvinov/terraform-talos/main/gcp-zonal/deployments/local-path-storage.yaml

gcp-zonal/templates/coredns_hosts.tpl

@@ -0,0 +1,14 @@
+data:
+  hosts: |
+    # static hosts
+    169.254.2.53        dns.local
+    fd00::169:254:2:53  dns.local
+    # terraform
+%{ for node in masters ~}
+    ${format("%-24s",node.ipv4_address)} ${node.name}
+    ${format("%-24s",node.ipv6_address)} ${node.name}
+%{ endfor ~}
+%{ for node in web ~}
+    ${format("%-24s",node.ipv4_address)} ${node.name}
+    ${format("%-24s",node.ipv6_address)} ${node.name}
+%{ endfor ~}

gcp-zonal/variables.tf

@@ -0,0 +1,118 @@
+
+variable "project_id" {
+  description = "The project ID to host the cluster in"
+}
+
+variable "cluster_name" {
+  description = "A default cluster name"
+  default     = "talos"
+}
+
+variable "region" {
+  description = "The region to host the cluster in"
+}
+
+variable "zones" {
+  type        = list(string)
+  description = "The zone to host the cluster in (required if is a zonal cluster)"
+}
+
+variable "kubernetes" {
+  type = map(string)
+  default = {
+    podSubnets     = "10.32.0.0/12"
+    serviceSubnets = "10.200.0.0/22"
+    domain         = "cluster.local"
+    cluster_name   = "talos-k8s-hezner"
+    tokenmachine   = ""
+    token          = ""
+    ca             = ""
+  }
+  sensitive   = true
+}
+
+variable "network" {
+  description = "The VPC network created to host the cluster in"
+  default     = "production"
+}
+
+variable "network_cidr" {
+  description = "Local subnet rfc1918"
+  default     = "172.16.0.0/16"
+}
+
+variable "whitelist_web" {
+  description = "Cloudflare subnets"
+  default = [
+    "173.245.48.0/20",
+    "103.21.244.0/22",
+    "103.22.200.0/22",
+    "103.31.4.0/22",
+    "141.101.64.0/18",
+    "108.162.192.0/18",
+    "190.93.240.0/20",
+    "188.114.96.0/20",
+    "197.234.240.0/22",
+    "198.41.128.0/17",
+    "162.158.0.0/15",
+    "172.64.0.0/13",
+    "131.0.72.0/22",
+    "104.16.0.0/13",
+    "104.24.0.0/14",
+  ]
+}
+
+variable "whitelist_admin" {
+  description = "Cloudflare subnets"
+  default = [
+    "0.0.0.0/0",
+  ]
+}
+
+variable "tags" {
+  description = "Tags of resources"
+  type        = list(string)
+  default = [
+    "develop"
+  ]
+}
+
+variable "controlplane" {
+  description = "Count of controlplanes"
+  type        = map(any)
+  default = {
+    count = 0,
+    type  = "e2-small"
+  }
+}
+
+variable "instances" {
+  description = "Map of region's properties"
+  type        = map(any)
+  default = {
+    "a" = {
+      web_count            = 0,
+      web_instance_type    = "e2-small",
+      worker_count         = 0,
+      worker_instance_type = "e2-small",
+    },
+    "b" = {
+      web_count            = 0,
+      web_instance_type    = "e2-small",
+      worker_count         = 0,
+      worker_instance_type = "e2-small",
+    }
+    "c" = {
+      web_count            = 0,
+      web_instance_type    = "e2-small",
+      worker_count         = 0,
+      worker_instance_type = "e2-small",
+    }
+    "all" = {
+      web_count            = 0,
+      web_instance_type    = "e2-small",
+      worker_count         = 0,
+      worker_instance_type = "e2-small",
+    }
+  }
+}

gcp-zonal/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 3.76.0"
+    }
+  }
+  required_version = ">= 1.0"
+}

system_os/gcp/gcp.pkr.hcl

@@ -0,0 +1,56 @@
+
+packer {
+  required_plugins {
+    googlecompute = {
+      version = ">= 1.0.0"
+      source = "github.com/hashicorp/googlecompute"
+    }
+  }
+}
+
+variable "google_account" {
+  type      = string
+  default   = ""
+  sensitive = true
+}
+
+variable "google_project" {
+  type      = string
+  default   = ""
+  sensitive = true
+}
+
+variable "talos_version" {
+  type    = string
+  default = "v0.11.3"
+}
+
+source "googlecompute" "talos" {
+  account_file        = "${var.google_account}"
+  project_id          = "${var.google_project}"
+  zone                = "europe-west4-a"
+  subnetwork          = "default"
+  source_image_family = "debian-10"
+  ssh_username        = "debian"
+
+  machine_type = "e2-small"
+  disk_size    = 10
+  disk_type    = "pd-standard"
+
+  image_name              = "talos"
+  image_description       = "talos system disk"
+  image_family            = "talos"
+  image_licenses          = ["projects/vm-options/global/licenses/enable-vmx"]
+  image_storage_locations = ["europe-west4"]
+}
+
+build {
+  sources = ["source.googlecompute.talos"]
+  provisioner "shell" {
+    inline = [
+      "sudo apt-get install -y wget",
+      "wget -O /tmp/talos.tar.gz https://github.com/talos-systems/talos/releases/download/${var.talos_version}/gcp-amd64.tar.gz",
+      "tar xOzf /tmp/talos.tar.gz | sudo dd of=/dev/sda",
+    ]
+  }
+}