Uly.me

cloud engineer

terraform

Terraform GCloud VM Image Family

How to implement image family with Terraform in GCP.

Declare the machine image in terraform.tfvars.

image-family = "centos-7"

Declare data type for the machine image in maint.tf.

data "google_compute_image" "my_image" {
  family  = var.image-family
  project = "your-project-id"
}

In main.tf use “google_compute_instance” under boot disk section in main.tf.

boot_disk {
  initialize_params {
    image = data.google_compute_image.my_image.self_link
  }
}

Sublime Text Terraform Syntax

If you use Terraform and Sublime Text, add Terraform Syntax Highlighter using Package Control.

Press Ctrl+Shift+P or Cmd+Shift+P.
Select “Package Control: Install package”
Select “Terraform”

It should install in a few seconds.

Terraform in a Docker Container

Run Terraform in a Docker container.

docker run --rm -it --name terraform -v ~/.aws:/root/.aws -v $(pwd):/workspace -w /workspace hashicorp/terraform:latest

Create an alias.

alias terraform='docker run --rm -it --name terraform -v ~/.aws:/root/.aws -v $(pwd):/workspace -w /workspace hashicorp/terraform:latest'

Run the command

terraform --version
Terraform v1.0.2
on linux_amd64

Terraform GCP Firewall

How to create GCP firewall via Terraform.

Ingress

provider "google" {
    project = "project-id"
}
resource "google_compute_firewall" "default" {
    name    = "test-firewall"
    description = "this is a test firewall"
    priority = "1000"
    direction = "INGRESS"
    network = "projects/project-id/regions/us-east1/subnetworks/default"
    target_service_accounts = ["service-account-compute@developer.gserviceaccount.com"]
    source_ranges = ["10.128.0.0/20"]
    allow {
        protocol = "tcp"
        ports    = ["80", "8080", "1000-2000"]
    }
}

Egress

provider "google" {
    project = "project-id"
}
resource "google_compute_firewall" "default" {
    name    = "test-firewall"
    description = "this is a test firewall"
    priority = "1000"
    direction = "EGRESS"
    network = "projects/project-id/regions/us-east1/subnetworks/default"
    target_service_accounts = ["service-account-compute@developer.gserviceaccount.com"]
    destination_ranges = ["10.128.0.0/20"]
    allow {
        protocol = "tcp"
        ports    = ["80", "8080", "1000-2000"]
    }
}

Service account to Service account.

provider "google" {
    project = "project-id"
}
resource "google_compute_firewall" "default" {
    name    = "test-firewall"
    description = "this is a test firewall"
    priority = "1000"
    direction = "INGRESS"
    network = "projects/project-id/regions/us-east1/subnetworks/default"
    source_service_accounts = ["source-service-account-compute@developer.gserviceaccount.com"]
    target_service_accounts = ["target-service-account-compute@developer.gserviceaccount.com"]
    source_ranges = ["10.128.0.0/20"]
    allow {
        protocol = "tcp"
        ports    = ["80", "8080", "1000-2000"]
    }
}

AWS Spot Instances Running Docker

I have an AMI with docker installed. Here’s how I launch a spot instance using Terraform.

Here’s my Terraform script.

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
  }
}
provider "aws" {
  profile = "default"
  region  = "us-east-1"
}
resource "aws_spot_instance_request" "docker" {
  ami                           = "ami-xxxxxxxxxxxxxxxx"
  spot_price                    = "0.0031"
  wait_for_fulfillment          = "true"
  key_name                      = "servers"
  instance_type                 = "t3.micro"
  subnet_id                     = "subnet-xxxxxxxxxxxxxxxx"
  security_groups               = ["sg-xxxxxxxxxxxxxxxxxx"]
  associate_public_ip_address   = "true"
  user_data = <<-EOF
              #!/bin/bash
              hostnamectl set-hostname docker
              EOF
  tags = {
        Name = "docker-0.1"
  }
}
resource "aws_ec2_tag" "tagging" {
  resource_id                   = aws_spot_instance_request.docker.spot_instance_id
  key                           = "Name"
  value                         = "docker-0.1"
}

I use “aws_ec2_tag” resource to tag the instance properly.

In addition, I use user_data to run a script, to set the hostname.

To launch via Terraform, I run the following commands.

terraform init
terraform apply

When done, I could stop the instance to stop incurring charges. Or just simply destroy it via Terraform.

terraform destroy

It’s not bad deal for an instance that costs only $0.0031 per hour.