Skip to content

Commit b03cf0c

Browse files
wtsdwtsd
committed
Documentation generated
1 parent a858cba commit b03cf0c

File tree

6 files changed

+224
-0
lines changed

6 files changed

+224
-0
lines changed

‎.github/workflows/deploy.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: GCP Deploy
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
workflow_dispatch:
7+
8+
jobs:
9+
deploy:
10+
runs-on: ubuntu-latest
11+
env:
12+
TF_IN_AUTOMATION: true
13+
SCENARIO: serverless_public
14+
VAR_FILE: terraform.tfvars
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- name: Set up Python
19+
uses: actions/setup-python@v5
20+
with:
21+
python-version: "3.12"
22+
23+
- name: Install CLI deps
24+
run: |
25+
python -m pip install --upgrade pip
26+
pip install -r requirements.txt
27+
28+
- name: Authenticate to Google Cloud (Workload Identity Federation)
29+
uses: google-github-actions/auth@v2
30+
with:
31+
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
32+
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
33+
access_token_lifetime: 3600s
34+
35+
- name: Setup gcloud
36+
uses: google-github-actions/setup-gcloud@v2
37+
38+
- name: Setup Terraform
39+
uses: hashicorp/setup-terraform@v3
40+
with:
41+
terraform_version: 1.9.5
42+
43+
- name: Terraform Init
44+
working-directory: terraform/${{ env.SCENARIO }}
45+
run: terraform init
46+
47+
- name: Terraform Apply
48+
working-directory: terraform/${{ env.SCENARIO }}
49+
env:
50+
TF_VAR_project_id: ${{ secrets.GCP_PROJECT_ID }}
51+
TF_VAR_region: ${{ vars.GCP_REGION }}
52+
TF_VAR_zones: ${{ vars.GCP_ZONES }}
53+
TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}
54+
run: |
55+
terraform apply -auto-approve -var-file=${{ env.VAR_FILE }}
56+
57+
- name: Terraform Outputs
58+
working-directory: terraform/${{ env.SCENARIO }}
59+
run: terraform output -json

‎docs/ci_cd.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# CI/CD (GitHub Actions)
2+
3+
We include `.github/workflows/deploy.yml` with **Workload Identity Federation**.
4+
5+
**Required repo secrets**
6+
- `GCP_WORKLOAD_IDENTITY_PROVIDER` – resource name of your WIF provider
7+
- `GCP_SERVICE_ACCOUNT` – service account email with Terraform permissions
8+
- `GCP_PROJECT_ID` – target project
9+
- `DB_PASSWORD` – Cloud SQL user password
10+
11+
**Optional repo vars**
12+
- `GCP_REGION`, `GCP_ZONES`
13+
14+
**Switch scenario**
15+
- Set workflow env `SCENARIO` to `serverless_public` or `private_mig`
16+
17+
**Outputs**
18+
- `terraform output -json` is shown at the end

‎docs/private_mig.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Private MIG Scenario (HTTPS LB + Compute Engine + Cloud SQL Private IP)
2+
3+
**What you get**
4+
- Custom VPC with two subnets
5+
- Cloud Router + NAT (instances have no external IP)
6+
- Two zonal MIGs running NGINX (simple landing page)
7+
- Global external HTTP LB (always), optional **managed HTTPS** when `domain_name` is set
8+
- Cloud SQL (Postgres 15) with **private IP** (Service Networking)
9+
- Firewall permitting only LB/health-check sources to port 80
10+
11+
**Outputs**
12+
- `lb_ip` and `http_url`
13+
- `db_private_ip`
14+
15+
**TLS & DNS (optional)**
16+
- Set `domain_name = "app.example.com"` in `terraform.tfvars` to create a managed cert and HTTPS forwarding rule
17+
- Create an **A** record in your DNS provider pointing `app.example.com` to `lb_ip`
18+
- Certificate may take some minutes to become **ACTIVE**
19+
20+
**Security**
21+
- Backends have no external IPs
22+
- Only Google LB/HC source ranges can hit port 80
23+
- Add SSH only from your IP if needed (extra firewall rule)
24+
25+
**Scaling**
26+
- Adjust `desired_size`
27+
- Switch to `regional_instance_group_manager` for per-zone autoscaling if desired

‎docs/quickstart.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Quick Start (GCP DevOps Framework)
2+
3+
## Prereqs
4+
- GCP project and billing enabled
5+
- Roles: Project Editor or least-privileged set for Compute, Cloud Run, Cloud SQL, Service Networking, VPC Access
6+
- `gcloud` authenticated (`gcloud auth login` and `gcloud config set project YOUR_PROJECT`)
7+
- Terraform >= 1.5 (or use the Docker image we provide)
8+
9+
## Local usage
10+
```bash
11+
python -m venv .venv && source .venv/bin/activate
12+
pip install -r requirements.txt
13+
```
14+
15+
### Choose a scenario
16+
17+
**Serverless public (Cloud Run + Cloud SQL private IP):**
18+
```bash
19+
cd terraform/serverless_public
20+
cp terraform.tfvars.example terraform.tfvars
21+
# Edit project_id, region, db_password, etc.
22+
terraform init
23+
terraform apply -auto-approve
24+
terraform output -json
25+
```
26+
27+
**Private MIG (GCE + HTTPS LB + Cloud SQL private IP):**
28+
```bash
29+
cd terraform/private_mig
30+
cp terraform.tfvars.example terraform.tfvars
31+
# Edit project_id, region, zones, db_password, etc.
32+
terraform init
33+
terraform apply -auto-approve
34+
terraform output -json
35+
```
36+
37+
## Python CLI wrapper
38+
From repo root:
39+
```bash
40+
python cli.py init --scenario serverless_public --var-file terraform/serverless_public/terraform.tfvars
41+
python cli.py deploy --scenario serverless_public --var-file terraform/serverless_public/terraform.tfvars
42+
python cli.py outputs --scenario serverless_public
43+
python cli.py destroy --scenario serverless_public
44+
```
45+
46+
## Docker workflow
47+
```bash
48+
docker build -t gcp-devops-framework .
49+
# Mount your gcloud config for auth
50+
make init SCENARIO=private_mig VARS=terraform/private_mig/terraform.tfvars
51+
make deploy SCENARIO=private_mig VARS=terraform/private_mig/terraform.tfvars
52+
make outputs SCENARIO=private_mig
53+
make destroy SCENARIO=private_mig
54+
```
55+
56+
> ⚠ Costs: Load balancer, Cloud SQL, NAT, and compute incur charges. Destroy when done.

‎docs/serverless_public.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Serverless Public Scenario (Cloud Run + Cloud SQL Private IP)
2+
3+
**What you get**
4+
- VPC + /28 subnet for Serverless VPC Connector
5+
- Private Service Connect peering for Cloud SQL Private IP
6+
- Cloud SQL (Postgres 15) with private address
7+
- Cloud Run v2 service (public, unauthenticated) connected through the VPC connector
8+
- App env vars for DB connection (host/user/pass/name)
9+
10+
**Outputs**
11+
- `cloud_run_url` – copy into your browser
12+
13+
**Domain & TLS**
14+
- Cloud Run already serves HTTPS on `*.run.app`
15+
- For custom domains, use Cloud Run domain mappings (see `gcloud run domain-mappings` docs) or put an external HTTPS LB in front (advanced).
16+
17+
**Variables**
18+
See `terraform/serverless_public/variables.tf` and `terraform.tfvars.example`
19+
20+
**Security**
21+
- DB has private IP and is not internet-exposed
22+
- Cloud Run is public; add IAM policy if you want private (remove the `allUsers` invoker) or put behind IAP
23+
24+
**Typical next steps**
25+
- Swap `container_image` with your app image
26+
- Store secrets in Secret Manager and mount via Cloud Run

‎docs/verification.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Verification Guide (gcloud & curl)
2+
3+
## Cloud Run (serverless_public)
4+
```bash
5+
gcloud run services list --region REGION
6+
# open the URL
7+
```
8+
9+
## Cloud SQL
10+
```bash
11+
gcloud sql instances list
12+
gcloud sql instances describe <instance-name> --format="value(ipAddresses)"
13+
# For private IP, connect from Cloud Run or a VM/container in the VPC
14+
```
15+
16+
## Load Balancer (private_mig)
17+
```bash
18+
gcloud compute forwarding-rules list --global
19+
gcloud compute addresses list --global
20+
gcloud compute backend-services list
21+
gcloud compute backend-services get-health <backend-name> --global
22+
```
23+
24+
## Instance Groups
25+
```bash
26+
gcloud compute instance-groups managed list
27+
gcloud compute instance-groups managed list-instances private-mig-mig-a --zone us-east1-b
28+
```
29+
30+
## Firewall
31+
```bash
32+
gcloud compute firewall-rules list --filter="name~allow-lb-hc"
33+
```
34+
35+
## Curl test
36+
```bash
37+
curl http://<LB_IP>/
38+
```

0 commit comments

Comments
 (0)