Install GCP (Optional)

This is a model for creating in Python an GKE environment with the GCP provider on Pulumi using GitHub Actions.

Access "https://github.com/smashse/pulumi-iac-gke"
Click in "Use this template"
Create a new repository from template "pulumi-iac-gke"(example "pulumi-iac-gke") and chose as "Private"

Install GCP (Optional)

cd /tmp
sudo touch /etc/apt/sources.list.d/google-cloud-sdk.list
sudo chmod 666 /etc/apt/sources.list.d/google-cloud-sdk.list
sudo curl -fsSL 'https://packages.cloud.google.com/apt/doc/apt-key.gpg' | sudo apt-key add -
sudo echo "deb [arch=amd64] https://packages.cloud.google.com/apt cloud-sdk main" > "/etc/apt/sources.list.d/google-cloud-sdk.list"
sudo chmod 644 /etc/apt/sources.list.d/google-cloud-sdk.list
sudo apt-key adv --keyserver hkp:https://keyserver.ubuntu.com:80 --recv-keys 54A647F9048D5688D7DA2ABE6A030B21BA07F4FB
sudo apt update --fix-missing
sudo apt -y install google-cloud-sdk
gcloud init

Configure environment

Authorize gcloud to access the Cloud Platform with Google user credentials

gcloud auth login

List organizations accessible by the active account

gcloud organizations list

List billing account ID

gcloud beta billing accounts list --filter=open=true

Create the PULUMI Project

Note: Project IDs are immutable and can be set only during project creation. They must start with a lowercase letter and can have lowercase ASCII letters, digits or hyphens. Project IDs must be between 6 and 30 characters. To avoid conflicts, when creating a project the ID is generated randomly, if you want to use a fixed ID after the project name, do as below.

export PROJECT_ID=`date +%M%S%N`
gcloud projects create gke-project-$PROJECT_ID --name=gke-project --set-as-default
gcloud config set project gke-project-$PROJECT_ID
gcloud beta billing projects link gke-project-$PROJECT_ID --billing-account `gcloud beta billing accounts list --filter=open=true --uri | cut -f 6 -d "/"`

Create the PULUMI service account

gcloud iam service-accounts create gkeadmin --display-name "GKE Admin"
gcloud iam service-accounts keys create ~/.config/gcloud/gkeadmin-account.json --iam-account gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com

Enable API Services

gcloud services enable cloudbilling.googleapis.com
gcloud services enable cloudresourcemanager.googleapis.com
gcloud services enable compute.googleapis.com
gcloud services enable container.googleapis.com
gcloud services enable gkeconnect.googleapis.com
gcloud services enable iam.googleapis.com
gcloud services enable serviceusage.googleapis.com

Grant the service account permission

gcloud projects add-iam-policy-binding gke-project-$PROJECT_ID --member serviceAccount:gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com --role roles/compute.admin
gcloud projects add-iam-policy-binding gke-project-$PROJECT_ID --member serviceAccount:gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com --role roles/container.clusterAdmin
gcloud projects add-iam-policy-binding gke-project-$PROJECT_ID --member serviceAccount:gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com --role roles/iam.serviceAccountAdmin
gcloud projects add-iam-policy-binding gke-project-$PROJECT_ID --member serviceAccount:gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com --role roles/iam.serviceAccountKeyAdmin
gcloud projects add-iam-policy-binding gke-project-$PROJECT_ID --member serviceAccount:gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com --role roles/iam.serviceAccountUser
gcloud projects add-iam-policy-binding gke-project-$PROJECT_ID --member serviceAccount:gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com --role roles/iap.httpsResourceAccessor
gcloud projects add-iam-policy-binding gke-project-$PROJECT_ID --member serviceAccount:gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com --role roles/storage.admin
gcloud projects add-iam-policy-binding gke-project-$PROJECT_ID --member serviceAccount:gkeadmin@gke-project-$PROJECT_ID.iam.gserviceaccount.com --role roles/viewer

Download the PULUMI template

mkdir -p $HOME/Pulumi
cd $HOME/Pulumi
git clone https://github.com/yourgithubuser/pulumi-iac-gke.git
cd pulumi-iac-gke

Install Pulumi on Linux by running the installation script:

curl -fsSL https://get.pulumi.com | sh && bash

Install Python VirtualEnv:

sudo apt -y install python3-virtualenv

Create a "pulumi_gke_py" project:

cd $HOME/Pulumi/pulumi-iac-gke/pulumi_gke_py

Note: If you want to change the name given to Kubernetes cluster, execute the command below in the template folder.

sed -i "s/"template-"/"desiredname-"/g" *.py

Install Python Requirements

python3 -m venv venv
source venv/bin/activate
python -m pip install --upgrade pip setuptools wheel
python -m pip install -r requirements.txt

Perform an initial deployment, run the following commands:

pulumi login
pulumi stack init pulumi_gke_py

Set GCP_PROJECT:

pulumi config set gcp:project gke-project-$PROJECT_ID

Set GCP_REGION:

pulumi config set gcp:zone us-west1-a

Review the "pulumi_gke_py" project

pulumi preview

Enable Workflow

cd $HOME/Pulumi/pulumi-iac-gke/.github/workflows

mv pull_request.yml.template pull_request.yml
mv push.yml.template push.yml

Environment Variables

There are a number of Environment Variables that can be set to interact with the action:

By default, Pulumi will try to connect to the Pulumi SaaS. For this to happen, the GitHub Action needs to be passed a "PULUMI_ACCESS_TOKEN".

Google Cloud Platform (GCP)

For GCP, you'll need to create or use or use an existing service account key. Please see the Pulumi documentation page for pointers to the relevant GCP documentation for doing this.

As soon as you have credentials in hand, you'll set the environment variable "GOOGLE_CREDENTIALS" to contain the credentials JSON using GitHub Secrets, and then consume it in your action:

How to get JSON for credentials?

gcloud auth application-default login
cat $HOME/.config/gcloud/application_default_credentials.json

Note: Go to Settings> Secrets and add "PULUMI_ACCESS_TOKEN" and "GOOGLE_CREDENTIALS" as new repository secret.

Commit the changes

cd $HOME/Pulumi/pulumi-iac-gke/

git add *
git add .github/workflows/*
git add .pulumi/*
git add pulumi_gke_py/*
git commit -m "pulumi-iac-gke"
git push

Access GKE Kubernetes cluster

sudo snap install kubectl --classic
pulumi stack output kubeconfig > kubeconfig.yaml
KUBECONFIG=./kubeconfig.yaml kubectl get po --all-namespaces

Destroy the "pulumi_gke_py" project

cd $HOME/Pulumi/pulumi-iac-gke/pulumi_gke_py
pulumi destroy

Remove the "pulumi_gke_py" project from Stack

cd $HOME/Pulumi/pulumi-iac-gke/pulumi_gke_py
pulumi stack rm pulumi_gke_py

Source:

https://www.pulumi.com/docs/get-started/

https://www.pulumi.com/docs/reference/pkg/

https://www.pulumi.com/docs/intro/concepts/state/

https://www.pulumi.com/docs/guides/continuous-delivery/github-actions/

https://github.com/pulumi/actions

Name		Name	Last commit message	Last commit date
Latest commit History 8 Commits
.github/workflows		.github/workflows
.pulumi		.pulumi
pulumi_gke_py		pulumi_gke_py
LICENSE		LICENSE
README.md		README.md

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

Install GCP (Optional)

Configure environment

Authorize gcloud to access the Cloud Platform with Google user credentials

List organizations accessible by the active account

List billing account ID

Create the PULUMI Project

Create the PULUMI service account

Enable API Services

Grant the service account permission

Download the PULUMI template

Install Pulumi on Linux by running the installation script:

Install Python VirtualEnv:

Create a "pulumi_gke_py" project:

Install Python Requirements

Perform an initial deployment, run the following commands:

Set GCP_PROJECT:

Set GCP_REGION:

Review the "pulumi_gke_py" project

Enable Workflow

Environment Variables

Google Cloud Platform (GCP)

Commit the changes

Access GKE Kubernetes cluster

Destroy the "pulumi_gke_py" project

Remove the "pulumi_gke_py" project from Stack

Source:

About

Releases

Packages

Languages

License

smashse/pulumi-iac-gke

Folders and files

Latest commit

History

Repository files navigation

Install GCP (Optional)

Configure environment

Authorize gcloud to access the Cloud Platform with Google user credentials

List organizations accessible by the active account

List billing account ID

Create the PULUMI Project

Create the PULUMI service account

Enable API Services

Grant the service account permission

Download the PULUMI template

Install Pulumi on Linux by running the installation script:

Install Python VirtualEnv:

Create a "pulumi_gke_py" project:

Install Python Requirements

Perform an initial deployment, run the following commands:

Set GCP_PROJECT:

Set GCP_REGION:

Review the "pulumi_gke_py" project

Enable Workflow

Environment Variables

Google Cloud Platform (GCP)

Commit the changes

Access GKE Kubernetes cluster

Destroy the "pulumi_gke_py" project

Remove the "pulumi_gke_py" project from Stack

Source:

About

Resources

License

Stars

Watchers

Forks

Releases

Packages 0

Languages

Packages