cloud-foundation-fabric/modules/compute-vm

Google Compute Engine VM module

This module can operate in two distinct modes:

• instance creation, with optional unmanaged group
• instance template creation

In both modes, an optional service account can be created and assigned to either instances or template. If you need a managed instance group when using the module in template mode, refer to the compute-mig module.

Examples

Instance leveraging defaults

The simplest example leverages defaults for the boot disk image and size, and uses a service account created by the module. Multiple instances can be managed via the instance_count variable.

module "simple-vm-example" {
  source     = "../modules/compute-vm"
  project_id = "my-project"
  region     = "europe-west1"
  name       = "test"
  network_interfaces = [{
    network    = local.network_self_link,
    subnetwork = local.subnet_self_link,
    nat        = false,
    addresses  = null
  }]
  service_account_create = true
  instance_count = 1
}

Disk encryption with Cloud KMS

This example shows how to control disk encryption via the the encryption variable, in this case the self link to a KMS CryptoKey that will be used to encrypt boot and attached disk. Managing the key with the ../kms module is of course possible, but is not shown here.

module "kms-vm-example" {
  source     = "../modules/compute-vm"
  project_id = local.project_id
  region     = local.region
  name       = "kms-test"
  network_interfaces = [{
    network    = local.network_self_link,
    subnetwork = local.subnet_self_link,
    nat        = false,
    addresses  = null
  }]
  attached_disks = [
    {
      name  = "attached-disk"
      size  = 10
      image = null
      options = {
        auto_delete = true
        mode        = null
        source      = null
        type        = null
      }
    }
  ]
  service_account_create = true
  instance_count         = 1
  boot_disk = {
    image        = "projects/debian-cloud/global/images/family/debian-10"
    type         = "pd-ssd"
    size         = 10
  }
  encryption = {
    encrypt_boot            = true
    disk_encryption_key_raw = null
    kms_key_self_link       = local.kms_key.self_link
  }
}

Instance template

This example shows how to use the module to manage an instance template that defines an additional attached disk for each instance, and overrides defaults for the boot disk image and service account.

module "cos-test" {
  source     = "../modules/compute-vm"
  project_id = "my-project"
  region     = "europe-west1"
  name       = "test"
  network_interfaces = [{
    network    = local.network_self_link,
    subnetwork = local.subnet_self_link,
    nat        = false,
    addresses  = null
  }]
  instance_count = 1
  boot_disk      = {
    image = "projects/cos-cloud/global/images/family/cos-stable"
    type  = "pd-ssd"
    size  = 10
  }
  attached_disks = [
    { name = "disk-1", size = 10, image = null, options = null }
  ]
  service_account        = "vm-default@my-project.iam.gserviceaccount.com"
  use_instance_template  = true
}

Instance group

If an instance group is needed when operating in instance mode, simply set the group variable to a non null map. The map can contain named port declarations, or be empty if named ports are not needed.

module "instance-group" {
  source     = "../../cloud-foundation-fabric/modules/compute-vm"
  project_id = "my-project"
  region     = "europe-west1"
  name       = "ilb-test"
  network_interfaces = [{
    network    = local.network_self_link,
    subnetwork = local.subnetwork_self_link,
    nat        = false,
    addresses  = null
  }]
  boot_disk = {
    image = "projects/cos-cloud/global/images/family/cos-stable"
    type  = "pd-ssd"
    size  = 10
  }
  service_account        = local.service_account_email
  service_account_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
  metadata = {
    user-data = local.cloud_config
  }
  group = { named_ports = {} }
}

Variables

name	description	type	required	default
name	Instances base name.	string	✓
network_interfaces	Network interfaces configuration. Use self links for Shared VPC, set addresses to null if not needed.	list(object({...}))	✓
project_id	Project id.	string	✓
region	Compute region.	string	✓
attached_disk_defaults	Defaults for attached disks options.	object({...})		...
attached_disks	Additional disks, if options is null defaults will be used in its place.	list(object({...}))		[]
boot_disk	Boot disk properties.	object({...})		...
can_ip_forward	Enable IP forwarding.	bool		false
encryption	Encryption options. Only one of kms_key_self_link and disk_encryption_key_raw may be set. If needed, you can specify to encrypt or not the boot disk.	object({...})		null
group	Define this variable to create an instance group for instances. Disabled for template use.	object({...})		null
hostname	Instance FQDN name.	string		null
iam_members	Map of member lists used to set authoritative bindings, keyed by role. Ignored for template use.	map(list(string))		{}
iam_roles	List of roles used to set authoritative bindings. Ignored for template use.	list(string)		[]
instance_count	Number of instances to create (only for non-template usage).	number		1
instance_type	Instance type.	string		f1-micro
labels	Instance labels.	map(string)		{}
metadata	Instance metadata.	map(string)		{}
metadata_list	List of instance metadata that will be cycled through. Ignored for template use.	list(map(string))		[]
min_cpu_platform	Minimum CPU platform.	string		null
options	Instance options.	object({...})		...
scratch_disks	Scratch disks configuration.	object({...})		...
service_account	Service account email. Unused if service account is auto-created.	string		null
service_account_create	Auto-create service account.	bool		false
service_account_scopes	Scopes applied to service account.	list(string)		[]
shielded_config	Shielded VM configuration of the instances.	object({...})		null
tags	Instance tags.	list(string)		[]
use_instance_template	Create instance template instead of instances.	bool		false
zones	Compute zone, instance will cycle through the list, defaults to the 'b' zone in the region.	list(string)		[]

Outputs

name	description	sensitive
external_ips	Instance main interface external IP addresses.
group	Instance group resource.
instances	Instance resources.
internal_ips	Instance main interface internal IP addresses.
names	Instance names.
self_links	Instance self links.
service_account	Service account resource.
service_account_email	Service account email.
service_account_iam_email	Service account email.
template	Template resource.
template_name	Template name.

TODO

• add support for instance groups