GithubValidationREPO/googlekubernetesLogSetup.tf at main · Alekhya0824/GithubValidationREPO · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "3.73.0"
    }
  }

  required_version = ">= 0.15.0"
}

data "google_project" "project" {
  project_id = "Enter Project ID"
}

variable "topic-name" {
  type    = string
  default = "sentinel-GCPGKE-topic"
  description = "Name of existing topic"
}

variable "organization-id" {
  type    = string
  default = ""
  description = "Organization id"
}

resource "google_project_service" "enable-logging-api" {
  service = "logging.googleapis.com"
  project = data.google_project.project.project_id
}

resource "google_pubsub_topic" "sentinel-GCPGKE-topic" {
  count = "${var.topic-name != "sentinel-GCPGKE-topic" ? 0 : 1}"
  name = var.topic-name
  project = data.google_project.project.project_id
}

resource "google_pubsub_subscription" "sentinel-subscription" {
  project = data.google_project.project.project_id
  name  = "sentinel-subscription-GCPGKElogs"
  topic = var.topic-name
  depends_on = [google_pubsub_topic.sentinel-GCPGKE-topic]
}

resource "google_logging_project_sink" "sentinel-sink" {
  project = data.google_project.project.project_id
  count = var.organization-id == "" ? 1 : 0
  name = "GCPGKE-logs-sentinel-sink"
  destination = "pubsub.googleapis.com/projects/${data.google_project.project.project_id}/topics/${var.topic-name}"
  depends_on = [google_pubsub_topic.sentinel-GCPGKE-topic]

  filter = "(resource.type=\"k8s_cluster\") OR logName =~ \"apiserver$\" OR logName =~ \"scheduler$\" OR logName =~ \"controller-manager$\" OR logName =~ \"hpa-controller$\" OR logName =~ \".*stdout$\" OR logName =~ \".*stderr$\""
  unique_writer_identity = true
}

resource "google_logging_organization_sink" "sentinel-organization-sink" {
  count = var.organization-id == "" ? 0 : 1
  name   = "GCPGKE-logs-organization-sentinel-sink"
  org_id = var.organization-id
  destination = "pubsub.googleapis.com/projects/${data.google_project.project.project_id}/topics/${var.topic-name}"

  filter = "(resource.type=\"k8s_cluster\") OR logName =~ \"apiserver$\" OR logName =~ \"scheduler$\" OR logName =~ \"controller-manager$\" OR logName =~ \"hpa-controller$\" OR logName =~ \".*stdout$\" OR logName =~ \".*stderr$\""
  include_children = true
}

resource "google_project_iam_binding" "log-writer" {
  count = var.organization-id == "" ? 1 : 0
  project = data.google_project.project.project_id
  role = "roles/pubsub.publisher"

  members = [
    google_logging_project_sink.sentinel-sink[0].writer_identity
  ]
}

resource "google_project_iam_binding" "log-writer-organization" {
  count = var.organization-id == "" ? 0 : 1
  project = data.google_project.project.project_id
  role = "roles/pubsub.publisher"

  members = [
    google_logging_organization_sink.sentinel-organization-sink[0].writer_identity
  ]
}

output "An_output_message"{
  value = "Please copy the following values to Sentinel"
}

output "GCP_project_id" {
  value       = data.google_project.project.project_id
}

output "GCP_project_number" {
  value       = data.google_project.project.number
}

output "GCP_subscription_name" {
  value       = google_pubsub_subscription.sentinel-subscription.name
}