PF-02 · GCP · IaC
GCP Terraform GKE platform
A module set that keeps capacity during GKE node pool upgrades with SURGE, and opens only what a VPN needs through a firewall baseline, all as code.
- 22
- Terraform modules
- 5
- Extra nodes first (max_surge)
- 0
- Nodes down at once (max_unavailable)
- Problem
-
A GKE node upgrade must not reduce serving capacity, and management ports should open only from a VPN.
- Approach
-
The node pool upgrades with SURGE: five new nodes come up first and unavailable stays at zero. The c2sfirewall module opens management ports from the VPN at priority 1000 and denies other tcp and udp outbound at priority 65534.
- Result
-
Old nodes leave only after replacements are ready. Host errors flow from the hostError audit log to a log-based metric, an alert policy, and a Slack channel.
- What I learned
-
I learned that judging behavior from a setting's name can be wrong. A value like soak time sounds as if it applies to every upgrade, but it is read only under the BLUE_GREEN strategy, so the SURGE example states in a comment that the value has no effect there. Protecting capacity during upgrades also works only when the intent is pinned in numbers, such as bring five new nodes up first (max_surge 5) and take none away (max_unavailable 0), so the result stays the same whoever runs it. The firewall follows the same idea: the module ships a baseline that opens only management ports at priority 1000 and blocks the rest at 65534, so every new environment starts from the same rules.