GCP Terraform GKE platform Design and implementation

Node pool SURGE settings

What this code does: Defines the game node pool to autoscale between 3 and 12 nodes and sets the upgrade strategy to SURGE. max_surge 5 brings five new nodes up first, and max_unavailable 0 means no existing node is taken away before its replacement is ready, so serving capacity does not drop during an upgrade. As the comment says, the soak time below is read only if the strategy is switched to BLUE_GREEN.

  node_pool = {
    game = {
      autoscaling_enable = true
      min_node_count     = 3
      max_node_count     = 12
      location_policy    = "BALANCED"
      node_count         = null
      pool_version       = "1.31"
      machine_type       = "e2-standard-4"
      tags               = ["gke-node"]

      # Five extra nodes come up first, and no node is taken away until its replacement is ready.
      strategy        = ["SURGE"]
      max_surge       = 5
      max_unavailable = 0

      # Soak time is read only when the strategy is switched to BLUE_GREEN.
      node_pool_soak_duration = "3600s"
    }
  }

A VPN-only firewall baseline

What this code does: Declares firewall rules as a map, and the c2s-inbound-vpn rule allows incoming (INGRESS) tcp traffic. The only sources are the VPN ranges passed in as a variable (vpn_source_ranges), only the management ports from another variable (management_ports) are opened, and priority 1000 makes it apply before the deny rules that follow. Because ranges and ports are variables, the same rule structure is reused across environments.

locals {
  firewall_rules = {
    c2s-inbound-vpn = {
      direction            = "INGRESS"
      action               = "allow"
      ranges               = var.vpn_source_ranges
      sources              = null
      targets              = null
      use_service_accounts = false
      enable_logging       = false
      priority             = "1000"
      rules = [
        {
          protocol = "tcp"
          ports    = var.management_ports
        }
      ]
    }