Olá!
Quem acompanha meu blog sabe que eu estou escrevendo um livro sobre DevOps para um editora indiana, um dos últimos capítulos que escrevi vou sobre Terraform e GCP, então resolvi pegar um pedaço e compartilhar com vocês aqui.
Vamos lá! Já estou considerando que você tem o Terraform instalado e a conta no GCP criada. Então o primeiro passo é acessar o console, depois IAM & Admin e criar uma Service Account com o nome terraform. 
Será pedido para que você selecione uma Role, que é a configuração responsável por definir os recursos que a sua Service Account pode gerenciar, nesse caso eu selecionei Compute Admin.
Prossiga com a criação, gere uma chave e salve no formato JSON. 
Faça o download do arquivo.json, pois ele será necessário para fazer a autenticação entre o Terraform e o Console do Google Cloud. Eu criei um diretório chamado ProductionInfrastructure onde eu vou salvar os arquivos:
PS C:\Users\1511 MXTI> mkdir ProductionInfrastructure
Directory: C:\Users\1511 MXTI
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/10/2020 12:07 PM ProductionInfrastructure
PS C:\Users\1511 MXTI> cd .\ProductionInfrastructure\ PS C:\Users\1511 MXTI\ProductionInfrastructure>
Dentro dele crie um arquivo chamado infrastructure.tf e coloque o arquivo.json que você baixou do google no mesmo diretório. Dentro do infrastructure.tf, cole o seguinte código:
provider "google" {
credentials = file("terraform_sa.json")
project = "alisson-187813"
region = "us-east1"
}
Pra que não sabe muito de Terraform, esse trecho de código é respectivo ao provider, que define com quem vamos nos conectar e como vamos nos conectar, nesse caso eu vou me contar com o Google, as minha credenciais de autenticação estão no arquivo terraform_sa.json, a infraestrutura será criada dentro do projeto alisson-187813 na região us-east1.
Esses providers não são baixados nativamente com o Terraform, então você precisa baixa-los para executar o seu código, isso é feito quando usando o comando terraform init.
C:\Users\1511 MXTI\ProductionInfrastructure> terraform init Initializing the backend... Initializing provider plugins... - Checking for available provider plugins... - Downloading plugin for provider "google" (hashicorp/google) 3.20.0... The following providers do not have any version constraints in configuration, so the latest version was installed. To prevent automatic upgrades to new major versions that may contain breaking changes, it is recommended to add version = "..." constraints to the corresponding provider blocks in configuration, with the constraint strings suggested below. * provider.google: version = "~> 3.20" Terraform has been successfully initialized! You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure. All Terraform commands should now work. If you ever set or change modules or backend configuration for Terraform, rerun this command to reinitialize your working directory. If you forget, other commands will detect it and remind you to do so if necessary.
Perfeito, agora vamos definir o trecho de código para a nossa instância.
provider "google" {
credentials = file("terraform_sa.json")
project = "alisson-187813"
region = "us-east1"
}
resource "google_compute_instance" "chapter8" {
name = "chapter8-instance"
machine_type = "g1-small"
zone = "us-east1-b"
boot_disk {
initialize_params {
image = "ubuntu-1804-bionic-v20200414"
}
}
network_interface {
network = "default"
access_config {
}
}
}
Acima definimos que eu vou utilizar o recurso google_compute_instance, que é respectivo as VMs no google, dentro desse recurso temos que definir alguns parametros que definem como a Máquina Virtual será criada, como tamanho da intância, nome que você utilizará para identificar a instancia, a zona em que ela será criada, a imagem, que no caso utilizei o ubuntu e a rede em que a máquina será criada, no access_config, ficou vazio pois utilizaremos as configurações padrão do google, no casso vamos ter um IP Publico por padrão.
Antes de executar o código, sempre utilizamos o comando terraform plan, esse comando vai verificar as diferenças entre o arquivo terraform.tfstate, que pode ser encontrado no mesmo diretório em que você criou o código, porém ele só é criado após você executar o plan. Então ele irá te mostrar as diferenças entre o estado controlado pelo terraform e o seu código/
PS C:\Users\1511 MXTI\ProductionInfrastructure> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# google_compute_instance.chapter8 will be created
+ resource "google_compute_instance" "chapter8" {
+ can_ip_forward = false
+ cpu_platform = (known after apply)
+ current_status = (known after apply)
+ deletion_protection = false
+ guest_accelerator = (known after apply)
+ id = (known after apply)
+ instance_id = (known after apply)
+ label_fingerprint = (known after apply)
+ machine_type = "g1-small"
+ metadata_fingerprint = (known after apply)
+ min_cpu_platform = (known after apply)
+ name = "chapter8-instance"
+ project = (known after apply)
+ self_link = (known after apply)
+ tags_fingerprint = (known after apply)
+ zone = "us-east1-b"
+ boot_disk {
+ auto_delete = true
+ device_name = (known after apply)
+ disk_encryption_key_sha256 = (known after apply)
+ kms_key_self_link = (known after apply)
+ mode = "READ_WRITE"
+ source = (known after apply)
+ initialize_params {
+ image = "ubuntu/ubuntu-1804-lts"
+ labels = (known after apply)
+ size = (known after apply)
+ type = (known after apply)
}
}
+ network_interface {
+ name = (known after apply)
+ network = "default"
+ network_ip = (known after apply)
+ subnetwork = (known after apply)
+ subnetwork_project = (known after apply)
+ access_config {
+ nat_ip = (known after apply)
+ network_tier = (known after apply)
}
}
+ scheduling {
+ automatic_restart = (known after apply)
+ on_host_maintenance = (known after apply)
+ preemptible = (known after apply)
+ node_affinities {
+ key = (known after apply)
+ operator = (known after apply)
+ values = (known after apply)
}
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.
Na saíde do comando, pode-se ver que na frente de todos os recursos existe o sinal de mais ( + ). Esse sinal indica que o recurso será criado, no final também pode-se ver essa linha que é muito importante: Plan: 1 to add, 0 to change, 0 to destroy.
Que resume tudo que será feito, mas o mais importante e ver que nada será destruido. Após validar se está tudo como você planejada, utilize o comando terraform apply para executar a criação da infraestrutura.
PS C:\Users\1511 MXTI\ProductionInfrastructure> terraform apply
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# google_compute_instance.chapter8 will be created
+ resource "google_compute_instance" "chapter8" {
+ can_ip_forward = false
+ cpu_platform = (known after apply)
+ current_status = (known after apply)
+ deletion_protection = false
+ guest_accelerator = (known after apply)
+ id = (known after apply)
+ instance_id = (known after apply)
+ label_fingerprint = (known after apply)
+ machine_type = "g1-small"
+ metadata_fingerprint = (known after apply)
+ min_cpu_platform = (known after apply)
+ name = "chapter8-instance"
+ project = (known after apply)
+ self_link = (known after apply)
+ tags_fingerprint = (known after apply)
+ zone = "us-east1-b"
+ boot_disk {
+ auto_delete = true
+ device_name = (known after apply)
+ disk_encryption_key_sha256 = (known after apply)
+ kms_key_self_link = (known after apply)
+ mode = "READ_WRITE"
+ source = (known after apply)
+ initialize_params {
+ image = "ubuntu-1804-bionic-v20200414"
+ labels = (known after apply)
+ size = (known after apply)
+ type = (known after apply)
}
}
+ network_interface {
+ name = (known after apply)
+ network = "default"
+ network_ip = (known after apply)
+ subnetwork = (known after apply)
+ subnetwork_project = (known after apply)
+ access_config {
+ nat_ip = (known after apply)
+ network_tier = (known after apply)
}
}
+ scheduling {
+ automatic_restart = (known after apply)
+ on_host_maintenance = (known after apply)
+ preemptible = (known after apply)
+ node_affinities {
+ key = (known after apply)
+ operator = (known after apply)
+ values = (known after apply)
}
}
}
Plan: 1 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
google_compute_instance.chapter8: Creating...
google_compute_instance.chapter8: Still creating... [10s elapsed]
google_compute_instance.chapter8: Creation complete after 14s [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
Muitos atributos da sua instância, só estarão disponíveis após a criação dela, como pro exemplo o IP Público, que é uma informação crucial, pois sem ela não conseguimos acessar a máquina, então vamos pegar esse informaçào utilizando o terraform output.
provider "google" {
credentials = file("terraform_sa.json")
project = "alisson-187813"
region = "us-east1"
}
resource "google_compute_instance" "chapter8" {
name = "chapter8-instance"
machine_type = "g1-small"
zone = "us-east1-b"
boot_disk {
initialize_params {
image = "ubuntu-1804-bionic-v20200414"
}
}
network_interface {
network = "default"
access_config {
}
}
}
output "name" {
value = google_compute_instance.chapter8.name
}
output "size" {
value = google_compute_instance.chapter8.machine_type
}
output "public_ip" {
value = google_compute_instance.chapter8.network_interface[0].access_config[0].nat_ip
}
Veja que no final eu final foi adicionado três novos trechos de códigos, que começam com output, então eu vou retornar o nome da instância, o tamanho dela e o endereço publico.
Como eu não estou modificando nada com relação a instância, eu só estou pegando informações, posso executar o terraform apply direto.
PS C:\Users\1511 MXTI\ProductionInfrastructure> terraform apply google_compute_instance.chapter8: Refreshing state... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance] Apply complete! Resources: 0 added, 0 changed, 0 destroyed. Outputs: name = chapter8-instance public_ip = 104.196.24.122 size = g1-small
Veja que agora após o apply foi mostrado as informações que eu requisitei no output. Mas eu não preciso executar o apply todas as vezes para ter essas informações. Abaixo um exemplo de como é retornada a execução do comando terraform output.
PS C:\Users\1511 MXTI\ProductionInfrastructure> terraform output name = chapter8-instance public_ip = 104.196.24.122 size = g1-small
Agora que já temos todas as informações necessárias, podemos adicionar a chave de SSH e acessar a instância. Para adicionar a chave de ssh adicione o código conforme abaixo:
provider "google" {
credentials = file("terraform_sa.json")
project = "alisson-187813"
region = "us-east1"
}
resource "google_compute_instance" "chapter8" {
name = "chapter8-instance"
machine_type = "g1-small"
zone = "us-east1-b"
boot_disk {
initialize_params {
image = "ubuntu-1804-bionic-v20200414"
}
}
network_interface {
network = "default"
access_config {
}
}
metadata = {
sshKeys = join("",["alisson:",file("id_rsa.pub")])
}
}
output "name" {
value = google_compute_instance.chapter8.name
}
output "size" {
value = google_compute_instance.chapter8.machine_type
}
output "public_ip" {
value = google_compute_instance.chapter8.network_interface[0].access_config[0].nat_ip
}
Veja que na parte da instância, foi adicionado um novo atributo chamado metadata e dentro dele temos sshKeys, que recebe uma string seguindo o padrão: usuario:chave_publica Que no caso eu coloquei a minha chave padrão id_rsa.pub, que pode ser encontrada geralmente dentro de ~/.ssh , caso você já tenha gerado ela. Agora vamos executar esse código:
PS C:\Users\1511 MXTI\ProductionInfrastructure> terraform apply google_compute_instance.chapter8: Refreshing state... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance]
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
~ update in-place
Terraform will perform the following actions:
# google_compute_instance.chapter8 will be updated in-place
~ resource "google_compute_instance" "chapter8" {
can_ip_forward = false
cpu_platform = "Intel Haswell"
current_status = "RUNNING"
deletion_protection = false
enable_display = false
guest_accelerator = []
id = "projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance"
instance_id = "9170008912891805003"
label_fingerprint = "42WmSpB8rSM="
labels = {}
machine_type = "g1-small"
~ metadata = {
+ "sshKeys" = <<~EOT
alisson:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChi8HX26xv9Rk9gz47Qhb+Tu7MRqGIyPxnheIeEgFad/dlqG4w4pY7y5dtx5LNGE9C01varco5dZagqsHplI7M+5ECSvjAuS6b5rkYZwZiZruDXxckcQHFpr2yIz3DOzKRTUc5Hg5JHF5aymiqyVfTsxL/aI/LDY8Ikh+INn3S9+b5bZtU+74tA6yuqth5SCtNSWwMUlv7QL6ONHtQiviAjBe+ksDBBV6thWz2ZIJA/jApSIBJWK9AWmZwq2hFy9sOZArUDB2Kt6kl3rIZnHpqJ/GMUCxFhtggYamJ5J2H6277qLFqLZ/8tum9uc5l/lSWYKTDm2+E/prQfmFrxPf9 alisson
EOT
}
metadata_fingerprint = "bxkbv_NPHas="
name = "chapter8-instance"
project = "alisson-187813"
resource_policies = []
self_link = "https://www.googleapis.com/compute/v1/projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance"
tags = []
tags_fingerprint = "42WmSpB8rSM="
zone = "us-east1-b"
boot_disk {
auto_delete = true
device_name = "persistent-disk-0"
mode = "READ_WRITE"
source = "https://www.googleapis.com/compute/v1/projects/alisson-187813/zones/us-east1-b/disks/chapter8-instance"
initialize_params {
image = "https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/images/ubuntu-1804-bionic-v20200414"
labels = {}
size = 10
type = "pd-standard"
}
}
network_interface {
name = "nic0"
network = "https://www.googleapis.com/compute/v1/projects/alisson-187813/global/networks/default"
network_ip = "10.142.0.3"
subnetwork = "https://www.googleapis.com/compute/v1/projects/alisson-187813/regions/us-east1/subnetworks/default"
subnetwork_project = "alisson-187813"
access_config {
nat_ip = "104.196.24.122"
network_tier = "PREMIUM"
}
}
scheduling {
automatic_restart = true
on_host_maintenance = "MIGRATE"
preemptible = false
}
shielded_instance_config {
enable_integrity_monitoring = true
enable_secure_boot = false
enable_vtpm = true
}
}
Plan: 0 to add, 1 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
google_compute_instance.chapter8: Modifying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance]
google_compute_instance.chapter8: Still modifying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 10s elapsed]
google_compute_instance.chapter8: Modifications complete after 13s [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance]
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
Outputs:
name = chapter8-instance
public_ip = 104.196.24.122
size = g1-small
Note que mesmo executando o apply direto, sempre é exibido o plan, para você saber o que será modificado e é requerido que você digite yes, para continuar. Agora que tudo já foi criado e configurado para acessar, vamos testar esse acesso:
PS C:\Users\1511 MXTI\ProductionInfrastructure> ssh alisson@104.196.24.122 Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 5.0.0-1034-gcp x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Mon May 11 13:21:39 UTC 2020
System load: 0.0 Processes: 94
Usage of /: 12.8% of 9.52GB Users logged in: 0
Memory usage: 13% IP address for ens4: 10.142.0.3
Swap usage: 0%
* Ubuntu 20.04 LTS is out, raising the bar on performance, security,
and optimisation for Intel, AMD, Nvidia, ARM64 and Z15 as well as
AWS, Azure and Google Cloud.
https://ubuntu.com/blog/ubuntu-20-04-lts-arrives
0 packages can be updated.
0 updates are security updates.
The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.
alisson@chapter8-instance:~$
Agora que tudo já foi criado e está funcionando, vamos destruir pra não ter uma surpresa com a fatura do cartào depois.
PS C:\Users\1511 MXTI\ProductionInfrastructure> terraform destroy google_compute_instance.chapter8: Refreshing state... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance]
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
- destroy
Terraform will perform the following actions:
# google_compute_instance.chapter8 will be destroyed
- resource "google_compute_instance" "chapter8" {
- can_ip_forward = false -> null
- cpu_platform = "Intel Haswell" -> null
- current_status = "RUNNING" -> null
- deletion_protection = false -> null
- enable_display = false -> null
- guest_accelerator = [] -> null
- id = "projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance" -> null
- instance_id = "9170008912891805003" -> null
- label_fingerprint = "42WmSpB8rSM=" -> null
- labels = {} -> null
- machine_type = "g1-small" -> null
- metadata = {
- "sshKeys" = <<~EOT
alisson:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQChi8HX26xv9Rk9gz47Qhb+Tu7MRqGIyPxnheIeEgFad/dlqG4w4pY7y5dtx5LNGE9C01varco5dZagqsHplI7M+5ECSvjAuS6b5rkYZwZiZruDXxckcQHFpr2yIz3DOzKRTUc5Hg5JHF5aymiqyVfTsxL/aI/LDY8Ikh+INn3S9+b5bZtU+74tA6yuqth5SCtNSWwMUlv7QL6ONHtQiviAjBe+ksDBBV6thWz2ZIJA/jApSIBJWK9AWmZwq2hFy9sOZArUDB2Kt6kl3rIZnHpqJ/GMUCxFhtggYamJ5J2H6277qLFqLZ/8tum9uc5l/lSWYKTDm2+E/prQfmFrxPf9 alisson
EOT
} -> null
- metadata_fingerprint = "lZHcUBfXG-4=" -> null
- name = "chapter8-instance" -> null
- project = "alisson-187813" -> null
- resource_policies = [] -> null
- self_link = "https://www.googleapis.com/compute/v1/projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance" -> null
- tags = [] -> null
- tags_fingerprint = "42WmSpB8rSM=" -> null
- zone = "us-east1-b" -> null
- boot_disk {
- auto_delete = true -> null
- device_name = "persistent-disk-0" -> null
- mode = "READ_WRITE" -> null
- source = "https://www.googleapis.com/compute/v1/projects/alisson-187813/zones/us-east1-b/disks/chapter8-instance" -> null
- initialize_params {
- image = "https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/images/ubuntu-1804-bionic-v20200414" -> null
- labels = {} -> null
- size = 10 -> null
- type = "pd-standard" -> null
}
}
- network_interface {
- name = "nic0" -> null
- network = "https://www.googleapis.com/compute/v1/projects/alisson-187813/global/networks/default" -> null
- network_ip = "10.142.0.3" -> null
- subnetwork = "https://www.googleapis.com/compute/v1/projects/alisson-187813/regions/us-east1/subnetworks/default" -> null
- subnetwork_project = "alisson-187813" -> null
- access_config {
- nat_ip = "104.196.24.122" -> null
- network_tier = "PREMIUM" -> null
}
}
- scheduling {
- automatic_restart = true -> null
- on_host_maintenance = "MIGRATE" -> null
- preemptible = false -> null
}
- shielded_instance_config {
- enable_integrity_monitoring = true -> null
- enable_secure_boot = false -> null
- enable_vtpm = true -> null
}
}
Plan: 0 to add, 0 to change, 1 to destroy.
Do you really want to destroy all resources?
Terraform will destroy all your managed infrastructure, as shown above.
There is no undo. Only 'yes' will be accepted to confirm.
Enter a value: yes
google_compute_instance.chapter8: Destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 10s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 20s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 30s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 40s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 50s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 1m0s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 1m10s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 1m20s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 1m30s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 1m40s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 1m50s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 2m0s elapsed]
google_compute_instance.chapter8: Still destroying... [id=projects/alisson-187813/zones/us-east1-b/instances/chapter8-instance, 2m10s elapsed]
google_compute_instance.chapter8: Destruction complete after 2m19s
Destroy complete! Resources: 1 destroyed.
Resumidamente é isso ai haha.
Obrigado galera!