Terraform Gcp Infrastructure Elements

This project is intended to gather common elements for GCP infrastructures in order to centralize security configurations and best practices.

We suggest following Terraform best practices as described in https://www.terraform-best-practices.com/code-structure.

SSL default policy

Creates a default policy for SSL that disables unsecure ciphers and tls<1.2

Google Cloud Logging Exclusions

Creates standard logging exclusions for Google Cloud projects.

Features

• Creates a health probe exclusion to filter out traffic from monitoring systems
• Creates a default exclusion for common Kubernetes system logs
• Configurable list of probe user agents to exclude

Usage

module "logging_exclusions" {
  source = "./modules/logging-exclusions"
  
  project_id = var.project
  
  # Selectively enable or disable specific exclusions
  enable_exclusions = {
    probe_exclusion                   = true
    default_k8s_exclusion             = true
    gke_metadata_server_sync_sandbox  = false  # Disable this exclusion
  }
}

Providers

Name	Version
google	>= 5.13

Requirements

Name	Version
terraform	>= 1.5
google	>= 5.13

Inputs

Name	Description	Type	Default	Required
custom_exclusions	Map of custom exclusion filters with their descriptions	map(object({ filter = string description = string }))	{}	no
default_exclusion_filter	Filter for default log exclusion	string	"resource.type=\"k8s_cluster\" AND (protoPayload.authenticationInfo.principalEmail=~\"container-engine-robot.iam.gserviceaccount.com\" OR protoPayload.authenticationInfo.principalEmail=\"system:kubestore-collector\" OR protoPayload.authenticationInfo.principalEmail=\"system:cloud-controller-manager\" OR protoPayload.authenticationInfo.principalEmail=\"system:kube-scheduler\" OR protoPayload.authenticationInfo.principalEmail=\"system:cluster-autoscaler\" OR protoPayload.authenticationInfo.principalEmail=\"system:l7-lb-controller\" OR protoPayload.authenticationInfo.principalEmail=\"system:kube-controller-manager\" OR protoPayload.authenticationInfo.principalEmail=\"system:serviceaccount:kube-system:metrics-server\" OR protoPayload.authenticationInfo.principalEmail=\"system:addon-manager\" OR protoPayload.authenticationInfo.principalEmail=\"system:vpa-recommender\" OR protoPayload.authenticationInfo.principalEmail=\"system:gke-master-healthcheck\" OR protoPayload.authenticationInfo.principalEmail=\"system:managed-certificate-controller\" OR protoPayload.authenticationInfo.principalEmail=\"system:clustermetrics\" OR protoPayload.authenticationInfo.principalEmail=\"system:pd-csi-controller\" OR protoPayload.authenticationInfo.principalEmail=\"system:konnectivity-server\" OR protoPayload.authenticationInfo.principalEmail=\"system:serviceaccount:kube-system:kube-dns-autoscaler\" OR protoPayload.authenticationInfo.principalEmail=\"system:serviceaccount:kube-system:generic-garbage-collector\" OR protoPayload.authenticationInfo.principalEmail=\"system:gke-common-webhooks\" OR protoPayload.authenticationInfo.principalEmail=\"system:serviceaccount:kube-system:resourcequota-controller\" OR protoPayload.authenticationInfo.principalEmail=\"system:serviceaccount:kube-system:konnectivity-agent-cpha\" OR protoPayload.authenticationInfo.principalEmail=\"system:serviceaccount:kube-system:persistent-volume-binder\" OR (protoPayload.authenticationInfo.principalEmail=\"system:apiserver\" AND protoPayload.methodName=\"io.k8s.core.v1.endpoints.get\") OR protoPayload.methodName=~\"watch\" OR protoPayload.methodName=~\"io.k8s.apiserver.flowcontrol\" OR protoPayload.methodName=~\"io.k8s.discovery.v1.endpointslices\" OR protoPayload.methodName=~\"io.k8s.v1.nodes.watch\" OR protoPayload.methodName=~\"io.k8s.coordination.v1.leases\" OR protoPayload.methodName=~\"io.k8s.core.v1.componentstatuses\" OR protoPayload.methodName=~\"io.k8s.autoscaling\" OR protoPayload.methodName=~\"io.k8s.metrics.v1beta1\" OR protoPayload.methodName=~\"io.k8s.authorization.v1.selfsubjectaccessreviews\" OR protoPayload.methodName=~\"io.k8s.core.v1.nodes.status.patch\" OR (protoPayload.methodName=~\"io.k8s.get\" AND protoPayload.resourceName =~ \"metrics\") OR (protoPayload.methodName=~\"io.k8s.core.v1.configmaps.get\" AND protoPayload.resourceName =~ \"metrics\") OR protoPayload.resourceName=\"readyz\" OR protoPayload.resourceName=\"livez\")\n"	no
enable_exclusions	Map of boolean flags to enable/disable individual exclusions	map(bool)	{ "default_k8s_exclusion": true, "fluentbit_gke": true, "fpm": true, "gke_metadata_server_sync_sandbox": true, "probe_exclusion": true }	no
enable_ssl_policy	Enable SSL policy creation	bool	true	no
fluentbit_gke	Fluentbit-gke exclusion for failed to parse time	string	"resource.labels.container_name=\"fluentbit-gke\" AND \njsonPayload.message=~\"Failed to parse time\"\n"	no
fpm	FPM exclusion	string	"resource.type=\"container\" AND\n\"fpm\" AND\n( \n ( trace:* sample(trace, 0.5) ) OR\n ( NOT trace:* operation.id:* sample(operation.id, 0.5) ) OR\n ( NOT trace:* NOT operation.id:* sample(insertId, 0.5) ) \n)\n"	no
gke_metadata_server_exclusion_sync_sandbox	Filter for gke-metadata-server exclusion for failed to sync sandbox	string	"resource.type=\"k8s_container\" AND\nseverity=INFO AND\nresource.labels.namespace_name=\"kube-system\" AND\nlabels.k8s-pod/k8s-app=\"gke-metadata-server\" AND\njsonPayload.message=~\"Unable to sync sandbox\"\n"	no
probe_user_agents	List of probe user agents to exclude from logs	list(string)	[ "kube-probe", "GoogleHC" ]	no
project_id	The Google Cloud project ID where logging exclusions will be created	string	n/a	yes

Outputs

Name	Description
default_exclusion_id	The ID of the default exclusion resource
fluentbit_gke_exclusion_id	The ID of the Fluentbit GKE exclusion resource
fpm_exclusion_id	The ID of the FPM exclusion resource
gke_metadata_server_exclusion_id	The ID of the GKE metadata server exclusion resource
probe_exclusion_filter	The filter used for probe exclusions
probe_exclusion_id	The ID of the probe exclusion resource

Resources

Name	Type
google_compute_ssl_policy.modern_tls_1_2	resource
google_logging_project_exclusion.custom_exclusions	resource
google_logging_project_exclusion.default_exclusion	resource
google_logging_project_exclusion.fluentbit_gke_parse_time	resource
google_logging_project_exclusion.fpm	resource
google_logging_project_exclusion.gke_metadata_server_exclusion_sync_sandbox	resource
google_logging_project_exclusion.probe_exclusion	resource

Modules

No modules.