main.tf

# per https://www.terraform.io/docs/providers/google/r/container_cluster.html, 
# logging service "Defaults to logging.googleapis.com/kubernetes" 
# monitoring service "Defaults to monitoring.googleapis.com/kubernetes"
# which is why we see fluentd, prometheus, etc pods

resource "google_container_cluster" "primary" {
  name               = "node-svc-k8s"
   location          = "us-central1-c"
  initial_node_count = 3

  master_auth {
    username = ""
    password = ""

    client_certificate_config {
      issue_client_certificate = false
    }
  }

  # configure kubectl to talk to the cluster
  provisioner "local-exec" {
    command = "gcloud container clusters get-credentials ${var.cluster_name} --zone ${var.zone} --project ${var.project_id}"
  }

  node_config {
    preemptible  = true
    machine_type = "e2-micro"

    oauth_scopes = [
      "https://www.googleapis.com/auth/compute",
      "https://www.googleapis.com/auth/devstorage.read_only",
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring",
    ]

    metadata = {
      disable-legacy-endpoints = "true"
    }

    tags = ["node-svc-k8s"]
  }

  timeouts {
    create = "30m"
    update = "40m"
  }
}

# create firewall rule to allow access to application
resource "google_compute_firewall" "nodeports" {
  name    = "node-port-range"
  network = "default"

  allow {
    protocol = "tcp"
    ports    = ["30000-32767"]
  }
  source_ranges = ["0.0.0.0/0"]
}