GCP Cloud Engineer: Arquitectura de Infraestructura Enterprise, Terraform, IAM y FinOps

# -----------------------------------------------------------------------------
# Google Cloud Platform - Production Secure VPC & GKE Autopilot
# Arquitectura: Eduardo Martínez Agrelo (AI & Data Architect)
# -----------------------------------------------------------------------------

terraform {
  required_version = ">= 1.5.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.20.0"
    }
  }
}

variable "project_id" {
  type        = string
  description = "GCP Project ID"
}

variable "region" {
  type        = string
  default     = "europe-west1"
}

# 1. Custom VPC Network (Custom Subnet Mode)
resource "google_compute_network" "custom_vpc" {
  name                    = "vpc-enterprise-prod"
  auto_create_subnetworks = false
  routing_mode            = "GLOBAL"
}

# 2. Subred Privada con Rangos Secundarios para GKE y Private Google Access
resource "google_compute_subnetwork" "prod_k8s_subnet" {
  name                     = "snet-k8s-prod-${var.region}"
  ip_cidr_range            = "10.100.0.0/20"
  region                   = var.region
  network                  = google_compute_network.custom_vpc.id
  private_ip_google_access = true # Evita costes de Cloud NAT hacia APIs de Google

  secondary_ip_range {
    range_name    = "pods-range"
    ip_cidr_range = "172.16.0.0/16"
  }

  secondary_ip_range {
    range_name    = "services-range"
    ip_cidr_range = "172.17.0.0/20"
  }
}

# 3. GKE Autopilot Cluster con Hardening y Workload Identity
resource "google_container_cluster" "autopilot_cluster" {
  name     = "gke-enterprise-prod"
  location = var.region

  enable_autopilot = true
  network          = google_compute_network.custom_vpc.name
  subnetwork       = google_compute_subnetwork.prod_k8s_subnet.name

  ip_allocation_policy {
    cluster_secondary_range_name  = "pods-range"
    services_secondary_range_name = "services-range"
  }

  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = false # Endpoint público restringido con Authorized Networks
    master_ipv4_cidr_block  = "172.16.255.0/28"
  }

  master_authorized_networks_config {
    cidr_blocks {
      cidr_block   = "198.51.100.0/24"
      display_name = "Corporate VPN Gateway"
    }
  }

  # Configuración FinOps & Release Channel
  release_channel {
    channel = "REGULAR"
  }

  deletion_protection = true
}

output "gke_endpoint" {
  description = "GKE Master Endpoint"
  value       = google_container_cluster.autopilot_cluster.endpoint
}