resources:
- name: {{ properties['prefix'] }}-bastion
  properties:
    disks:
    - autoDelete: true
      boot: true
      deviceName: persistent-disk-0
      index: 0
      initializeParams:
        sourceImage: global/images/family/{{ properties['gold_image'] }}
        diskSizeGb: {{ properties['bastion_disk_size'] }}
        diskType: zones/{{ properties['zone'] }}/diskTypes/pd-ssd
    machineType: zones/{{ properties['zone'] }}/machineTypes/{{ properties['bastion_machine_type'] }}
    metadata: {}
    networkInterfaces:
    - accessConfigs:
      - name: external-nat
        type: ONE_TO_ONE_NAT
      name: nic0
      network: projects/{{env['project']}}/global/networks/{{ properties['prefix'] }}-network
      {% if properties['gce_vpc_custom_subnet_cidr'] %}
      subnetwork: projects/{{env['project']}}/regions/{{ properties['region'] }}/subnetworks/{{ properties['prefix'] }}-{{ properties['region'] }}-subnet
      {% endif %}
    scheduling:
      automaticRestart: true
      onHostMaintenance: MIGRATE
      preemptible: false
    serviceAccounts:
    - scopes:
      - https://www.googleapis.com/auth/cloud.useraccounts.readonly
      - https://www.googleapis.com/auth/compute
      - https://www.googleapis.com/auth/devstorage.read_write
      - https://www.googleapis.com/auth/logging.write
      - https://www.googleapis.com/auth/monitoring.write
      - https://www.googleapis.com/auth/service.management.readonly
      - https://www.googleapis.com/auth/servicecontrol
    tags:
      items:
      - {{ properties['prefix'] }}-bastion
      - {{ properties['prefix'] }}-ssh-external
    zone: {{ properties['zone'] }}
  type: compute.v1.instance
- name: {{ properties['prefix'] }}-master-template
  properties:
    description: ''
    properties:
      canIpForward: false
      disks:
      - autoDelete: true
        boot: true
        index: 0
        initializeParams:
          diskSizeGb: {{ properties['master_boot_disk_size'] }}
          sourceImage: global/images/family/{{ properties['gold_image'] }}
          diskType: pd-ssd
      {% if properties['containerized'] %}
      - autoDelete: true
        boot: false
        index: 1
        deviceName: docker
        initializeParams:
          sourceImage: global/images/empty-1g
          diskSizeGb: {{ properties['master_docker_disk_size'] }}
          diskType: pd-ssd
      {% endif %}
      machineType: {{ properties['master_machine_type'] }}
      metadata:
        items:
        - key: user-data
          value: |
            #cloud-config
            write_files:
            - content: |
                DOCKER_STORAGE_OPTIONS='--storage-driver overlay2'
              path: /etc/sysconfig/docker-storage
              permissions: '0644'
            {% if properties['containerized'] %}
            fs_setup:
            - label: docker
              filesystem: xfs
              device: /dev/disk/by-id/google-docker
              partition: none

            mounts:
            - [ '/dev/disk/by-id/google-docker', '/var/lib/docker', 'xfs', 'defaults', '0', '0' ]
            {% endif %}
            runcmd:
            - [ /usr/sbin/restorecon, -R, /var/lib/docker ]
      networkInterfaces:
      - accessConfigs:
        - name: external-nat
          type: ONE_TO_ONE_NAT
        network: projects/{{env['project']}}/global/networks/{{ properties['prefix'] }}-network
        {% if properties['gce_vpc_custom_subnet_cidr'] %}
        subnetwork: projects/{{env['project']}}/regions/{{ properties['region'] }}/subnetworks/{{ properties['prefix'] }}-{{ properties['region'] }}-subnet
        {% endif %}
      scheduling:
        automaticRestart: true
        onHostMaintenance: MIGRATE
        preemptible: false
      serviceAccounts:
      - scopes:
        - https://www.googleapis.com/auth/cloud.useraccounts.readonly
        - https://www.googleapis.com/auth/compute
        - https://www.googleapis.com/auth/devstorage.read_only
        - https://www.googleapis.com/auth/logging.write
        - https://www.googleapis.com/auth/monitoring.write
        - https://www.googleapis.com/auth/service.management.readonly
        - https://www.googleapis.com/auth/servicecontrol
      tags:
        items:
        - {{ properties['prefix'] }}
        - {{ properties['prefix'] }}-master
  type: compute.v1.instanceTemplate
- name: {{ properties['prefix'] }}-infra-node-template
  properties:
    description: ''
    properties:
      canIpForward: false
      disks:
      - autoDelete: true
        boot: true
        index: 0
        initializeParams:
          diskSizeGb: {{ properties['infra_boot_disk_size'] }}
          sourceImage: global/images/family/{{ properties['gold_image'] }}
          diskType: pd-ssd
      - autoDelete: true
        boot: false
        index: 1
        deviceName: docker
        initializeParams:
          sourceImage: global/images/empty-1g
          diskSizeGb: {{ properties['infra_docker_disk_size'] }}
          diskType: pd-ssd
      - autoDelete: true
        boot: false
        index: 2
        deviceName: openshift
        initializeParams:
          sourceImage: global/images/empty-1g
          diskSizeGb: {{ properties['infra_openshift_disk_size'] }}
          diskType: pd-ssd
      machineType: {{ properties['infra_machine_type'] }}
      metadata:
        items:
        - key: user-data
          value: |
            #cloud-config
            write_files:
            - content: |
                DOCKER_STORAGE_OPTIONS='--storage-driver overlay2'
              path: /etc/sysconfig/docker-storage
              permissions: '0644'

            fs_setup:
            - label: docker
              filesystem: xfs
              device: /dev/disk/by-id/google-docker
              partition: none
            - label: osl
              filesystem: xfs
              device: /dev/disk/by-id/google-openshift
              partition: none

            mounts:
            - [ '/dev/disk/by-id/google-docker', '/var/lib/docker', 'xfs', 'defaults', '0', '0' ]
            - [ '/dev/disk/by-id/google-openshift', '/var/lib/origin/openshift.local.volumes', 'xfs', 'defaults,gquota', '0', '0' ]

            runcmd:
            - [ /usr/sbin/restorecon, -R, /var/lib/docker ]
      networkInterfaces:
      - accessConfigs:
        - name: external-nat
          type: ONE_TO_ONE_NAT
        network: projects/{{env['project']}}/global/networks/{{ properties['prefix'] }}-network
        {% if properties['gce_vpc_custom_subnet_cidr'] %}
        subnetwork: projects/{{env['project']}}/regions/{{ properties['region'] }}/subnetworks/{{ properties['prefix'] }}-{{ properties['region'] }}-subnet
        {% endif %}
      scheduling:
        automaticRestart: true
        onHostMaintenance: MIGRATE
        preemptible: false
      serviceAccounts:
      - scopes:
        - https://www.googleapis.com/auth/cloud.useraccounts.readonly
        - https://www.googleapis.com/auth/compute
        - https://www.googleapis.com/auth/devstorage.read_write
        - https://www.googleapis.com/auth/logging.write
        - https://www.googleapis.com/auth/monitoring.write
        - https://www.googleapis.com/auth/service.management.readonly
        - https://www.googleapis.com/auth/servicecontrol
      tags:
        items:
        - {{ properties['prefix'] }}
        - {{ properties['prefix'] }}-infra-node
  type: compute.v1.instanceTemplate
- name: {{ properties['prefix'] }}-node-template
  properties:
    description: ''
    properties:
      canIpForward: false
      disks:
      - autoDelete: true
        boot: true
        index: 0
        initializeParams:
          diskSizeGb: {{ properties['node_boot_disk_size'] }}
          sourceImage: global/images/family/{{ properties['gold_image'] }}
          diskType: pd-ssd
      - autoDelete: true
        boot: false
        index: 1
        deviceName: docker
        initializeParams:
          sourceImage: global/images/empty-1g
          diskSizeGb: {{ properties['node_docker_disk_size'] }}
          diskType: pd-ssd
      - autoDelete: true
        boot: false
        index: 2
        deviceName: openshift
        initializeParams:
          sourceImage: global/images/empty-1g
          diskSizeGb: {{ properties['node_openshift_disk_size'] }}
          diskType: pd-ssd
      machineType: {{ properties['node_machine_type'] }}
      metadata:
        items:
        - key: user-data
          value: |
            #cloud-config
            write_files:
            - content: |
                DOCKER_STORAGE_OPTIONS='--storage-driver overlay2'
              path: /etc/sysconfig/docker-storage
              permissions: '0644'

            fs_setup:
            - label: docker
              filesystem: xfs
              device: /dev/disk/by-id/google-docker
              partition: none
            - label: osl
              filesystem: xfs
              device: /dev/disk/by-id/google-openshift
              partition: none

            mounts:
            - [ '/dev/disk/by-id/google-docker', '/var/lib/docker', 'xfs', 'defaults', '0', '0' ]
            - [ '/dev/disk/by-id/google-openshift', '/var/lib/origin/openshift.local.volumes', 'xfs', 'defaults,gquota', '0', '0' ]

            runcmd:
            - [ /usr/sbin/restorecon, -R, /var/lib/docker ]
      networkInterfaces:
      - accessConfigs:
        - name: external-nat
          type: ONE_TO_ONE_NAT
        network: projects/{{env['project']}}/global/networks/{{ properties['prefix'] }}-network
        {% if properties['gce_vpc_custom_subnet_cidr'] %}
        subnetwork: projects/{{env['project']}}/regions/{{ properties['region'] }}/subnetworks/{{ properties['prefix'] }}-{{ properties['region'] }}-subnet
        {% endif %}
      scheduling:
        automaticRestart: true
        onHostMaintenance: MIGRATE
        preemptible: false
      serviceAccounts:
      - scopes:
        - https://www.googleapis.com/auth/cloud.useraccounts.readonly
        - https://www.googleapis.com/auth/compute
        - https://www.googleapis.com/auth/devstorage.read_only
        - https://www.googleapis.com/auth/logging.write
        - https://www.googleapis.com/auth/monitoring.write
        - https://www.googleapis.com/auth/service.management.readonly
        - https://www.googleapis.com/auth/servicecontrol
      tags:
        items:
        - {{ properties['prefix'] }}
        - {{ properties['prefix'] }}-node
  type: compute.v1.instanceTemplate
- name: {{ properties['prefix'] }}-master
  properties:
    baseInstanceName: {{ properties['prefix'] }}-master
    instanceTemplate: $(ref.{{ properties['prefix'] }}-master-template.selfLink)
    namedPorts:
    - name: {{ properties['prefix'] }}-web-console
      port: {{ properties['console_port'] }}
    targetPools:
    - $(ref.{{ properties['prefix'] }}-master-network-lb-pool.selfLink)
    targetSize: {{ properties['master_instance_group_size'] }}
    region: {{ properties['region'] }}
  type: compute.v1.regionInstanceGroupManager
- name: {{ properties['prefix'] }}-infra-node
  properties:
    baseInstanceName: {{ properties['prefix'] }}-infra-node
    instanceTemplate: $(ref.{{ properties['prefix'] }}-infra-node-template.selfLink)
    targetPools:
    - $(ref.{{ properties['prefix'] }}-router-network-lb-pool.selfLink)
    targetSize: {{ properties['infra_node_instance_group_size'] }}
    region: {{ properties['region'] }}
  type: compute.v1.regionInstanceGroupManager
- name: {{ properties['prefix'] }}-node
  properties:
    baseInstanceName: {{ properties['prefix'] }}-node
    instanceTemplate: $(ref.{{ properties['prefix'] }}-node-template.selfLink)
    targetSize: {{ properties['node_instance_group_size'] }}
    region: {{ properties['region'] }}
  type: compute.v1.regionInstanceGroupManager
- name: {{ properties['prefix'] }}-master-https-lb-health-check
  properties:
    checkIntervalSec: 5
    description: ''
    healthyThreshold: 2
    httpsHealthCheck:
      port: {{ properties['console_port'] }}
      proxyHeader: NONE
      requestPath: /healthz
    timeoutSec: 5
    type: HTTPS
    unhealthyThreshold: 2
  type: compute.v1.healthCheck
- name: {{ properties['prefix'] }}-master-network-lb-health-check
  properties:
    checkIntervalSec: 5
    description: ''
    healthyThreshold: 2
    host: ''
    port: 8080
    requestPath: /healthz
    timeoutSec: 5
    unhealthyThreshold: 2
  type: compute.v1.httpHealthCheck
- name: {{ properties['prefix'] }}-router-network-lb-health-check
  properties:
    checkIntervalSec: 5
    description: ''
    healthyThreshold: 2
    host: ''
    port: 1936
    requestPath: /healthz
    timeoutSec: 5
    unhealthyThreshold: 2
  type: compute.v1.httpHealthCheck
- name: {{ properties['prefix'] }}-master-https-lb-backend
  properties:
    healthChecks:
    - $(ref.{{ properties['prefix'] }}-master-https-lb-health-check.selfLink)
    loadBalancingScheme: EXTERNAL
    portName: {{ properties['prefix'] }}-web-console
    protocol: HTTPS
    timeoutSec: 300
    backends:
    - group: $(ref.{{ properties['prefix'] }}-master.instanceGroup)
  type: compute.v1.backendService
- name: {{ properties['prefix'] }}-master-https-lb-url-map
  properties:
    defaultService: $(ref.{{ properties['prefix'] }}-master-https-lb-backend.selfLink)
  type: compute.v1.urlMap
- name: {{ properties['prefix'] }}-master-https-lb-target
  properties:
    urlMap: $(ref.{{ properties['prefix'] }}-master-https-lb-url-map.selfLink)
    sslCertificates:
    - projects/{{env['project']}}/global/sslCertificates/{{ properties['prefix'] }}-master-https-lb-cert
  type: compute.v1.targetHttpsProxy
- name: {{ properties['prefix'] }}-master-https-lb-ip
  type: compute.v1.globalAddress
- name: {{ properties['prefix'] }}-master-https-lb-rule
  properties:
    IPProtocol: TCP
    description: ''
    IPAddress: $(ref.{{ properties['prefix'] }}-master-https-lb-ip.selfLink)
    loadBalancingScheme: EXTERNAL
    portRange: {{ properties['console_port'] }}-{{ properties['console_port'] }}
    target: $(ref.{{ properties['prefix'] }}-master-https-lb-target.selfLink)
  type: compute.v1.globalForwardingRule
- name: {{ properties['prefix'] }}-master-network-lb-pool
  properties:
    description: ''
    healthChecks:
    - $(ref.{{ properties['prefix'] }}-master-network-lb-health-check.selfLink)
    region: {{ properties['region'] }}
  type: compute.v1.targetPool
- name: {{ properties['prefix'] }}-master-network-lb-ip
  properties:
    description: ''
    region: {{ properties['region'] }}
  type: compute.v1.address
- name: {{ properties['prefix'] }}-master-network-lb-rule
  properties:
    IPProtocol: TCP
    description: ''
    IPAddress: $(ref.{{ properties['prefix'] }}-master-network-lb-ip.selfLink)
    loadBalancingScheme: EXTERNAL
    portRange: {{ properties['console_port'] }}-{{ properties['console_port'] }}
    region: {{ properties['region'] }}
    target: $(ref.{{ properties['prefix'] }}-master-network-lb-pool.selfLink)
  type: compute.v1.forwardingRule
- name: {{ properties['prefix'] }}-router-network-lb-pool
  properties:
    description: ''
    healthChecks:
    - $(ref.{{ properties['prefix'] }}-router-network-lb-health-check.selfLink)
    region: {{ properties['region'] }}
  type: compute.v1.targetPool
- name: {{ properties['prefix'] }}-router-network-lb-ip
  properties:
    description: ''
    region: {{ properties['region'] }}
  type: compute.v1.address
- name: {{ properties['prefix'] }}-router-network-lb-rule
  properties:
    IPProtocol: TCP
    description: ''
    IPAddress: $(ref.{{ properties['prefix'] }}-router-network-lb-ip.selfLink)
    loadBalancingScheme: EXTERNAL
    portRange: 80-443
    region: {{ properties['region'] }}
    target: $(ref.{{ properties['prefix'] }}-router-network-lb-pool.selfLink)
  type: compute.v1.forwardingRule
- name: {{ properties['gcs_registry_bucket'] }}
  properties:
    location: {{ properties['region'] }}
  type: storage.v1.bucket
