blob: 6dc0ed56c76e211dac0be3cad385d5639c4eaa17 [file] [log] [blame]
#/bin/bash
# Creates a node-pool following the best security practices at the time.
# Turns off unsafe addons and uses a service account with the minimum
# set of needed permissions to run Kubernetes. See
# https://cloudplatform.googleblog.com/2017/11/precious-cargo-securing-containers-with-Kubernetes-Engine-18.html
# This script presumes the service account has already been created, which is
# done in ./create-cluster.sh, which needs to have been run before this
# script.
set -x -e
source ./config.sh
NODE_POOL=n1-highmem-64
gcloud container node-pools create ${NODE_POOL} \
--cluster "${CLUSTER_NAME}" \
--service-account="${SA_NAME}@${PROJECT_SUBDOMAIN}.iam.gserviceaccount.com" \
--disk-size "200" \
--enable-autoscaling \
--enable-autoupgrade \
--enable-autorepair \
--image-type "COS" \
--machine-type "n1-highmem-64" \
--min-nodes "1" --max-nodes "15" \
--num-nodes "1" \
--zone "us-central1-a"