GCP for DevOps — Cloud Foundation Toolkit

Cloud Foundation Toolkit

The Cloud Foundation Toolkit (CFT) is a collection of Google-maintained Terraform modules that implement GCP best practices. They are production-tested, opinionated, and cover networking, GKE, IAM, project setup, and more.

Why Use CFT?

Feature	Custom Modules	CFT Modules
Maintained by	Your team	Google Cloud
Best practices	Manual enforcement	Built-in
Security hardening	DIY	Pre-configured
Testing	Your responsibility	Kitchen-terraform tests
Updates	Manual	Regular releases
Documentation	Varies	Comprehensive

Key CFT Modules

Module	Repository	Purpose
terraform-google-project-factory	GoogleCloudPlatform/terraform-google-project-factory	Create projects with best practices
terraform-google-network	terraform-google-modules/network	VPC, subnets, firewall, NAT
terraform-google-kubernetes-engine	terraform-google-modules/kubernetes-engine	GKE Standard and Autopilot
terraform-google-iam	terraform-google-modules/iam	IAM bindings and custom roles
terraform-google-cloud-storage	terraform-google-modules/cloud-storage	Buckets with lifecycle, IAM
terraform-google-log-export	terraform-google-modules/log-export	Logging sinks and exports

Project Factory

Create GCP projects with consistent configuration.

module "project" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 15.0"

  name                 = "my-app-prod"
  org_id               = var.org_id
  billing_account      = var.billing_account
  folder_id            = var.folder_id
  default_service_account = "deprivilege"

  activate_apis = [
    "compute.googleapis.com",
    "container.googleapis.com",
    "run.googleapis.com",
    "cloudbuild.googleapis.com",
    "secretmanager.googleapis.com",
    "monitoring.googleapis.com",
    "logging.googleapis.com",
  ]

  labels = {
    environment = "production"
    team        = "platform"
    cost_center = "engineering"
  }
}

Network Module

module "vpc" {
  source  = "terraform-google-modules/network/google"
  version = "~> 9.0"

  project_id   = module.project.project_id
  network_name = "prod-vpc"
  routing_mode = "GLOBAL"

  subnets = [
    {
      subnet_name           = "app-subnet"
      subnet_ip             = "10.0.0.0/20"
      subnet_region         = "us-central1"
      subnet_private_access = true
    },
    {
      subnet_name           = "data-subnet"
      subnet_ip             = "10.0.16.0/20"
      subnet_region         = "us-central1"
      subnet_private_access = true
    },
  ]

  secondary_ranges = {
    "app-subnet" = [
      { range_name = "pods",     ip_cidr_range = "10.4.0.0/14" },
      { range_name = "services", ip_cidr_range = "10.8.0.0/20" },
    ]
  }

  routes = [
    {
      name              = "egress-internet"
      description       = "Default route to internet"
      destination_range = "0.0.0.0/0"
      next_hop_internet = "true"
    },
  ]
}

GKE Module

module "gke" {
  source  = "terraform-google-modules/kubernetes-engine/google//modules/autopilot"
  version = "~> 30.0"

  project_id        = module.project.project_id
  name              = "prod-cluster"
  region            = "us-central1"
  network           = module.vpc.network_name
  subnetwork        = "app-subnet"
  ip_range_pods     = "pods"
  ip_range_services = "services"

  enable_private_nodes    = true
  master_ipv4_cidr_block  = "172.16.0.0/28"

  master_authorized_networks = [
    {
      cidr_block   = var.admin_cidr
      display_name = "Admin Access"
    },
  ]
}

Terraform vs Deployment Manager

Feature	Terraform	Deployment Manager
Status	Recommended	Legacy (limited updates)
Language	HCL	YAML/Jinja2/Python
State	Remote (GCS)	API-managed
Multi-cloud	Yes	GCP only
Modules	Registry + custom	Templates
Community	Very large	Small
CFT support	Full	Limited

Google recommends Terraform for all new GCP infrastructure projects.

Landing Zone Pattern

CFT modules compose into a landing zone — a pre-configured, secure foundation for your GCP organization.

┌─────────────────────────────────────────────┐
│              Landing Zone                    │
├─────────────────────────────────────────────┤
│                                              │
│  Organization                                │
│  ├── Folders (prod, non-prod, shared)        │
│  ├── Organization Policies                   │
│  ├── Billing Account                         │
│  │                                           │
│  ├── Shared Services Project                 │
│  │   ├── Shared VPC Host                     │
│  │   ├── DNS Hub                             │
│  │   └── Logging/Monitoring                  │
│  │                                           │
│  ├── Production Project                      │
│  │   ├── GKE Cluster                         │
│  │   ├── Cloud SQL                           │
│  │   └── Service VPC                         │
│  │                                           │
│  └── Non-Production Project                  │
│      ├── Dev Cluster                         │
│      └── Test Resources                      │
└─────────────────────────────────────────────┘

Common Mistakes

Mistake	Why It’s Wrong	Fix
Building from scratch when CFT exists	Reinventing the wheel	Check CFT modules first
Not pinning CFT versions	Breaking changes	Always pin version = "~> X.0"
Ignoring module outputs	Can’t compose	Wire outputs into dependent modules
Using Deployment Manager for new projects	Legacy, limited	Use Terraform + CFT
No landing zone for organizations	Inconsistent projects	Use Project Factory + CFT

Quick Reference

CFT Module	Registry Path
Project Factory	terraform-google-modules/project-factory/google
Network	terraform-google-modules/network/google
GKE	terraform-google-modules/kubernetes-engine/google
IAM	terraform-google-modules/iam/google
Cloud Storage	terraform-google-modules/cloud-storage/google
Log Export	terraform-google-modules/log-export/google

Next → IaC Exercises