[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FCA5FM5MBHZVF4JBSZMDHB":3,"skill-same:01M6FCA5FM5MBHZVF4JBSZMDHB":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":36,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":65,"install":66,"resources":79},"01M6FCA5FM5MBHZVF4JBSZMDHB","terraform-gcp",null,"Provision GCP infrastructure with Terraform. Configure providers and deploy Google Cloud resources. Use when implementing IaC for GCP.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",13,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-terraform-gcp\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"terraform","gcp","terraform gcp","community","2026","when","implementing","relevant","resources","scripts","critical","os","platform","main","google","only","configure","access","devops-security","Providers","infrastructure","security","google cloud","2026-11-10 10:12:30",false,"---\nname: terraform-gcp\ndescription: Provision GCP infrastructure with Terraform. Configure providers and\n  deploy Google Cloud resources. Use when implementing IaC for GCP.\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only\n helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# Terraform GCP\n\nProvision and manage Google Cloud Platform infrastructure using Terraform with the `hashicorp\u002Fgoogle` provider.\n\n## When to Use\n\n- Defining GCP infrastructure as code for repeatable, auditable deployments\n- Managing multi-environment setups (dev, staging, production) from a single codebase\n- Provisioning complex resource graphs (VPC + GKE + Cloud SQL + IAM) in one plan\n- Integrating infrastructure changes into CI\u002FCD pipelines with plan\u002Fapply stages\n\nExamples are partial modules and require complete variable declarations, subnet CIDRs, API enablement dependencies, private service networking connection\u002Foutputs and provider-compatible schemas before planning. HCL attributes use newlines, not semicolon separators. Confirm project\u002Fbackend\u002Fworkspace, cost and saved-plan changes before apply; protect state and plan files because generated passwords remain in state despite sensitive flags. Prefer workload identity\u002Fshort-lived CI credentials over service account key files. Private GKE nodes do not imply a private control-plane endpoint; explicitly configure endpoint access. A force-new property cannot generally be fixed with state mv; use moved\u002Fstate operations only for a true address refactor of the same resource.\n\n## Prerequisites\n\n- Terraform >= 1.5 installed\n- Google Cloud SDK or a service account key for CI\n- A GCP project with billing enabled\n\n```bash\ngcloud auth application-default login          # local dev\nexport GOOGLE_APPLICATION_CREDENTIALS=\"sa.json\" # CI\u002FCD\nterraform version\n```\n\n## Provider Configuration\n\n```hcl\n# versions.tf\nterraform {\n  required_version = \">= 1.5\"\n  required_providers {\n    google      = { source = \"hashicorp\u002Fgoogle\"\n      version = \"~> 5.0\" }\n    google-beta = { source = \"hashicorp\u002Fgoogle-beta\"\n version = \"~> 5.0\" }\n  }\n  backend \"gcs\" { bucket = \"my-project-tf-state\"\n prefix = \"terraform\u002Fstate\" }\n}\n\nprovider \"google\"      { project = var.project_id\n region = var.region }\nprovider \"google-beta\" { project = var.project_id\n region = var.region }\n```\n\n```hcl\n# variables.tf\nvariable \"project_id\"  { type = string }\nvariable \"region\"      { type = string\n default = \"us-central1\" }\nvariable \"environment\" {\n  type = string\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"production\"], var.environment)\n    error_message = \"Must be dev, staging, or production.\"\n  }\n}\n```\n\n## Project Setup and State Bucket\n\n```bash\ngcloud storage buckets create gs:\u002F\u002Fmy-project-tf-state \\\n  --location=us-central1 --uniform-bucket-level-access --public-access-prevention\ngcloud storage buckets update gs:\u002F\u002Fmy-project-tf-state --versioning\n\nterraform init\nterraform plan -var=\"project_id=my-project\" -var=\"environment=production\" -out=tfplan\nterraform apply tfplan\n```\n\n```hcl\nresource \"google_project_service\" \"apis\" {\n  for_each = toset([\n    \"compute.googleapis.com\", \"container.googleapis.com\",\n    \"sqladmin.googleapis.com\", \"servicenetworking.googleapis.com\",\n    \"cloudfunctions.googleapis.com\", \"run.googleapis.com\",\n    \"secretmanager.googleapis.com\", \"artifactregistry.googleapis.com\",\n  ])\n  project = var.project_id\n  service = each.value\n  disable_dependent_services = false\n  disable_on_destroy         = false\n}\n```\n\n## Networking Module\n\n```hcl\n# modules\u002Fnetworking\u002Fmain.tf\nresource \"google_compute_network\" \"vpc\" {\n  name                    = \"${var.environment}-vpc\"\n  auto_create_subnetworks = false\n  routing_mode            = \"REGIONAL\"\n}\n\nresource \"google_compute_subnetwork\" \"main\" {\n  name                     = \"${var.environment}-main-subnet\"\n  ip_cidr_range            = var.subnet_cidr\n  region                   = var.region\n  network                  = google_compute_network.vpc.id\n  private_ip_google_access = true\n  log_config { aggregation_interval = \"INTERVAL_5_SEC\"\n flow_sampling = 0.5 }\n}\n\nresource \"google_compute_subnetwork\" \"gke\" {\n  name                     = \"${var.environment}-gke-subnet\"\n  ip_cidr_range            = var.gke_subnet_cidr\n  region                   = var.region\n  network                  = google_compute_network.vpc.id\n  private_ip_google_access = true\n  secondary_ip_range { range_name = \"pods\"\n     ip_cidr_range = var.pods_cidr }\n  secondary_ip_range { range_name = \"services\"\n ip_cidr_range = var.services_cidr }\n}\n\nresource \"google_compute_firewall\" \"allow_iap\" {\n  name    = \"${var.environment}-allow-iap\"\n  network = google_compute_network.vpc.name\n  allow { protocol = \"tcp\"\n ports = [\"22\", \"3389\"] }\n  source_ranges = [\"35.235.240.0\u002F20\"]\n}\n\nresource \"google_compute_router\" \"router\" {\n  name    = \"${var.environment}-router\"\n  region  = var.region\n  network = google_compute_network.vpc.id\n}\n\nresource \"google_compute_router_nat\" \"nat\" {\n  name                               = \"${var.environment}-nat\"\n  router                             = google_compute_router.router.name\n  region                             = var.region\n  nat_ip_allocate_option             = \"AUTO_ONLY\"\n  source_subnetwork_ip_ranges_to_nat = \"ALL_SUBNETWORKS_ALL_IP_RANGES\"\n  log_config { enable = true\n filter = \"ERRORS_ONLY\" }\n}\n\noutput \"vpc_id\"         { value = google_compute_network.vpc.id }\noutput \"gke_subnet_id\"  { value = google_compute_subnetwork.gke.id }\n```\n\n## GKE Cluster Module\n\n```hcl\n# modules\u002Fgke\u002Fmain.tf\nresource \"google_container_cluster\" \"primary\" {\n  name     = \"${var.environment}-cluster\"\n  location = var.region\n\n  release_channel { channel = var.release_channel }\n  workload_identity_config { workload_pool = \"${var.project_id}.svc.id.goog\" }\n  network    = var.vpc_name\n  subnetwork = var.gke_subnet_name\n\n  ip_allocation_policy {\n    cluster_secondary_range_name  = \"pods\"\n    services_secondary_range_name = \"services\"\n  }\n  private_cluster_config {\n    enable_private_nodes   = true\n    master_ipv4_cidr_block = \"172.16.0.0\u002F28\"\n  }\n  network_policy { enabled = true }\n  logging_config    { enable_components = [\"SYSTEM_COMPONENTS\", \"WORKLOADS\"] }\n  monitoring_config {\n    enable_components = [\"SYSTEM_COMPONENTS\", \"WORKLOADS\"]\n    managed_prometheus { enabled = true }\n  }\n\n  remove_default_node_pool = true\n  initial_node_count       = 1\n}\n\nresource \"google_container_node_pool\" \"primary\" {\n  name     = \"primary-pool\"\n  cluster  = google_container_cluster.primary.name\n  location = var.region\n\n  initial_node_count = var.initial_node_count\n  autoscaling { min_node_count = var.min_nodes\n max_node_count = var.max_nodes }\n  management  { auto_repair = true\n auto_upgrade = true }\n\n  node_config {\n    service_account = var.node_sa_email\n    machine_type = var.machine_type\n    disk_size_gb = 100\n    oauth_scopes = [\"https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform\"]\n    shielded_instance_config { enable_secure_boot = true\n enable_integrity_monitoring = true }\n    metadata = { disable-legacy-endpoints = \"true\" }\n  }\n}\n\noutput \"cluster_name\"     { value = google_container_cluster.primary.name }\noutput \"cluster_endpoint\" { value = google_container_cluster.primary.endpoint\n sensitive = true }\n```\n\n## Cloud SQL Module\n\n```hcl\n# modules\u002Fcloud-sql\u002Fmain.tf\nresource \"google_sql_database_instance\" \"main\" {\n  name             = \"${var.environment}-db\"\n  database_version = var.database_version\n  region           = var.region\n\n  settings {\n    tier              = var.tier\n    availability_type = var.environment == \"production\" ? \"REGIONAL\" : \"ZONAL\"\n    disk_type         = \"PD_SSD\"\n    disk_size         = var.disk_size\n    disk_autoresize   = true\n\n    backup_configuration {\n      enabled                        = true\n      start_time                     = \"02:00\"\n      point_in_time_recovery_enabled = true\n      backup_retention_settings { retained_backups = var.environment == \"production\" ? 30 : 7 }\n    }\n    ip_configuration {\n      ipv4_enabled    = false\n      private_network = var.vpc_id\n      require_ssl     = true\n    }\n    database_flags { name = \"max_connections\"\n value = var.max_connections }\n  }\n\n  deletion_protection = var.environment == \"production\"\n  # In this module, depend on a real private service networking connection resource.\n}\n\nresource \"google_sql_database\" \"app\" { name = var.database_name\n instance = google_sql_database_instance.main.name }\nresource \"google_sql_user\" \"app\"     { name = var.db_user\n instance = google_sql_database_instance.main.name\n password = random_password.db.result }\nresource \"random_password\" \"db\"      { length = 32\n special = true }\n\noutput \"connection_name\" { value = google_sql_database_instance.main.connection_name }\noutput \"private_ip\"      { value = google_sql_database_instance.main.private_ip_address }\n```\n\n## IAM and Service Accounts\n\n```hcl\nresource \"google_service_account\" \"gke_nodes\" {\n  account_id   = \"${var.environment}-gke-nodes\"\n  display_name = \"GKE Node Pool SA\"\n}\n\nresource \"google_project_iam_member\" \"gke_nodes\" {\n  for_each = toset([\n    \"roles\u002Flogging.logWriter\", \"roles\u002Fmonitoring.metricWriter\",\n    \"roles\u002Fartifactregistry.reader\",\n  ])\n  project = var.project_id\n  role    = each.value\n  member  = \"serviceAccount:${google_service_account.gke_nodes.email}\"\n}\n\nresource \"google_service_account\" \"app\" {\n  account_id   = \"${var.environment}-app\"\n  display_name = \"Application SA\"\n}\n\nresource \"google_service_account_iam_member\" \"workload_identity\" {\n  service_account_id = google_service_account.app.name\n  role               = \"roles\u002Fiam.workloadIdentityUser\"\n  member             = \"serviceAccount:${var.project_id}.svc.id.goog[myapp\u002Fapp-ksa]\"\n}\n```\n\n## Root Module Composition\n\n```hcl\nmodule \"networking\" {\n  source      = \".\u002Fmodules\u002Fnetworking\"\n  project_id  = var.project_id\n  environment = var.environment\n  region      = var.region\n}\n\nmodule \"gke\" {\n  source          = \".\u002Fmodules\u002Fgke\"\n  project_id      = var.project_id\n  environment     = var.environment\n  region          = var.region\n  vpc_name        = module.networking.vpc_id\n  gke_subnet_name = module.networking.gke_subnet_id\n  node_sa_email   = google_service_account.gke_nodes.email\n  depends_on      = [module.networking]\n}\n\nmodule \"database\" {\n  source               = \".\u002Fmodules\u002Fcloud-sql\"\n  project_id           = var.project_id\n  environment          = var.environment\n  region               = var.region\n  vpc_id               = module.networking.vpc_id\n  database_version     = \"POSTGRES_16\"\n  tier                 = \"db-custom-4-16384\"\n  private_vpc_connection = module.networking.private_vpc_connection\n  depends_on           = [module.networking]\n}\n```\n\n## Environment Configuration\n\n```hcl\n# environments\u002Fproduction.tfvars\nproject_id  = \"my-company-prod\"\nenvironment = \"production\"\nregion      = \"us-central1\"\n```\n\n```bash\nterraform plan -var-file=environments\u002Fproduction.tfvars -out=tfplan\nterraform apply tfplan\n```\n\n## CI\u002FCD Integration\n\n```bash\nterraform init -input=false\nterraform validate && terraform fmt -check\nterraform plan -var-file=environments\u002F${ENV}.tfvars -out=tfplan -input=false\nterraform apply -input=false tfplan\n\n# Import existing resources\nterraform import google_compute_network.vpc projects\u002F${PROJECT_ID}\u002Fglobal\u002Fnetworks\u002Fprod-vpc\n\n# State management\nterraform state list\nterraform state mv google_compute_instance.old google_compute_instance.new\n```\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---------|-------|-----|\n| `Error 403: Access Not Configured` | API not enabled | Add API to `google_project_service` resources |\n| `Error acquiring the state lock` | Concurrent run or stale lock | Run `terraform force-unlock LOCK_ID` after verification |\n| `Resource already exists` | Created outside Terraform | Import with `terraform import` |\n| `Quota exceeded` | Project quota too low | Request increase in Cloud Console > Quotas |\n| Plan shows destroy\u002Frecreate | Changed force-new attribute | Use `moved` blocks or `terraform state mv` |\n| `Backend initialization required` | Changed backend config | Run `terraform init -migrate-state` |\n| Cycle in resource graph | Circular references | Refactor with data sources\n split applies |\n\n## Related Skills\n\n- **gcp-networking** - VPC and firewall resources managed by Terraform\n- **gcp-gke** - GKE cluster provisioning with Terraform modules\n- **gcp-cloud-sql** - Cloud SQL instance management via Terraform\n- **gcp-compute** - Compute Engine resources defined in Terraform\n- **gcp-cloud-functions** - Serverless function deployment with Terraform\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n","# Terraform GCP\n\nProvision and manage Google Cloud Platform infrastructure using Terraform with the `hashicorp\u002Fgoogle` provider.\n\n## When to Use\n\n- Defining GCP infrastructure as code for repeatable, auditable deployments\n- Managing multi-environment setups (dev, staging, production) from a single codebase\n- Provisioning complex resource graphs (VPC + GKE + Cloud SQL + IAM) in one plan\n- Integrating infrastructure changes into CI\u002FCD pipelines with plan\u002Fapply stages\n\nExamples are partial modules and require complete variable declarations, subnet CIDRs, API enablement dependencies, private service networking connection\u002Foutputs and provider-compatible schemas before planning. HCL attributes use newlines, not semicolon separators. Confirm project\u002Fbackend\u002Fworkspace, cost and saved-plan changes before apply; protect state and plan files because generated passwords remain in state despite sensitive flags. Prefer workload identity\u002Fshort-lived CI credentials over service account key files. Private GKE nodes do not imply a private control-plane endpoint; explicitly configure endpoint access. A force-new property cannot generally be fixed with state mv; use moved\u002Fstate operations only for a true address refactor of the same resource.\n\n## Prerequisites\n\n- Terraform >= 1.5 installed\n- Google Cloud SDK or a service account key for CI\n- A GCP project with billing enabled\n\n```bash\ngcloud auth application-default login          # local dev\nexport GOOGLE_APPLICATION_CREDENTIALS=\"sa.json\" # CI\u002FCD\nterraform version\n```\n\n## Provider Configuration\n\n```hcl\n# versions.tf\nterraform {\n  required_version = \">= 1.5\"\n  required_providers {\n    google      = { source = \"hashicorp\u002Fgoogle\"\n      version = \"~> 5.0\" }\n    google-beta = { source = \"hashicorp\u002Fgoogle-beta\"\n version = \"~> 5.0\" }\n  }\n  backend \"gcs\" { bucket = \"my-project-tf-state\"\n prefix = \"terraform\u002Fstate\" }\n}\n\nprovider \"google\"      { project = var.project_id\n region = var.region }\nprovider \"google-beta\" { project = var.project_id\n region = var.region }\n```\n\n```hcl\n# variables.tf\nvariable \"project_id\"  { type = string }\nvariable \"region\"      { type = string\n default = \"us-central1\" }\nvariable \"environment\" {\n  type = string\n  validation {\n    condition     = contains([\"dev\", \"staging\", \"production\"], var.environment)\n    error_message = \"Must be dev, staging, or production.\"\n  }\n}\n```\n\n## Project Setup and State Bucket\n\n```bash\ngcloud storage buckets create gs:\u002F\u002Fmy-project-tf-state \\\n  --location=us-central1 --uniform-bucket-level-access --public-access-prevention\ngcloud storage buckets update gs:\u002F\u002Fmy-project-tf-state --versioning\n\nterraform init\nterraform plan -var=\"project_id=my-project\" -var=\"environment=production\" -out=tfplan\nterraform apply tfplan\n```\n\n```hcl\nresource \"google_project_service\" \"apis\" {\n  for_each = toset([\n    \"compute.googleapis.com\", \"container.googleapis.com\",\n    \"sqladmin.googleapis.com\", \"servicenetworking.googleapis.com\",\n    \"cloudfunctions.googleapis.com\", \"run.googleapis.com\",\n    \"secretmanager.googleapis.com\", \"artifactregistry.googleapis.com\",\n  ])\n  project = var.project_id\n  service = each.value\n  disable_dependent_services = false\n  disable_on_destroy         = false\n}\n```\n\n## Networking Module\n\n```hcl\n# modules\u002Fnetworking\u002Fmain.tf\nresource \"google_compute_network\" \"vpc\" {\n  name                    = \"${var.environment}-vpc\"\n  auto_create_subnetworks = false\n  routing_mode            = \"REGIONAL\"\n}\n\nresource \"google_compute_subnetwork\" \"main\" {\n  name                     = \"${var.environment}-main-subnet\"\n  ip_cidr_range            = var.subnet_cidr\n  region                   = var.region\n  network                  = google_compute_network.vpc.id\n  private_ip_google_access = true\n  log_config { aggregation_interval = \"INTERVAL_5_SEC\"\n flow_sampling = 0.5 }\n}\n\nresource \"google_compute_subnetwork\" \"gke\" {\n  name                     = \"${var.environment}-gke-subnet\"\n  ip_cidr_range            = var.gke_subnet_cidr\n  region                   = var.region\n  network                  = google_compute_network.vpc.id\n  private_ip_google_access = true\n  secondary_ip_range { range_name = \"pods\"\n     ip_cidr_range = var.pods_cidr }\n  secondary_ip_range { range_name = \"services\"\n ip_cidr_range = var.services_cidr }\n}\n\nresource \"google_compute_firewall\" \"allow_iap\" {\n  name    = \"${var.environment}-allow-iap\"\n  network = google_compute_network.vpc.name\n  allow { protocol = \"tcp\"\n ports = [\"22\", \"3389\"] }\n  source_ranges = [\"35.235.240.0\u002F20\"]\n}\n\nresource \"google_compute_router\" \"router\" {\n  name    = \"${var.environment}-router\"\n  region  = var.region\n  network = google_compute_network.vpc.id\n}\n\nresource \"google_compute_router_nat\" \"nat\" {\n  name                               = \"${var.environment}-nat\"\n  router                             = google_compute_router.router.name\n  region                             = var.region\n  nat_ip_allocate_option             = \"AUTO_ONLY\"\n  source_subnetwork_ip_ranges_to_nat = \"ALL_SUBNETWORKS_ALL_IP_RANGES\"\n  log_config { enable = true\n filter = \"ERRORS_ONLY\" }\n}\n\noutput \"vpc_id\"         { value = google_compute_network.vpc.id }\noutput \"gke_subnet_id\"  { value = google_compute_subnetwork.gke.id }\n```\n\n## GKE Cluster Module\n\n```hcl\n# modules\u002Fgke\u002Fmain.tf\nresource \"google_container_cluster\" \"primary\" {\n  name     = \"${var.environment}-cluster\"\n  location = var.region\n\n  release_channel { channel = var.release_channel }\n  workload_identity_config { workload_pool = \"${var.project_id}.svc.id.goog\" }\n  network    = var.vpc_name\n  subnetwork = var.gke_subnet_name\n\n  ip_allocation_policy {\n    cluster_secondary_range_name  = \"pods\"\n    services_secondary_range_name = \"services\"\n  }\n  private_cluster_config {\n    enable_private_nodes   = true\n    master_ipv4_cidr_block = \"172.16.0.0\u002F28\"\n  }\n  network_policy { enabled = true }\n  logging_config    { enable_components = [\"SYSTEM_COMPONENTS\", \"WORKLOADS\"] }\n  monitoring_config {\n    enable_components = [\"SYSTEM_COMPONENTS\", \"WORKLOADS\"]\n    managed_prometheus { enabled = true }\n  }\n\n  remove_default_node_pool = true\n  initial_node_count       = 1\n}\n\nresource \"google_container_node_pool\" \"primary\" {\n  name     = \"primary-pool\"\n  cluster  = google_container_cluster.primary.name\n  location = var.region\n\n  initial_node_count = var.initial_node_count\n  autoscaling { min_node_count = var.min_nodes\n max_node_count = var.max_nodes }\n  management  { auto_repair = true\n auto_upgrade = true }\n\n  node_config {\n    service_account = var.node_sa_email\n    machine_type = var.machine_type\n    disk_size_gb = 100\n    oauth_scopes = [\"https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform\"]\n    shielded_instance_config { enable_secure_boot = true\n enable_integrity_monitoring = true }\n    metadata = { disable-legacy-endpoints = \"true\" }\n  }\n}\n\noutput \"cluster_name\"     { value = google_container_cluster.primary.name }\noutput \"cluster_endpoint\" { value = google_container_cluster.primary.endpoint\n sensitive = true }\n```\n\n## Cloud SQL Module\n\n```hcl\n# modules\u002Fcloud-sql\u002Fmain.tf\nresource \"google_sql_database_instance\" \"main\" {\n  name             = \"${var.environment}-db\"\n  database_version = var.database_version\n  region           = var.region\n\n  settings {\n    tier              = var.tier\n    availability_type = var.environment == \"production\" ? \"REGIONAL\" : \"ZONAL\"\n    disk_type         = \"PD_SSD\"\n    disk_size         = var.disk_size\n    disk_autoresize   = true\n\n    backup_configuration {\n      enabled                        = true\n      start_time                     = \"02:00\"\n      point_in_time_recovery_enabled = true\n      backup_retention_settings { retained_backups = var.environment == \"production\" ? 30 : 7 }\n    }\n    ip_configuration {\n      ipv4_enabled    = false\n      private_network = var.vpc_id\n      require_ssl     = true\n    }\n    database_flags { name = \"max_connections\"\n value = var.max_connections }\n  }\n\n  deletion_protection = var.environment == \"production\"\n  # In this module, depend on a real private service networking connection resource.\n}\n\nresource \"google_sql_database\" \"app\" { name = var.database_name\n instance = google_sql_database_instance.main.name }\nresource \"google_sql_user\" \"app\"     { name = var.db_user\n instance = google_sql_database_instance.main.name\n password = random_password.db.result }\nresource \"random_password\" \"db\"      { length = 32\n special = true }\n\noutput \"connection_name\" { value = google_sql_database_instance.main.connection_name }\noutput \"private_ip\"      { value = google_sql_database_instance.main.private_ip_address }\n```\n\n## IAM and Service Accounts\n\n```hcl\nresource \"google_service_account\" \"gke_nodes\" {\n  account_id   = \"${var.environment}-gke-nodes\"\n  display_name = \"GKE Node Pool SA\"\n}\n\nresource \"google_project_iam_member\" \"gke_nodes\" {\n  for_each = toset([\n    \"roles\u002Flogging.logWriter\", \"roles\u002Fmonitoring.metricWriter\",\n    \"roles\u002Fartifactregistry.reader\",\n  ])\n  project = var.project_id\n  role    = each.value\n  member  = \"serviceAccount:${google_service_account.gke_nodes.email}\"\n}\n\nresource \"google_service_account\" \"app\" {\n  account_id   = \"${var.environment}-app\"\n  display_name = \"Application SA\"\n}\n\nresource \"google_service_account_iam_member\" \"workload_identity\" {\n  service_account_id = google_service_account.app.name\n  role               = \"roles\u002Fiam.workloadIdentityUser\"\n  member             = \"serviceAccount:${var.project_id}.svc.id.goog[myapp\u002Fapp-ksa]\"\n}\n```\n\n## Root Module Composition\n\n```hcl\nmodule \"networking\" {\n  source      = \".\u002Fmodules\u002Fnetworking\"\n  project_id  = var.project_id\n  environment = var.environment\n  region      = var.region\n}\n\nmodule \"gke\" {\n  source          = \".\u002Fmodules\u002Fgke\"\n  project_id      = var.project_id\n  environment     = var.environment\n  region          = var.region\n  vpc_name        = module.networking.vpc_id\n  gke_subnet_name = module.networking.gke_subnet_id\n  node_sa_email   = google_service_account.gke_nodes.email\n  depends_on      = [module.networking]\n}\n\nmodule \"database\" {\n  source               = \".\u002Fmodules\u002Fcloud-sql\"\n  project_id           = var.project_id\n  environment          = var.environment\n  region               = var.region\n  vpc_id               = module.networking.vpc_id\n  database_version     = \"POSTGRES_16\"\n  tier                 = \"db-custom-4-16384\"\n  private_vpc_connection = module.networking.private_vpc_connection\n  depends_on           = [module.networking]\n}\n```\n\n## Environment Configuration\n\n```hcl\n# environments\u002Fproduction.tfvars\nproject_id  = \"my-company-prod\"\nenvironment = \"production\"\nregion      = \"us-central1\"\n```\n\n```bash\nterraform plan -var-file=environments\u002Fproduction.tfvars -out=tfplan\nterraform apply tfplan\n```\n\n## CI\u002FCD Integration\n\n```bash\nterraform init -input=false\nterraform validate && terraform fmt -check\nterraform plan -var-file=environments\u002F${ENV}.tfvars -out=tfplan -input=false\nterraform apply -input=false tfplan\n\n# Import existing resources\nterraform import google_compute_network.vpc projects\u002F${PROJECT_ID}\u002Fglobal\u002Fnetworks\u002Fprod-vpc\n\n# State management\nterraform state list\nterraform state mv google_compute_instance.old google_compute_instance.new\n```\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---------|-------|-----|\n| `Error 403: Access Not Configured` | API not enabled | Add API to `google_project_service` resources |\n| `Error acquiring the state lock` | Concurrent run or stale lock | Run `terraform force-unlock LOCK_ID` after verification |\n| `Resource already exists` | Created outside Terraform | Import with `terraform import` |\n| `Quota exceeded` | Project quota too low | Request increase in Cloud Console > Quotas |\n| Plan shows destroy\u002Frecreate | Changed force-new attribute | Use `moved` blocks or `terraform state mv` |\n| `Backend initialization required` | Changed backend config | Run `terraform init -migrate-state` |\n| Cycle in resource graph | Circular references | Refactor with data sources\n split applies |\n\n## Related Skills\n\n- **gcp-networking** - VPC and firewall resources managed by Terraform\n- **gcp-gke** - GKE cluster provisioning with Terraform modules\n- **gcp-cloud-sql** - Cloud SQL instance management via Terraform\n- **gcp-compute** - Compute Engine resources defined in Terraform\n- **gcp-cloud-functions** - Serverless function deployment with Terraform\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n",{"name":5,"risk":33,"source":51,"license":14,"category":52,"metadata":53,"date_added":56,"description":7,"source_repo":57,"source_type":26,"compatibility":58,"license_source":59},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":54,"version":55},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-terraform-gcp",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-14 14:18:11",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add boisenoise\u002Fskills-collections --skill terraform-gcp",{"tool":72,"command":73},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill terraform-gcp",{"tool":75,"command":76},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill terraform-gcp","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-terraform-gcp\u002FSKILL.md",true,[],[81,105,131,157,176,199],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":86,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":46},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[90,40,91,92,93,94,95,96,97,98,99,38,100,101,35,33,102,103,104,28,27],"web","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","free","cover","normal",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":109,"sourceHtmlUrl":110,"categories":111,"keywords":115,"publishedAt":46},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[107,116,117,118,92,93,119,97,120,121,122,123,124,125,126,33,127,128,129,130,27],"MCP","cli","github","license","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":135,"sourceHtmlUrl":136,"categories":137,"keywords":143,"publishedAt":46},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[138],{"categoryNo":139,"categoryName":140,"taxonomyType":141,"taxonomyTypeDesc":142},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[133,118,92,119,144,145,146,147,148,149,33,150,151,152,128,153,154,155,156,130,107,27],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":161,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":46},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[165,166,167,118,92,119,168,169,144,170,120,171,172,173,148,33,174,175,130,107,27],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":180,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":46},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[184,185,118,186,92,187,119,188,189,190,191,192,33,193,194,195,196,197,198,130],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":203,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":46},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[207,208,209,118,92,119,210,211,147,212,213,33,214,215,216,217,218,219,220,130],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]