commit cae4e350b35df6e66a27a64d0d0c2857dc644e16
Author: sirius0xdev <sirius0xdev@proton.me>
Date:   Tue Dec 30 01:57:06 2025 +0000

    first terraform cluster deployment

diff --git a/.devcontainer.json b/.devcontainer.json
new file mode 100644
index 0000000..675768c
--- /dev/null
+++ b/.devcontainer.json
@@ -0,0 +1,12 @@
+{
+  "image": "mcr.microsoft.com/devcontainers/base:debian" ,
+  "onCreateCommand": "sudo chsh -s /usr/bin/zsh $USER" ,
+  "settings": {
+    "terminal/integrated.defaultProfile.linux": "zsh", 
+    "terminal/integrated.profiles.linux": {  
+      "zsh": {
+        "path": "usr/bin/zsh"
+     }
+    }
+  }
+}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..9c71ee7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,48 @@
+# Local .terraform directories
+.terraform/
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Ignore transient lock info files created by terraform apply
+.terraform.tfstate.lock.info
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Optional: ignore graph output files generated by `terraform graph`
+# *.dot
+
+# Optional: ignore plan files saved before destroying Terraform configuration
+# Uncomment the line below if you want to ignore planout files.
+# planout
+
+kubeconfig 
+
+application_default_credentials.json 
diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
new file mode 100644
index 0000000..fbdf18e
--- /dev/null
+++ b/.terraform.lock.hcl
@@ -0,0 +1,21 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/google" {
+  version = "7.14.1"
+  hashes = [
+    "h1:PWld5LsERFpdHnINaCgXebs2oQtm2T09Ls/0OUASk0A=",
+    "zh:0006182db112098af8514fc38d9cd4e816da4145a2a0b9fb62cc9e281eb2b2a1",
+    "zh:60311d9770ca26c549af9a964ee6cb60ce7541b52fedfaf5f112b0931e6bcce1",
+    "zh:65b400c0718f6b7c5cd0fba1b2e3696d5f4f69868229627b11b0b2b94b613ade",
+    "zh:9ec00812dc750687610140f9a97c374492ef320eddcb669b154e1d2e8714f7f3",
+    "zh:adaf0486d68da121886992a3762cedffa86b611fa43294359b2a569044c462a7",
+    "zh:ba95c0d8279dd8e7b9294e521e461d4adaa7c171b00502be197b6c7ff4f07d65",
+    "zh:c216ca4b350a90c4e74e3f502ef3f35617cdd5c278e2b04ecba2bca980fb5e96",
+    "zh:dd7991a71477dee46c7c57f60775341524271c425ab04e66d8f2762f9b4763eb",
+    "zh:dd7b63b40e67b073d2acb32ee60099d884ce75bf1152a307422c47358054d170",
+    "zh:e5d601ca4ab813c51d897e4c2e80bf3e3565c0dd4f37f85bb91964e90ca92dfe",
+    "zh:f12d8f91ed783ffac9ed8d6c331e0cbe5189455fe352ba633b171b366f52e2cd",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
diff --git a/main.tf b/main.tf
new file mode 100644
index 0000000..458eebb
--- /dev/null
+++ b/main.tf
@@ -0,0 +1,60 @@
+# Configure the Google Cloud provider
+provider "google" {
+  credentials = file("~/.config/gcloud/application_default_credentials.json")
+  project     = "devops-lab-cluster"
+  region      = "us-central1" # Or your desired region/location
+}
+
+resource "google_compute_network" "default" {
+  name = "devops-lab-network"
+
+  auto_create_subnetworks  = false
+  enable_ula_internal_ipv6 = true
+}
+
+resource "google_compute_subnetwork" "default" {
+  name = "devops-lab-subnetwork"
+
+  ip_cidr_range = "10.0.0.0/16"
+  region        = "us-central1"
+
+  stack_type       = "IPV4_IPV6"
+  ipv6_access_type = "INTERNAL" # Change to "EXTERNAL" if creating an external loadbalancer
+
+  network = google_compute_network.default.id
+  secondary_ip_range {
+    range_name    = "services-range"
+    ip_cidr_range = "192.168.0.0/24"
+  }
+
+  secondary_ip_range {
+    range_name    = "pod-ranges"
+    ip_cidr_range = "192.168.1.0/24"
+  }
+}
+
+resource "google_container_cluster" "default" {
+  name     = "devops-lab-cluster"
+  location = "us-central1-a"
+
+  # 1. Enable Cilium via Dataplane V2
+  datapath_provider = "ADVANCED_DATAPATH"
+  initial_node_count = 1 
+  # 2. REQUIRED: Remove the network_policy block. 
+  # Dataplane V2 handles policies natively.
+
+  # 3. Optional: Enable Cilium-specific cluster-wide policies (GKE 1.28+)
+  enable_cilium_clusterwide_network_policy = true
+
+  network    = google_compute_network.default.id
+  subnetwork = google_compute_subnetwork.default.id
+
+  ip_allocation_policy {
+    stack_type                    = "IPV4_IPV6"
+    services_secondary_range_name = google_compute_subnetwork.default.secondary_ip_range[0].range_name
+    cluster_secondary_range_name  = google_compute_subnetwork.default.secondary_ip_range[1].range_name
+  }
+
+  enable_l4_ilb_subsetting = true
+  deletion_protection      = false
+}
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 0000000..030b0e6
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,4 @@
+[tools]
+gcloud = "latest"
+k9s = "latest"
+terraform = "latest"
diff --git a/scripts/.devcontainer.json b/scripts/.devcontainer.json
new file mode 100644
index 0000000..27dc5b1
--- /dev/null
+++ b/scripts/.devcontainer.json
@@ -0,0 +1 @@
+{"image":"mcr.microsoft.com/devcontainers/base:ubuntu"}
\ No newline at end of file
diff --git a/scripts/setup b/scripts/setup
new file mode 100755
index 0000000..2e23d60
--- /dev/null
+++ b/scripts/setup
@@ -0,0 +1,3 @@
+#!/bin/bash
+/usr/local/bin/mise trust /workspaces/gcloud-lab/mise.toml && /usr/local/bin/mise install
+