# Bare VM on the workload subnet, for manually verifying that its traffic to
# remote_cidrs flows through the router. Off by default so a plain apply
# stays to just the router.

resource "google_compute_instance" "workload" {
  count        = var.deploy_workload_vm ? 1 : 0
  name         = "${var.name}-workload"
  machine_type = var.machine_type
  zone         = var.zone

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
    }
  }

  network_interface {
    network    = google_compute_network.internal.id
    subnetwork = google_compute_subnetwork.workload.id
  }

  metadata = {
    ssh-keys = "${var.admin_username}:${var.admin_ssh_public_key}"
  }
}