Add support for GKE Autopilot in google_container_cluster resource

[paulwilljones]

Adds support for GKE Autopilot to google_container_cluster resource.

Due to the defaults set in GKE Autopilot, some features of GKE aren't available when in Autopilot mode.

[c2thorn]

@paulwilljones Thanks for starting this process. With the amount of differences between autopilot and standard GKE, this is not a straightforward change. We want to be cautious and ensure that standard GKE UX is not disrupted.

In addition to the comments already suggested, I would request more extensive testing:

• A test config with all available fields set
• A test checking the error for autopilot on a zonal cluster (similar to https://github.com/hashicorp/terraform-provider-google/blob/master/google/resource_container_cluster_test.go#L1468)

[paulwilljones]

@paulwilljones Thanks for starting this process. With the amount of differences between autopilot and standard GKE, this is not a straightforward change. We want to be cautious and ensure that standard GKE UX is not disrupted.

In addition to the comments already suggested, I would request more extensive testing:

• A test config with all available fields set
• A test checking the error for autopilot on a zonal cluster (similar to https://github.com/hashicorp/terraform-provider-google/blob/master/google/resource_container_cluster_test.go#L1468)

Thanks both. I'll take a look at those changes.
One thing I've noticed is certain features will need enabling when enable_autopilot: true, such as shielded nodes in order for the API to accept the request:

Error: googleapi: Error 400: Autopilot clusters requires shielded nodes to be enabled., badRequest                                            

[c2thorn]

One thing I've noticed is certain features will need enabling when enable_autopilot: true, such as shielded nodes in order for the API to accept the request:

Error: googleapi: Error 400: Autopilot clusters requires shielded nodes to be enabled., badRequest                                            

Omitting shielded nodes from the request altogether works correct?

[glerchundi]

This is absolutely fantastic! Cannot wait to see this merged and ready to be consumed :D

[c2thorn]

LGTM, thanks for the changes!

I'll work on getting this upstreamed to https://github.com/GoogleCloudPlatform/magic-modules where there'll be more testing and another review.

[cmcga1125]

not trying to be pesky - any idea when this will hit the provider?

[c2thorn]

@cmcga1125 My estimate is version v3.62 scheduled for March 29th. Running the full test suite for google_container_cluster showed that this implementation introduces new test failures that need to be addressed before releasing. The cutoff for the v3.61 release was last night, so this looks like it will be released in v3.62.

[c2thorn]

@paulwilljones If you are interested in taking a stab at the failing tests, I have found there are a few types of failures:

• enable_shielded_nodes shows a diff after applying - seen in TestAccContainerCluster_withMasterAuthConfig
• enable_autopilot shows a diff after importing - seen in TestAccContainerCluster_withReleaseChannelEnabled
• A container cluster datasource tests are also failing: see TestAccContainerClusterDatasource_zonal

Otherwise, I plan to address them in GoogleCloudPlatform/magic-modules#4591

[paulwilljones]

@paulwilljones If you are interested in taking a stab at the failing tests, I have found there are a few types of failures:

• enable_shielded_nodes shows a diff after applying - seen in TestAccContainerCluster_withMasterAuthConfig
• enable_autopilot shows a diff after importing - seen in TestAccContainerCluster_withReleaseChannelEnabled
• A container cluster datasource tests are also failing: see TestAccContainerClusterDatasource_zonal

Otherwise, I plan to address them in GoogleCloudPlatform/magic-modules#4591

Addressed in 8ea195f

[paulwilljones]

@c2thorn Enabling Shielded Nodes by default is in alignment with GKE 1.18.

I'm seeing test failures (for example TestAccContainerCluster_withMasterAuthConfig) when shielded nodes is false:

# google_container_cluster.with_master_auth_no_cert will be updated in-place
          ~ resource "google_container_cluster" "with_master_auth_no_cert" {
              ~ enable_shielded_nodes       = true -> false

[c2thorn]

@paulwilljones I've made a few changes to the upstream PR in GoogleCloudPlatform/magic-modules#4591 and believe I have a working iteration. Syncing this PR isn't required, since the upstream PR will cover the differences.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!