An example configuration is found in examples/root_example/main.tf.
Assuming you have the GCloud CLI installed and configured, to the example, run
tf apply --target module.sn_cluster
tf apply
Name | Version |
---|---|
terraform | >=1.3.0 |
~> 5.19 | |
google-beta | ~> 5.19 |
helm | ~> 2.2 |
kubernetes | ~> 2.8 |
Name | Version |
---|---|
~> 5.19 | |
helm | ~> 2.2 |
kubernetes | ~> 2.8 |
Name | Source | Version |
---|---|---|
cert_manager_sa | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | 30.1.0 |
external_dns_sa | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | 30.1.0 |
external_secrets_sa | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | 30.1.0 |
gke | terraform-google-modules/kubernetes-engine/google | 29.0.0 |
gke_private | terraform-google-modules/kubernetes-engine/google//modules/private-cluster | 29.0.0 |
istio | github.com/streamnative/terraform-helm-charts//modules/istio-operator | master |
Name | Type |
---|---|
google_kms_crypto_key.gke_encryption_key | resource |
google_kms_key_ring.keyring | resource |
google_project_iam_member.kms_iam_binding | resource |
helm_release.cert_issuer | resource |
helm_release.cert_manager | resource |
helm_release.cilium | resource |
helm_release.external_dns | resource |
helm_release.external_secrets | resource |
kubernetes_namespace.istio_system | resource |
kubernetes_namespace.sn_system | resource |
kubernetes_resource_quota.istio_critical_pods | resource |
kubernetes_storage_class.sn_default | resource |
kubernetes_storage_class.sn_ssd | resource |
google_compute_zones.available | data source |
google_project.project | data source |
Name | Description | Type | Default | Required |
---|---|---|---|---|
add_cluster_firewall_rules | Creates additional firewall rules on the cluster. | bool |
false |
no |
add_master_webhook_firewall_rules | Create master_webhook firewall rules for ports defined in firewall_inbound_ports. | bool |
false |
no |
add_shadow_firewall_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | bool |
false |
no |
authenticator_security_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | string |
null |
no |
cert_issuer_support_email | The email address to receive notifications from the cert issuer. | string |
"certs-support@streamnative.io" |
no |
cert_manager_helm_chart_name | The name of the Cert Manager Helm chart to be used. | string |
"cert-manager" |
no |
cert_manager_helm_chart_repository | The location of the helm chart to use for Cert Manager. | string |
"https://charts.bitnami.com/bitnami" |
no |
cert_manager_helm_chart_version | The version of the Cert Manager helm chart to install. Defaults to "0.7.8". | string |
"0.7.8" |
no |
cert_manager_settings | Additional settings which will be passed to the Helm chart values. See https://github.com/bitnami/charts/tree/master/bitnami/cert-manager for detailed options. | map(any) |
{} |
no |
cilium_helm_chart_name | The name of the Helm chart in the repository for Cilium. | string |
"cilium" |
no |
cilium_helm_chart_repository | The repository containing the Cilium helm chart. | string |
"https://helm.cilium.io" |
no |
cilium_helm_chart_version | Helm chart version for Cilium. See https://artifacthub.io/packages/helm/cilium/cilium for updates. | string |
"1.13.2" |
no |
cluster_autoscaling_config | Cluster autoscaling configuration for node auto-provisioning. This is disabled for our configuration, since we typically want to scale existing node pools rather than add new ones to the cluster | object({ |
{ |
no |
cluster_http_load_balancing | Enable the HTTP load balancing addon for the cluster. Defaults to "true" | bool |
true |
no |
cluster_name | The name of your GKE cluster. | string |
n/a | yes |
cluster_network_policy | Enable the network policy addon for the cluster. Defaults to "true", and uses CALICO as the provider | bool |
true |
no |
create_service_account | Creates a service account for the cluster. Defaults to "true". | bool |
true |
no |
database_encryption_key_name | Name of the KMS key to encrypt Kubernetes secrets at rest in etcd | string |
"" |
no |
datapath_provider | the datapath provider to use, in the future, the default of this should be ADVANCED_DATAPATH | string |
"DATAPATH_PROVIDER_UNSPECIFIED" |
no |
default_max_pods_per_node | the number of pods per node, defaults to GKE default of 110, but in smaller CIDRs we want to tune this | number |
110 |
no |
deletion_protection | Whether or not to allow Terraform to destroy the cluster. | bool |
true |
no |
enable_cert_manager | Enables the Cert-Manager addon service on the cluster. Defaults to "true", and in most situations is required by StreamNative Cloud. | bool |
true |
no |
enable_cilium | Enables Cilium on the cluster. Set to "false" by default. | bool |
false |
no |
enable_database_encryption | Enables etcd encryption via Google KMS. | bool |
false |
no |
enable_external_dns | Enables the External DNS addon service on the cluster. Defaults to "true", and in most situations is required by StreamNative Cloud. | bool |
true |
no |
enable_external_secrets | Enables kubernetes-external-secrets on the cluster, which uses GCP Secret Manager as the secrets backend | bool |
true |
no |
enable_func_pool | Enable an additional dedicated pool for Pulsar Functions. Enabled by default. | bool |
true |
no |
enable_istio | Enables Istio on the cluster. Set to "false" by default. | bool |
false |
no |
enable_private_gke | Enables private GKE cluster, where nodes are not publicly accessible. Defaults to "false". | bool |
false |
no |
enable_private_nodes | Whether nodes have internal IP addresses only, only used for private clusters | bool |
true |
no |
enable_resource_creation | When enabled, all dependencies, like service accounts, buckets, etc will be created. When disabled, they will note. Use in combination with enable_<app> to manage these outside this module |
bool |
true |
no |
external_dns_helm_chart_name | The name of the Helm chart in the repository for ExternalDNS. | string |
"external-dns" |
no |
external_dns_helm_chart_repository | The repository containing the ExternalDNS helm chart. | string |
"https://charts.bitnami.com/bitnami" |
no |
external_dns_helm_chart_version | Helm chart version for ExternalDNS. See https://github.com/bitnami/charts/tree/master/bitnami/external-dns for updates. | string |
"6.15.0" |
no |
external_dns_policy | Sets how DNS records are managed by ExternalDNS. Options are "sync", which allows ExternalDNS to create and delete records, or "upsert_only", which only allows for the creation of records | string |
"upsert-only" |
no |
external_dns_settings | Additional settings which will be passed to the Helm chart values, see https://github.com/bitnami/charts/tree/master/bitnami/external-dns for detailed options. | map(any) |
{} |
no |
external_dns_version | The version of the ExternalDNS helm chart to install. Defaults to "5.2.2". | string |
"5.2.2" |
no |
external_secrets_helm_chart_name | The name of the Helm chart in the repository for kubernetes-external-secrets | string |
"kubernetes-external-secrets" |
no |
external_secrets_helm_chart_repository | The repository containing the kubernetes-external-secrets helm chart | string |
"https://external-secrets.github.io/kubernetes-external-secrets" |
no |
external_secrets_helm_chart_version | Helm chart version for kubernetes-external-secrets. Defaults to "8.3.0". See https://github.com/external-secrets/kubernetes-external-secrets/tree/master/charts/kubernetes-external-secrets for updates | string |
"8.3.0" |
no |
external_secrets_settings | Additional settings which will be passed to the Helm chart values, see https://github.com/external-secrets/kubernetes-external-secrets/tree/master/charts/kubernetes-external-secrets for available options | map(any) |
{} |
no |
firewall_inbound_ports | List of TCP ports for admission/webhook controllers. Either flag add_master_webhook_firewall_rules or add_cluster_firewall_rules (also adds egress rules) must be set to true for inbound-ports firewall rules to be applied. |
list(string) |
[ |
no |
func_pool_auto_repair | Enable auto-repair for the Pulsar Functions pool. | bool |
true |
no |
func_pool_auto_upgrade | Enable auto-upgrade for the Pulsar Functions pool. | bool |
true |
no |
func_pool_autoscaling | Enable autoscaling of the Pulsar Functions pool. Defaults to "true". | bool |
true |
no |
func_pool_autoscaling_initial_count | The initial number of nodes in the Pulsar Functions pool, per zone, when autoscaling is enabled. Defaults to 0. | number |
0 |
no |
func_pool_autoscaling_max_size | The maximum size of the Pulsar Functions pool Autoscaling group. Defaults to 3. | number |
3 |
no |
func_pool_autoscaling_min_size | The minimum size of the Pulsar Functions pool AutoScaling group. Defaults to 0. | number |
0 |
no |
func_pool_count | The number of worker nodes in the Pulsar Functions pool. This is only used if func_pool_autoscaling is set to false. Defaults to 1. | number |
1 |
no |
func_pool_disk_size | Disk size in GB for worker nodes in the Pulsar Functions pool. Defaults to 100. | number |
100 |
no |
func_pool_disk_type | The type disk attached to worker nodes in the Pulsar Functions pool. Defaults to "pd-standard". | string |
"pd-standard" |
no |
func_pool_image_type | The image type to use for worker nodes in the Pulsar Functions pool. Defaults to "COS" (cointainer-optimized OS with docker). | string |
"COS_CONTAINERD" |
no |
func_pool_locations | A string of comma seperated values (upstream requirement) of zones for the Pulsar Functions pool, e.g. "us-central1-b,us-central1-c" etc. Nodes must be in the same region as the cluster. Defaults to three random zones in the region specified for the cluster via the "cluster_location" input, or the zones provided through the "node_pool_locations" input (if it is defined). | string |
"" |
no |
func_pool_machine_type | The machine type to use for worker nodes in the Pulsar Functions pool. Defaults to "n2-standard-4". | string |
"n2-standard-4" |
no |
func_pool_max_pods_per_node | the number of pods per node | number |
110 |
no |
func_pool_name | The name of the Pulsar Functions pool. Defaults to "default-node-pool". | string |
"func-pool" |
no |
func_pool_service_account | The service account email address to use for the Pulsar Functions pool. If create_service_account is set to true, it will use the the output from the module. | string |
"" |
no |
func_pool_ssd_count | The number of SSDs to attach to each node in the Pulsar Functions pool. Defaults to 0. | number |
0 |
no |
func_pool_version | The version of Kubernetes to use for the Pulsar Functions pool. If the input "release_channel" is not defined, defaults to "kubernetes_version" used for the cluster. Should only be defined while "func_pool_auto_upgrade" is also set to "false". | string |
"" |
no |
google_service_account | when set, don't create GSAs and instead use the this service account for all apps | string |
"" |
no |
horizontal_pod_autoscaling | Enable horizontal pod autoscaling for the cluster. Defaults to "true". | bool |
true |
no |
istio_chart_version | The version of the istio chart to use | string |
"2.11" |
no |
istio_mesh_id | The ID used by the Istio mesh. This is also the ID of the StreamNative Cloud Pool used for the workload environments. This is required when "enable_istio_operator" is set to "true". | string |
null |
no |
istio_network | The name of network used for the Istio deployment. This is required when "enable_istio_operator" is set to "true". | string |
"default" |
no |
istio_network_loadbalancer | n/a | string |
"internet_facing" |
no |
istio_profile | The path or name for an Istio profile to load. Set to the profile "default" if not specified. | string |
"default" |
no |
istio_revision_tag | The revision tag value use for the Istio label "istio.io/rev". | string |
"sn-stable" |
no |
istio_settings | Additional settings which will be passed to the Helm chart values | map(any) |
{} |
no |
istio_trust_domain | The trust domain used for the Istio deployment, which corresponds to the root of a system. This is required when "enable_istio_operator" is set to "true". | string |
"cluster.local" |
no |
kiali_operator_settings | Additional settings which will be passed to the Helm chart values | map(any) |
{} |
no |
kubernetes_version | The version of Kubernetes to use for the cluster. Defaults to "latest", which uses the latest available version for GKE in the region specified. | string |
"latest" |
no |
logging_enabled_components | List of services to monitor: SYSTEM_COMPONENTS, APISERVER, CONTROLLER_MANAGER, SCHEDULER, WORKLOADS. Empty list is default GKE configuration. | list(string) |
[] |
no |
logging_service | The logging service to use for the cluster. Defaults to "logging.googleapis.com/kubernetes". | string |
"logging.googleapis.com/kubernetes" |
no |
maintenance_exclusions | A list of objects used to define exceptions to the maintenance window, when non-emergency maintenance should not occur. Can have up to three exclusions. Refer to the offical Terraform docs on the "google_container_cluster" resource for object schema. | list(object({ name = string, start_time = string, end_time = string, exclusion_scope = string })) |
[] |
no |
maintenance_window | The start time (in RFC3339 format) for the GKE to perform maintenance operations. Defaults to "05:00". | string |
"05:00" |
no |
master_authorized_networks | A list of objects used to define authorized networks. If none are provided, the default is to disallow external access. See the parent module for more details. https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest | list(object({ cidr_block = string, display_name = string })) |
[] |
no |
master_ipv4_cidr_block | The IP range in CIDR notation to use for the hosted master network. Only used for private clusters | string |
"10.0.0.0/28" |
no |
monitoring_enabled_components | List of services to monitor: SYSTEM_COMPONENTS, APISERVER, CONTROLLER_MANAGER, SCHEDULER. Empty list is default GKE configuration. | list(string) |
[] |
no |
network_project_id | If using a different project, the id of the project | string |
"" |
no |
node_pool_auto_repair | Enable auto-repair for the default node pool. | bool |
true |
no |
node_pool_auto_upgrade | Enable auto-upgrade for the default node pool. | bool |
true |
no |
node_pool_autoscaling | Enable autoscaling of the default node pool. Defaults to "true". | bool |
true |
no |
node_pool_autoscaling_initial_count | The initial number of nodes per zone in the default node pool, PER ZONE, when autoscaling is enabled. Defaults to 1. | number |
1 |
no |
node_pool_autoscaling_max_size | The maximum size of the default node pool Autoscaling group. Defaults to 5. | number |
5 |
no |
node_pool_autoscaling_min_size | The minimum size of the default node pool AutoScaling group. Defaults to 1. | number |
1 |
no |
node_pool_count | The number of worker nodes in the default node pool. This is only used if node_pool_autoscaling is set to false. Defaults to 3. | number |
3 |
no |
node_pool_disk_size | Disk size in GB for worker nodes in the default node pool. Defaults to 100. | number |
100 |
no |
node_pool_disk_type | The type disk attached to worker nodes in the default node pool. Defaults to "pd-standard". | string |
"pd-standard" |
no |
node_pool_image_type | The image type to use for worker nodes in the default node pool. Defaults to "COS" (cointainer-optimized OS with docker). | string |
"COS_CONTAINERD" |
no |
node_pool_locations | A string of comma seperated values (upstream requirement) of zones for the location of the default node pool, e.g. "us-central1-b,us-central1-c" etc. Nodes must be in the region as the cluster. Defaults to three random zones in the region chosen for the cluster | string |
"" |
no |
node_pool_machine_type | The machine type to use for worker nodes in the default node pool. Defaults to "n2-standard-8". | string |
"n2-standard-8" |
no |
node_pool_max_pods_per_node | the number of pods per node | number |
110 |
no |
node_pool_name | The name of the default node pool. Defaults to "sn-node-pool". | string |
"default-node-pool" |
no |
node_pool_secure_boot | enable the node pool secure boot setting | bool |
false |
no |
node_pool_service_account | The service account email address to use for the default node pool. If create_service_account is set to true, it will use the the output from the module. | string |
"" |
no |
node_pool_ssd_count | The number of SSDs to attach to each node in the default node pool | number |
0 |
no |
node_pool_version | The version of Kubernetes to use for the default node pool. If the input "release_channel" is not defined, defaults to "kubernetes_version" used for the cluster. Should only be defined while "node_pool_auto_upgrade" is also set to "false". | string |
"" |
no |
project_id | The project ID to use for the cluster. Defaults to the current GCP project. | string |
n/a | yes |
region | The GCP region where the GKE cluster will be deployed. This module only supports creation of a regional cluster | string |
n/a | yes |
release_channel | The Kubernetes release channel to use for the cluster. Accepted values are "UNSPECIFIED", "RAPID", "REGULAR" and "STABLE". Defaults to "UNSPECIFIED". | string |
"STABLE" |
no |
secondary_ip_range_pods | The name of the secondary range to use for the pods in the cluster. If no secondary range for the pod network is provided, GKE will create a /14 CIDR within the subnetwork provided by the "vpc_subnet" input | string |
null |
no |
secondary_ip_range_pods_cidr | The cidr of the secondary range, required when using cillium | string |
null |
no |
secondary_ip_range_services | The name of the secondary range to use for services in the cluster. If no secondary range for the services network is provided, GKE will create a /20 CIDR within the subnetwork provided by the "vpc_subnet" input | string |
null |
no |
service_domain | The DNS domain for external service endpoints. This must be set when enabling Istio or else the deployment will fail. | string |
null |
no |
storage_class_default_ssd | determines if the default storage class should be with ssd | bool |
false |
no |
suffix | A unique string that is used to distinguish cluster resources, where name length constraints are imposed by GKE. Defaults to an empty string. | string |
"" |
no |
vpc_network | The name of the VPC network to use for the cluster. Can be set to "default" if the default VPC is enabled in the project | string |
n/a | yes |
vpc_subnet | The name of the VPC subnetwork to use by the cluster nodes. Can be set to "default" if the default VPC is enabled in the project, and GKE will choose the subnetwork based on the "region" input | string |
n/a | yes |
Name | Description |
---|---|
ca_certificate | n/a |
cert_manager_sa_email | n/a |
endpoint | n/a |
external_dns_manager_sa_email | n/a |
external_secrets_sa_email | n/a |
id | n/a |
master_version | n/a |
name | n/a |
node_pool_azs | n/a |
service_account | n/a |