Skip to content

Commit

Permalink
fix: promoting release_channel, database_encryption, workload_identit…
Browse files Browse the repository at this point in the history 
…y_config, and enable_shielded_nodes from beta to GA
  • Loading branch information
@marko7460
marko7460 committed Oct 12, 2020
1 parent 68e8eec commit 0b9fcd4
Show file tree
Hide file tree
Showing 45 changed files with 562 additions and 259 deletions.
7 changes: 7 additions & 0 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -107,18 +107,21 @@ Then perform the following commands on the root folder:
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | map(string) | `<map>` | no |
| configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | string | `"false"` | no |
| create\_service\_account | Defines if service account specified to run nodes should be created. | bool | `"true"` | no |
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. | object | `<list>` | no |
| default\_max\_pods\_per\_node | The maximum number of pods to schedule per node | string | `"110"` | no |
| description | The description of the cluster | string | `""` | no |
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | bool | `"true"` | no |
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | bool | `"false"` | no |
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | bool | `"true"` | no |
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"true"` | no |
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | list(string) | `<list>` | no |
| firewall\_priority | Priority rule for firewall rules | number | `"1000"` | no |
| gcloud\_skip\_download | Whether to skip downloading gcloud (assumes gcloud is already available outside the module) | bool | `"true"` | no |
| gcloud\_upgrade | Whether to upgrade gcloud at runtime | bool | `"false"` | no |
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"false"` | no |
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
| http\_load\_balancing | Enable httpload balancer addon | bool | `"true"` | no |
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | string | `"enabled"` | no |
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | number | `"0"` | no |
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | bool | `"false"` | no |
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | string | `"60s"` | no |
Expand All @@ -135,6 +138,7 @@ Then perform the following commands on the root folder:
| network\_policy | Enable network policy addon | bool | `"true"` | no |
| network\_policy\_provider | The network policy provider. | string | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | string | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"GKE_METADATA_SERVER"` | no |
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
| node\_pools\_labels | Map of maps containing node labels by node-pool name | map(map(string)) | `<map>` | no |
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | map(map(string)) | `<map>` | no |
Expand All @@ -146,6 +150,7 @@ Then perform the following commands on the root folder:
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
| registry\_project\_id | Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project. | string | `""` | no |
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | string | `"null"` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | string | `""` | no |
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
Expand All @@ -163,6 +168,7 @@ Then perform the following commands on the root folder:
| endpoint | Cluster endpoint |
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
| http\_load\_balancing\_enabled | Whether http load balancing enabled |
| identity\_namespace | Workload Identity namespace |
| location | Cluster location (region if regional cluster, zone if zonal cluster) |
| logging\_service | Logging service used |
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
Expand All @@ -174,6 +180,7 @@ Then perform the following commands on the root folder:
| node\_pools\_names | List of node pools names |
| node\_pools\_versions | List of node pools versions |
| region | Cluster region |
| release\_channel | The release channel of this cluster |
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
| type | Cluster type (regional / zonal) |
| zones | List of zones in which the cluster resides |
Expand Down
15 changes: 3 additions & 12 deletions autogen/main/cluster.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,15 +45,13 @@ resource "google_container_cluster" "primary" {
}
}

{% if beta_cluster %}
dynamic "release_channel" {
for_each = local.release_channel

content {
channel = release_channel.value.channel
}
}
{% endif %}

subnetwork = "projects/${local.network_project_id}/regions/${var.region}/subnetworks/${var.subnetwork}"

Expand All @@ -62,11 +60,7 @@ resource "google_container_cluster" "primary" {
disabled = var.disable_default_snat
}
{% endif %}
{% if beta_cluster %}
min_master_version = var.release_channel != null ? null : local.master_version
{% else %}
min_master_version = local.master_version
{% endif %}

logging_service = var.logging_service
monitoring_service = var.monitoring_service
Expand All @@ -88,10 +82,10 @@ resource "google_container_cluster" "primary" {

default_max_pods_per_node = var.default_max_pods_per_node

enable_shielded_nodes = var.enable_shielded_nodes
{% if beta_cluster %}
enable_binary_authorization = var.enable_binary_authorization
enable_intranode_visibility = var.enable_intranode_visibility
enable_shielded_nodes = var.enable_shielded_nodes
enable_kubernetes_alpha = var.enable_kubernetes_alpha

vertical_pod_autoscaling {
Expand Down Expand Up @@ -224,7 +218,6 @@ resource "google_container_cluster" "primary" {

node_config {
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
{% if beta_cluster %}

dynamic "workload_metadata_config" {
for_each = local.cluster_node_metadata_config
Expand All @@ -233,7 +226,6 @@ resource "google_container_cluster" "primary" {
node_metadata = workload_metadata_config.value.node_metadata
}
}
{% endif %}
}
}

Expand Down Expand Up @@ -278,7 +270,6 @@ resource "google_container_cluster" "primary" {
{% endif %}

remove_default_node_pool = var.remove_default_node_pool
{% if beta_cluster %}

dynamic "database_encryption" {
for_each = var.database_encryption
Expand All @@ -297,6 +288,7 @@ resource "google_container_cluster" "primary" {
}
}

{% if beta_cluster %}
dynamic "authenticator_groups_config" {
for_each = local.cluster_authenticator_security_group
content {
Expand Down Expand Up @@ -501,7 +493,6 @@ resource "google_container_node_pool" "pools" {
count = guest_accelerator["count"]
}
]
{% if beta_cluster %}

dynamic "workload_metadata_config" {
for_each = local.cluster_node_metadata_config
Expand All @@ -510,7 +501,7 @@ resource "google_container_node_pool" "pools" {
node_metadata = lookup(each.value, "node_metadata", workload_metadata_config.value.node_metadata)
}
}

{% if beta_cluster %}
dynamic "sandbox_config" {
for_each = local.cluster_sandbox_enabled

Expand Down
17 changes: 8 additions & 9 deletions autogen/main/main.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,8 +50,8 @@ locals {
node_pool_names = [for np in toset(var.node_pools) : np.name]
node_pools = zipmap(local.node_pool_names, tolist(toset(var.node_pools)))

{% if beta_cluster %}
release_channel = var.release_channel != null ? [{ channel : var.release_channel }] : []
{% if beta_cluster %}

autoscalling_resource_limits = var.cluster_autoscaling.enabled ? [{
resource_type = "cpu"
Expand Down Expand Up @@ -95,17 +95,16 @@ locals {

cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]

cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
node_metadata = var.node_metadata
}]

cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
security_group = var.authenticator_security_group
}]

cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []

{% endif %}
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
node_metadata = var.node_metadata
}]

cluster_output_name = google_container_cluster.primary.name
cluster_output_regional_zones = google_container_cluster.primary.node_locations
Expand Down Expand Up @@ -167,6 +166,10 @@ locals {
cluster_network_policy_enabled = ! local.cluster_output_network_policy_enabled
cluster_http_load_balancing_enabled = ! local.cluster_output_http_load_balancing_enabled
cluster_horizontal_pod_autoscaling_enabled = ! local.cluster_output_horizontal_pod_autoscaling_enabled
workload_identity_enabled = ! (var.identity_namespace == null || var.identity_namespace == "null")
cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
identity_namespace = "${var.project_id}.svc.id.goog" }] : [{ identity_namespace = var.identity_namespace
}]
{% if beta_cluster %}
# BETA features
cluster_istio_enabled = ! local.cluster_output_istio_disabled
Expand All @@ -176,10 +179,6 @@ locals {
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled

workload_identity_enabled = ! (var.identity_namespace == null || var.identity_namespace == "null")
cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
identity_namespace = "${var.project_id}.svc.id.goog" }] : [{ identity_namespace = var.identity_namespace
}]
# /BETA features
{% endif %}

Expand Down
26 changes: 13 additions & 13 deletions autogen/main/outputs.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,19 @@ output "service_account" {
description = "The service account to default running nodes as if not overridden in `node_pools`."
value = local.service_account
}

output "release_channel" {
description = "The release channel of this cluster"
value = var.release_channel
}

output "identity_namespace" {
description = "Workload Identity namespace"
value = length(local.cluster_workload_identity_config) > 0 ? local.cluster_workload_identity_config[0].identity_namespace : null
depends_on = [
google_container_cluster.primary
]
}
{% if private_cluster %}

output "master_ipv4_cidr_block" {
Expand Down Expand Up @@ -161,17 +174,4 @@ output "vertical_pod_autoscaling_enabled" {
description = "Whether veritical pod autoscaling is enabled"
value = local.cluster_vertical_pod_autoscaling_enabled
}

output "release_channel" {
description = "The release channel of this cluster"
value = var.release_channel
}

output "identity_namespace" {
description = "Workload Identity namespace"
value = length(local.cluster_workload_identity_config) > 0 ? local.cluster_workload_identity_config[0].identity_namespace : null
depends_on = [
google_container_cluster.primary
]
}
{% endif %}
49 changes: 24 additions & 25 deletions autogen/main/variables.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -445,16 +445,6 @@ variable "config_connector" {
default = false
}

variable "database_encryption" {
description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key."
type = list(object({ state = string, key_name = string }))

default = [{
state = "DECRYPTED"
key_name = ""
}]
}

variable "cloudrun" {
description = "(Beta) Enable CloudRun addon"
default = false
Expand All @@ -471,12 +461,6 @@ variable "enable_pod_security_policy" {
default = false
}

variable "node_metadata" {
description = "Specifies how node metadata is exposed to the workload running on the node"
default = "GKE_METADATA_SERVER"
type = string
}

variable "sandbox_enabled" {
type = bool
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it)."
Expand All @@ -495,21 +479,38 @@ variable "enable_vertical_pod_autoscaling" {
default = false
}

variable "identity_namespace" {
description = "Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`)"
type = string
default = "enabled"
}

variable "authenticator_security_group" {
type = string
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com"
default = null
}
{% endif %}

variable "node_metadata" {
description = "Specifies how node metadata is exposed to the workload running on the node"
default = "GKE_METADATA_SERVER"
type = string
}

variable "database_encryption" {
description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key."
type = list(object({ state = string, key_name = string }))

default = [{
state = "DECRYPTED"
key_name = ""
}]
}

variable "identity_namespace" {
description = "Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`)"
type = string
default = "enabled"
}

variable "release_channel" {
type = string
description = "(Beta) The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`."
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`."
default = null
}

Expand All @@ -518,8 +519,6 @@ variable "enable_shielded_nodes" {
description = "Enable Shielded Nodes features on all nodes in this cluster"
default = true
}
{% endif %}


variable "add_cluster_firewall_rules" {
type = bool
Expand Down

0 comments on commit 0b9fcd4

Please sign in to comment.