Skip to content

Commit

Permalink
feat: support gVNIC
Browse files Browse the repository at this point in the history
  • Loading branch information
anoxape committed Jun 29, 2022
1 parent 71e7067 commit 3db2711
Show file tree
Hide file tree
Showing 20 changed files with 128 additions and 4 deletions.
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ module "gke" {
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
enable_gvnic = false
auto_repair = true
auto_upgrade = true
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
Expand Down Expand Up @@ -238,6 +239,7 @@ The node_pools variable takes the following parameters:
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
Expand Down
2 changes: 2 additions & 0 deletions autogen/main/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,7 @@ module "gke" {
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
enable_gvnic = false
auto_repair = true
auto_upgrade = true
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
Expand Down Expand Up @@ -196,6 +197,7 @@ The node_pools variable takes the following parameters:
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
Expand Down
14 changes: 14 additions & 0 deletions autogen/main/cluster.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -311,6 +311,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "gvnic" {
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

tags = concat(
Expand Down Expand Up @@ -449,6 +456,7 @@ locals {
{% endif %}
"service_account",
"enable_gcfs",
"enable_gvnic",
"enable_secure_boot",
]
}
Expand Down Expand Up @@ -600,6 +608,12 @@ resource "google_container_node_pool" "pools" {
enabled = gcfs_config.value
}
}
dynamic "gvnic" {
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},
Expand Down
2 changes: 1 addition & 1 deletion autogen/main/versions.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.10.0, < 5.0"
version = ">= 4.14.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
13 changes: 13 additions & 0 deletions cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "gvnic" {
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

tags = concat(
Expand Down Expand Up @@ -307,6 +314,12 @@ resource "google_container_node_pool" "pools" {
enabled = gcfs_config.value
}
}
dynamic "gvnic" {
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ module "gke" {
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
enable_gvnic = false
auto_repair = true
auto_upgrade = true
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
Expand Down Expand Up @@ -313,6 +314,7 @@ The node_pools variable takes the following parameters:
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
Expand Down
14 changes: 14 additions & 0 deletions modules/beta-private-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "gvnic" {
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

tags = concat(
Expand Down Expand Up @@ -394,6 +401,7 @@ locals {
"spot",
"service_account",
"enable_gcfs",
"enable_gvnic",
"enable_secure_boot",
]
}
Expand Down Expand Up @@ -531,6 +539,12 @@ resource "google_container_node_pool" "pools" {
enabled = gcfs_config.value
}
}
dynamic "gvnic" {
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ module "gke" {
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
enable_gvnic = false
auto_repair = true
auto_upgrade = true
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
Expand Down Expand Up @@ -291,6 +292,7 @@ The node_pools variable takes the following parameters:
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
Expand Down
13 changes: 13 additions & 0 deletions modules/beta-private-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "gvnic" {
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

tags = concat(
Expand Down Expand Up @@ -443,6 +450,12 @@ resource "google_container_node_pool" "pools" {
enabled = gcfs_config.value
}
}
dynamic "gvnic" {
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-public-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@ module "gke" {
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
enable_gvnic = false
auto_repair = true
auto_upgrade = true
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
Expand Down Expand Up @@ -300,6 +301,7 @@ The node_pools variable takes the following parameters:
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
Expand Down
14 changes: 14 additions & 0 deletions modules/beta-public-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "gvnic" {
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

tags = concat(
Expand Down Expand Up @@ -375,6 +382,7 @@ locals {
"spot",
"service_account",
"enable_gcfs",
"enable_gvnic",
"enable_secure_boot",
]
}
Expand Down Expand Up @@ -512,6 +520,12 @@ resource "google_container_node_pool" "pools" {
enabled = gcfs_config.value
}
}
dynamic "gvnic" {
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-public-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ module "gke" {
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
enable_gvnic = false
auto_repair = true
auto_upgrade = true
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
Expand Down Expand Up @@ -278,6 +279,7 @@ The node_pools variable takes the following parameters:
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
Expand Down
13 changes: 13 additions & 0 deletions modules/beta-public-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "gvnic" {
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

tags = concat(
Expand Down Expand Up @@ -424,6 +431,12 @@ resource "google_container_node_pool" "pools" {
enabled = gcfs_config.value
}
}
dynamic "gvnic" {
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},
Expand Down
2 changes: 2 additions & 0 deletions modules/private-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ module "gke" {
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
enable_gvnic = false
auto_repair = true
auto_upgrade = true
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
Expand Down Expand Up @@ -272,6 +273,7 @@ The node_pools variable takes the following parameters:
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
Expand Down
14 changes: 14 additions & 0 deletions modules/private-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "gvnic" {
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}

service_account = lookup(var.node_pools[0], "service_account", local.service_account)

tags = concat(
Expand Down Expand Up @@ -280,6 +287,7 @@ locals {
"preemptible",
"service_account",
"enable_gcfs",
"enable_gvnic",
"enable_secure_boot",
]
}
Expand Down Expand Up @@ -407,6 +415,12 @@ resource "google_container_node_pool" "pools" {
enabled = gcfs_config.value
}
}
dynamic "gvnic" {
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
content {
enabled = gvnic.value
}
}
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster-update-variant/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.10.0, < 5.0"
version = ">= 4.14.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
2 changes: 2 additions & 0 deletions modules/private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@ module "gke" {
disk_type = "pd-standard"
image_type = "COS_CONTAINERD"
enable_gcfs = false
enable_gvnic = false
auto_repair = true
auto_upgrade = true
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
Expand Down Expand Up @@ -250,6 +251,7 @@ The node_pools variable takes the following parameters:
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
Expand Down
Loading

0 comments on commit 3db2711

Please sign in to comment.