fix(TPGv5)!: update to TPG v5 (#1761)

Co-authored-by: Andrew Peabody <andrewpeabody@google.com>
terraform-google-modules · Oct 31, 2023 · 455a93c · 455a93c
1 parent cbaec18
commit 455a93c
Show file tree

Hide file tree

Showing 134 changed files with 346 additions and 208 deletions.
diff --git a/README.md b/README.md
@@ -149,6 +149,7 @@ Then perform the following commands on the root folder:
 | database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. | `list(object({ state = string, key_name = string }))` | <pre>[<br>  {<br>    "key_name": "",<br>    "state": "DECRYPTED"<br>  }<br>]</pre> | no |
 | datapath\_provider | The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature. | `string` | `"DATAPATH_PROVIDER_UNSPECIFIED"` | no |
 | default\_max\_pods\_per\_node | The maximum number of pods to schedule per node | `number` | `110` | no |
+| deletion\_protection | Whether or not to allow Terraform to destroy the cluster. | `bool` | `true` | no |
 | description | The description of the cluster | `string` | `""` | no |
 | disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
 | disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
@@ -331,7 +332,7 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
 - [kubectl](https://github.com/kubernetes/kubernetes/releases) 1.9.x
 #### Terraform and Plugins
 - [Terraform](https://www.terraform.io/downloads.html) 1.3+
-- [Terraform Provider for GCP][terraform-provider-google] v4.51
+- [Terraform Provider for GCP][terraform-provider-google] v5
 #### gcloud
 Some submodules use the [terraform-google-gcloud](https://github.com/terraform-google-modules/terraform-google-gcloud) module. By default, this module assumes you already have gcloud installed in your $PATH.
 See the [module](https://github.com/terraform-google-modules/terraform-google-gcloud#downloading) documentation for more information.

diff --git a/autogen/main/README.md b/autogen/main/README.md
@@ -272,9 +272,9 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
 #### Terraform and Plugins
 - [Terraform](https://www.terraform.io/downloads.html) 1.3+
 {% if beta_cluster %}
-- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v4.51
+- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v5
 {% else %}
-- [Terraform Provider for GCP][terraform-provider-google] v4.51
+- [Terraform Provider for GCP][terraform-provider-google] v5
 {% endif %}
 #### gcloud
 Some submodules use the [terraform-google-gcloud](https://github.com/terraform-google-modules/terraform-google-gcloud) module. By default, this module assumes you already have gcloud installed in your $PATH.

diff --git a/autogen/main/cluster.tf.tmpl b/autogen/main/cluster.tf.tmpl
@@ -31,10 +31,12 @@ resource "google_container_cluster" "primary" {
   project         = var.project_id
   resource_labels = var.cluster_resource_labels
 
-  location          = local.location
-  node_locations    = local.node_locations
-  cluster_ipv4_cidr = var.cluster_ipv4_cidr
-  network           = "projects/${local.network_project_id}/global/networks/${var.network}"
+  location            = local.location
+  node_locations      = local.node_locations
+  cluster_ipv4_cidr   = var.cluster_ipv4_cidr
+  network             = "projects/${local.network_project_id}/global/networks/${var.network}"
+  deletion_protection = var.deletion_protection
+
   {% if autopilot_cluster != true %}
   dynamic "network_policy" {
     for_each = local.cluster_network_policy

diff --git a/autogen/main/variables.tf.tmpl b/autogen/main/variables.tf.tmpl
@@ -592,6 +592,12 @@ variable "notification_config_topic" {
   default = ""
 }
 
+variable "deletion_protection" {
+  type        = bool
+  description = "Whether or not to allow Terraform to destroy the cluster."
+  default     = true
+}
+
 {% if beta_cluster %}
 variable "enable_tpu" {
   type        = bool

diff --git a/autogen/main/versions.tf.tmpl b/autogen/main/versions.tf.tmpl
@@ -24,11 +24,11 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
+      version = ">= 5.0.0, < 6"
     }
     google-beta = {
       source  = "hashicorp/google-beta"
-      version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
+      version = ">= 5.0.0, < 6"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
@@ -46,7 +46,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
+      version = ">= 5.0.0, < 6"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"

diff --git a/autogen/safer-cluster/main.tf.tmpl b/autogen/safer-cluster/main.tf.tmpl
@@ -24,14 +24,15 @@ module "gke" {
   {% else %}
   source             = "../beta-private-cluster/"
   {% endif %}
-  project_id         = var.project_id
-  name               = var.name
-  description        = var.description
-  regional           = var.regional
-  region             = var.region
-  zones              = var.zones
-  network            = var.network
-  network_project_id = var.network_project_id
+  project_id          = var.project_id
+  name                = var.name
+  description         = var.description
+  regional            = var.regional
+  region              = var.region
+  zones               = var.zones
+  network             = var.network
+  network_project_id  = var.network_project_id
+  deletion_protection = var.deletion_protection
 
   // We need to enforce a minimum Kubernetes Version to ensure
   // that the necessary security features are enabled.

diff --git a/autogen/safer-cluster/variables.tf.tmpl b/autogen/safer-cluster/variables.tf.tmpl
@@ -520,3 +520,9 @@ variable "workload_config_audit_mode" {
   type        = string
   default     = "DISABLED"
 }
+
+variable "deletion_protection" {
+  type        = bool
+  description = "Whether or not to allow Terraform to destroy the cluster."
+  default     = true
+}
diff --git a/cluster.tf b/cluster.tf
@@ -27,10 +27,12 @@ resource "google_container_cluster" "primary" {
   project         = var.project_id
   resource_labels = var.cluster_resource_labels
 
-  location          = local.location
-  node_locations    = local.node_locations
-  cluster_ipv4_cidr = var.cluster_ipv4_cidr
-  network           = "projects/${local.network_project_id}/global/networks/${var.network}"
+  location            = local.location
+  node_locations      = local.node_locations
+  cluster_ipv4_cidr   = var.cluster_ipv4_cidr
+  network             = "projects/${local.network_project_id}/global/networks/${var.network}"
+  deletion_protection = var.deletion_protection
+
   dynamic "network_policy" {
     for_each = local.cluster_network_policy
 

diff --git a/docs/upgrading_to_v29.0.md b/docs/upgrading_to_v29.0.md
@@ -2,6 +2,41 @@
 The v29.0 release of *kubernetes-engine* is a backwards incompatible
 release.
 
+### Google Cloud Platform Provider upgrade
+The Terraform Kubernetes Engine Module now requires version 5.0 or higher of the Google Cloud Platform Providers.
+
+```diff
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+-      version = "~> 4.0"
++      version = "~> 5.0"
+    }
+    google-beta = {
+      source  = "hashicorp/google-beta"
+-      version = "~> 4.0"
++      version = "~> 5.0"
+    }
+
+  }
+}
+```
+
+### Deletion Protection
+The Terraform Kubernetes Engine Module now includes the `deletion_protection` option which defaults to `true`.  To delete your cluster you should specify it explicitly to `false`:
+
+```diff
+  module "gke" {
+-   source  = "terraform-google-modules/kubernetes-engine/google"
+-   version = "~> 28.0"
++   source  = "terraform-google-modules/kubernetes-engine/google"
++   version = "~> 29.0"
+...
++   deletion_protection = false
+}
+```
+
 ### Update variant random ID keepers updated
 
 The v29.0 release updates the keepers for the update variant modules. This will force a recreation of the nodepools.

diff --git a/examples/acm-terraform-blog-part1/terraform/providers.tf b/examples/acm-terraform-blog-part1/terraform/providers.tf
@@ -17,8 +17,7 @@
 terraform {
   required_providers {
     google-beta = {
-      source  = "hashicorp/google-beta"
-      version = ">= 3.73.0"
+      source = "hashicorp/google-beta"
     }
   }
 }

diff --git a/examples/acm-terraform-blog-part2/terraform/providers.tf b/examples/acm-terraform-blog-part2/terraform/providers.tf
@@ -17,8 +17,7 @@
 terraform {
   required_providers {
     google-beta = {
-      source  = "hashicorp/google-beta"
-      version = ">= 3.73.0"
+      source = "hashicorp/google-beta"
     }
   }
 }

diff --git a/examples/acm-terraform-blog-part3/terraform/providers.tf b/examples/acm-terraform-blog-part3/terraform/providers.tf
@@ -17,8 +17,7 @@
 terraform {
   required_providers {
     google-beta = {
-      source  = "hashicorp/google-beta"
-      version = ">= 4.27.0, < 5.0"
+      source = "hashicorp/google-beta"
     }
   }
 }

diff --git a/examples/deploy_service/main.tf b/examples/deploy_service/main.tf
@@ -38,6 +38,7 @@ module "gke" {
   ip_range_services      = var.ip_range_services
   create_service_account = false
   service_account        = var.compute_engine_service_account
+  deletion_protection    = false
 }
 
 resource "kubernetes_pod" "nginx-example" {

diff --git a/examples/deploy_service/versions.tf b/examples/deploy_service/versions.tf
@@ -17,8 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source  = "hashicorp/google"
-      version = "~> 4.0"
+      source = "hashicorp/google"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/examples/disable_client_cert/main.tf b/examples/disable_client_cert/main.tf
@@ -40,4 +40,5 @@ module "gke" {
   create_service_account   = false
   service_account          = var.compute_engine_service_account
   issue_client_certificate = false
+  deletion_protection      = false
 }
diff --git a/examples/disable_client_cert/versions.tf b/examples/disable_client_cert/versions.tf
@@ -17,8 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source  = "hashicorp/google"
-      version = "~> 4.0"
+      source = "hashicorp/google"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/examples/node_pool/main.tf b/examples/node_pool/main.tf
@@ -40,6 +40,7 @@ module "gke" {
   remove_default_node_pool          = false
   disable_legacy_metadata_endpoints = false
   cluster_autoscaling               = var.cluster_autoscaling
+  deletion_protection               = false
 
   node_pools = [
     {

diff --git a/examples/node_pool/versions.tf b/examples/node_pool/versions.tf
@@ -20,8 +20,7 @@ terraform {
       source = "hashicorp/google"
     }
     google-beta = {
-      source  = "hashicorp/google-beta"
-      version = "~> 4.0"
+      source = "hashicorp/google-beta"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/examples/node_pool_update_variant/main.tf b/examples/node_pool_update_variant/main.tf
@@ -48,6 +48,7 @@ module "gke" {
   enable_private_endpoint = true
   enable_private_nodes    = true
   master_ipv4_cidr_block  = "172.16.0.0/28"
+  deletion_protection     = false
 
   master_authorized_networks = [
     {

diff --git a/examples/node_pool_update_variant/versions.tf b/examples/node_pool_update_variant/versions.tf
@@ -17,8 +17,7 @@
 terraform {
   required_providers {
     google = {
-      source  = "hashicorp/google"
-      version = "~> 4.0"
+      source = "hashicorp/google"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/examples/node_pool_update_variant_beta/main.tf b/examples/node_pool_update_variant_beta/main.tf
@@ -53,6 +53,7 @@ module "gke" {
   enable_private_endpoint = true
   enable_private_nodes    = true
   master_ipv4_cidr_block  = "172.16.0.0/28"
+  deletion_protection     = false
 
   master_authorized_networks = [
     {

diff --git a/examples/node_pool_update_variant_beta/versions.tf b/examples/node_pool_update_variant_beta/versions.tf
@@ -20,8 +20,7 @@ terraform {
       source = "hashicorp/google"
     }
     google-beta = {
-      source  = "hashicorp/google-beta"
-      version = "~> 4.0"
+      source = "hashicorp/google-beta"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/examples/node_pool_update_variant_public_beta/main.tf b/examples/node_pool_update_variant_public_beta/main.tf
@@ -49,6 +49,7 @@ module "gke" {
   ip_range_services      = var.ip_range_services
   create_service_account = false
   service_account        = var.compute_engine_service_account
+  deletion_protection    = false
 
   master_authorized_networks = [
     {

diff --git a/examples/node_pool_update_variant_public_beta/versions.tf b/examples/node_pool_update_variant_public_beta/versions.tf
@@ -20,8 +20,7 @@ terraform {
       source = "hashicorp/google"
     }
     google-beta = {
-      source  = "hashicorp/google-beta"
-      version = "~> 4.0"
+      source = "hashicorp/google-beta"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/examples/private_zonal_with_networking/main.tf b/examples/private_zonal_with_networking/main.tf
@@ -24,7 +24,7 @@ provider "kubernetes" {
 
 module "gcp-network" {
   source  = "terraform-google-modules/network/google"
-  version = ">= 4.0.1"
+  version = ">= 7.5"
 
   project_id   = var.project_id
   network_name = var.network
@@ -75,6 +75,7 @@ module "gke" {
   enable_private_endpoint = true
   enable_private_nodes    = true
   master_ipv4_cidr_block  = "172.16.0.0/28"
+  deletion_protection     = false
 
   master_authorized_networks = [
     {

diff --git a/examples/regional_private_node_pool_oauth_scopes/main.tf b/examples/regional_private_node_pool_oauth_scopes/main.tf
@@ -32,6 +32,7 @@ module "gke" {
   service_account                   = "create"
   remove_default_node_pool          = true
   disable_legacy_metadata_endpoints = true
+  deletion_protection               = false
 
   master_authorized_networks = [
     {

diff --git a/examples/regional_private_node_pool_oauth_scopes/network.tf b/examples/regional_private_node_pool_oauth_scopes/network.tf
@@ -16,7 +16,7 @@
 
 module "gke-network" {
   source  = "terraform-google-modules/network/google"
-  version = ">= 4.0.1"
+  version = ">= 7.5"
 
   project_id   = var.project_id
   network_name = "random-gke-network"

diff --git a/examples/regional_private_node_pool_oauth_scopes/versions.tf b/examples/regional_private_node_pool_oauth_scopes/versions.tf
@@ -17,12 +17,10 @@
 terraform {
   required_providers {
     google = {
-      source  = "hashicorp/google"
-      version = "~> 4.0"
+      source = "hashicorp/google"
     }
     google-beta = {
-      source  = "hashicorp/google-beta"
-      version = "~> 4.0"
+      source = "hashicorp/google-beta"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/examples/safer_cluster/main.tf b/examples/safer_cluster/main.tf
@@ -65,6 +65,7 @@ module "gke" {
   firewall_inbound_ports     = ["9443", "15017"]
   kubernetes_version         = random_shuffle.version.result[0]
   release_channel            = "UNSPECIFIED"
+  deletion_protection        = false
 
   master_authorized_networks = [
     {

diff --git a/examples/safer_cluster/network.tf b/examples/safer_cluster/network.tf
@@ -16,7 +16,7 @@
 
 module "gcp-network" {
   source  = "terraform-google-modules/network/google"
-  version = ">= 4.0.1"
+  version = ">= 7.5"
 
   project_id   = var.project_id
   network_name = local.network_name

diff --git a/examples/safer_cluster/versions.tf b/examples/safer_cluster/versions.tf
@@ -18,19 +18,17 @@ terraform {
   required_version = ">= 0.13"
   required_providers {
     google = {
-      source  = "hashicorp/google"
-      version = "~> 4.0"
+      source = "hashicorp/google"
     }
     google-beta = {
-      source  = "hashicorp/google-beta"
-      version = "~> 4.0"
+      source = "hashicorp/google-beta"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.0"
+      version = ">= 3.0"
     }
   }
 }