Skip to content

Commit

Permalink
feat: Add support for gVisor per node pool (#1001)
Browse files Browse the repository at this point in the history 
* feat: Add support for gVisor per node pool

* fix image type, add test

Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
  • Loading branch information
@LukaszCzarnotaSabre @bharathkkb
LukaszCzarnotaSabre and bharathkkb committed Sep 28, 2021
1 parent d2f1105 commit 850c418
Show file tree
Hide file tree
Showing 12 changed files with 25 additions and 27 deletions.
5 changes: 2 additions & 3 deletions autogen/main/cluster.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -495,7 +495,7 @@ resource "google_container_node_pool" "pools" {

node_config {
{% if beta_cluster %}
image_type = lookup(each.value, "image_type", var.sandbox_enabled ? "COS_CONTAINERD" : "COS")
image_type = lookup(each.value, "image_type", lookup(each.value, "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
{% else %}
image_type = lookup(each.value, "image_type", "COS")
{% endif %}
Expand Down Expand Up @@ -577,8 +577,7 @@ resource "google_container_node_pool" "pools" {
}
{% if beta_cluster %}
dynamic "sandbox_config" {
for_each = local.cluster_sandbox_enabled

for_each = tobool((lookup(each.value, "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
Expand Down
2 changes: 0 additions & 2 deletions autogen/main/main.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,6 @@ locals {

cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]

cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []

{% endif %}

cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
Expand Down
3 changes: 2 additions & 1 deletion examples/node_pool/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -70,14 +70,15 @@ module "gke" {
},
{
name = "pool-03"
machine_type = "n1-standard-2"
node_locations = "${var.region}-b,${var.region}-c"
autoscaling = false
node_count = 2
disk_type = "pd-standard"
image_type = "COS"
auto_upgrade = true
service_account = var.compute_engine_service_account
pod_range = "test"
sandbox_enabled = true
},
]

Expand Down
5 changes: 2 additions & 3 deletions modules/beta-private-cluster-update-variant/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -447,7 +447,7 @@ resource "google_container_node_pool" "pools" {
}

node_config {
image_type = lookup(each.value, "image_type", var.sandbox_enabled ? "COS_CONTAINERD" : "COS")
image_type = lookup(each.value, "image_type", lookup(each.value, "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
machine_type = lookup(each.value, "machine_type", "e2-medium")
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
Expand Down Expand Up @@ -523,8 +523,7 @@ resource "google_container_node_pool" "pools" {
}
}
dynamic "sandbox_config" {
for_each = local.cluster_sandbox_enabled

for_each = tobool((lookup(each.value, "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
Expand Down
2 changes: 0 additions & 2 deletions modules/beta-private-cluster-update-variant/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,6 @@ locals {

cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]

cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []


cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
security_group = var.authenticator_security_group
Expand Down
5 changes: 2 additions & 3 deletions modules/beta-private-cluster/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -363,7 +363,7 @@ resource "google_container_node_pool" "pools" {
}

node_config {
image_type = lookup(each.value, "image_type", var.sandbox_enabled ? "COS_CONTAINERD" : "COS")
image_type = lookup(each.value, "image_type", lookup(each.value, "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
machine_type = lookup(each.value, "machine_type", "e2-medium")
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
Expand Down Expand Up @@ -439,8 +439,7 @@ resource "google_container_node_pool" "pools" {
}
}
dynamic "sandbox_config" {
for_each = local.cluster_sandbox_enabled

for_each = tobool((lookup(each.value, "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
Expand Down
2 changes: 0 additions & 2 deletions modules/beta-private-cluster/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,6 @@ locals {

cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]

cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []


cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
security_group = var.authenticator_security_group
Expand Down
5 changes: 2 additions & 3 deletions modules/beta-public-cluster-update-variant/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -428,7 +428,7 @@ resource "google_container_node_pool" "pools" {
}

node_config {
image_type = lookup(each.value, "image_type", var.sandbox_enabled ? "COS_CONTAINERD" : "COS")
image_type = lookup(each.value, "image_type", lookup(each.value, "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
machine_type = lookup(each.value, "machine_type", "e2-medium")
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
Expand Down Expand Up @@ -504,8 +504,7 @@ resource "google_container_node_pool" "pools" {
}
}
dynamic "sandbox_config" {
for_each = local.cluster_sandbox_enabled

for_each = tobool((lookup(each.value, "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
Expand Down
2 changes: 0 additions & 2 deletions modules/beta-public-cluster-update-variant/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,6 @@ locals {

cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]

cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []


cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
security_group = var.authenticator_security_group
Expand Down
5 changes: 2 additions & 3 deletions modules/beta-public-cluster/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -344,7 +344,7 @@ resource "google_container_node_pool" "pools" {
}

node_config {
image_type = lookup(each.value, "image_type", var.sandbox_enabled ? "COS_CONTAINERD" : "COS")
image_type = lookup(each.value, "image_type", lookup(each.value, "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
machine_type = lookup(each.value, "machine_type", "e2-medium")
labels = merge(
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
Expand Down Expand Up @@ -420,8 +420,7 @@ resource "google_container_node_pool" "pools" {
}
}
dynamic "sandbox_config" {
for_each = local.cluster_sandbox_enabled

for_each = tobool((lookup(each.value, "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
content {
sandbox_type = sandbox_config.value
}
Expand Down
2 changes: 0 additions & 2 deletions modules/beta-public-cluster/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,6 @@ locals {

cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]

cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []


cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
security_group = var.authenticator_security_group
Expand Down
14 changes: 13 additions & 1 deletion test/integration/node_pool/controls/gcloud.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -351,7 +351,7 @@
including(
"name" => "pool-03",
"config" => including(
"machineType" => "e2-medium",
"machineType" => "n1-standard-2",
),
)
)
Expand Down Expand Up @@ -408,6 +408,7 @@
"all-pools-example" => "true",
"cluster_name" => cluster_name,
"node_pool" => "pool-03",
"sandbox.gke.io/runtime"=>"gvisor"
},
),
)
Expand Down Expand Up @@ -441,6 +442,17 @@
)
end

it "has the expected image" do
expect(data['nodePools']).to include(
including(
"name" => "pool-03",
"config" => including(
"imageType" => "COS_CONTAINERD",
),
)
)
end

it "has the expected linux node config sysctls" do
expect(data['nodePools']).to include(
including(
Expand Down

0 comments on commit 850c418

Please sign in to comment.