-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add beta support for confidential_nodes #1040
Changes from 5 commits
cf48091
6b05f54
ef5d312
5e64e75
a70209b
6cf7a1a
da08d4a
ce6910f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
|
@@ -614,6 +614,12 @@ variable "shadow_firewall_rules_priority" { | |||||
} | ||||||
|
||||||
{% if beta_cluster %} | ||||||
variable "enable_confidential_node" { | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
type = bool | ||||||
description = "An optional flag to enable confidential node config." | ||||||
default = false | ||||||
} | ||||||
|
||||||
variable "disable_default_snat" { | ||||||
type = bool | ||||||
description = "Whether to disable the default SNAT to support the private use of public IP addresses" | ||||||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,49 @@ | ||
# Simple Regional Cluster | ||
|
||
This example illustrates how to create a simple private cluster with beta features. | ||
|
||
[^]: (autogen_docs_start) | ||
|
||
## Inputs | ||
|
||
| Name | Description | Type | Default | Required | | ||
|------|-------------|:----:|:-----:|:-----:| | ||
| cloudrun | Boolean to enable / disable CloudRun | string | `"true"` | no | | ||
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no | | ||
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes | | ||
| credentials\_path | The path to the GCP credentials JSON file | string | n/a | yes | | ||
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes | | ||
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes | | ||
| istio | Boolean to enable / disable Istio | string | `"true"` | no | | ||
| network | The VPC network to host the cluster in | string | n/a | yes | | ||
| project\_id | The project ID to host the cluster in | string | n/a | yes | | ||
| region | The region to host the cluster in | string | n/a | yes | | ||
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes | | ||
|
||
## Outputs | ||
|
||
| Name | Description | | ||
|------|-------------| | ||
| ca\_certificate | | | ||
| client\_token | | | ||
| cluster\_name | Cluster name | | ||
| credentials\_path | | | ||
| ip\_range\_pods | The secondary IP range used for pods | | ||
| ip\_range\_services | The secondary IP range used for services | | ||
| kubernetes\_endpoint | | | ||
| location | | | ||
| master\_kubernetes\_version | The master Kubernetes version | | ||
| network | | | ||
| project\_id | | | ||
| region | | | ||
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. | | ||
| subnetwork | | | ||
| zones | List of zones in which the cluster resides | | ||
|
||
[^]: (autogen_docs_end) | ||
|
||
To provision this example, run the following from within this directory: | ||
- `terraform init` to get the plugins | ||
- `terraform plan` to see the infrastructure plan | ||
- `terraform apply` to apply the infrastructure build | ||
- `terraform destroy` to destroy the built infrastructure |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,72 @@ | ||
/** | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thank you for adding a test! However, we're trying to avoid too many examples. Could you instead consolidate this by adding confidential notes to one of the existing examples/tests? |
||
* Copyright 2018 Google LLC | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
locals { | ||
cluster_type = "simple-regional-private-beta" | ||
} | ||
|
||
provider "google" { | ||
version = "~> 3.42.0" | ||
region = var.region | ||
} | ||
|
||
provider "google-beta" { | ||
version = "~> 3.79.0" | ||
region = var.region | ||
} | ||
|
||
data "google_client_config" "default" {} | ||
|
||
provider "kubernetes" { | ||
host = "https://${module.gke.endpoint}" | ||
token = data.google_client_config.default.access_token | ||
cluster_ca_certificate = base64decode(module.gke.ca_certificate) | ||
} | ||
|
||
data "google_compute_subnetwork" "subnetwork" { | ||
name = var.subnetwork | ||
project = var.project_id | ||
region = var.region | ||
} | ||
|
||
module "gke" { | ||
source = "../../modules/beta-private-cluster/" | ||
project_id = var.project_id | ||
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}" | ||
regional = true | ||
region = var.region | ||
network = var.network | ||
subnetwork = var.subnetwork | ||
ip_range_pods = var.ip_range_pods | ||
ip_range_services = var.ip_range_services | ||
service_account = var.compute_engine_service_account | ||
enable_private_endpoint = true | ||
enable_private_nodes = true | ||
master_ipv4_cidr_block = "172.16.0.0/28" | ||
enable_confidential_node = true | ||
|
||
master_authorized_networks = [ | ||
{ | ||
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range | ||
display_name = "VPC" | ||
}, | ||
] | ||
|
||
istio = var.istio | ||
cloudrun = var.cloudrun | ||
dns_cache = var.dns_cache | ||
gce_pd_csi_driver = var.gce_pd_csi_driver | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,35 @@ | ||
/** | ||
* Copyright 2018 Google LLC | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
output "kubernetes_endpoint" { | ||
sensitive = true | ||
value = module.gke.endpoint | ||
} | ||
|
||
output "client_token" { | ||
sensitive = true | ||
value = base64encode(data.google_client_config.default.access_token) | ||
} | ||
|
||
output "ca_certificate" { | ||
value = module.gke.ca_certificate | ||
} | ||
|
||
output "service_account" { | ||
description = "The default service account used for running nodes." | ||
value = module.gke.service_account | ||
} | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,64 @@ | ||
/** | ||
* Copyright 2018 Google LLC | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
// These outputs are used to test the module with kitchen-terraform | ||
// They do not need to be included in real-world uses of this module | ||
|
||
output "project_id" { | ||
value = var.project_id | ||
} | ||
|
||
output "region" { | ||
value = module.gke.region | ||
} | ||
|
||
output "cluster_name" { | ||
description = "Cluster name" | ||
value = module.gke.name | ||
} | ||
|
||
output "network" { | ||
value = var.network | ||
} | ||
|
||
output "subnetwork" { | ||
value = var.subnetwork | ||
} | ||
|
||
output "location" { | ||
value = module.gke.location | ||
} | ||
|
||
output "ip_range_pods" { | ||
description = "The secondary IP range used for pods" | ||
value = var.ip_range_pods | ||
} | ||
|
||
output "ip_range_services" { | ||
description = "The secondary IP range used for services" | ||
value = var.ip_range_services | ||
} | ||
|
||
output "zones" { | ||
description = "List of zones in which the cluster resides" | ||
value = module.gke.zones | ||
} | ||
|
||
output "master_kubernetes_version" { | ||
description = "The master Kubernetes version" | ||
value = module.gke.master_version | ||
} | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,69 @@ | ||
/** | ||
* Copyright 2018 Google LLC | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
variable "project_id" { | ||
description = "The project ID to host the cluster in" | ||
} | ||
|
||
variable "cluster_name_suffix" { | ||
description = "A suffix to append to the default cluster name" | ||
default = "" | ||
} | ||
|
||
variable "region" { | ||
description = "The region to host the cluster in" | ||
} | ||
|
||
variable "network" { | ||
description = "The VPC network to host the cluster in" | ||
} | ||
|
||
variable "subnetwork" { | ||
description = "The subnetwork to host the cluster in" | ||
} | ||
|
||
variable "ip_range_pods" { | ||
description = "The secondary ip range to use for pods" | ||
} | ||
|
||
variable "ip_range_services" { | ||
description = "The secondary ip range to use for services" | ||
} | ||
|
||
variable "compute_engine_service_account" { | ||
description = "Service account to associate to the nodes in the cluster" | ||
} | ||
|
||
variable "istio" { | ||
description = "Boolean to enable / disable Istio" | ||
default = true | ||
} | ||
|
||
variable "cloudrun" { | ||
description = "Boolean to enable / disable CloudRun" | ||
default = true | ||
} | ||
|
||
variable "dns_cache" { | ||
description = "Boolean to enable / disable NodeLocal DNSCache " | ||
default = false | ||
} | ||
|
||
variable "gce_pd_csi_driver" { | ||
type = bool | ||
description = "(Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver." | ||
default = false | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
/** | ||
* Copyright 2018 Google LLC | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
terraform { | ||
required_version = ">=0.12" | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For future reference, it's usually more intuitive to just hard-code this (
enabled = true
).There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I thought this would be more aligned with existing code like
terraform-google-kubernetes-engine/autogen/main/cluster.tf.tmpl
Line 43 in 8e92f6e
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, that's an anti-pattern though.