Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add beta support for confidential_nodes #1040

Merged
merged 8 commits into from
Nov 2, 2021
Merged

Add beta support for confidential_nodes #1040

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
cf48091
Add beta support for confidential_nodes
stenalpjolly Oct 30, 2021
6b05f54
Cannot use a null value in for_each
stenalpjolly Oct 31, 2021
ef5d312
Add example and test
stenalpjolly Oct 31, 2021
5e64e75
Add example and test
stenalpjolly Oct 31, 2021
a70209b
Update test name
stenalpjolly Oct 31, 2021
6cf7a1a
Review Comments
stenalpjolly Nov 2, 2021
da08d4a
Review Comments
stenalpjolly Nov 2, 2021
ce6910f
Review Comments
stenalpjolly Nov 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions autogen/main/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,7 @@ The node_pools variable takes the following parameters:
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
{% endif %}
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
Expand Down
8 changes: 8 additions & 0 deletions autogen/main/cluster.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,14 @@ resource "google_container_cluster" "primary" {
channel = release_channel.value.channel
}
}
{% if beta_cluster %}
dynamic "confidential_nodes" {
for_each = local.confidential_node_config
content {
enabled = confidential_nodes.value.enabled
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For future reference, it's usually more intuitive to just hard-code this (enabled = true).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought this would be more aligned with existing code like

terraform-google-kubernetes-engine/autogen/main/cluster.tf.tmpl

Line 43 in 8e92f6e

enabled = network_policy.value.enabled

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's an anti-pattern though.

}
}
{% endif %}

subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"

Expand Down
1 change: 1 addition & 0 deletions autogen/main/main.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,7 @@ locals {
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []

# /BETA features
{% endif %}
Expand Down
6 changes: 6 additions & 0 deletions autogen/main/variables.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -614,6 +614,12 @@ variable "shadow_firewall_rules_priority" {
}

{% if beta_cluster %}
variable "enable_confidential_nodes" {
type = bool
description = "An optional flag to enable confidential node config."
default = false
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
2 changes: 2 additions & 0 deletions examples/simple_regional_private_beta/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,8 @@ module "gke" {
},
]

enable_confidential_nodes = true

istio = var.istio
cloudrun = var.cloudrun
dns_cache = var.dns_cache
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,7 @@ Then perform the following commands on the root folder:
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
Expand Down Expand Up @@ -301,6 +302,7 @@ The node_pools variable takes the following parameters:
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster-update-variant/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,12 @@ resource "google_container_cluster" "primary" {
channel = release_channel.value.channel
}
}
dynamic "confidential_nodes" {
for_each = local.confidential_node_config
content {
enabled = confidential_nodes.value.enabled
}
}

subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"

Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster-update-variant/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ locals {
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []

# /BETA features

Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -593,6 +593,12 @@ variable "shadow_firewall_rules_priority" {
default = 999
}

variable "enable_confidential_nodes" {
type = bool
description = "An optional flag to enable confidential node config."
default = false
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,7 @@ Then perform the following commands on the root folder:
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
Expand Down Expand Up @@ -279,6 +280,7 @@ The node_pools variable takes the following parameters:
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,12 @@ resource "google_container_cluster" "primary" {
channel = release_channel.value.channel
}
}
dynamic "confidential_nodes" {
for_each = local.confidential_node_config
content {
enabled = confidential_nodes.value.enabled
}
}

subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"

Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ locals {
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []

# /BETA features

Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -593,6 +593,12 @@ variable "shadow_firewall_rules_priority" {
default = 999
}

variable "enable_confidential_nodes" {
type = bool
description = "An optional flag to enable confidential node config."
default = false
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-public-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,7 @@ Then perform the following commands on the root folder:
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
Expand Down Expand Up @@ -288,6 +289,7 @@ The node_pools variable takes the following parameters:
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-public-cluster-update-variant/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,12 @@ resource "google_container_cluster" "primary" {
channel = release_channel.value.channel
}
}
dynamic "confidential_nodes" {
for_each = local.confidential_node_config
content {
enabled = confidential_nodes.value.enabled
}
}

subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"

Expand Down
1 change: 1 addition & 0 deletions modules/beta-public-cluster-update-variant/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ locals {
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []

# /BETA features

Expand Down
6 changes: 6 additions & 0 deletions modules/beta-public-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -562,6 +562,12 @@ variable "shadow_firewall_rules_priority" {
default = 999
}

variable "enable_confidential_nodes" {
type = bool
description = "An optional flag to enable confidential node config."
default = false
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-public-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,7 @@ Then perform the following commands on the root folder:
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
Expand Down Expand Up @@ -266,6 +267,7 @@ The node_pools variable takes the following parameters:
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-public-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,12 @@ resource "google_container_cluster" "primary" {
channel = release_channel.value.channel
}
}
dynamic "confidential_nodes" {
for_each = local.confidential_node_config
content {
enabled = confidential_nodes.value.enabled
}
}

subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"

Expand Down
1 change: 1 addition & 0 deletions modules/beta-public-cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ locals {
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []

# /BETA features

Expand Down
6 changes: 6 additions & 0 deletions modules/beta-public-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -562,6 +562,12 @@ variable "shadow_firewall_rules_priority" {
default = 999
}

variable "enable_confidential_nodes" {
type = bool
description = "An optional flag to enable confidential node config."
default = false
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down