Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[WIP] Require Google provider 4.0.0 #1071

Closed
wants to merge 34 commits into from
Closed

[WIP] Require Google provider 4.0.0 #1071

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
34 commits
Select commit Hold shift + click to select a range
5f8e135
feat: update TPG version constraints to allow 4.0
cloud-foundation-bot Nov 17, 2021
860f790
Removes basic auth, renames namespace_identity
jackwhelpton Nov 22, 2021
6e4b330
Regenerates modules and documentation
jackwhelpton Nov 22, 2021
0027c3b
Updates tests to use latest Google provider
jackwhelpton Nov 22, 2021
12a6834
Updates network module for Google provider 4.0 compatibility
jackwhelpton Nov 22, 2021
6138b52
Temporarily uses "main" for gcloud module (until next release is cut)
jackwhelpton Nov 22, 2021
6f99d53
Comments out version constraint (temporary change)
jackwhelpton Nov 22, 2021
6531be7
Uses master branch for gcloud module (until release is cut)
jackwhelpton Nov 23, 2021
586e6f2
Merge branch 'master' of https://github.com/rakuten-gcloud/terraform-…
jackwhelpton Nov 23, 2021
2e3f3d1
Merge branch 'master' of https://github.com/terraform-google-modules/…
jackwhelpton Nov 23, 2021
a8f5dbd
Applies fmt
jackwhelpton Nov 23, 2021
73b3891
Uses kubectl-wrapper where appropriate
jackwhelpton Nov 23, 2021
9f88922
Uses released version of gcloud module
jackwhelpton Nov 24, 2021
bce89ed
Returns instance group URLs per node pool
jackwhelpton Nov 24, 2021
a1799fd
Extends use of cluster_output_node_pools_ variables
jackwhelpton Nov 25, 2021
7130a05
Fixes documentation
jackwhelpton Nov 25, 2021
dc95ed0
Updates more modules
jackwhelpton Nov 25, 2021
7eaf1a5
Updates READMEs to match variables
jackwhelpton Nov 25, 2021
ca74832
Uses master branch of bastion
jackwhelpton Nov 25, 2021
37210e3
Updates node pools versions description
jackwhelpton Nov 25, 2021
5fa17c7
Adds locals for node pool instance group URLs
jackwhelpton Nov 25, 2021
00f5691
Uses master branch of terraform-google-project-factory
jackwhelpton Nov 25, 2021
2e7a687
Updates project version ready for release
jackwhelpton Nov 25, 2021
e4d372d
Updates pinned version of Google provider for example
jackwhelpton Nov 25, 2021
b374965
Updates pinned version of Google provider in example
jackwhelpton Nov 25, 2021
2d41101
Addresses code review comments
jackwhelpton Nov 29, 2021
019182a
Temporarily applies an empty source_tags setting.
jackwhelpton Dec 1, 2021
092ef7a
Fixes indentation
jackwhelpton Dec 1, 2021
3bebdce
Uses newly-released version of project factory
jackwhelpton Dec 7, 2021
03ff18a
Uses released version of bastion host
jackwhelpton Dec 7, 2021
2493bd5
Merge branch 'master' of https://github.com/terraform-google-modules/…
jackwhelpton Dec 19, 2021
0d0a4c8
Addresses linting warnings
jackwhelpton Dec 20, 2021
3f8f9fd
Adds missing newline as per linting warnings
jackwhelpton Dec 20, 2021
345fa58
Removes use of SECURE mode (deprecated)
jackwhelpton Dec 23, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,8 +128,6 @@ Then perform the following commands on the root folder:
| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no |
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
| basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no |
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | `string` | `""` | no |
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> })</pre> | <pre>{<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | `any` | `null` | no |
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | `map(string)` | `{}` | no |
Expand All @@ -150,7 +148,7 @@ Then perform the following commands on the root folder:
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `""` | no |
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
Expand All @@ -169,7 +167,7 @@ Then perform the following commands on the root folder:
| network\_policy | Enable network policy addon | `bool` | `false` | no |
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA"` | no |
| node\_pools | List of maps containing node pools | `list(map(string))` | <pre>[<br> {<br> "name": "default-node-pool"<br> }<br>]</pre> | no |
| node\_pools\_labels | Map of maps containing node labels by node-pool name | `map(map(string))` | <pre>{<br> "all": {},<br> "default-node-pool": {}<br>}</pre> | no |
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | `map(map(string))` | <pre>{<br> "all": {},<br> "default-node-pool": {}<br>}</pre> | no |
Expand Down Expand Up @@ -201,7 +199,7 @@ Then perform the following commands on the root folder:
| endpoint | Cluster endpoint |
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
| http\_load\_balancing\_enabled | Whether http load balancing enabled |
| identity\_namespace | Workload Identity namespace |
| identity\_namespace | Workload Identity pool |
| instance\_group\_urls | List of GKE generated instance groups |
| location | Cluster location (region if regional cluster, zone if zonal cluster) |
| logging\_service | Logging service used |
Expand All @@ -212,7 +210,7 @@ Then perform the following commands on the root folder:
| name | Cluster name |
| network\_policy\_enabled | Whether network policy enabled |
| node\_pools\_names | List of node pools names |
| node\_pools\_versions | List of node pools versions |
| node\_pools\_versions | Node pool versions by node pool name |
| region | Cluster region |
| release\_channel | The release channel of this cluster |
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
Expand Down
10 changes: 4 additions & 6 deletions autogen/main/cluster.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,9 +161,6 @@ resource "google_container_cluster" "primary" {
}

master_auth {
username = var.basic_auth_username
password = var.basic_auth_password

client_certificate_config {
issue_client_certificate = var.issue_client_certificate
}
Expand Down Expand Up @@ -292,7 +289,7 @@ resource "google_container_cluster" "primary" {
for_each = local.cluster_node_metadata_config

content {
node_metadata = workload_metadata_config.value.node_metadata
mode = workload_metadata_config.value.mode
}
}

Expand Down Expand Up @@ -371,7 +368,7 @@ resource "google_container_cluster" "primary" {
for_each = local.cluster_workload_identity_config

content {
identity_namespace = workload_identity_config.value.identity_namespace
workload_pool = workload_identity_config.value.workload_pool
}
}

Expand Down Expand Up @@ -628,9 +625,10 @@ resource "google_container_node_pool" "pools" {
for_each = local.cluster_node_metadata_config

content {
node_metadata = lookup(each.value, "node_metadata", workload_metadata_config.value.node_metadata)
mode = lookup(each.value, "node_metadata", workload_metadata_config.value.mode)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure we want to change the input value (ie. still look at node_metadata).

Copy link
Contributor Author

@jackwhelpton jackwhelpton Nov 29, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I need to refresh my memory on this (and find a line reference), but I think I'm still using the original input value, but I've adjusted the workload_metadata_config object to match the names of the new properties, so it serves as an adapter between the two; at the time that seemed to make the most sense to me.

}
}

{% if beta_cluster %}
dynamic "sandbox_config" {
for_each = tobool((lookup(each.value, "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
Expand Down
5 changes: 3 additions & 2 deletions autogen/main/dns.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,9 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 3.1"

enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && !var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
Expand Down
1 change: 1 addition & 0 deletions autogen/main/firewall.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ resource "google_compute_firewall" "master_webhooks" {
direction = "INGRESS"

source_ranges = [local.cluster_endpoint_for_nodes]
source_tags = [""]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI seems to be failing due to this. IIRC we added this due hashicorp/terraform-provider-google#10494. Maybe we should do source_tags = [] as a workaround

       Error: Error creating Firewall: googleapi: Error 400: Invalid value for field 'resource.sourceTags[0]': ''. Must be a match of regex '(?:[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?)', invalid
       
         with module.example.module.gke.google_compute_firewall.master_webhooks[0],
         on ../../../firewall.tf line 63, in resource "google_compute_firewall" "master_webhooks":
         63: resource "google_compute_firewall" "master_webhooks" {

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought the "correct" (?) fix for that was covered by this:

GoogleCloudPlatform/magic-modules#5526

so we may still see the CI failing until that (or something better) is merged.

On a more personal note, I left my previous employer at the end of last year, so it may be hard for me to take this much further, as the CLA etc. was signed with that email. I'm in touch with a former coworker who I'm going to try and persuade to finish this off for me; I'll let you know how that goes.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On a more personal note, I left my previous employer at the end of last year, so it may be hard for me to take this much further, as the CLA etc. was signed with that email. I'm in touch with a former coworker who I'm going to try and persuade to finish this off for me; I'll let you know how that goes.

Thanks, we can probably follow through if necessary as well.

target_tags = [local.cluster_network_tag]

allow {
Expand Down
6 changes: 3 additions & 3 deletions autogen/main/main.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,7 @@ locals {
}]

cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
node_metadata = var.node_metadata
mode = var.node_metadata
}]

cluster_output_name = google_container_cluster.primary.name
Expand Down Expand Up @@ -153,7 +153,7 @@ locals {
}]

cluster_output_node_pools_names = concat([for np in google_container_node_pool.pools : np.name], [""])
cluster_output_node_pools_versions = concat([for np in google_container_node_pool.pools : np.version], [""])
cluster_output_node_pools_versions = { for np in google_container_node_pool.pools : np.name => np.version }

cluster_master_auth_list_layer1 = local.cluster_output_master_auth
cluster_master_auth_list_layer2 = local.cluster_master_auth_list_layer1[0]
Expand All @@ -177,7 +177,7 @@ locals {
cluster_horizontal_pod_autoscaling_enabled = !local.cluster_output_horizontal_pod_autoscaling_enabled
workload_identity_enabled = !(var.identity_namespace == null || var.identity_namespace == "null")
cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
identity_namespace = "${var.project_id}.svc.id.goog" }] : [{ identity_namespace = var.identity_namespace
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
}]
{% if beta_cluster %}
# BETA features
Expand Down
16 changes: 8 additions & 8 deletions autogen/main/outputs.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ output "node_pools_names" {
}

output "node_pools_versions" {
description = "List of node pools versions"
description = "Node pool versions by node pool name"
morgante marked this conversation as resolved.
Show resolved Hide resolved
value = local.cluster_node_pools_versions
}

Expand All @@ -123,23 +123,23 @@ output "service_account" {
value = local.service_account
}

output "instance_group_urls" {
description = "List of GKE generated instance groups"
value = distinct(flatten([for np in google_container_node_pool.pools : np.managed_instance_group_urls]))
}

output "release_channel" {
description = "The release channel of this cluster"
value = var.release_channel
}

output "identity_namespace" {
description = "Workload Identity namespace"
value = length(local.cluster_workload_identity_config) > 0 ? local.cluster_workload_identity_config[0].identity_namespace : null
description = "Workload Identity pool"
value = length(local.cluster_workload_identity_config) > 0 ? local.cluster_workload_identity_config[0].workload_pool : null
depends_on = [
google_container_cluster.primary
]
}

output "instance_group_urls" {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to keep this output value, as it is helpful for broadly addressing the cluster. Could we simply concat all the instance groups from the different node pools?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By all means: so you'd keep the new node_pools_ outputs but also include this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, just saw your next comment, perhaps I'll wait for you to finish the review :)

I don't think I have enough knowledge about how the instance_group_urls output is currently consumed: it's obviously possible to keep it as a single flattened list, but now the property has migrated to the node pool level within the provider I worried about the loss of information that would result from doing that.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my experience, it's most useful for addressing the cluster as a whole to apply networking changes. Let's leave it as-is—we can always add an additional output later if requests come in, but every output we add is an addition to the API surface.

description = "List of GKE generated instance groups"
value = google_container_cluster.primary.instance_group_urls
}
{% if private_cluster %}

output "master_ipv4_cidr_block" {
Expand Down
16 changes: 2 additions & 14 deletions autogen/main/variables.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,18 +395,6 @@ variable "service_account" {
default = ""
}

variable "basic_auth_username" {
type = string
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
default = ""
}

variable "basic_auth_password" {
type = string
description = "The password to be used with Basic Authentication."
default = ""
}

variable "issue_client_certificate" {
type = bool
description = "Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive!"
Expand Down Expand Up @@ -550,7 +538,7 @@ variable "authenticator_security_group" {

variable "node_metadata" {
description = "Specifies how node metadata is exposed to the workload running on the node"
default = "GKE_METADATA_SERVER"
default = "GKE_METADATA"
type = string
}

Expand All @@ -565,7 +553,7 @@ variable "database_encryption" {
}

variable "identity_namespace" {
description = "Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`)"
description = "The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`)"
type = string
default = "enabled"
}
Expand Down
4 changes: 2 additions & 2 deletions autogen/main/versions.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 3.87.0, <4.0.0"
version = ">= 4.0.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand All @@ -38,7 +38,7 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 3.39.0, <4.0.0"
version = ">= 4.0.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
6 changes: 1 addition & 5 deletions autogen/safer-cluster/main.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,10 +111,6 @@ module "gke" {
registry_project_ids = var.registry_project_ids
grant_registry_access = var.grant_registry_access

// Basic Auth disabled
basic_auth_username = ""
basic_auth_password = ""

issue_client_certificate = false

cluster_resource_labels = var.cluster_resource_labels
Expand Down Expand Up @@ -164,7 +160,7 @@ module "gke" {

enable_vertical_pod_autoscaling = var.enable_vertical_pod_autoscaling

// We enable identity namespace by default.
// We enable Workload Identity by default.
identity_namespace = "${var.project_id}.svc.id.goog"

authenticator_security_group = var.authenticator_security_group
Expand Down
2 changes: 1 addition & 1 deletion autogen/safer-cluster/outputs.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ output "node_pools_names" {
}

output "node_pools_versions" {
description = "List of node pools versions"
description = "Node pool versions by node pool name"
value = module.gke.node_pools_versions
}

Expand Down
10 changes: 4 additions & 6 deletions cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,9 +98,6 @@ resource "google_container_cluster" "primary" {
}

master_auth {
username = var.basic_auth_username
password = var.basic_auth_password

client_certificate_config {
issue_client_certificate = var.issue_client_certificate
}
Expand Down Expand Up @@ -156,7 +153,7 @@ resource "google_container_cluster" "primary" {
for_each = local.cluster_node_metadata_config

content {
node_metadata = workload_metadata_config.value.node_metadata
mode = workload_metadata_config.value.mode
}
}

Expand Down Expand Up @@ -202,7 +199,7 @@ resource "google_container_cluster" "primary" {
for_each = local.cluster_workload_identity_config

content {
identity_namespace = workload_identity_config.value.identity_namespace
workload_pool = workload_identity_config.value.workload_pool
}
}

Expand Down Expand Up @@ -330,10 +327,11 @@ resource "google_container_node_pool" "pools" {
for_each = local.cluster_node_metadata_config

content {
node_metadata = lookup(each.value, "node_metadata", workload_metadata_config.value.node_metadata)
mode = lookup(each.value, "node_metadata", workload_metadata_config.value.mode)
}
}


shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
5 changes: 3 additions & 2 deletions dns.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,9 @@
Delete default kube-dns configmap
*****************************************/
module "gcloud_delete_default_kube_dns_configmap" {
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 2.1.0"
source = "terraform-google-modules/gcloud/google//modules/kubectl-wrapper"
version = "~> 3.1"

enabled = (local.custom_kube_dns_config || local.upstream_nameservers_config) && !var.skip_provisioners
cluster_name = google_container_cluster.primary.name
cluster_location = google_container_cluster.primary.location
Expand Down
65 changes: 65 additions & 0 deletions docs/upgrading_to_v18.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
# Upgrading to v18.0

The v18.0 release of *kubernetes-engine* is a backwards incompatible release.

### Google Cloud Platform Provider upgrade
The Terraform Kubernetes Engine Module now requires version 4.0 or higher of
the Google Cloud Platform Provider.

```diff
terraform {
required_providers {
google = {
source = "hashicorp/google"
- version = "~> 3.0"
+ version = "~> 4.0"
}
google-beta = {
source = "hashicorp/google-beta"
- version = "~> 3.0"
+ version = "~> 4.0"
}

}
}
```

### Kubernetes Basic Authentication removed
Basic authentication is deprecated and has been removed in GKE 1.19 and later.
Owing to this, the `basic_auth_username` and `basic_auth_password` variables
have been eliminated.

```diff
module "gke" {
source = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster"
- version = "~> 17.0"
+ version = "~> 18.0"

- basic_auth_username = "admin"
- basic_auth_password = "s3crets!"
}
```

### Acceptable values for node_metadata modified
The `node_metadata` variable should now be set to one of `GKE_METADATA`,
`GCE_METADATA` or `UNSPECIFIED`. `GKE_METADATA` replaces the previous
`GKE_METADATA_SERVER` value, `GCE_METADATA` should be used in place of
`EXPOSE`. The `SECURE` option, previously deprecated, has now been removed.

```diff
module "gke" {
source = "../../modules/safer-cluster"

node_pools = [
{

- node_metadata = "GKE_METADATA_SERVER"
+ node_metadata = "GKE_METADATA"
}
]
}
```

### node_pools_versions is now keyed by node-pool name
The `node_pools_versions` output is now an object keyed by node pool name,
rather than a list as previously.
2 changes: 1 addition & 1 deletion docs/upgrading_to_v8.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ The v8.0 release of *kubernetes-engine* is a backwards incompatible
release.

## Workload Identity (beta)
Beta clusters now have Workload Identity enabled by default. To disable Workload Identity, set `identity_namespace = null`
Beta clusters now have Workload Identity enabled by default. To disable Workload Identity, set `workload_pool = null`

## Shielded Nodes (beta)
Beta clusters now have shielded nodes enabled by default. To disable, set `enable_shielded_nodes = false`
2 changes: 1 addition & 1 deletion examples/acm-terraform-blog-part1/terraform/gke.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

module "enabled_google_apis" {
source = "terraform-google-modules/project-factory/google//modules/project_services"
version = "~> 10.0"
version = "~> 11.3"

project_id = var.project
disable_services_on_destroy = false
Expand Down
Loading