Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(TPG>=4.32.0)!: Support enabling Policy Controller mutations #1665

Merged
merged 2 commits into from
Jun 15, 2023
Merged

feat(TPG>=4.32.0)!: Support enabling Policy Controller mutations #1665

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c068e0
Support enabling Policy Controller mutations
ferrarimarco Jun 14, 2023
272ac7b
Merge branch 'master' into mutations
apeabody Jun 15, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
20 changes: 12 additions & 8 deletions modules/acm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
This module installs [Anthos Config Management](https://cloud.google.com/anthos-config-management/docs/) (ACM) in a Kubernetes cluster.

Specifically, this module automates the following steps for [installing ACM](https://cloud.google.com/anthos-config-management/docs/how-to/installing):

1. Enabling the ACM feature on the fleet
2. Registering the cluster to the fleet
3. Optionally, generating an SSH key for accessing Git and providing it to the Operator
Expand All @@ -11,6 +12,7 @@ Specifically, this module automates the following steps for [installing ACM](htt
6. Optionally, create and configure a Google Cloud Service Account for writing ACM metrics to Cloud Monitoring

## Fleet feature

Only the first cluster in a fleet should activate the ACM fleet feature.

Other clusters should disable feature activation by setting `enable_fleet_feature = false`.
Expand Down Expand Up @@ -46,9 +48,10 @@ module "acm" {
```

To deploy this config:

1. Configure the [Kubernetes Provider](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs) for the target cluster, for example:

```
```tf
provider "kubernetes" {
host = "https://${module.gke.endpoint}"
token = data.google_client_config.default.access_token
Expand All @@ -58,13 +61,13 @@ provider "kubernetes" {
data "google_client_config" "default" {}
```

2. Run `terraform apply`
3. Inspect the `git_creds_public` [output](#outputs) to retrieve the public key used for accessing Git. Whitelist this key for access to your Git repo. Instructions for some popular Git hosting providers are included for convenience:
1. Run `terraform apply`
1. Inspect the `git_creds_public` [output](#outputs) to retrieve the public key used for accessing Git. Whitelist this key for access to your Git repo. Instructions for some popular Git hosting providers are included for convenience:

* [Cloud Souce Repositories](https://cloud.google.com/source-repositories/docs/authentication#ssh)
* [Bitbucket](https://confluence.atlassian.com/bitbucket/set-up-an-ssh-key-728138079.html)
* [GitHub](https://help.github.com/articles/adding-a-new-ssh-key-to-your-github-account/)
* [Gitlab](https://docs.gitlab.com/ee/ssh/)
* [Cloud Souce Repositories](https://cloud.google.com/source-repositories/docs/authentication#ssh)
* [Bitbucket](https://confluence.atlassian.com/bitbucket/set-up-an-ssh-key-728138079.html)
* [GitHub](https://help.github.com/articles/adding-a-new-ssh-key-to-your-github-account/)
* [Gitlab](https://docs.gitlab.com/ee/ssh/)

<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
## Inputs
Expand All @@ -80,14 +83,15 @@ data "google_client_config" "default" {}
| enable\_fleet\_feature | Whether to enable the ACM feature on the fleet. | `bool` | `true` | no |
| enable\_fleet\_registration | Whether to create a new membership. | `bool` | `true` | no |
| enable\_log\_denies | Whether to enable logging of all denies and dryrun failures for ACM Policy Controller. | `bool` | `false` | no |
| enable\_mutation | Whether to enable mutations for ACM Policy Controller. | `bool` | `false` | no |
| enable\_policy\_controller | Whether to enable the ACM Policy Controller on the cluster | `bool` | `true` | no |
| enable\_referential\_rules | Enables referential constraints which reference another object in it definition and are therefore eventually consistent. | `bool` | `true` | no |
| hierarchy\_controller | Configurations for Hierarchy Controller. See [Hierarchy Controller docs](https://cloud.google.com/anthos-config-management/docs/how-to/installing-hierarchy-controller) for more details | `map(any)` | `null` | no |
| https\_proxy | URL for the HTTPS proxy to be used when communicating with the Git repo. | `string` | `null` | no |
| install\_template\_library | Whether to install the default Policy Controller template library | `bool` | `true` | no |
| location | GCP location used to reach cluster. | `string` | n/a | yes |
| metrics\_gcp\_sa\_name | The name of the Google service account for ACM metrics writing | `string` | `"acm-metrics-writer"` | no |
| policy\_bundles | A list of Policy Controller policy bundles git urls (example: https://github.com/GoogleCloudPlatform/acm-policy-controller-library.git/bundles/policy-essentials-v2022) to install on the cluster. | `list(string)` | `[]` | no |
| policy\_bundles | A list of Policy Controller policy bundles git urls (example: <https://github.com/GoogleCloudPlatform/acm-policy-controller-library.git/bundles/policy-essentials-v2022>) to install on the cluster. | `list(string)` | `[]` | no |
| policy\_dir | Subfolder containing configs in ACM Git repo. If un-set, uses Config Management default. | `string` | `""` | no |
| project\_id | GCP project\_id used to reach cluster. | `string` | n/a | yes |
| secret\_type | git authentication secret type, is passed through to ConfigManagement spec.git.secretType. Overriden to value 'ssh' if `create_ssh_key` is true | `string` | `"ssh"` | no |
Expand Down
1 change: 1 addition & 0 deletions modules/acm/feature.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ resource "google_gke_hub_feature_membership" "main" {

content {
enabled = true
mutation_enabled = var.enable_mutation
referential_rules_enabled = var.enable_referential_rules
template_library_installed = var.install_template_library
log_denies_enabled = var.enable_log_denies
Expand Down
6 changes: 6 additions & 0 deletions modules/acm/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,12 @@ variable "enable_log_denies" {
default = false
}

variable "enable_mutation" {
description = "Whether to enable mutations for ACM Policy Controller."
type = bool
default = false
}

# Hierarchy Controller config
variable "hierarchy_controller" {
description = "Configurations for Hierarchy Controller. See [Hierarchy Controller docs](https://cloud.google.com/anthos-config-management/docs/how-to/installing-hierarchy-controller) for more details"
Expand Down
4 changes: 2 additions & 2 deletions modules/acm/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.19.0, < 5.0"
version = ">= 4.32.0, < 5.0"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.19.0, < 5.0"
version = ">= 4.32.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down