Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for Terraform v0.12 #177

Merged
merged 17 commits into from
Jul 12, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,12 @@ Extending the adopted spec, each change should have a link to its corresponding

## [Unreleased]

## [4.0.0] 2019-07-ZZ

### Changed

* Supported version of Terraform is 0.12. [#58]

## [v3.0.0] - 2019-07-08

### Added
Expand Down
2 changes: 1 addition & 1 deletion Gemfile
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
ruby "~> 2.5"

source 'https://rubygems.org/' do
gem "kitchen-terraform", "~> 4.0"
gem "kitchen-terraform", "~> 4.9"
gem "kubeclient", "~> 4.0"
gem "rest-client", "~> 2.0"
end
29 changes: 7 additions & 22 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,8 @@ SHELL := /usr/bin/env bash
# Docker build config variables
CREDENTIALS_PATH ?= /cft/workdir/credentials.json
DOCKER_ORG := gcr.io/cloud-foundation-cicd
DOCKER_TAG_BASE_KITCHEN_TERRAFORM ?= 1.3.0
DOCKER_TAG_BASE_KITCHEN_TERRAFORM ?= 2.1.0
DOCKER_REPO_BASE_KITCHEN_TERRAFORM := ${DOCKER_ORG}/cft/kitchen-terraform:${DOCKER_TAG_BASE_KITCHEN_TERRAFORM}
DOCKER_TAG_KITCHEN_TERRAFORM ?= ${DOCKER_TAG_BASE_KITCHEN_TERRAFORM}
DOCKER_IMAGE_KITCHEN_TERRAFORM := ${DOCKER_ORG}/cft/kitchen-terraform_terraform-google-kubernetes-engine

# All is the first target in the file so it will get picked up when you just run 'make' on its own
.PHONY: all
Expand Down Expand Up @@ -105,19 +103,6 @@ dev: generate generate_docs
version:
@source helpers/version-repo.sh

# Build Docker
.PHONY: docker_build_kitchen_terraform
docker_build_kitchen_terraform:
docker build -f build/docker/kitchen_terraform/Dockerfile \
--build-arg BASE_IMAGE=${DOCKER_REPO_BASE_KITCHEN_TERRAFORM} \
-t ${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} .

# Push Docker image
.PHONY: docker_push_kitchen_terraform
docker_push_kitchen_terraform:
docker tag ${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} ${DOCKER_ORG}/${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM}
docker push ${DOCKER_ORG}/${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM}

# Run docker
.PHONY: docker_run
docker_run:
Expand All @@ -130,7 +115,7 @@ docker_run:
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
-v "$(CURDIR)":/cft/workdir \
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
${DOCKER_REPO_BASE_KITCHEN_TERRAFORM} \
/bin/bash -c "source test/ci_integration.sh && setup_environment && exec /bin/bash"

.PHONY: docker_create
Expand All @@ -144,7 +129,7 @@ docker_create: docker_build_kitchen_terraform
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
-v "$(CURDIR)":/cft/workdir \
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
${DOCKER_REPO_BASE_KITCHEN_TERRAFORM} \
/bin/bash -c "source test/ci_integration.sh && setup_environment && kitchen create"

.PHONY: docker_converge
Expand All @@ -158,7 +143,7 @@ docker_converge:
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
-v "$(CURDIR)":/cft/workdir \
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
${DOCKER_REPO_BASE_KITCHEN_TERRAFORM} \
/bin/bash -c "source test/ci_integration.sh && setup_environment && kitchen converge && kitchen converge"

.PHONY: docker_verify
Expand All @@ -172,7 +157,7 @@ docker_verify:
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
-v "$(CURDIR)":/cft/workdir \
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
${DOCKER_REPO_BASE_KITCHEN_TERRAFORM} \
/bin/bash -c "source test/ci_integration.sh && setup_environment && kitchen verify"

.PHONY: docker_destroy
Expand All @@ -186,7 +171,7 @@ docker_destroy:
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
-v "$(CURDIR)":/cft/workdir \
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
${DOCKER_REPO_BASE_KITCHEN_TERRAFORM} \
/bin/bash -c "source test/ci_integration.sh && setup_environment && kitchen destroy"

.PHONY: test_integration_docker
Expand All @@ -198,5 +183,5 @@ test_integration_docker:
-e ZONES \
-e SERVICE_ACCOUNT_JSON \
-v "$(CURDIR)":/cft/workdir \
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
${DOCKER_REPO_BASE_KITCHEN_TERRAFORM} \
/bin/bash -c "test/ci_integration.sh"
61 changes: 35 additions & 26 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,14 @@ The resources/services/activations/deletions that this module will create/trigge
- Activate network policy if `network_policy` is true
- Add `ip-masq-agent` configmap with provided `non_masquerade_cidrs` if `network_policy` is true


## Compatibility

This module is meant for use with Terraform 0.12. If you haven't
[upgraded][terraform-0.12-upgrade] and need a Terraform
0.11.x-compatible version of this module, the last released version
intended for Terraform 0.11.x is [3.0.0].

## Usage
There are multiple examples included in the [examples](./examples/) folder but simple usage is as follows:

Expand Down Expand Up @@ -56,7 +64,7 @@ module "gke" {
all = {}

default-node-pool = {
default-node-pool = "true"
default-node-pool = true
}
}

Expand All @@ -74,7 +82,7 @@ module "gke" {
default-node-pool = [
{
key = "default-node-pool"
value = "true"
value = true
effect = "PREFER_NO_SCHEDULE"
},
]
Expand Down Expand Up @@ -113,8 +121,7 @@ Version 1.0.0 of this module introduces a breaking change: adding the `disable-l

In either case, upgrading to module version `v1.0.0` will trigger a recreation of all node pools in the cluster.

[^]: (autogen_docs_start)

<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
## Inputs

| Name | Description | Type | Default | Required |
Expand All @@ -124,43 +131,43 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | string | `""` | no |
| configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | string | `"false"` | no |
| description | The description of the cluster | string | `""` | no |
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |
| http\_load\_balancing | Enable httpload balancer addon | string | `"true"` | no |
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | string | `"0"` | no |
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | string | `"false"` | no |
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | bool | `"true"` | no |
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
| http\_load\_balancing | Enable httpload balancer addon | bool | `"true"` | no |
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | number | `"0"` | no |
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | bool | `"false"` | no |
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | string | `"60s"` | no |
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | string | n/a | yes |
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | string | n/a | yes |
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | string | `"false"` | no |
| kubernetes\_dashboard | Enable kubernetes dashboard addon | string | `"false"` | no |
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | bool | `"false"` | no |
| kubernetes\_dashboard | Enable kubernetes dashboard addon | bool | `"false"` | no |
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | string | `"latest"` | no |
| logging\_service | The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none | string | `"logging.googleapis.com"` | no |
| maintenance\_start\_time | Time window specified for daily maintenance operations in RFC3339 format | string | `"05:00"` | no |
| master\_authorized\_networks\_config | The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists)<br><br> ### example format ### master_authorized_networks_config = [{ cidr_blocks = [{ cidr_block = "10.0.0.0/8" display_name = "example_network" }], }] | list | `<list>` | no |
| master\_authorized\_networks\_config | The desired configuration options for master authorized networks. The object format is {cidr_blocks = list(object({cidr_block = string, display_name = string}))}. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). | object | `<list>` | no |
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | string | `"monitoring.googleapis.com"` | no |
| name | The name of the cluster (required) | string | n/a | yes |
| network | The VPC network to host the cluster in (required) | string | n/a | yes |
| network\_policy | Enable network policy addon | string | `"false"` | no |
| network\_policy | Enable network policy addon | bool | `"false"` | no |
| network\_policy\_provider | The network policy provider. | string | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | string | `""` | no |
| node\_pools | List of maps containing node pools | list | `<list>` | no |
| node\_pools\_labels | Map of maps containing node labels by node-pool name | map | `<map>` | no |
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | map | `<map>` | no |
| node\_pools\_oauth\_scopes | Map of lists containing node oauth scopes by node-pool name | map | `<map>` | no |
| node\_pools\_tags | Map of lists containing node network tags by node-pool name | map | `<map>` | no |
| node\_pools\_taints | Map of lists containing node taints by node-pool name | map | `<map>` | no |
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
| node\_pools\_labels | Map of maps containing node labels by node-pool name | map(map(string)) | `<map>` | no |
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | map(map(string)) | `<map>` | no |
| node\_pools\_oauth\_scopes | Map of lists containing node oauth scopes by node-pool name | map(list(string)) | `<map>` | no |
| node\_pools\_tags | Map of lists containing node network tags by node-pool name | map(list(string)) | `<map>` | no |
| node\_pools\_taints | Map of lists containing node taints by node-pool name | object | `<map>` | no |
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list | `<list>` | no |
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (required) | string | n/a | yes |
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | string | `"true"` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | string | `"false"` | no |
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The default value will cause a cluster-specific service account to be created. | string | `"create"` | no |
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map | `<map>` | no |
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | list | `<list>` | no |
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | list | `<list>` | no |
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | list(string) | `<list>` | no |

## Outputs

Expand All @@ -186,7 +193,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
| type | Cluster type (regional / zonal) |
| zones | List of zones in which the cluster resides |

[^]: (autogen_docs_end)
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

## Requirements

Expand All @@ -203,7 +210,7 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
#### Kubectl
- [kubectl](https://github.com/kubernetes/kubernetes/releases) 1.9.x
#### Terraform and Plugins
- [Terraform](https://www.terraform.io/downloads.html) 0.11.x
- [Terraform](https://www.terraform.io/downloads.html) 0.12
aaron-lane marked this conversation as resolved.
Show resolved Hide resolved
- [Terraform Provider for GCP][terraform-provider-google] v2.9

### Configure a Service Account
Expand Down Expand Up @@ -374,3 +381,5 @@ command.
[upgrading-to-v2.0]: docs/upgrading_to_v2.0.md
[upgrading-to-v3.0]: docs/upgrading_to_v3.0.md
[terraform-provider-google]: https://github.com/terraform-providers/terraform-provider-google
[3.0.0]: https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/3.0.0
[terraform-0.12-upgrade]: https://www.terraform.io/upgrade-guides/0-12.html
6 changes: 3 additions & 3 deletions auth.tf
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
Retrieve authentication token
*****************************************/
data "google_client_config" "default" {
provider = "google"
provider = google
}

/******************************************
Expand All @@ -29,6 +29,6 @@ data "google_client_config" "default" {
provider "kubernetes" {
load_config_file = false
host = "https://${local.cluster_endpoint}"
token = "${data.google_client_config.default.access_token}"
cluster_ca_certificate = "${base64decode(local.cluster_ca_certificate)}"
token = data.google_client_config.default.access_token
cluster_ca_certificate = base64decode(local.cluster_ca_certificate)
}
20 changes: 15 additions & 5 deletions autogen/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,14 @@ The resources/services/activations/deletions that this module will create/trigge
**Note**: You must run Terraform from a VM on the same VPC as your cluster, otherwise there will be issues connecting to the GKE master.

{% endif %}

## Compatibility

This module is meant for use with Terraform 0.12. If you haven't
[upgraded][terraform-0.12-upgrade] and need a Terraform
0.11.x-compatible version of this module, the last released version
intended for Terraform 0.11.x is [3.0.0].

## Usage
There are multiple examples included in the [examples](./examples/) folder but simple usage is as follows:

Expand Down Expand Up @@ -70,7 +78,7 @@ module "gke" {
all = {}

default-node-pool = {
default-node-pool = "true"
default-node-pool = true
}
}

Expand All @@ -88,7 +96,7 @@ module "gke" {
default-node-pool = [
{
key = "default-node-pool"
value = "true"
value = true
effect = "PREFER_NO_SCHEDULE"
},
]
Expand Down Expand Up @@ -127,8 +135,8 @@ Version 1.0.0 of this module introduces a breaking change: adding the `disable-l

In either case, upgrading to module version `v1.0.0` will trigger a recreation of all node pools in the cluster.

[^]: (autogen_docs_start)
[^]: (autogen_docs_end)
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

## Requirements

Expand All @@ -145,7 +153,7 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
#### Kubectl
- [kubectl](https://github.com/kubernetes/kubernetes/releases) 1.9.x
#### Terraform and Plugins
- [Terraform](https://www.terraform.io/downloads.html) 0.11.x
- [Terraform](https://www.terraform.io/downloads.html) 0.12
{% if private_cluster or beta_cluster %}
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v2.9
{% else %}
Expand Down Expand Up @@ -332,3 +340,5 @@ command.
{% else %}
[terraform-provider-google]: https://github.com/terraform-providers/terraform-provider-google
{% endif %}
[3.0.0]: https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/3.0.0
[terraform-0.12-upgrade]: https://www.terraform.io/upgrade-guides/0-12.html
10 changes: 7 additions & 3 deletions autogen/auth.tf
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,11 @@
Retrieve authentication token
*****************************************/
data "google_client_config" "default" {
provider = "{% if private_cluster or beta_cluster %}google-beta{% else %}google{% endif %}"
{% if private_cluster or beta_cluster %}
provider = google-beta
{% else %}
provider = google
{% endif %}
}

/******************************************
Expand All @@ -29,6 +33,6 @@ data "google_client_config" "default" {
provider "kubernetes" {
load_config_file = false
host = "https://${local.cluster_endpoint}"
token = "${data.google_client_config.default.access_token}"
cluster_ca_certificate = "${base64decode(local.cluster_ca_certificate)}"
token = data.google_client_config.default.access_token
cluster_ca_certificate = base64decode(local.cluster_ca_certificate)
}
Loading