Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable GKE_METADATA_SERVER as node_metadata for beta-clusters (#490) #512

Merged
merged 2 commits into from
May 6, 2020
Merged

Enable GKE_METADATA_SERVER as node_metadata for beta-clusters (#490) #512

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
872ecd4
Enable GKE_METADATA_SERVER as node_metadata for beta-clusters by defa…
schostin May 6, 2020
8d470b3
Fixed wrong reference for sandbox_enabled cluster fixture
schostin May 6, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion autogen/main/variables.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -454,7 +454,7 @@ variable "pod_security_policy_config" {

variable "node_metadata" {
description = "Specifies how node metadata is exposed to the workload running on the node"
default = "SECURE"
default = "GKE_METADATA_SERVER"
type = string
}

Expand Down
1 change: 0 additions & 1 deletion examples/simple_regional_beta/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ This example illustrates how to create a simple cluster with beta features.
| ip\_range\_services | The secondary ip range to use for services | string | n/a | yes |
| istio | Boolean to enable / disable Istio | string | `"true"` | no |
| network | The VPC network to host the cluster in | string | n/a | yes |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"SECURE"` | no |
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
| project\_id | The project ID to host the cluster in | string | n/a | yes |
Expand Down
1 change: 0 additions & 1 deletion examples/simple_regional_beta/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,6 @@ module "gke" {
cloudrun = var.cloudrun
dns_cache = var.dns_cache
gce_pd_csi_driver = var.gce_pd_csi_driver
node_metadata = var.node_metadata
sandbox_enabled = var.sandbox_enabled
remove_default_node_pool = var.remove_default_node_pool
node_pools = var.node_pools
Expand Down
6 changes: 0 additions & 6 deletions examples/simple_regional_beta/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,12 +69,6 @@ variable "gce_pd_csi_driver" {
default = false
}

variable "node_metadata" {
description = "Specifies how node metadata is exposed to the workload running on the node"
default = "SECURE"
type = string
}

variable "sandbox_enabled" {
type = bool
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it)."
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,7 +209,7 @@ Then perform the following commands on the root folder:
| network\_policy | Enable network policy addon | bool | `"true"` | no |
| network\_policy\_provider | The network policy provider. | string | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | string | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"SECURE"` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"GKE_METADATA_SERVER"` | no |
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
| node\_pools\_labels | Map of maps containing node labels by node-pool name | map(map(string)) | `<map>` | no |
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | map(map(string)) | `<map>` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -447,7 +447,7 @@ variable "pod_security_policy_config" {

variable "node_metadata" {
description = "Specifies how node metadata is exposed to the workload running on the node"
default = "SECURE"
default = "GKE_METADATA_SERVER"
type = string
}

Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ Then perform the following commands on the root folder:
| network\_policy | Enable network policy addon | bool | `"true"` | no |
| network\_policy\_provider | The network policy provider. | string | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | string | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"SECURE"` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"GKE_METADATA_SERVER"` | no |
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
| node\_pools\_labels | Map of maps containing node labels by node-pool name | map(map(string)) | `<map>` | no |
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | map(map(string)) | `<map>` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -447,7 +447,7 @@ variable "pod_security_policy_config" {

variable "node_metadata" {
description = "Specifies how node metadata is exposed to the workload running on the node"
default = "SECURE"
default = "GKE_METADATA_SERVER"
type = string
}

Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ Then perform the following commands on the root folder:
| network\_policy | Enable network policy addon | bool | `"true"` | no |
| network\_policy\_provider | The network policy provider. | string | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | string | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"SECURE"` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"GKE_METADATA_SERVER"` | no |
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
| node\_pools\_labels | Map of maps containing node labels by node-pool name | map(map(string)) | `<map>` | no |
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | map(map(string)) | `<map>` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -423,7 +423,7 @@ variable "pod_security_policy_config" {

variable "node_metadata" {
description = "Specifies how node metadata is exposed to the workload running on the node"
default = "SECURE"
default = "GKE_METADATA_SERVER"
type = string
}

Expand Down
2 changes: 0 additions & 2 deletions test/fixtures/beta_cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,8 +63,6 @@ module "this" {
pod_security_policy_config = [{
enabled = true
}]

node_metadata = "EXPOSE"
}

data "google_client_config" "default" {
Expand Down
1 change: 0 additions & 1 deletion test/fixtures/sandbox_enabled/example.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ module "example" {
compute_engine_service_account = var.compute_engine_service_accounts[0]
istio = false
cloudrun = false
node_metadata = "UNSPECIFIED"
sandbox_enabled = true
remove_default_node_pool = true

Expand Down
18 changes: 16 additions & 2 deletions test/integration/beta_cluster/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,8 +74,9 @@
end

it "has the expected nodeMetadata conseal config" do
expect(data['nodeConfig']['workloadMetadataConfig']).to include({
"nodeMetadata" => 'EXPOSE',
expect(data['nodeConfig']['workloadMetadataConfig']).to eq({
"mode" => "GKE_METADATA",
"nodeMetadata" => 'GKE_METADATA_SERVER',
})
end

Expand Down Expand Up @@ -210,6 +211,19 @@
)
)
end

it "has the expected node metadata for workload identity" do
expect(node_pools).to include(
including(
"config" => including(
"workloadMetadataConfig" => eq(
"mode" => "GKE_METADATA",
"nodeMetadata" => 'GKE_METADATA_SERVER',
),
),
)
)
end
end
end
end