Hub registration using kubeconfig and labels support

examples/simple_zonal_with_hub_kubeconfig/README.md

@@ -0,0 +1,57 @@
+# Simple Zonal Cluster Registered using kubeconfig
+
+This example illustrates how to register any Kubernetes Cluster with [Anthos](https://cloud.google.com/anthos/multicluster-management/environs)
+
+It incorporates the standard cluster GKE module, uses kubecontext to register the cluster using the [Hub registration module](../../modules/hub).
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| cluster\_name\_suffix | A suffix to append to the default cluster name | `string` | `""` | no |
+| ip\_range\_pods | The secondary ip range to use for pods | `string` | `""` | no |
+| ip\_range\_services | The secondary ip range to use for services | `string` | `""` | no |
+| network | The VPC network to host the cluster in | `string` | `"default"` | no |
+| project\_id | The project ID to host the cluster in | `any` | n/a | yes |
+| region | The region to host the cluster in | `any` | n/a | yes |
+| subnetwork | The subnetwork to host the cluster in | `string` | `"default"` | no |
+| zones | The zone to host the cluster in (required if is a zonal cluster) | `list(string)` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| ca\_certificate | n/a |
+| client\_token | n/a |
+| cluster\_name | Cluster name |
+| ip\_range\_pods | The secondary IP range used for pods |
+| ip\_range\_services | The secondary IP range used for services |
+| kubernetes\_endpoint | n/a |
+| location | n/a |
+| master\_kubernetes\_version | The master Kubernetes version |
+| network | n/a |
+| project\_id | n/a |
+| region | n/a |
+| service\_account | The default service account used for running nodes. |
+| subnetwork | n/a |
+| zones | List of zones in which the cluster resides |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+
+To provision this example, run the following from within this directory:
+- `terraform init` to get the plugins
+- `terraform plan` to see the infrastructure plan
+- `terraform apply` to apply the infrastructure build
+- `terraform destroy` to destroy the built infrastructure
+
+Example:
+
+```
+terraform init
+
+terraform apply \
+    -var project_id=${PROJECT} \
+    -var region="us-central1" \
+    -var zones='["us-central1-c"]'
+```

examples/simple_zonal_with_hub_kubeconfig/hub.tf

@@ -0,0 +1,25 @@
+/**
+ * Copyright 2018 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "hub" {
+  source           = "../../modules/hub"
+  project_id       = var.project_id
+  location         = module.gke.location
+  cluster_name     = module.gke.name
+  cluster_endpoint = module.gke.endpoint
+  use_kubeconfig   = true
+  labels           = "testlabel=usekubecontext"
+}

examples/simple_zonal_with_hub_kubeconfig/main.tf

@@ -0,0 +1,41 @@
+/**
+ * Copyright 2018 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+  cluster_type = "simple-zonal"
+}
+
+provider "google" {
+  version = "~> 3.42.0"
+  region  = var.region
+}
+
+module "gke" {
+  source            = "../../"
+  project_id        = var.project_id
+  name              = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
+  regional          = false
+  region            = var.region
+  zones             = var.zones
+  network           = var.network
+  subnetwork        = var.subnetwork
+  ip_range_pods     = var.ip_range_pods
+  ip_range_services = var.ip_range_services
+  service_account   = "create"
+}
+
+data "google_client_config" "default" {
+}

examples/simple_zonal_with_hub_kubeconfig/outputs.tf

@@ -0,0 +1,34 @@
+/**
+ * Copyright 2018 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "kubernetes_endpoint" {
+  sensitive = true
+  value     = module.gke.endpoint
+}
+
+output "client_token" {
+  sensitive = true
+  value     = base64encode(data.google_client_config.default.access_token)
+}
+
+output "ca_certificate" {
+  value = module.gke.ca_certificate
+}
+
+output "service_account" {
+  description = "The default service account used for running nodes."
+  value       = module.gke.service_account
+}

examples/simple_zonal_with_hub_kubeconfig/test_outputs.tf

@@ -0,0 +1,63 @@
+/**
+ * Copyright 2018 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// These outputs are used to test the module with kitchen-terraform
+// They do not need to be included in real-world uses of this module
+
+output "project_id" {
+  value = var.project_id
+}
+
+output "region" {
+  value = module.gke.region
+}
+
+output "cluster_name" {
+  description = "Cluster name"
+  value       = module.gke.name
+}
+
+output "network" {
+  value = var.network
+}
+
+output "subnetwork" {
+  value = var.subnetwork
+}
+
+output "location" {
+  value = module.gke.location
+}
+
+output "ip_range_pods" {
+  description = "The secondary IP range used for pods"
+  value       = var.ip_range_pods
+}
+
+output "ip_range_services" {
+  description = "The secondary IP range used for services"
+  value       = var.ip_range_services
+}
+
+output "zones" {
+  description = "List of zones in which the cluster resides"
+  value       = module.gke.zones
+}
+
+output "master_kubernetes_version" {
+  description = "The master Kubernetes version"
+  value       = module.gke.master_version
+}

examples/simple_zonal_with_hub_kubeconfig/variables.tf

@@ -0,0 +1,53 @@
+/**
+ * Copyright 2018 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "project_id" {
+  description = "The project ID to host the cluster in"
+}
+
+variable "cluster_name_suffix" {
+  description = "A suffix to append to the default cluster name"
+  default     = ""
+}
+
+variable "region" {
+  description = "The region to host the cluster in"
+}
+
+variable "zones" {
+  type        = list(string)
+  description = "The zone to host the cluster in (required if is a zonal cluster)"
+}
+
+variable "network" {
+  description = "The VPC network to host the cluster in"
+  default     = "default"
+}
+
+variable "subnetwork" {
+  description = "The subnetwork to host the cluster in"
+  default     = "default"
+}
+
+variable "ip_range_pods" {
+  description = "The secondary ip range to use for pods"
+  default     = ""
+}
+
+variable "ip_range_services" {
+  description = "The secondary ip range to use for services"
+  default     = ""
+}

modules/hub/README.md

@@ -6,7 +6,7 @@ Specifically, this module automates the following steps for [registering a clust
 
 ## Usage
 
-There is a [full example](../../examples/simple_zonal_with_asm) provided. Simple usage is as follows:
+There is [GKE full example](../../examples/simple_zonal_with_asm) and a [Generic K8s example](../../examples/simple_zonal_with_hub_kubeconfig) provided. Simple usage is as follows:
 
 ```tf
 module "hub" {
@@ -37,13 +37,15 @@ To deploy this config:
 | cluster\_name | The unique name to identify the cluster in ASM. | `string` | n/a | yes |
 | enable\_gke\_hub\_registration | Enables GKE Hub Registration when set to true | `bool` | `true` | no |
 | gcloud\_sdk\_version | The gcloud sdk version to use. Minimum required version is 293.0.0 | `string` | `"296.0.1"` | no |
-| gke\_hub\_membership\_name | Memebership name that uniquely represents the cluster being registered on the Hub | `string` | `"gke-hub-membership"` | no |
+| gke\_hub\_membership\_name | Membership name that uniquely represents the cluster being registered on the Hub | `string` | `"gke-hub-membership"` | no |
 | gke\_hub\_sa\_name | Name for the GKE Hub SA stored as a secret `creds-gcp` in the `gke-connect` namespace. | `string` | `"gke-hub-sa"` | no |
+| labels | Comma separated labels in the format name=value to apply to cluster in the GCP Console. | `string` | `""` | no |
 | location | The location (zone or region) this cluster has been created in. | `string` | n/a | yes |
 | module\_depends\_on | List of modules or resources this module depends on. | `list` | `[]` | no |
 | project\_id | The project in which the resource belongs. | `string` | n/a | yes |
 | sa\_private\_key | Private key for service account base64 encoded. Required only if `use_existing_sa` is set to `true`. | `string` | `null` | no |
 | use\_existing\_sa | Uses an existing service account to register membership. Requires sa\_private\_key | `bool` | `false` | no |
+| use\_kubeconfig | Use existing kubeconfig to register membership. Set this to true for non GKE clusters. Assumes kubectl context is set to cluster to register. | `bool` | `false` | no |
 | use\_tf\_google\_credentials\_env\_var | Optional GOOGLE\_CREDENTIALS environment variable to be activated. | `bool` | `false` | no |
 
 ## Outputs

modules/hub/main.tf

@@ -16,6 +16,12 @@
 
 locals {
   gke_hub_sa_key = var.use_existing_sa ? var.sa_private_key : google_service_account_key.gke_hub_key[0].private_key
+
+  is_gke_flag               = var.use_kubeconfig ? 0 : 1
+  create_cmd_gke_entrypoint = "${path.module}/scripts/gke_hub_registration.sh"
+  create_cmd_gke_body       = "${local.is_gke_flag} ${var.gke_hub_membership_name} ${var.location} ${var.cluster_name} ${local.gke_hub_sa_key} ${var.project_id} ${var.labels}"
+  destroy_gke_entrypoint    = "${path.module}/scripts/gke_hub_unregister.sh"
+  destroy_gke_body          = "${local.is_gke_flag} ${var.gke_hub_membership_name} ${var.location} ${var.cluster_name} ${var.project_id}"
 }
 
 data "google_client_config" "default" {
@@ -50,8 +56,8 @@ module "gke_hub_registration" {
   use_tf_google_credentials_env_var = var.use_tf_google_credentials_env_var
   module_depends_on                 = concat([var.cluster_endpoint], var.module_depends_on)
 
-  create_cmd_entrypoint  = "${path.module}/scripts/gke_hub_registration.sh"
-  create_cmd_body        = "${var.gke_hub_membership_name} ${var.location} ${var.cluster_name} ${local.gke_hub_sa_key} ${var.project_id}"
-  destroy_cmd_entrypoint = "gcloud"
-  destroy_cmd_body       = "container hub memberships unregister ${var.gke_hub_membership_name} --gke-cluster=${var.location}/${var.cluster_name} --project ${var.project_id}"
+  create_cmd_entrypoint  = local.create_cmd_gke_entrypoint
+  create_cmd_body        = local.create_cmd_gke_body
+  destroy_cmd_entrypoint = local.destroy_gke_entrypoint
+  destroy_cmd_body       = local.destroy_gke_body
 }

modules/hub/scripts/gke_hub_registration.sh

@@ -15,16 +15,18 @@
 
 set -e
 
-if [ "$#" -lt 4 ]; then
+if [ "$#" -lt 5 ]; then
     >&2 echo "Not all expected arguments set."
     exit 1
 fi
 
-MEMBERSHIP_NAME=$1
-CLUSTER_LOCATION=$2
-CLUSTER_NAME=$3
-SERVICE_ACCOUNT_KEY=$4
-PROJECT_ID=$5
+GKE_CLUSTER_FLAG=$1
+MEMBERSHIP_NAME=$2
+CLUSTER_LOCATION=$3
+CLUSTER_NAME=$4
+SERVICE_ACCOUNT_KEY=$5
+PROJECT_ID=$6
+LABELS=$7
 
 #write temp key, cleanup at exit
 tmp_file=$(mktemp)
@@ -33,4 +35,20 @@ trap "rm -rf $tmp_file" EXIT
 base64 --help | grep "\--decode" && B64_ARG="--decode" || B64_ARG="-d"
 echo "${SERVICE_ACCOUNT_KEY}" | base64 ${B64_ARG} > "$tmp_file"
 
-gcloud container hub memberships register "${MEMBERSHIP_NAME}" --gke-cluster="${CLUSTER_LOCATION}"/"${CLUSTER_NAME}" --service-account-key-file="${tmp_file}" --project="${PROJECT_ID}" --quiet
+if [[ ${GKE_CLUSTER_FLAG} == 1 ]]; then
+    echo "Registering GKE Cluster."
+    gcloud container hub memberships register "${MEMBERSHIP_NAME}" --gke-cluster="${CLUSTER_LOCATION}"/"${CLUSTER_NAME}" --service-account-key-file="${tmp_file}" --project="${PROJECT_ID}" --quiet
+else
+    echo "Registering a non-GKE Cluster. Using current-context to register Hub membership."
+    #Get the kubeconfig
+    CONTEXT=$(kubectl config current-context)
+    gcloud container hub memberships register "${MEMBERSHIP_NAME}" --context="${CONTEXT}" --service-account-key-file="${tmp_file}" --project="${PROJECT_ID}" --quiet
+fi
+
+
+# Add labels to the registered cluster
+if [ -z ${LABELS+x} ]; then
+    echo "No hub labels to apply."
+else
+    gcloud container hub memberships update "${MEMBERSHIP_NAME}" --update-labels "$LABELS"
+fi