Skip to content

Commit 152ff2e

Browse files
author
Aaron Lane
authored
Merge pull request #354 from terraform-google-modules/feature/simplify-master-authorized
Simplify master_authorized_networks_config to master_authorized_networks
2 parents 5b08b91 + 3d23898 commit 152ff2e

File tree

48 files changed

+143
-116
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+143
-116
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
149149
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | string | `"latest"` | no |
150150
| logging\_service | The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none | string | `"logging.googleapis.com"` | no |
151151
| maintenance\_start\_time | Time window specified for daily maintenance operations in RFC3339 format | string | `"05:00"` | no |
152-
| master\_authorized\_networks\_config | The desired configuration options for master authorized networks. The object format is {cidr_blocks = list(object({cidr_block = string, display_name = string}))}. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). | object | `<list>` | no |
152+
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | object | `<list>` | no |
153153
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | string | `"monitoring.googleapis.com"` | no |
154154
| name | The name of the cluster (required) | string | n/a | yes |
155155
| network | The VPC network to host the cluster in (required) | string | n/a | yes |

‎autogen/cluster.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ resource "google_container_cluster" "primary" {
101101
}
102102
{% endif %}
103103
dynamic "master_authorized_networks_config" {
104-
for_each = var.master_authorized_networks_config
104+
for_each = local.master_authorized_networks_config
105105
content {
106106
dynamic "cidr_blocks" {
107107
for_each = master_authorized_networks_config.value.cidr_blocks

‎autogen/main.tf.tmpl

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,10 @@ locals {
127127
# /BETA features
128128
{% endif %}
129129

130+
master_authorized_networks_config = length(var.master_authorized_networks) == 0 ? [] : [{
131+
cidr_blocks : var.master_authorized_networks
132+
}]
133+
130134
cluster_output_node_pools_names = concat(google_container_node_pool.pools.*.name, [""])
131135
cluster_output_node_pools_versions = concat(google_container_node_pool.pools.*.version, [""])
132136

‎autogen/outputs.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ output "monitoring_service" {
7575

7676
output "master_authorized_networks_config" {
7777
description = "Networks from which access to master is permitted"
78-
value = var.master_authorized_networks_config
78+
value = google_container_cluster.primary.master_authorized_networks_config
7979
}
8080

8181
output "master_version" {

‎autogen/variables.tf.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,9 @@ variable "node_version" {
7878
default = ""
7979
}
8080

81-
variable "master_authorized_networks_config" {
82-
type = list(object({ cidr_blocks = list(object({ cidr_block = string, display_name = string })) }))
83-
description = "The desired configuration options for master authorized networks. The object format is {cidr_blocks = list(object({cidr_block = string, display_name = string}))}. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists)."
81+
variable "master_authorized_networks" {
82+
type = list(object({ cidr_block = string, display_name = string }))
83+
description = "List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists)."
8484
default = []
8585
}
8686

‎cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ resource "google_container_cluster" "primary" {
4949
monitoring_service = var.monitoring_service
5050

5151
dynamic "master_authorized_networks_config" {
52-
for_each = var.master_authorized_networks_config
52+
for_each = local.master_authorized_networks_config
5353
content {
5454
dynamic "cidr_blocks" {
5555
for_each = master_authorized_networks_config.value.cidr_blocks

‎docs/upgrading_to_v6.0.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Upgrading to v6.0
2+
3+
The v6.0 release of *kubernetes-engine* is a backwards incompatible
4+
release.
5+
6+
## Dropped support
7+
Due to changes in GKE, the module has dropped support for setting the `kubernetes_dashboard` variable.
8+
9+
Additionally, support for Google provider versions older than v2.18 has been removed.
10+
11+
## Migration Instructions
12+
13+
### Master Authorized Networks
14+
Previously, setting up master authorized networks required setting a nested config within `master_authorized_networks_config`.
15+
Now, to set up master authorized networks you can simply pass a list of authorized networks.
16+
17+
```diff
18+
module "kubernetes_engine_private_cluster" {
19+
source = "terraform-google-modules/kubernetes-engine/google"
20+
- version = "~> 5.0"
21+
+ version = "~> 6.0"
22+
23+
- master_authorized_networks_config = [
24+
+ master_authorized_networks = [
25+
{
26+
- cidr_blocks = [
27+
- {
28+
- cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
29+
- display_name = "VPC"
30+
- },
31+
- ]
32+
+ cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
33+
+ display_name = "VPC"
34+
},
35+
]
36+
}
37+
```

‎examples/node_pool_update_variant/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,14 +46,10 @@ module "gke" {
4646
enable_private_nodes = true
4747
master_ipv4_cidr_block = "172.16.0.0/28"
4848

49-
master_authorized_networks_config = [
49+
master_authorized_networks = [
5050
{
51-
cidr_blocks = [
52-
{
53-
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
54-
display_name = "VPC"
55-
},
56-
]
51+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
52+
display_name = "VPC"
5753
},
5854
]
5955

‎examples/node_pool_update_variant_beta/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,10 @@ module "gke" {
4747
enable_private_nodes = true
4848
master_ipv4_cidr_block = "172.16.0.0/28"
4949

50-
master_authorized_networks_config = [
50+
master_authorized_networks = [
5151
{
52-
cidr_blocks = [
53-
{
54-
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
55-
display_name = "VPC"
56-
},
57-
]
52+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
53+
display_name = "VPC"
5854
},
5955
]
6056

‎examples/private_zonal_with_networking/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -71,14 +71,10 @@ module "gke" {
7171
enable_private_nodes = true
7272
master_ipv4_cidr_block = "172.16.0.0/28"
7373

74-
master_authorized_networks_config = [
74+
master_authorized_networks = [
7575
{
76-
cidr_blocks = [
77-
{
78-
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
79-
display_name = "VPC"
80-
},
81-
]
76+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
77+
display_name = "VPC"
8278
},
8379
]
8480
}

‎examples/regional_private_node_pool_oauth_scopes/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,10 @@ module "gke" {
3333
remove_default_node_pool = true
3434
disable_legacy_metadata_endpoints = true
3535

36-
master_authorized_networks_config = [
36+
master_authorized_networks = [
3737
{
38-
cidr_blocks = [
39-
{
40-
cidr_block = module.gke-network.subnets_ips[0]
41-
display_name = "VPC"
42-
},
43-
]
38+
cidr_block = module.gke-network.subnets_ips[0]
39+
display_name = "VPC"
4440
},
4541
]
4642

‎examples/safer_cluster/main.tf

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,16 +49,14 @@ module "gke" {
4949
ip_range_services = local.svc_range_name
5050
compute_engine_service_account = var.compute_engine_service_account
5151
master_ipv4_cidr_block = "172.16.0.0/28"
52-
master_authorized_networks_config = [
52+
53+
master_authorized_networks = [
5354
{
54-
cidr_blocks = [
55-
{
56-
cidr_block = "10.60.0.0/17"
57-
display_name = "VPC"
58-
},
59-
]
55+
cidr_block = "10.60.0.0/17"
56+
display_name = "VPC"
6057
},
6158
]
59+
6260
istio = true
6361
cloudrun = true
6462
}

‎examples/simple_regional_private/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -45,14 +45,10 @@ module "gke" {
4545
enable_private_nodes = true
4646
master_ipv4_cidr_block = "172.16.0.0/28"
4747

48-
master_authorized_networks_config = [
48+
master_authorized_networks = [
4949
{
50-
cidr_blocks = [
51-
{
52-
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
53-
display_name = "VPC"
54-
},
55-
]
50+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
51+
display_name = "VPC"
5652
},
5753
]
5854
}

‎examples/simple_regional_private_beta/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,10 @@ module "gke" {
4444
enable_private_nodes = true
4545
master_ipv4_cidr_block = "172.16.0.0/28"
4646

47-
master_authorized_networks_config = [
47+
master_authorized_networks = [
4848
{
49-
cidr_blocks = [
50-
{
51-
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
52-
display_name = "VPC"
53-
},
54-
]
49+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
50+
display_name = "VPC"
5551
},
5652
]
5753

‎examples/simple_zonal_private/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,14 +46,10 @@ module "gke" {
4646
enable_private_nodes = true
4747
master_ipv4_cidr_block = "172.16.0.0/28"
4848

49-
master_authorized_networks_config = [
49+
master_authorized_networks = [
5050
{
51-
cidr_blocks = [
52-
{
53-
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
54-
display_name = "VPC"
55-
},
56-
]
51+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
52+
display_name = "VPC"
5753
},
5854
]
5955
}

‎examples/stub_domains_private/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,14 +40,10 @@ module "gke" {
4040
enable_private_endpoint = false
4141
enable_private_nodes = true
4242

43-
master_authorized_networks_config = [
43+
master_authorized_networks = [
4444
{
45-
cidr_blocks = [
46-
{
47-
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
48-
display_name = "VPC"
49-
},
50-
]
45+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
46+
display_name = "VPC"
5147
},
5248
]
5349

‎examples/workload_metadata_config/main.tf

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -48,14 +48,10 @@ module "gke" {
4848
master_ipv4_cidr_block = "172.16.0.0/28"
4949
node_metadata = "SECURE"
5050

51-
master_authorized_networks_config = [
51+
master_authorized_networks = [
5252
{
53-
cidr_blocks = [
54-
{
55-
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
56-
display_name = "VPC"
57-
},
58-
]
53+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
54+
display_name = "VPC"
5955
},
6056
]
6157
}

‎main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,10 @@ locals {
8282
cluster_output_horizontal_pod_autoscaling_enabled = google_container_cluster.primary.addons_config.0.horizontal_pod_autoscaling.0.disabled
8383

8484

85+
master_authorized_networks_config = length(var.master_authorized_networks) == 0 ? [] : [{
86+
cidr_blocks : var.master_authorized_networks
87+
}]
88+
8589
cluster_output_node_pools_names = concat(google_container_node_pool.pools.*.name, [""])
8690
cluster_output_node_pools_versions = concat(google_container_node_pool.pools.*.version, [""])
8791

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
171171
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | string | `"latest"` | no |
172172
| logging\_service | The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none | string | `"logging.googleapis.com"` | no |
173173
| maintenance\_start\_time | Time window specified for daily maintenance operations in RFC3339 format | string | `"05:00"` | no |
174-
| master\_authorized\_networks\_config | The desired configuration options for master authorized networks. The object format is {cidr_blocks = list(object({cidr_block = string, display_name = string}))}. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). | object | `<list>` | no |
174+
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | object | `<list>` | no |
175175
| master\_ipv4\_cidr\_block | (Beta) The IP range in CIDR notation to use for the hosted master network | string | `"10.0.0.0/28"` | no |
176176
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | string | `"monitoring.googleapis.com"` | no |
177177
| name | The name of the cluster (required) | string | n/a | yes |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ resource "google_container_cluster" "primary" {
9393
}
9494
}
9595
dynamic "master_authorized_networks_config" {
96-
for_each = var.master_authorized_networks_config
96+
for_each = local.master_authorized_networks_config
9797
content {
9898
dynamic "cidr_blocks" {
9999
for_each = master_authorized_networks_config.value.cidr_blocks

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,10 @@ locals {
113113

114114
# /BETA features
115115

116+
master_authorized_networks_config = length(var.master_authorized_networks) == 0 ? [] : [{
117+
cidr_blocks : var.master_authorized_networks
118+
}]
119+
116120
cluster_output_node_pools_names = concat(google_container_node_pool.pools.*.name, [""])
117121
cluster_output_node_pools_versions = concat(google_container_node_pool.pools.*.version, [""])
118122

‎modules/beta-private-cluster-update-variant/outputs.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ output "monitoring_service" {
7575

7676
output "master_authorized_networks_config" {
7777
description = "Networks from which access to master is permitted"
78-
value = var.master_authorized_networks_config
78+
value = google_container_cluster.primary.master_authorized_networks_config
7979
}
8080

8181
output "master_version" {

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,9 @@ variable "node_version" {
7878
default = ""
7979
}
8080

81-
variable "master_authorized_networks_config" {
82-
type = list(object({ cidr_blocks = list(object({ cidr_block = string, display_name = string })) }))
83-
description = "The desired configuration options for master authorized networks. The object format is {cidr_blocks = list(object({cidr_block = string, display_name = string}))}. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists)."
81+
variable "master_authorized_networks" {
82+
type = list(object({ cidr_block = string, display_name = string }))
83+
description = "List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists)."
8484
default = []
8585
}
8686

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
171171
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | string | `"latest"` | no |
172172
| logging\_service | The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none | string | `"logging.googleapis.com"` | no |
173173
| maintenance\_start\_time | Time window specified for daily maintenance operations in RFC3339 format | string | `"05:00"` | no |
174-
| master\_authorized\_networks\_config | The desired configuration options for master authorized networks. The object format is {cidr_blocks = list(object({cidr_block = string, display_name = string}))}. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists). | object | `<list>` | no |
174+
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | object | `<list>` | no |
175175
| master\_ipv4\_cidr\_block | (Beta) The IP range in CIDR notation to use for the hosted master network | string | `"10.0.0.0/28"` | no |
176176
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | string | `"monitoring.googleapis.com"` | no |
177177
| name | The name of the cluster (required) | string | n/a | yes |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ resource "google_container_cluster" "primary" {
9393
}
9494
}
9595
dynamic "master_authorized_networks_config" {
96-
for_each = var.master_authorized_networks_config
96+
for_each = local.master_authorized_networks_config
9797
content {
9898
dynamic "cidr_blocks" {
9999
for_each = master_authorized_networks_config.value.cidr_blocks

‎modules/beta-private-cluster/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,10 @@ locals {
113113

114114
# /BETA features
115115

116+
master_authorized_networks_config = length(var.master_authorized_networks) == 0 ? [] : [{
117+
cidr_blocks : var.master_authorized_networks
118+
}]
119+
116120
cluster_output_node_pools_names = concat(google_container_node_pool.pools.*.name, [""])
117121
cluster_output_node_pools_versions = concat(google_container_node_pool.pools.*.version, [""])
118122

‎modules/beta-private-cluster/outputs.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ output "monitoring_service" {
7575

7676
output "master_authorized_networks_config" {
7777
description = "Networks from which access to master is permitted"
78-
value = var.master_authorized_networks_config
78+
value = google_container_cluster.primary.master_authorized_networks_config
7979
}
8080

8181
output "master_version" {

‎modules/beta-private-cluster/variables.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,9 @@ variable "node_version" {
7878
default = ""
7979
}
8080

81-
variable "master_authorized_networks_config" {
82-
type = list(object({ cidr_blocks = list(object({ cidr_block = string, display_name = string })) }))
83-
description = "The desired configuration options for master authorized networks. The object format is {cidr_blocks = list(object({cidr_block = string, display_name = string}))}. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists)."
81+
variable "master_authorized_networks" {
82+
type = list(object({ cidr_block = string, display_name = string }))
83+
description = "List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists)."
8484
default = []
8585
}
8686

0 commit comments

Comments
 (0)