Skip to content

Commit 24eb22f

Browse files
bharathkkbbharathkkb
authored
Merge branch 'master' into mn/chore/promote-config-connector-ga
2 parents e04edb7 + 24c09ec commit 24eb22f

File tree

50 files changed

+342
-44
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+342
-44
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ Then perform the following commands on the root folder:
131131
| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no |
132132
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
133133
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
134-
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> })</pre> | <pre>{<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
134+
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
135135
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
136136
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
137137
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,12 @@ resource "google_container_cluster" "primary" {
135135
content {
136136
service_account = local.service_account
137137
oauth_scopes = local.node_pools_oauth_scopes["all"]
138+
139+
management {
140+
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
141+
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade",true)
142+
}
143+
138144
{% if beta_cluster %}
139145
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
140146
{% endif %}
@@ -156,7 +162,7 @@ resource "google_container_cluster" "primary" {
156162
{% if autopilot_cluster == true %}
157163
cluster_autoscaling {
158164
dynamic "auto_provisioning_defaults" {
159-
for_each = var.create_service_account ? [1] : []
165+
for_each = (var.create_service_account || var.service_account != "") ? [1] : []
160166

161167
content {
162168
service_account = local.service_account

‎autogen/main/main.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ locals {
6868
resource_type = "memory"
6969
minimum = var.cluster_autoscaling.min_memory_gb
7070
maximum = var.cluster_autoscaling.max_memory_gb
71-
}], var.cluster_autoscaling.gpu_resources) : []
71+
}], var.cluster_autoscaling.gpu_resources) : []
7272
{% endif %}
7373

7474

‎autogen/main/variables.tf.tmpl

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,8 @@ variable "cluster_autoscaling" {
241241
min_memory_gb = number
242242
max_memory_gb = number
243243
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
244+
auto_repair = bool
245+
auto_upgrade = bool
244246
})
245247
default = {
246248
enabled = false
@@ -252,6 +254,8 @@ variable "cluster_autoscaling" {
252254
max_memory_gb = 0
253255
min_memory_gb = 0
254256
gpu_resources = []
257+
auto_repair = true
258+
auto_upgrade = true
255259
}
256260
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
257261
}

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,8 @@ variable "cluster_autoscaling" {
233233
min_memory_gb = number
234234
max_memory_gb = number
235235
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
236+
auto_repair = bool
237+
auto_upgrade = bool
236238
})
237239
default = {
238240
enabled = false
@@ -242,6 +244,8 @@ variable "cluster_autoscaling" {
242244
max_memory_gb = 0
243245
min_memory_gb = 0
244246
gpu_resources = []
247+
auto_repair = true
248+
auto_upgrade = true
245249
}
246250
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
247251
}

‎cluster.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,12 @@ resource "google_container_cluster" "primary" {
104104
content {
105105
service_account = local.service_account
106106
oauth_scopes = local.node_pools_oauth_scopes["all"]
107+
108+
management {
109+
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
110+
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade", true)
111+
}
112+
107113
}
108114
}
109115
dynamic "resource_limits" {

‎examples/deploy_service/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ resource "kubernetes_pod" "nginx-example" {
5252

5353
spec {
5454
container {
55-
image = "nginx:1.23.2"
55+
image = "nginx:1.23.3"
5656
name = "nginx-example"
5757
}
5858
}

‎examples/node_pool/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This example illustrates how to create a cluster with multiple custom node-pool
77

88
| Name | Description | Type | Default | Required |
99
|------|-------------|------|---------|:--------:|
10-
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({<br> resource_type = string<br> minimum = number<br> maximum = number<br> }))<br> })</pre> | <pre>{<br> "autoscaling_profile": "BALANCED",<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
10+
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({<br> resource_type = string<br> minimum = number<br> maximum = number<br> }))<br> auto_repair = bool<br> auto_upgrade = bool<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
1111
| cluster\_name\_suffix | A suffix to append to the default cluster name | `string` | `""` | no |
1212
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | `any` | n/a | yes |
1313
| ip\_range\_pods | The secondary ip range to use for pods | `any` | n/a | yes |

‎examples/node_pool/variables.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@ variable "cluster_autoscaling" {
6565
minimum = number
6666
maximum = number
6767
}))
68+
auto_repair = bool
69+
auto_upgrade = bool
6870
})
6971
default = {
7072
enabled = false
@@ -74,6 +76,8 @@ variable "cluster_autoscaling" {
7476
max_memory_gb = 0
7577
min_memory_gb = 0
7678
gpu_resources = []
79+
auto_repair = true
80+
auto_upgrade = true
7781
}
7882
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
7983
}

‎examples/simple_zonal_with_acm/README.md

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Simple Zonal Cluster
22

3-
This example illustrates how to create a simple cluster and install [Anthos Config Management](https://cloud.google.com/anthos-config-management/docs/).
3+
This example illustrates how to create a simple cluster and install [Anthos Config Management](https://cloud.google.com/anthos-config-management/docs/)'s [Config Sync](https://cloud.google.com/anthos-config-management/docs/config-sync-overview) and [Policy Controller](https://cloud.google.com/anthos-config-management/docs/concepts/policy-controller) with the [Policy Essentials v2022 policy bundle](https://cloud.google.com/anthos-config-management/docs/how-to/using-policy-essentials-v2022).
44

55
It incorporates the standard cluster module and the [ACM install module](../../modules/acm).
66

@@ -27,13 +27,19 @@ After applying the Terraform configuration, you can run the following commands t
2727
kubectl describe ns shipping-dev
2828
```
2929
30+
4. You can also use `kubectl` to view any policy violations on the cluster:
31+
32+
```
33+
kubectl get constraint -l policycontroller.gke.io/bundleName=policy-essentials-v2022 -o json | jq -cC '.items[]| [.metadata.name,.status.totalViolations]'
34+
```
35+
3036
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
3137
## Inputs
3238
3339
| Name | Description | Type | Default | Required |
3440
|------|-------------|------|---------|:--------:|
3541
| cluster\_name\_suffix | A suffix to append to the default cluster name | `string` | `""` | no |
36-
| project\_id | The project ID to host the cluster in | `any` | n/a | yes |
42+
| project\_id | The project ID to host the cluster in | `string` | n/a | yes |
3743
| region | The region to host the cluster in | `string` | `"us-central1"` | no |
3844
| zone | The zone to host the cluster in | `string` | `"us-central1-a"` | no |
3945

‎examples/simple_zonal_with_acm/acm.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,8 @@ module "acm" {
2525
policy_dir = "foo-corp"
2626

2727
secret_type = "ssh"
28+
29+
policy_bundles = ["https://github.com/GoogleCloudPlatform/acm-policy-controller-library/bundles/policy-essentials-v2022#e4094aacb91a35b0219f6f4cf6a31580e85b3c28"]
30+
31+
create_metrics_gcp_sa = true
2832
}

‎examples/simple_zonal_with_acm/variables.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,18 @@
1616

1717
variable "project_id" {
1818
description = "The project ID to host the cluster in"
19+
type = string
1920
}
2021

2122
variable "cluster_name_suffix" {
2223
description = "A suffix to append to the default cluster name"
24+
type = string
2325
default = ""
2426
}
2527

2628
variable "region" {
2729
description = "The region to host the cluster in"
30+
type = string
2831
default = "us-central1"
2932
}
3033

‎examples/simple_zonal_with_acm/versions.tf

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,12 @@ terraform {
2121
version = "~> 4.0"
2222
}
2323
kubernetes = {
24-
source = "hashicorp/kubernetes"
24+
source = "hashicorp/kubernetes"
25+
version = "~> 2.10"
26+
}
27+
random = {
28+
source = "hashicorp/random"
29+
version = ">= 2.1"
2530
}
2631
}
2732
required_version = ">= 0.13"

‎modules/acm/README.md

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@
33
This module installs [Anthos Config Management](https://cloud.google.com/anthos-config-management/docs/) (ACM) in a Kubernetes cluster.
44

55
Specifically, this module automates the following steps for [installing ACM](https://cloud.google.com/anthos-config-management/docs/how-to/installing):
6-
1. Enabling the ACM feature on the fleet.
6+
1. Enabling the ACM feature on the fleet
77
2. Registering the cluster to the fleet
88
3. Optionally, generating an SSH key for accessing Git and providing it to the Operator
99
4. Configuring the ACM feature on your cluster
10+
5. Optionally, installing ACM Policy Controller [Policy Bundle(s)](https://cloud.google.com/anthos-config-management/docs/concepts/policy-controller-bundles)
11+
6. Optionally, create and configure a Google Cloud Service Account for writing ACM metrics to Cloud Monitoring
1012

1113
## Fleet feature
1214
Only the first cluster in a fleet should activate the ACM fleet feature.
@@ -35,6 +37,11 @@ module "acm" {
3537
sync_repo = "[email protected]:GoogleCloudPlatform/anthos-config-management-samples.git"
3638
sync_branch = "1.0.0"
3739
policy_dir = "foo-corp"
40+
41+
# ACM Policy Controller Policy Essentials Policy Bundle: https://cloud.google.com/anthos-config-management/docs/how-to/using-policy-essentials-v2022
42+
policy_bundles = ["https://github.com/GoogleCloudPlatform/acm-policy-controller-library/bundles/policy-essentials-v2022#e4094aacb91a35b0219f6f4cf6a31580e85b3c28"]
43+
44+
create_metrics_gcp_sa = true
3845
}
3946
```
4047

@@ -67,7 +74,9 @@ data "google_client_config" "default" {}
6774
| cluster\_membership\_id | The cluster membership ID. If unset, one will be autogenerated. | `string` | `""` | no |
6875
| cluster\_name | GCP cluster Name used to reach cluster and which becomes the cluster name in the Config Sync kubernetes custom resource. | `string` | n/a | yes |
6976
| configmanagement\_version | Version of ACM. | `string` | `""` | no |
77+
| create\_metrics\_gcp\_sa | Create a Google service account for ACM metrics writing | `bool` | `false` | no |
7078
| create\_ssh\_key | Controls whether a key will be generated for Git authentication | `bool` | `true` | no |
79+
| enable\_config\_sync | Whether to enable the ACM Config Sync on the cluster | `bool` | `true` | no |
7180
| enable\_fleet\_feature | Whether to enable the ACM feature on the fleet. | `bool` | `true` | no |
7281
| enable\_fleet\_registration | Whether to create a new membership. | `bool` | `true` | no |
7382
| enable\_log\_denies | Whether to enable logging of all denies and dryrun failures for ACM Policy Controller. | `bool` | `false` | no |
@@ -77,19 +86,22 @@ data "google_client_config" "default" {}
7786
| https\_proxy | URL for the HTTPS proxy to be used when communicating with the Git repo. | `string` | `null` | no |
7887
| install\_template\_library | Whether to install the default Policy Controller template library | `bool` | `true` | no |
7988
| location | GCP location used to reach cluster. | `string` | n/a | yes |
89+
| metrics\_gcp\_sa\_name | The name of the Google service account for ACM metrics writing | `string` | `"acm-metrics-writer"` | no |
90+
| policy\_bundles | A list of Policy Controller policy bundles git urls (example: https://github.com/GoogleCloudPlatform/acm-policy-controller-library.git/bundles/policy-essentials-v2022) to install on the cluster. | `list(string)` | `[]` | no |
8091
| policy\_dir | Subfolder containing configs in ACM Git repo. If un-set, uses Config Management default. | `string` | `""` | no |
8192
| project\_id | GCP project\_id used to reach cluster. | `string` | n/a | yes |
8293
| secret\_type | git authentication secret type, is passed through to ConfigManagement spec.git.secretType. Overriden to value 'ssh' if `create_ssh_key` is true | `string` | `"ssh"` | no |
8394
| source\_format | Configures a non-hierarchical repo if set to 'unstructured'. Uses [ACM defaults](https://cloud.google.com/anthos-config-management/docs/how-to/installing#configuring-config-management-operator) when unset. | `string` | `""` | no |
8495
| ssh\_auth\_key | Key for Git authentication. Overrides 'create\_ssh\_key' variable. Can be set using 'file(path/to/file)'-function. | `string` | `null` | no |
8596
| sync\_branch | ACM repo Git branch. If un-set, uses Config Management default. | `string` | `""` | no |
86-
| sync\_repo | ACM Git repo address | `string` | n/a | yes |
97+
| sync\_repo | ACM Git repo address | `string` | `""` | no |
8798
| sync\_revision | ACM repo Git revision. If un-set, uses Config Management default. | `string` | `""` | no |
8899

89100
## Outputs
90101

91102
| Name | Description |
92103
|------|-------------|
104+
| acm\_metrics\_writer\_sa | The ACM metrics writer Service Account |
93105
| configmanagement\_version | Version of ACM installed. |
94106
| git\_creds\_public | Public key of SSH keypair to allow the Anthos Config Management Operator to authenticate to your Git repository. |
95107
| wait | An output to use when you want to depend on cmd finishing |

0 commit comments

Comments
 (0)