Skip to content

Commit 28fab3d

Browse files
splichysplichy
committed
autogen
1 parent 1b5ebba commit 28fab3d

File tree

28 files changed

+383
-113
lines changed

28 files changed

+383
-113
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,7 @@ Then perform the following commands on the root folder:
196196
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
197197
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
198198
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
199+
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
199200
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
200201
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks `stub_domains` and `upstream_nameservers` variables functionality. | `bool` | `false` | no |
201202
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | `map(list(string))` | `{}` | no |

‎docs/private_clusters.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ module "gke" {
2828
add_shadow_firewall_rules = true
2929
shadow_firewall_rules_log_config = null # to save some $ on logs
3030
}
31-
```
31+
```
3232

3333
## Troubleshooting
3434

‎firewall.tf

Lines changed: 27 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -111,8 +111,11 @@ resource "google_compute_firewall" "shadow_allow_pods" {
111111
allow { protocol = "esp" }
112112
allow { protocol = "ah" }
113113

114-
log_config {
115-
metadata = "INCLUDE_ALL_METADATA"
114+
dynamic "log_config" {
115+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
116+
content {
117+
metadata = log_config.value.metadata
118+
}
116119
}
117120
}
118121

@@ -134,8 +137,11 @@ resource "google_compute_firewall" "shadow_allow_master" {
134137
ports = ["10250", "443"]
135138
}
136139

137-
log_config {
138-
metadata = "INCLUDE_ALL_METADATA"
140+
dynamic "log_config" {
141+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
142+
content {
143+
metadata = log_config.value.metadata
144+
}
139145
}
140146
}
141147

@@ -166,8 +172,11 @@ resource "google_compute_firewall" "shadow_allow_nodes" {
166172
ports = ["1-65535"]
167173
}
168174

169-
log_config {
170-
metadata = "INCLUDE_ALL_METADATA"
175+
dynamic "log_config" {
176+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
177+
content {
178+
metadata = log_config.value.metadata
179+
}
171180
}
172181
}
173182

@@ -178,7 +187,7 @@ resource "google_compute_firewall" "shadow_allow_inkubelet" {
178187
description = "Managed by terraform GKE module: A shadow firewall rule to match the default rule allowing worker nodes & pods communication to kubelet."
179188
project = local.network_project_id
180189
network = var.network
181-
priority = min(998, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 999
190+
priority = var.shadow_firewall_rules_priority - 1 # rule created by GKE robot have prio 999
182191
direction = "INGRESS"
183192

184193
source_ranges = local.pod_all_ip_ranges
@@ -190,8 +199,11 @@ resource "google_compute_firewall" "shadow_allow_inkubelet" {
190199
ports = ["10255"]
191200
}
192201

193-
log_config {
194-
metadata = "INCLUDE_ALL_METADATA"
202+
dynamic "log_config" {
203+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
204+
content {
205+
metadata = log_config.value.metadata
206+
}
195207
}
196208
}
197209

@@ -202,7 +214,7 @@ resource "google_compute_firewall" "shadow_deny_exkubelet" {
202214
description = "Managed by terraform GKE module: A shadow firewall rule to match the default deny rule to kubelet."
203215
project = local.network_project_id
204216
network = var.network
205-
priority = min(999, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 1000
217+
priority = var.shadow_firewall_rules_priority # rule created by GKE robot have prio 1000
206218
direction = "INGRESS"
207219

208220
source_ranges = ["0.0.0.0/0"]
@@ -213,7 +225,10 @@ resource "google_compute_firewall" "shadow_deny_exkubelet" {
213225
ports = ["10255"]
214226
}
215227

216-
log_config {
217-
metadata = "INCLUDE_ALL_METADATA"
228+
dynamic "log_config" {
229+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
230+
content {
231+
metadata = log_config.value.metadata
232+
}
218233
}
219234
}

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ Then perform the following commands on the root folder:
125125
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
126126
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
127127
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
128+
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
128129
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
129130
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks `stub_domains` and `upstream_nameservers` variables functionality. | `bool` | `false` | no |
130131
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | `map(list(string))` | `{}` | no |

‎modules/beta-autopilot-private-cluster/firewall.tf

Lines changed: 27 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -138,8 +138,11 @@ resource "google_compute_firewall" "shadow_allow_pods" {
138138
allow { protocol = "esp" }
139139
allow { protocol = "ah" }
140140

141-
log_config {
142-
metadata = "INCLUDE_ALL_METADATA"
141+
dynamic "log_config" {
142+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
143+
content {
144+
metadata = log_config.value.metadata
145+
}
143146
}
144147
}
145148

@@ -161,8 +164,11 @@ resource "google_compute_firewall" "shadow_allow_master" {
161164
ports = ["10250", "443"]
162165
}
163166

164-
log_config {
165-
metadata = "INCLUDE_ALL_METADATA"
167+
dynamic "log_config" {
168+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
169+
content {
170+
metadata = log_config.value.metadata
171+
}
166172
}
167173
}
168174

@@ -193,8 +199,11 @@ resource "google_compute_firewall" "shadow_allow_nodes" {
193199
ports = ["1-65535"]
194200
}
195201

196-
log_config {
197-
metadata = "INCLUDE_ALL_METADATA"
202+
dynamic "log_config" {
203+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
204+
content {
205+
metadata = log_config.value.metadata
206+
}
198207
}
199208
}
200209

@@ -205,7 +214,7 @@ resource "google_compute_firewall" "shadow_allow_inkubelet" {
205214
description = "Managed by terraform GKE module: A shadow firewall rule to match the default rule allowing worker nodes & pods communication to kubelet."
206215
project = local.network_project_id
207216
network = var.network
208-
priority = min(998, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 999
217+
priority = var.shadow_firewall_rules_priority - 1 # rule created by GKE robot have prio 999
209218
direction = "INGRESS"
210219

211220
source_ranges = local.pod_all_ip_ranges
@@ -217,8 +226,11 @@ resource "google_compute_firewall" "shadow_allow_inkubelet" {
217226
ports = ["10255"]
218227
}
219228

220-
log_config {
221-
metadata = "INCLUDE_ALL_METADATA"
229+
dynamic "log_config" {
230+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
231+
content {
232+
metadata = log_config.value.metadata
233+
}
222234
}
223235
}
224236

@@ -229,7 +241,7 @@ resource "google_compute_firewall" "shadow_deny_exkubelet" {
229241
description = "Managed by terraform GKE module: A shadow firewall rule to match the default deny rule to kubelet."
230242
project = local.network_project_id
231243
network = var.network
232-
priority = min(999, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 1000
244+
priority = var.shadow_firewall_rules_priority # rule created by GKE robot have prio 1000
233245
direction = "INGRESS"
234246

235247
source_ranges = ["0.0.0.0/0"]
@@ -240,7 +252,10 @@ resource "google_compute_firewall" "shadow_deny_exkubelet" {
240252
ports = ["10255"]
241253
}
242254

243-
log_config {
244-
metadata = "INCLUDE_ALL_METADATA"
255+
dynamic "log_config" {
256+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
257+
content {
258+
metadata = log_config.value.metadata
259+
}
245260
}
246261
}

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,20 @@ variable "shadow_firewall_rules_priority" {
357357
type = number
358358
description = "The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000."
359359
default = 999
360+
validation {
361+
condition = var.shadow_firewall_rules_priority < 1000
362+
error_message = "The shadow firewall rule priority must be lower than auto-created one(1000)."
363+
}
364+
}
365+
366+
variable "shadow_firewall_rules_log_config" {
367+
type = object({
368+
metadata = string
369+
})
370+
description = "The log_config for shadow firewall rules. You can set this variable to `null` to disable logging."
371+
default = {
372+
metadata = "INCLUDE_ALL_METADATA"
373+
}
360374
}
361375

362376
variable "enable_confidential_nodes" {

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,7 @@ Then perform the following commands on the root folder:
114114
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
115115
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
116116
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
117+
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
117118
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
118119
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks `stub_domains` and `upstream_nameservers` variables functionality. | `bool` | `false` | no |
119120
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | `map(list(string))` | `{}` | no |

‎modules/beta-autopilot-public-cluster/firewall.tf

Lines changed: 27 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -147,8 +147,11 @@ resource "google_compute_firewall" "shadow_allow_pods" {
147147
allow { protocol = "esp" }
148148
allow { protocol = "ah" }
149149

150-
log_config {
151-
metadata = "INCLUDE_ALL_METADATA"
150+
dynamic "log_config" {
151+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
152+
content {
153+
metadata = log_config.value.metadata
154+
}
152155
}
153156
}
154157

@@ -170,8 +173,11 @@ resource "google_compute_firewall" "shadow_allow_master" {
170173
ports = ["10250", "443"]
171174
}
172175

173-
log_config {
174-
metadata = "INCLUDE_ALL_METADATA"
176+
dynamic "log_config" {
177+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
178+
content {
179+
metadata = log_config.value.metadata
180+
}
175181
}
176182
}
177183

@@ -202,8 +208,11 @@ resource "google_compute_firewall" "shadow_allow_nodes" {
202208
ports = ["1-65535"]
203209
}
204210

205-
log_config {
206-
metadata = "INCLUDE_ALL_METADATA"
211+
dynamic "log_config" {
212+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
213+
content {
214+
metadata = log_config.value.metadata
215+
}
207216
}
208217
}
209218

@@ -214,7 +223,7 @@ resource "google_compute_firewall" "shadow_allow_inkubelet" {
214223
description = "Managed by terraform GKE module: A shadow firewall rule to match the default rule allowing worker nodes & pods communication to kubelet."
215224
project = local.network_project_id
216225
network = var.network
217-
priority = min(998, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 999
226+
priority = var.shadow_firewall_rules_priority - 1 # rule created by GKE robot have prio 999
218227
direction = "INGRESS"
219228

220229
source_ranges = local.pod_all_ip_ranges
@@ -226,8 +235,11 @@ resource "google_compute_firewall" "shadow_allow_inkubelet" {
226235
ports = ["10255"]
227236
}
228237

229-
log_config {
230-
metadata = "INCLUDE_ALL_METADATA"
238+
dynamic "log_config" {
239+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
240+
content {
241+
metadata = log_config.value.metadata
242+
}
231243
}
232244
}
233245

@@ -238,7 +250,7 @@ resource "google_compute_firewall" "shadow_deny_exkubelet" {
238250
description = "Managed by terraform GKE module: A shadow firewall rule to match the default deny rule to kubelet."
239251
project = local.network_project_id
240252
network = var.network
241-
priority = min(999, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 1000
253+
priority = var.shadow_firewall_rules_priority # rule created by GKE robot have prio 1000
242254
direction = "INGRESS"
243255

244256
source_ranges = ["0.0.0.0/0"]
@@ -249,7 +261,10 @@ resource "google_compute_firewall" "shadow_deny_exkubelet" {
249261
ports = ["10255"]
250262
}
251263

252-
log_config {
253-
metadata = "INCLUDE_ALL_METADATA"
264+
dynamic "log_config" {
265+
for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
266+
content {
267+
metadata = log_config.value.metadata
268+
}
254269
}
255270
}

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -327,6 +327,20 @@ variable "shadow_firewall_rules_priority" {
327327
type = number
328328
description = "The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000."
329329
default = 999
330+
validation {
331+
condition = var.shadow_firewall_rules_priority < 1000
332+
error_message = "The shadow firewall rule priority must be lower than auto-created one(1000)."
333+
}
334+
}
335+
336+
variable "shadow_firewall_rules_log_config" {
337+
type = object({
338+
metadata = string
339+
})
340+
description = "The log_config for shadow firewall rules. You can set this variable to `null` to disable logging."
341+
default = {
342+
metadata = "INCLUDE_ALL_METADATA"
343+
}
330344
}
331345

332346
variable "enable_confidential_nodes" {

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,7 @@ Then perform the following commands on the root folder:
254254
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
255255
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
256256
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
257+
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
257258
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
258259
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks `stub_domains` and `upstream_nameservers` variables functionality. | `bool` | `false` | no |
259260
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | `map(list(string))` | `{}` | no |
@@ -342,7 +343,7 @@ The node_pools variable takes the following parameters:
342343
| min_count | Minimum number of nodes in the NodePool. Must be >=0 and <= max_count. Should be used when autoscaling is true | 1 | Optional |
343344
| name | The name of the node pool | | Required |
344345
| placement_policy | Placement type to set for nodes in a node pool. Can be set as [COMPACT](https://cloud.google.com/kubernetes-engine/docs/how-to/compact-placement#overview) if desired | Optional |
345-
| pod_range | The ID of the secondary range for pod IPs. | | Optional |
346+
| pod_range | The name of the secondary range for pod IPs. | | Optional |
346347
| node_count | The number of nodes in the nodepool when autoscaling is false. Otherwise defaults to 1. Only valid for non-autoscaling clusters | | Required |
347348
| node_locations | The list of zones in which the cluster's nodes are located. Nodes must be in the region of their regional cluster or in the same region as their cluster's zone for zonal clusters. Defaults to cluster level node locations if nothing is specified | " " | Optional |
348349
| node_metadata | Options to expose the node metadata to the workload running on the node | | Optional |

0 commit comments

Comments
 (0)