Skip to content

Commit 430de9c

Browse files
bharathkkbbharathkkb
committed
wip asm module
add gke hub registration asm patch changes add binary checks, add tests fmt lint add readme default gcloud module to ADC, expose via var
1 parent 92c4ff2 commit 430de9c

File tree

26 files changed

+1073
-3
lines changed

26 files changed

+1073
-3
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,7 @@ credentials.json
5050

5151
# File to populate env vars used by Docker test runs
5252
.envrc
53+
54+
# ignore generated ASM yamls in /workspace/test/fixtures/simple_regional_with_asm as it is a test
55+
# in a production scenario these files are expected to be checked in
56+
/test/fixtures/simple_regional_with_asm/asm-dir

‎.kitchen.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,3 +228,13 @@ suites:
228228
systems:
229229
- name: safer_cluster_iap_bastion
230230
backend: local
231+
- name: "simple_regional_with_asm"
232+
driver:
233+
root_module_directory: test/fixtures/simple_regional_with_asm
234+
verifier:
235+
systems:
236+
- name: simple_regional_with_asm
237+
backend: local
238+
controls:
239+
- gcloud
240+
- kubectl

‎build/int.cloudbuild.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -404,6 +404,26 @@ steps:
404404
- verify safer-cluster-iap-bastion-local
405405
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
406406
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy safer-cluster-iap-bastion-local']
407+
- id: create simple-regional-with-asm-local
408+
waitFor:
409+
- prepare
410+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
411+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create simple-regional-with-asm-local']
412+
- id: converge simple-regional-with-asm-local
413+
waitFor:
414+
- create simple-regional-with-asm-local
415+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
416+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge simple-regional-with-asm-local']
417+
- id: verify simple-regional-with-asm-local
418+
waitFor:
419+
- converge simple-regional-with-asm-local
420+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
421+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify simple-regional-with-asm-local']
422+
- id: destroy simple-regional-with-asm-local
423+
waitFor:
424+
- verify simple-regional-with-asm-local
425+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
426+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-regional-with-asm-local']
407427
tags:
408428
- 'ci'
409429
- 'integration'

‎examples/simple_regional_with_asm/README.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Simple Regional Cluster with ASM
2+
3+
This example illustrates how to create a simple regional cluster with ASM.
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|:----:|:-----:|:-----:|
10+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
11+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
12+
| ip\_range\_services | The secondary ip range to use for services | string | n/a | yes |
13+
| network | The VPC network to host the cluster in | string | n/a | yes |
14+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
15+
| region | The region to host the cluster in | string | n/a | yes |
16+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
17+
18+
## Outputs
19+
20+
| Name | Description |
21+
|------|-------------|
22+
| ca\_certificate | |
23+
| client\_token | |
24+
| cluster\_name | Cluster name |
25+
| identity\_namespace | |
26+
| ip\_range\_pods | The secondary IP range used for pods |
27+
| ip\_range\_services | The secondary IP range used for services |
28+
| kubernetes\_endpoint | |
29+
| location | |
30+
| master\_kubernetes\_version | The master Kubernetes version |
31+
| network | |
32+
| project\_id | |
33+
| region | |
34+
| service\_account | The default service account used for running nodes. |
35+
| subnetwork | |
36+
| zones | List of zones in which the cluster resides |
37+
38+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
39+
40+
To provision this example, run the following from within this directory:
41+
- `terraform init` to get the plugins
42+
- `terraform plan` to see the infrastructure plan
43+
- `terraform apply` to apply the infrastructure build
44+
- `terraform destroy` to destroy the built infrastructure

‎examples/simple_regional_with_asm/main.tf

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "simple-regional-asm2"
19+
}
20+
21+
provider "google-beta" {
22+
version = "~> 3.19.0"
23+
region = var.region
24+
}
25+
26+
data "google_project" "project" {
27+
project_id = var.project_id
28+
}
29+
30+
module "gke" {
31+
source = "../../modules/beta-public-cluster/"
32+
project_id = var.project_id
33+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
34+
regional = true
35+
release_channel = "REGULAR"
36+
region = var.region
37+
network = var.network
38+
subnetwork = var.subnetwork
39+
ip_range_pods = var.ip_range_pods
40+
ip_range_services = var.ip_range_services
41+
network_policy = false
42+
cluster_resource_labels = { "mesh_id" : "proj-${data.google_project.project.number}" }
43+
node_pools = [
44+
{
45+
name = "asm-node-pool"
46+
autoscaling = false
47+
# ASM requires minimum 4 nodes and n1-standard-4
48+
# As this is a regional cluster we have node_count * 3 = 6 nodes
49+
node_count = 2
50+
machine_type = "n1-standard-4"
51+
},
52+
]
53+
}
54+
55+
module "asm" {
56+
source = "../../modules/asm"
57+
cluster_name = module.gke.name
58+
cluster_endpoint = module.gke.endpoint
59+
project_id = var.project_id
60+
location = module.gke.location
61+
}
62+
63+
data "google_client_config" "default" {
64+
}

‎examples/simple_regional_with_asm/outputs.tf

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = module.gke.endpoint
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = base64encode(data.google_client_config.default.access_token)
25+
}
26+
27+
output "ca_certificate" {
28+
value = module.gke.ca_certificate
29+
}
30+
31+
output "service_account" {
32+
description = "The default service account used for running nodes."
33+
value = module.gke.service_account
34+
}

‎examples/simple_regional_with_asm/test_outputs.tf

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
// These outputs are used to test the module with kitchen-terraform
18+
// They do not need to be included in real-world uses of this module
19+
20+
output "project_id" {
21+
value = var.project_id
22+
}
23+
24+
output "region" {
25+
value = module.gke.region
26+
}
27+
28+
output "cluster_name" {
29+
description = "Cluster name"
30+
value = module.gke.name
31+
}
32+
33+
output "network" {
34+
value = var.network
35+
}
36+
37+
output "subnetwork" {
38+
value = var.subnetwork
39+
}
40+
41+
output "location" {
42+
value = module.gke.location
43+
}
44+
45+
output "ip_range_pods" {
46+
description = "The secondary IP range used for pods"
47+
value = var.ip_range_pods
48+
}
49+
50+
output "ip_range_services" {
51+
description = "The secondary IP range used for services"
52+
value = var.ip_range_services
53+
}
54+
55+
output "zones" {
56+
description = "List of zones in which the cluster resides"
57+
value = module.gke.zones
58+
}
59+
60+
output "master_kubernetes_version" {
61+
description = "The master Kubernetes version"
62+
value = module.gke.master_version
63+
}
64+
65+
output "identity_namespace" {
66+
value = module.gke.identity_namespace
67+
}

‎examples/simple_regional_with_asm/variables.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "cluster_name_suffix" {
22+
description = "A suffix to append to the default cluster name"
23+
default = ""
24+
}
25+
26+
variable "region" {
27+
description = "The region to host the cluster in"
28+
}
29+
30+
variable "network" {
31+
description = "The VPC network to host the cluster in"
32+
}
33+
34+
variable "subnetwork" {
35+
description = "The subnetwork to host the cluster in"
36+
}
37+
38+
variable "ip_range_pods" {
39+
description = "The secondary ip range to use for pods"
40+
}
41+
42+
variable "ip_range_services" {
43+
description = "The secondary ip range to use for services"
44+
}

‎examples/simple_regional_with_asm/versions.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 0.12"
19+
}

‎modules/asm/README.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Terraform Kubernetes Engine ASM Submodule
2+
3+
This module installs [Anthos Service Mesh](https://cloud.google.com/service-mesh/docs) (ASM) in a Kubernetes cluster.
4+
5+
Specifically, this module automates the following steps for [installing ASM](https://cloud.google.com/service-mesh/docs/install):
6+
7+
1. Installing the ASM Istio Operator on your cluster.
8+
2. Optionally registering your cluster with GKE Hub.
9+
10+
## Usage
11+
12+
There is a [full example](../../examples/simple_regional_with_asm) provided. Simple usage is as follows:
13+
14+
```tf
15+
module "asm" {
16+
source = "terraform-google-modules/kubernetes-engine/google//modules/asm"
17+
18+
project_id = "my-project-id"
19+
cluster_name = "my-cluster-name"
20+
location = module.gke.location
21+
cluster_endpoint = module.gke.endpoint
22+
}
23+
```
24+
25+
To deploy this config:
26+
1. Run `terraform apply`
27+
28+
## Requirements
29+
30+
- Anthos Service Mesh [requires](https://cloud.google.com/service-mesh/docs/gke-install-existing-cluster#requirements) an active Anthos license.
31+
- GKE cluster must have minimum four nodes.
32+
- Minimum machine type is `e2-standard-4`.
33+
- GKE cluster must be enrolled in a release channel. ASM does not support static version.
34+
- ASM on a private GKE cluster requires adding a firewall rule to open port 15017 if you want to use [automatic sidecar injection](https://cloud.google.com/service-mesh/docs/proxy-injection).
35+
- Only one ASM per Google Cloud project is supported.
36+
37+
38+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
39+
## Inputs
40+
41+
| Name | Description | Type | Default | Required |
42+
|------|-------------|:----:|:-----:|:-----:|
43+
| cluster\_endpoint | The GKE cluster endpoint. | string | n/a | yes |
44+
| cluster\_name | The unique name to identify the cluster in ASM. | string | n/a | yes |
45+
| enable\_gke\_hub\_registration | Enables GKE Hub Registration when set to true | bool | `"true"` | no |
46+
| gcloud\_sdk\_version | The gcloud sdk version to use. Minimum required version is 293.0.0 | string | `"294.0.0"` | no |
47+
| gke\_hub\_membership\_name | Memebership name that uniquely represents the cluster being registered on the Hub | string | `"gke-asm-membership"` | no |
48+
| gke\_hub\_sa\_name | Name for the GKE Hub SA stored as a secret `creds-gcp` in the `gke-connect` namespace. | string | `"gke-hub-sa"` | no |
49+
| location | The location (zone or region) this cluster has been created in. | string | n/a | yes |
50+
| project\_id | The project in which the resource belongs. | string | n/a | yes |
51+
| skip\_gcloud\_download | Whether to skip downloading gcloud (assumes gcloud and kubectl already available outside the module) | bool | `"true"` | no |
52+
| use\_tf\_google\_credentials\_env\_var | Optional GOOGLE_CREDENTIALS environment variable to be activated. | bool | `"false"` | no |
53+
54+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)