Skip to content

Commit 6042fd6

Browse files
kir4hkir4h
authored
feat: Promote authenticator_security_group to GA modules (#989)
1 parent 409ce48 commit 6042fd6

File tree

19 files changed

+77
-15
lines changed

19 files changed

+77
-15
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@ Then perform the following commands on the root folder:
127127
| add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no |
128128
| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no |
129129
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
130+
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
130131
| basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no |
131132
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | `string` | `""` | no |
132133
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> })</pre> | <pre>{<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -323,14 +323,14 @@ resource "google_container_cluster" "primary" {
323323
}
324324
}
325325

326-
{% if beta_cluster %}
327326
dynamic "authenticator_groups_config" {
328327
for_each = local.cluster_authenticator_security_group
329328
content {
330329
security_group = authenticator_groups_config.value.security_group
331330
}
332331
}
333332

333+
{% if beta_cluster %}
334334
notification_config {
335335
pubsub {
336336
enabled = var.notification_config_topic != "" ? true : false
@@ -480,7 +480,7 @@ resource "google_container_node_pool" "pools" {
480480
}
481481
}
482482
{% endif %}
483-
483+
484484
management {
485485
auto_repair = lookup(each.value, "auto_repair", true)
486486
auto_upgrade = lookup(each.value, "auto_upgrade", local.default_auto_upgrade)
@@ -539,7 +539,7 @@ resource "google_container_node_pool" "pools" {
539539

540540
{% if beta_cluster %}
541541
dynamic "ephemeral_storage_config" {
542-
for_each = lookup(each.value, "local_ssd_ephemeral_count",0) > 0 ? [each.value.local_ssd_ephemeral_count] : []
542+
for_each = lookup(each.value, "local_ssd_ephemeral_count",0) > 0 ? [each.value.local_ssd_ephemeral_count] : []
543543
content {
544544
local_ssd_count = ephemeral_storage_config.value
545545
}

‎autogen/main/main.tf.tmpl

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -105,13 +105,14 @@ locals {
105105

106106
cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
107107

108+
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
109+
110+
{% endif %}
111+
108112
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
109113
security_group = var.authenticator_security_group
110114
}]
111115

112-
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
113-
114-
{% endif %}
115116
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
116117
node_metadata = var.node_metadata
117118
}]

‎autogen/main/variables.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -524,13 +524,13 @@ variable "enable_intranode_visibility" {
524524
description = "Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network"
525525
default = false
526526
}
527+
{% endif %}
527528

528529
variable "authenticator_security_group" {
529530
type = string
530531
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
531532
default = null
532533
}
533-
{% endif %}
534534

535535
variable "node_metadata" {
536536
description = "Specifies how node metadata is exposed to the workload running on the node"

‎cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,13 @@ resource "google_container_cluster" "primary" {
186186
}
187187
}
188188

189+
dynamic "authenticator_groups_config" {
190+
for_each = local.cluster_authenticator_security_group
191+
content {
192+
security_group = authenticator_groups_config.value.security_group
193+
}
194+
}
195+
189196
}
190197

191198
/******************************************

‎main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,11 @@ locals {
8181
provider = null
8282
}]
8383

84+
85+
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
86+
security_group = var.authenticator_security_group
87+
}]
88+
8489
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
8590
node_metadata = var.node_metadata
8691
}]

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,12 +96,13 @@ locals {
9696

9797
cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
9898

99+
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
100+
101+
99102
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
100103
security_group = var.authenticator_security_group
101104
}]
102105

103-
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
104-
105106
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
106107
node_metadata = var.node_metadata
107108
}]

‎modules/beta-private-cluster/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,12 +96,13 @@ locals {
9696

9797
cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
9898

99+
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
100+
101+
99102
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
100103
security_group = var.authenticator_security_group
101104
}]
102105

103-
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
104-
105106
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
106107
node_metadata = var.node_metadata
107108
}]

‎modules/beta-public-cluster-update-variant/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,12 +96,13 @@ locals {
9696

9797
cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
9898

99+
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
100+
101+
99102
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
100103
security_group = var.authenticator_security_group
101104
}]
102105

103-
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
104-
105106
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
106107
node_metadata = var.node_metadata
107108
}]

‎modules/beta-public-cluster/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,12 +96,13 @@ locals {
9696

9797
cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
9898

99+
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
100+
101+
99102
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
100103
security_group = var.authenticator_security_group
101104
}]
102105

103-
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
104-
105106
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
106107
node_metadata = var.node_metadata
107108
}]

‎modules/private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Then perform the following commands on the root folder:
155155
| add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no |
156156
| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no |
157157
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
158+
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
158159
| basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no |
159160
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | `string` | `""` | no |
160161
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> })</pre> | <pre>{<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |

‎modules/private-cluster-update-variant/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,13 @@ resource "google_container_cluster" "primary" {
199199
}
200200
}
201201

202+
dynamic "authenticator_groups_config" {
203+
for_each = local.cluster_authenticator_security_group
204+
content {
205+
security_group = authenticator_groups_config.value.security_group
206+
}
207+
}
208+
202209
}
203210

204211
/******************************************

‎modules/private-cluster-update-variant/main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,11 @@ locals {
8181
provider = null
8282
}]
8383

84+
85+
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
86+
security_group = var.authenticator_security_group
87+
}]
88+
8489
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
8590
node_metadata = var.node_metadata
8691
}]

‎modules/private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,12 @@ variable "master_ipv4_cidr_block" {
388388
default = "10.0.0.0/28"
389389
}
390390

391+
variable "authenticator_security_group" {
392+
type = string
393+
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
394+
default = null
395+
}
396+
391397
variable "node_metadata" {
392398
description = "Specifies how node metadata is exposed to the workload running on the node"
393399
default = "GKE_METADATA_SERVER"

‎modules/private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,7 @@ Then perform the following commands on the root folder:
133133
| add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no |
134134
| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no |
135135
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
136+
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
136137
| basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no |
137138
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | `string` | `""` | no |
138139
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> })</pre> | <pre>{<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |

‎modules/private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,13 @@ resource "google_container_cluster" "primary" {
199199
}
200200
}
201201

202+
dynamic "authenticator_groups_config" {
203+
for_each = local.cluster_authenticator_security_group
204+
content {
205+
security_group = authenticator_groups_config.value.security_group
206+
}
207+
}
208+
202209
}
203210

204211
/******************************************

‎modules/private-cluster/main.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,11 @@ locals {
8181
provider = null
8282
}]
8383

84+
85+
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
86+
security_group = var.authenticator_security_group
87+
}]
88+
8489
cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
8590
node_metadata = var.node_metadata
8691
}]

‎modules/private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,12 @@ variable "master_ipv4_cidr_block" {
388388
default = "10.0.0.0/28"
389389
}
390390

391+
variable "authenticator_security_group" {
392+
type = string
393+
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
394+
default = null
395+
}
396+
391397
variable "node_metadata" {
392398
description = "Specifies how node metadata is exposed to the workload running on the node"
393399
default = "GKE_METADATA_SERVER"

‎variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -364,6 +364,12 @@ variable "default_max_pods_per_node" {
364364
default = 110
365365
}
366366

367+
variable "authenticator_security_group" {
368+
type = string
369+
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
370+
default = null
371+
}
372+
367373
variable "node_metadata" {
368374
description = "Specifies how node metadata is exposed to the workload running on the node"
369375
default = "GKE_METADATA_SERVER"

0 commit comments

Comments
 (0)