Skip to content

Commit 6e2891b

Browse files
morgantemorgante
authored
Merge branch 'master' into fix/181
2 parents a3741fa + 3e57e64 commit 6e2891b

File tree

24 files changed

+274
-17
lines changed

24 files changed

+274
-17
lines changed

‎CHANGELOG.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,13 @@ Extending the adopted spec, each change should have a link to its corresponding
1414

1515
### Added
1616

17+
* Added support for resource usage export config [#238]
18+
* Added `sandbox_enabled` variable to use GKE Sandbox [#241]
19+
* Added `grant_registry_access` variable to grant Container Registry access to created SA [#236]
1720
* Support for Intranode Visbiility (IV) and Veritical Pod Autoscaling (VPA) beta features [#216]
1821
* Support for Workload Identity beta feature [#234]
22+
* Support for Google Groups based RBAC beta feature [#217]
23+
* Support for disabling node pool autoscaling by setting `autoscaling` to `false` within the node pool variable. [#250]
1924

2025
## [v4.1.0] 2019-07-24
2126

@@ -174,6 +179,11 @@ Extending the adopted spec, each change should have a link to its corresponding
174179
[v0.2.0]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/compare/v0.1.0...v0.2.0
175180

176181
[#228]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/228
182+
[#238]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/238
183+
[#241]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/241
184+
[#250]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/250
185+
[#236]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/236
186+
[#217]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/217
177187
[#234]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/234
178188
[#216]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/216
179189
[#214]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/214

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
137137
| create\_service\_account | Defines if service account specified to run nodes should be created. | bool | `"true"` | no |
138138
| description | The description of the cluster | string | `""` | no |
139139
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | bool | `"true"` | no |
140+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"false"` | no |
140141
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
141142
| http\_load\_balancing | Enable httpload balancer addon | bool | `"true"` | no |
142143
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | number | `"0"` | no |

‎autogen/cluster.tf

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,15 @@ resource "google_container_cluster" "primary" {
6767
}
6868
}
6969

70+
dynamic "resource_usage_export_config" {
71+
for_each = var.resource_usage_export_dataset_id != "" ? [var.resource_usage_export_dataset_id] : []
72+
content {
73+
enable_network_egress_metering = true
74+
bigquery_destination {
75+
dataset_id = resource_usage_export_config.value
76+
}
77+
}
78+
}
7079
{% endif %}
7180
dynamic "master_authorized_networks_config" {
7281
for_each = var.master_authorized_networks_config
@@ -158,6 +167,14 @@ resource "google_container_cluster" "primary" {
158167
node_metadata = workload_metadata_config.value.node_metadata
159168
}
160169
}
170+
171+
dynamic "sandbox_config" {
172+
for_each = local.cluster_sandbox_enabled
173+
174+
content {
175+
sandbox_type = sandbox_config.value
176+
}
177+
}
161178
{% endif %}
162179
}
163180
}
@@ -189,6 +206,13 @@ resource "google_container_cluster" "primary" {
189206
identity_namespace = workload_identity_config.value.identity_namespace
190207
}
191208
}
209+
210+
dynamic "authenticator_groups_config" {
211+
for_each = local.cluster_authenticator_security_group
212+
content {
213+
security_group = authenticator_groups_config.value.security_group
214+
}
215+
}
192216
{% endif %}
193217
}
194218

@@ -220,9 +244,14 @@ resource "google_container_node_pool" "pools" {
220244
max_pods_per_node = lookup(var.node_pools[count.index], "max_pods_per_node", null)
221245
{% endif %}
222246

223-
autoscaling {
224-
min_node_count = lookup(var.node_pools[count.index], "min_count", 1)
225-
max_node_count = lookup(var.node_pools[count.index], "max_count", 100)
247+
node_count = lookup(var.node_pools[count.index], "autoscaling", true) ? null : lookup(var.node_pools[count.index], "min_count", 1)
248+
249+
dynamic "autoscaling" {
250+
for_each = lookup(var.node_pools[count.index], "autoscaling", true) ? [var.node_pools[count.index]] : []
251+
content {
252+
min_node_count = lookup(autoscaling.value, "min_count", 1)
253+
max_node_count = lookup(autoscaling.value, "max_count", 100)
254+
}
226255
}
227256

228257
management {

‎autogen/main.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,12 @@ locals {
7171
node_metadata = var.node_metadata
7272
}]
7373

74+
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
75+
security_group = var.authenticator_security_group
76+
}]
77+
78+
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
79+
7480
{% endif %}
7581

7682
cluster_output_name = google_container_cluster.primary.name

‎autogen/sa.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,11 @@ resource "google_project_iam_member" "cluster_service_account-monitoring_viewer"
6161
role = "roles/monitoring.viewer"
6262
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6363
}
64+
65+
resource "google_project_iam_member" "cluster_service_account-gcr" {
66+
count = var.create_service_account && var.grant_registry_access ? 1 : 0
67+
project = var.project_id
68+
role = "roles/storage.objectViewer"
69+
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
70+
}
71+

‎autogen/variables.tf

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,12 @@ variable "create_service_account" {
263263
default = true
264264
}
265265

266+
variable "grant_registry_access" {
267+
type = bool
268+
description = "Grants created cluster-specific service account storage.objectViewer role."
269+
default = false
270+
}
271+
266272
variable "service_account" {
267273
type = string
268274
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
@@ -362,18 +368,30 @@ variable "pod_security_policy_config" {
362368
}]
363369
}
364370

371+
variable "resource_usage_export_dataset_id" {
372+
type = string
373+
description = "The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic."
374+
default = ""
375+
}
376+
365377
variable "node_metadata" {
366378
description = "Specifies how node metadata is exposed to the workload running on the node"
367379
default = "UNSPECIFIED"
368380
}
369381

382+
variable "sandbox_enabled" {
383+
type = bool
384+
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it)."
385+
default = false
386+
}
387+
370388
variable "enable_intranode_visibility" {
371389
type = bool
372390
description = "Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network"
373391
default = false
374392
}
375393

376-
variable "enable_vertical_pod_autoscaling" {
394+
variable "enable_vertical_pod_autoscaling" {
377395
type = bool
378396
description = "Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it"
379397
default = false
@@ -385,5 +403,10 @@ variable "identity_namespace" {
385403
default = ""
386404
}
387405

406+
variable "authenticator_security_group" {
407+
type = string
408+
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
409+
default = null
410+
}
388411

389412
{% endif %}

‎cluster.tf

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -142,9 +142,14 @@ resource "google_container_node_pool" "pools" {
142142
lookup(var.node_pools[count.index], "min_count", 1),
143143
)
144144

145-
autoscaling {
146-
min_node_count = lookup(var.node_pools[count.index], "min_count", 1)
147-
max_node_count = lookup(var.node_pools[count.index], "max_count", 100)
145+
node_count = lookup(var.node_pools[count.index], "autoscaling", true) ? null : lookup(var.node_pools[count.index], "min_count", 1)
146+
147+
dynamic "autoscaling" {
148+
for_each = lookup(var.node_pools[count.index], "autoscaling", true) ? [var.node_pools[count.index]] : []
149+
content {
150+
min_node_count = lookup(autoscaling.value, "min_count", 1)
151+
max_node_count = lookup(autoscaling.value, "max_count", 100)
152+
}
148153
}
149154

150155
management {

‎modules/beta-private-cluster/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
136136

137137
| Name | Description | Type | Default | Required |
138138
|------|-------------|:----:|:-----:|:-----:|
139+
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | string | `"null"` | no |
139140
| basic\_auth\_password | The password to be used with Basic Authentication. | string | `""` | no |
140141
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string | `""` | no |
141142
| cloudrun | (Beta) Enable CloudRun addon | string | `"false"` | no |
@@ -153,6 +154,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
153154
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | bool | `"false"` | no |
154155
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | bool | `"false"` | no |
155156
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
157+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"false"` | no |
156158
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
157159
| http\_load\_balancing | Enable httpload balancer addon | bool | `"true"` | no |
158160
| identity\_namespace | Workload Identity namespace | string | `""` | no |
@@ -189,6 +191,8 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
189191
| region | The region to host the cluster in (required) | string | n/a | yes |
190192
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
191193
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
194+
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | string | `""` | no |
195+
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
192196
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
193197
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
194198
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,15 @@ resource "google_container_cluster" "primary" {
6262
}
6363
}
6464

65+
dynamic "resource_usage_export_config" {
66+
for_each = var.resource_usage_export_dataset_id != "" ? [var.resource_usage_export_dataset_id] : []
67+
content {
68+
enable_network_egress_metering = true
69+
bigquery_destination {
70+
dataset_id = resource_usage_export_config.value
71+
}
72+
}
73+
}
6574
dynamic "master_authorized_networks_config" {
6675
for_each = var.master_authorized_networks_config
6776
content {
@@ -149,6 +158,14 @@ resource "google_container_cluster" "primary" {
149158
node_metadata = workload_metadata_config.value.node_metadata
150159
}
151160
}
161+
162+
dynamic "sandbox_config" {
163+
for_each = local.cluster_sandbox_enabled
164+
165+
content {
166+
sandbox_type = sandbox_config.value
167+
}
168+
}
152169
}
153170
}
154171

@@ -176,6 +193,13 @@ resource "google_container_cluster" "primary" {
176193
identity_namespace = workload_identity_config.value.identity_namespace
177194
}
178195
}
196+
197+
dynamic "authenticator_groups_config" {
198+
for_each = local.cluster_authenticator_security_group
199+
content {
200+
security_group = authenticator_groups_config.value.security_group
201+
}
202+
}
179203
}
180204

181205
/******************************************
@@ -200,9 +224,14 @@ resource "google_container_node_pool" "pools" {
200224
)
201225
max_pods_per_node = lookup(var.node_pools[count.index], "max_pods_per_node", null)
202226

203-
autoscaling {
204-
min_node_count = lookup(var.node_pools[count.index], "min_count", 1)
205-
max_node_count = lookup(var.node_pools[count.index], "max_count", 100)
227+
node_count = lookup(var.node_pools[count.index], "autoscaling", true) ? null : lookup(var.node_pools[count.index], "min_count", 1)
228+
229+
dynamic "autoscaling" {
230+
for_each = lookup(var.node_pools[count.index], "autoscaling", true) ? [var.node_pools[count.index]] : []
231+
content {
232+
min_node_count = lookup(autoscaling.value, "min_count", 1)
233+
max_node_count = lookup(autoscaling.value, "max_count", 100)
234+
}
206235
}
207236

208237
management {

‎modules/beta-private-cluster/main.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,12 @@ locals {
6666
node_metadata = var.node_metadata
6767
}]
6868

69+
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
70+
security_group = var.authenticator_security_group
71+
}]
72+
73+
cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
74+
6975

7076
cluster_output_name = google_container_cluster.primary.name
7177
cluster_output_location = google_container_cluster.primary.location

‎modules/beta-private-cluster/sa.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,11 @@ resource "google_project_iam_member" "cluster_service_account-monitoring_viewer"
6161
role = "roles/monitoring.viewer"
6262
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
6363
}
64+
65+
resource "google_project_iam_member" "cluster_service_account-gcr" {
66+
count = var.create_service_account && var.grant_registry_access ? 1 : 0
67+
project = var.project_id
68+
role = "roles/storage.objectViewer"
69+
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
70+
}
71+

‎modules/beta-private-cluster/variables.tf

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,12 @@ variable "create_service_account" {
261261
default = true
262262
}
263263

264+
variable "grant_registry_access" {
265+
type = bool
266+
description = "Grants created cluster-specific service account storage.objectViewer role."
267+
default = false
268+
}
269+
264270
variable "service_account" {
265271
type = string
266272
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
@@ -357,11 +363,23 @@ variable "pod_security_policy_config" {
357363
}]
358364
}
359365

366+
variable "resource_usage_export_dataset_id" {
367+
type = string
368+
description = "The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic."
369+
default = ""
370+
}
371+
360372
variable "node_metadata" {
361373
description = "Specifies how node metadata is exposed to the workload running on the node"
362374
default = "UNSPECIFIED"
363375
}
364376

377+
variable "sandbox_enabled" {
378+
type = bool
379+
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it)."
380+
default = false
381+
}
382+
365383
variable "enable_intranode_visibility" {
366384
type = bool
367385
description = "Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network"
@@ -380,4 +398,9 @@ variable "identity_namespace" {
380398
default = ""
381399
}
382400

401+
variable "authenticator_security_group" {
402+
type = string
403+
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
404+
default = null
405+
}
383406

‎modules/beta-public-cluster/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
131131

132132
| Name | Description | Type | Default | Required |
133133
|------|-------------|:----:|:-----:|:-----:|
134+
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | string | `"null"` | no |
134135
| basic\_auth\_password | The password to be used with Basic Authentication. | string | `""` | no |
135136
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string | `""` | no |
136137
| cloudrun | (Beta) Enable CloudRun addon | string | `"false"` | no |
@@ -145,6 +146,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
145146
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
146147
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | bool | `"false"` | no |
147148
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
149+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"false"` | no |
148150
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
149151
| http\_load\_balancing | Enable httpload balancer addon | bool | `"true"` | no |
150152
| identity\_namespace | Workload Identity namespace | string | `""` | no |
@@ -180,6 +182,8 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
180182
| region | The region to host the cluster in (required) | string | n/a | yes |
181183
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
182184
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
185+
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | string | `""` | no |
186+
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
183187
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
184188
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
185189
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |

0 commit comments

Comments
 (0)