Skip to content

Commit 6ff27f9

Browse files
bharathkkbbharathkkb
authored
feat: Add ASM install submodule (#538)
1 parent 796bd15 commit 6ff27f9

File tree

27 files changed

+1076
-3
lines changed

27 files changed

+1076
-3
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,7 @@ credentials.json
5050

5151
# File to populate env vars used by Docker test runs
5252
.envrc
53+
54+
# ignore generated ASM yamls in /workspace/test/fixtures/simple_regional_with_asm as it is a test
55+
# in a production scenario these files are expected to be checked in
56+
/test/fixtures/simple_regional_with_asm/asm-dir

‎.kitchen.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,3 +228,13 @@ suites:
228228
systems:
229229
- name: safer_cluster_iap_bastion
230230
backend: local
231+
- name: "simple_regional_with_asm"
232+
driver:
233+
root_module_directory: test/fixtures/simple_regional_with_asm
234+
verifier:
235+
systems:
236+
- name: simple_regional_with_asm
237+
backend: local
238+
controls:
239+
- gcloud
240+
- kubectl

‎build/int.cloudbuild.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -404,6 +404,26 @@ steps:
404404
- verify safer-cluster-iap-bastion-local
405405
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
406406
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy safer-cluster-iap-bastion-local']
407+
- id: create simple-regional-with-asm-local
408+
waitFor:
409+
- prepare
410+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
411+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create simple-regional-with-asm-local']
412+
- id: converge simple-regional-with-asm-local
413+
waitFor:
414+
- create simple-regional-with-asm-local
415+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
416+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge simple-regional-with-asm-local']
417+
- id: verify simple-regional-with-asm-local
418+
waitFor:
419+
- converge simple-regional-with-asm-local
420+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
421+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify simple-regional-with-asm-local']
422+
- id: destroy simple-regional-with-asm-local
423+
waitFor:
424+
- verify simple-regional-with-asm-local
425+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
426+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-regional-with-asm-local']
407427
tags:
408428
- 'ci'
409429
- 'integration'

‎build/lint.cloudbuild.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15+
timeout: 900s
1516
steps:
1617
- id: 'lint-tests'
1718
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'

‎examples/simple_regional_with_asm/README.md

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Simple Regional Cluster with ASM
2+
3+
This example illustrates how to create a simple regional cluster with ASM.
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|:----:|:-----:|:-----:|
10+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
11+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
12+
| ip\_range\_services | The secondary ip range to use for services | string | n/a | yes |
13+
| network | The VPC network to host the cluster in | string | n/a | yes |
14+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
15+
| region | The region to host the cluster in | string | n/a | yes |
16+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
17+
18+
## Outputs
19+
20+
| Name | Description |
21+
|------|-------------|
22+
| ca\_certificate | |
23+
| client\_token | |
24+
| cluster\_name | Cluster name |
25+
| identity\_namespace | |
26+
| ip\_range\_pods | The secondary IP range used for pods |
27+
| ip\_range\_services | The secondary IP range used for services |
28+
| kubernetes\_endpoint | |
29+
| location | |
30+
| master\_kubernetes\_version | The master Kubernetes version |
31+
| network | |
32+
| project\_id | |
33+
| region | |
34+
| service\_account | The default service account used for running nodes. |
35+
| subnetwork | |
36+
| zones | List of zones in which the cluster resides |
37+
38+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
39+
40+
To provision this example, run the following from within this directory:
41+
- `terraform init` to get the plugins
42+
- `terraform plan` to see the infrastructure plan
43+
- `terraform apply` to apply the infrastructure build
44+
- `terraform destroy` to destroy the built infrastructure

‎examples/simple_regional_with_asm/main.tf

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "simple-regional-asm2"
19+
}
20+
21+
provider "google-beta" {
22+
version = "~> 3.23.0"
23+
region = var.region
24+
}
25+
26+
data "google_project" "project" {
27+
project_id = var.project_id
28+
}
29+
30+
module "gke" {
31+
source = "../../modules/beta-public-cluster/"
32+
project_id = var.project_id
33+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
34+
regional = true
35+
release_channel = "REGULAR"
36+
region = var.region
37+
network = var.network
38+
subnetwork = var.subnetwork
39+
ip_range_pods = var.ip_range_pods
40+
ip_range_services = var.ip_range_services
41+
network_policy = false
42+
cluster_resource_labels = { "mesh_id" : "proj-${data.google_project.project.number}" }
43+
node_pools = [
44+
{
45+
name = "asm-node-pool"
46+
autoscaling = false
47+
# ASM requires minimum 4 nodes and e2-standard-4
48+
# As this is a regional cluster we have node_count * 3 = 6 nodes
49+
node_count = 2
50+
machine_type = "e2-standard-4"
51+
},
52+
]
53+
}
54+
55+
module "asm" {
56+
source = "../../modules/asm"
57+
cluster_name = module.gke.name
58+
cluster_endpoint = module.gke.endpoint
59+
project_id = var.project_id
60+
location = module.gke.location
61+
use_tf_google_credentials_env_var = true
62+
}
63+
64+
data "google_client_config" "default" {
65+
}

‎examples/simple_regional_with_asm/outputs.tf

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = module.gke.endpoint
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = base64encode(data.google_client_config.default.access_token)
25+
}
26+
27+
output "ca_certificate" {
28+
value = module.gke.ca_certificate
29+
}
30+
31+
output "service_account" {
32+
description = "The default service account used for running nodes."
33+
value = module.gke.service_account
34+
}

‎examples/simple_regional_with_asm/test_outputs.tf

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
// These outputs are used to test the module with kitchen-terraform
18+
// They do not need to be included in real-world uses of this module
19+
20+
output "project_id" {
21+
value = var.project_id
22+
}
23+
24+
output "region" {
25+
value = module.gke.region
26+
}
27+
28+
output "cluster_name" {
29+
description = "Cluster name"
30+
value = module.gke.name
31+
}
32+
33+
output "network" {
34+
value = var.network
35+
}
36+
37+
output "subnetwork" {
38+
value = var.subnetwork
39+
}
40+
41+
output "location" {
42+
value = module.gke.location
43+
}
44+
45+
output "ip_range_pods" {
46+
description = "The secondary IP range used for pods"
47+
value = var.ip_range_pods
48+
}
49+
50+
output "ip_range_services" {
51+
description = "The secondary IP range used for services"
52+
value = var.ip_range_services
53+
}
54+
55+
output "zones" {
56+
description = "List of zones in which the cluster resides"
57+
value = module.gke.zones
58+
}
59+
60+
output "master_kubernetes_version" {
61+
description = "The master Kubernetes version"
62+
value = module.gke.master_version
63+
}
64+
65+
output "identity_namespace" {
66+
value = module.gke.identity_namespace
67+
}

‎examples/simple_regional_with_asm/variables.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "cluster_name_suffix" {
22+
description = "A suffix to append to the default cluster name"
23+
default = ""
24+
}
25+
26+
variable "region" {
27+
description = "The region to host the cluster in"
28+
}
29+
30+
variable "network" {
31+
description = "The VPC network to host the cluster in"
32+
}
33+
34+
variable "subnetwork" {
35+
description = "The subnetwork to host the cluster in"
36+
}
37+
38+
variable "ip_range_pods" {
39+
description = "The secondary ip range to use for pods"
40+
}
41+
42+
variable "ip_range_services" {
43+
description = "The secondary ip range to use for services"
44+
}

‎examples/simple_regional_with_asm/versions.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 0.12"
19+
}

‎modules/asm/README.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Terraform Kubernetes Engine ASM Submodule
2+
3+
This module installs [Anthos Service Mesh](https://cloud.google.com/service-mesh/docs) (ASM) in a Kubernetes cluster.
4+
5+
Specifically, this module automates the following steps for [installing ASM](https://cloud.google.com/service-mesh/docs/install):
6+
7+
1. Installing the ASM Istio Operator on your cluster.
8+
2. Optionally registering your cluster with GKE Hub.
9+
10+
## Usage
11+
12+
There is a [full example](../../examples/simple_regional_with_asm) provided. Simple usage is as follows:
13+
14+
```tf
15+
module "asm" {
16+
source = "terraform-google-modules/kubernetes-engine/google//modules/asm"
17+
18+
project_id = "my-project-id"
19+
cluster_name = "my-cluster-name"
20+
location = module.gke.location
21+
cluster_endpoint = module.gke.endpoint
22+
}
23+
```
24+
25+
To deploy this config:
26+
1. Run `terraform apply`
27+
28+
## Requirements
29+
30+
- Anthos Service Mesh [requires](https://cloud.google.com/service-mesh/docs/gke-install-existing-cluster#requirements) an active Anthos license.
31+
- GKE cluster must have minimum four nodes.
32+
- Minimum machine type is `e2-standard-4`.
33+
- GKE cluster must be enrolled in a release channel. ASM does not support static version.
34+
- ASM on a private GKE cluster requires adding a firewall rule to open port 15017 if you want to use [automatic sidecar injection](https://cloud.google.com/service-mesh/docs/proxy-injection).
35+
- Only one ASM per Google Cloud project is supported.
36+
37+
38+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
39+
## Inputs
40+
41+
| Name | Description | Type | Default | Required |
42+
|------|-------------|:----:|:-----:|:-----:|
43+
| cluster\_endpoint | The GKE cluster endpoint. | string | n/a | yes |
44+
| cluster\_name | The unique name to identify the cluster in ASM. | string | n/a | yes |
45+
| enable\_gke\_hub\_registration | Enables GKE Hub Registration when set to true | bool | `"true"` | no |
46+
| gcloud\_sdk\_version | The gcloud sdk version to use. Minimum required version is 293.0.0 | string | `"296.0.1"` | no |
47+
| gke\_hub\_membership\_name | Memebership name that uniquely represents the cluster being registered on the Hub | string | `"gke-asm-membership"` | no |
48+
| gke\_hub\_sa\_name | Name for the GKE Hub SA stored as a secret `creds-gcp` in the `gke-connect` namespace. | string | `"gke-hub-sa"` | no |
49+
| location | The location (zone or region) this cluster has been created in. | string | n/a | yes |
50+
| project\_id | The project in which the resource belongs. | string | n/a | yes |
51+
| skip\_gcloud\_download | Whether to skip downloading gcloud (assumes gcloud and kubectl already available outside the module) | bool | `"true"` | no |
52+
| use\_tf\_google\_credentials\_env\_var | Optional GOOGLE_CREDENTIALS environment variable to be activated. | bool | `"false"` | no |
53+
54+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)