Skip to content

Commit 76bb697

Browse files
morgantemorgante
authored
Merge pull request #188 from chrislovecnm/enable-features-in-public-clusters
Enabling two features in beta clusters
2 parents ce40193 + 48bfedf commit 76bb697

22 files changed

+78
-84
lines changed

‎autogen/cluster_regional.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,10 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
{% if private_cluster %}
45+
{% if beta_cluster %}
4646
enable_binary_authorization = "${var.enable_binary_authorization}"
4747
pod_security_policy_config = "${var.pod_security_policy_config}"
48-
{% endif %}
48+
{% endif %}
4949
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
5050

5151
master_auth {

‎autogen/cluster_zonal.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,11 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
{% if private_cluster %}
45+
{% if beta_cluster %}
4646
enable_binary_authorization = "${var.enable_binary_authorization}"
4747
pod_security_policy_config = "${var.pod_security_policy_config}"
48-
{% endif %}
48+
{% endif %}
49+
4950
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
5051

5152
master_auth {

‎autogen/main.tf

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,10 @@ locals {
140140
regional = "${element(concat(google_container_cluster.primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
141141
zonal = "${element(concat(google_container_cluster.zonal_primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
142142
}
143+
cluster_type_output_pod_security_policy_enabled = {
144+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
145+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
146+
}
143147
# /BETA features
144148
{% endif %}
145149

@@ -153,13 +157,6 @@ locals {
153157
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
154158
}
155159

156-
{% if private_cluster %}
157-
cluster_type_output_pod_security_policy_enabled = {
158-
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
159-
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
160-
}
161-
162-
{% endif %}
163160
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
164161
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
165162
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -184,10 +181,9 @@ locals {
184181
# BETA features
185182
cluster_istio_enabled = "${local.cluster_type_output_istio_enabled[local.cluster_type] ? false : true}"
186183
cluster_cloudrun_enabled = "${local.cluster_type_output_cloudrun_enabled[local.cluster_type] ? false : true}"
187-
# /BETA features
188-
{% endif %}
189-
{% if private_cluster %}
184+
190185
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
186+
# /BETA features
191187
{% endif %}
192188
}
193189

‎autogen/outputs.tf

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,6 @@ output "service_account" {
113113
value = "${local.service_account}"
114114
}
115115
{% if beta_cluster %}
116-
117116
output "istio_enabled" {
118117
description = "Whether Istio is enabled"
119118
value = "${local.cluster_istio_enabled}"
@@ -123,8 +122,6 @@ output "cloudrun_enabled" {
123122
description = "Whether CloudRun enabled"
124123
value = "${local.cluster_cloudrun_enabled}"
125124
}
126-
{% endif %}
127-
{% if private_cluster %}
128125

129126
output "pod_security_policy_enabled" {
130127
description = "Whether pod security policy is enabled"

‎autogen/variables.tf

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -86,21 +86,6 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89-
{% if private_cluster %}
90-
variable "enable_binary_authorization" {
91-
description = "Enable BinAuthZ Admission controller"
92-
default = false
93-
}
94-
95-
variable "pod_security_policy_config" {
96-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
97-
98-
default = [{
99-
"enabled" = false
100-
}]
101-
}
102-
103-
{% endif %}
10489
variable "horizontal_pod_autoscaling" {
10590
description = "Enable horizontal pod autoscaling addon"
10691
default = true
@@ -279,7 +264,6 @@ variable "master_ipv4_cidr_block" {
279264
}
280265
{% endif %}
281266
{% if beta_cluster %}
282-
283267
variable "istio" {
284268
description = "(Beta) Enable Istio addon"
285269
default = false
@@ -304,6 +288,18 @@ variable "database_encryption" {
304288
key_name = ""
305289
}]
306290
}
291+
292+
variable "enable_binary_authorization" {
293+
description = "Enable BinAuthZ Admission controller"
294+
default = false
295+
}
296+
297+
variable "pod_security_policy_config" {
298+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
299+
default = [{
300+
"enabled" = false
301+
}]
302+
}
307303
{% endif %}
308304

309305
variable "basic_auth_username" {

‎cluster_zonal.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45+
4546
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4647

4748
master_auth {

‎modules/beta-private-cluster/cluster_zonal.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ resource "google_container_cluster" "zonal_primary" {
4444

4545
enable_binary_authorization = "${var.enable_binary_authorization}"
4646
pod_security_policy_config = "${var.pod_security_policy_config}"
47+
4748
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4849

4950
master_auth {

‎modules/beta-private-cluster/main.tf

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,11 @@ locals {
133133
zonal = "${element(concat(google_container_cluster.zonal_primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
134134
}
135135

136+
cluster_type_output_pod_security_policy_enabled = {
137+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
138+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
139+
}
140+
136141
# /BETA features
137142

138143
cluster_type_output_node_pools_names = {
@@ -143,10 +148,6 @@ locals {
143148
regional = "${concat(google_container_node_pool.pools.*.version, list(""))}"
144149
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
145150
}
146-
cluster_type_output_pod_security_policy_enabled = {
147-
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
148-
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
149-
}
150151
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
151152
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
152153
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -170,8 +171,9 @@ locals {
170171
# BETA features
171172
cluster_istio_enabled = "${local.cluster_type_output_istio_enabled[local.cluster_type] ? false : true}"
172173
cluster_cloudrun_enabled = "${local.cluster_type_output_cloudrun_enabled[local.cluster_type] ? false : true}"
173-
# /BETA features
174174
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
175+
176+
# /BETA features
175177
}
176178

177179
/******************************************

‎modules/beta-private-cluster/outputs.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,6 @@ output "service_account" {
112112
description = "The service account to default running nodes as if not overridden in `node_pools`."
113113
value = "${local.service_account}"
114114
}
115-
116115
output "istio_enabled" {
117116
description = "Whether Istio is enabled"
118117
value = "${local.cluster_istio_enabled}"

‎modules/beta-private-cluster/variables.tf

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -86,19 +86,6 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89-
variable "enable_binary_authorization" {
90-
description = "Enable BinAuthZ Admission controller"
91-
default = false
92-
}
93-
94-
variable "pod_security_policy_config" {
95-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
96-
97-
default = [{
98-
"enabled" = false
99-
}]
100-
}
101-
10289
variable "horizontal_pod_autoscaling" {
10390
description = "Enable horizontal pod autoscaling addon"
10491
default = true
@@ -302,6 +289,19 @@ variable "database_encryption" {
302289
}]
303290
}
304291

292+
variable "enable_binary_authorization" {
293+
description = "Enable BinAuthZ Admission controller"
294+
default = false
295+
}
296+
297+
variable "pod_security_policy_config" {
298+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
299+
300+
default = [{
301+
"enabled" = false
302+
}]
303+
}
304+
305305
variable "basic_auth_username" {
306306
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
307307
default = ""

‎modules/beta-public-cluster/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
124124
| database\_encryption | Application-layer Secrets Encryption settings. Example: database_encryption = [{ state = "ENCRYPTED", key_name = "projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key" }] | list | `<list>` | no |
125125
| description | The description of the cluster | string | `""` | no |
126126
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
127+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
127128
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |
128129
| http\_load\_balancing | Enable httpload balancer addon | string | `"true"` | no |
129130
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | string | `"0"` | no |
@@ -152,6 +153,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
152153
| node\_pools\_taints | Map of lists containing node taints by node-pool name | map | `<map>` | no |
153154
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
154155
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list | `<list>` | no |
156+
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
155157
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
156158
| region | The region to host the cluster in (required) | string | n/a | yes |
157159
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | string | `"true"` | no |
@@ -182,6 +184,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
182184
| network\_policy\_enabled | Whether network policy enabled |
183185
| node\_pools\_names | List of node pools names |
184186
| node\_pools\_versions | List of node pools versions |
187+
| pod\_security\_policy\_enabled | Whether pod security policy is enabled |
185188
| region | Cluster region |
186189
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
187190
| type | Cluster type (regional / zonal) |

‎modules/beta-public-cluster/cluster_regional.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45+
enable_binary_authorization = "${var.enable_binary_authorization}"
46+
pod_security_policy_config = "${var.pod_security_policy_config}"
4547
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4648

4749
master_auth {

‎modules/beta-public-cluster/cluster_zonal.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45+
enable_binary_authorization = "${var.enable_binary_authorization}"
46+
pod_security_policy_config = "${var.pod_security_policy_config}"
47+
4548
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4649

4750
master_auth {

‎modules/beta-public-cluster/main.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,11 @@ locals {
124124
zonal = "${element(concat(google_container_cluster.zonal_primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
125125
}
126126

127+
cluster_type_output_pod_security_policy_enabled = {
128+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
129+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
130+
}
131+
127132
# /BETA features
128133

129134
cluster_type_output_node_pools_names = {
@@ -157,6 +162,7 @@ locals {
157162
# BETA features
158163
cluster_istio_enabled = "${local.cluster_type_output_istio_enabled[local.cluster_type] ? false : true}"
159164
cluster_cloudrun_enabled = "${local.cluster_type_output_cloudrun_enabled[local.cluster_type] ? false : true}"
165+
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
160166

161167
# /BETA features
162168
}

‎modules/beta-public-cluster/outputs.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,6 @@ output "service_account" {
112112
description = "The service account to default running nodes as if not overridden in `node_pools`."
113113
value = "${local.service_account}"
114114
}
115-
116115
output "istio_enabled" {
117116
description = "Whether Istio is enabled"
118117
value = "${local.cluster_istio_enabled}"
@@ -122,3 +121,8 @@ output "cloudrun_enabled" {
122121
description = "Whether CloudRun enabled"
123122
value = "${local.cluster_cloudrun_enabled}"
124123
}
124+
125+
output "pod_security_policy_enabled" {
126+
description = "Whether pod security policy is enabled"
127+
value = "${local.cluster_pod_security_policy_enabled}"
128+
}

‎modules/beta-public-cluster/variables.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,19 @@ variable "database_encryption" {
269269
}]
270270
}
271271

272+
variable "enable_binary_authorization" {
273+
description = "Enable BinAuthZ Admission controller"
274+
default = false
275+
}
276+
277+
variable "pod_security_policy_config" {
278+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
279+
280+
default = [{
281+
"enabled" = false
282+
}]
283+
}
284+
272285
variable "basic_auth_username" {
273286
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
274287
default = ""

‎modules/private-cluster/README.md

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,6 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
126126
| deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | string | `"false"` | no |
127127
| description | The description of the cluster | string | `""` | no |
128128
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
129-
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
130129
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | string | `"false"` | no |
131130
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | string | `"false"` | no |
132131
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |
@@ -157,7 +156,6 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
157156
| node\_pools\_taints | Map of lists containing node taints by node-pool name | map | `<map>` | no |
158157
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
159158
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list | `<list>` | no |
160-
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
161159
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
162160
| region | The region to host the cluster in (required) | string | n/a | yes |
163161
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | string | `"true"` | no |
@@ -186,7 +184,6 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
186184
| network\_policy\_enabled | Whether network policy enabled |
187185
| node\_pools\_names | List of node pools names |
188186
| node\_pools\_versions | List of node pools versions |
189-
| pod\_security\_policy\_enabled | Whether pod security policy is enabled |
190187
| region | Cluster region |
191188
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
192189
| type | Cluster type (regional / zonal) |

‎modules/private-cluster/cluster_regional.tf

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,6 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
enable_binary_authorization = "${var.enable_binary_authorization}"
46-
pod_security_policy_config = "${var.pod_security_policy_config}"
4745
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4846

4947
master_auth {

‎modules/private-cluster/cluster_zonal.tf

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,7 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
enable_binary_authorization = "${var.enable_binary_authorization}"
46-
pod_security_policy_config = "${var.pod_security_policy_config}"
45+
4746
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4847

4948
master_auth {

‎modules/private-cluster/main.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -132,11 +132,6 @@ locals {
132132
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
133133
}
134134

135-
cluster_type_output_pod_security_policy_enabled = {
136-
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
137-
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
138-
}
139-
140135
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
141136
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
142137
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -158,7 +153,6 @@ locals {
158153
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
159154
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
160155
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
161-
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
162156
}
163157

164158
/******************************************

0 commit comments

Comments
 (0)