Skip to content

Commit 922719a

Browse files
ericyzericyz
committed
Merge branch 'loggingvariant' of https://github.com/billyfoss/terraform-google-kubernetes-engine into loggingvariant
2 parents 442d96e + b823eb5 commit 922719a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

62 files changed

+303
-10
lines changed

‎.github/renovate.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
":rebaseStalePrs"
88
],
99
"minimumReleaseAge": "7 days",
10-
"ignorePaths": [],
10+
"ignorePaths": [".github/workflows/lint.yaml", ".github/workflows/stale.yml"],
1111
"labels": ["dependencies"],
1212
"vulnerabilityAlerts": {
1313
"labels": ["type:security"],
@@ -17,11 +17,11 @@
1717
"packageRules": [
1818
{
1919
"matchFileNames": ["examples/**", "test/**", ".github/**"],
20-
"extends": [":semanticCommitTypeAll(chore)"]
20+
"commitMessagePrefix": "chore(deps):"
2121
},
2222
{
2323
"matchFileNames": ["*", "modules/**"],
24-
"extends": [":semanticCommitTypeAll(fix)"]
24+
"commitMessagePrefix": "fix(deps):"
2525
},
2626
{
2727
"matchFileNames": ["*", "modules/**"],
@@ -41,7 +41,7 @@
4141
"postUpdateOptions": ["gomodTidy"]
4242
},
4343
{
44-
"matchPackageNames": ["google", "google-beta"],
44+
"matchDepNames": ["google", "google-beta"],
4545
"groupName": "Terraform Google Provider"
4646
}
4747
],

‎.github/workflows/lint.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
name: 'lint'
3232
runs-on: 'ubuntu-latest'
3333
steps:
34-
- uses: 'actions/checkout@v3'
34+
- uses: 'actions/checkout@v4'
3535
- id: variables
3636
run: |
3737
MAKEFILE=$(find . -name Makefile -print -quit)

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Then perform the following commands on the root folder:
155155
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
156156
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
157157
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
158+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
158159
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
159160
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
160161
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no |
@@ -238,6 +239,7 @@ Then perform the following commands on the root folder:
238239
| logging\_service | Logging service used |
239240
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
240241
| master\_version | Current master kubernetes version |
242+
| mesh\_certificates\_config | Mesh certificates configuration |
241243
| min\_master\_version | Minimum master kubernetes version |
242244
| monitoring\_service | Monitoring service used |
243245
| name | Cluster name |

‎autogen/main/cluster.tf.tmpl

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -519,6 +519,16 @@ resource "google_container_cluster" "primary" {
519519
}
520520
{% endif %}
521521

522+
{% if autopilot_cluster != true %}
523+
dynamic "mesh_certificates" {
524+
for_each = local.cluster_mesh_certificates_config
525+
526+
content {
527+
enable_certificates = mesh_certificates.value.enable_certificates
528+
}
529+
}
530+
{% endif %}
531+
522532
dynamic "authenticator_groups_config" {
523533
for_each = local.cluster_authenticator_security_group
524534
content {

‎autogen/main/main.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,12 @@ locals {
219219
cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
220220
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
221221
}]
222+
{% if autopilot_cluster != true %}
223+
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
224+
enable_certificates = var.enable_mesh_certificates
225+
}] : []
226+
{% endif %}
227+
222228
{% if beta_cluster %}
223229
# BETA features
224230
cluster_istio_enabled = ! local.cluster_output_istio_disabled

‎autogen/main/outputs.tf.tmpl

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,17 @@ output "identity_namespace" {
170170
google_container_cluster.primary
171171
]
172172
}
173+
174+
{% if autopilot_cluster != true %}
175+
output "mesh_certificates_config" {
176+
description = "Mesh certificates configuration"
177+
value = local.cluster_mesh_certificates_config
178+
depends_on = [
179+
google_container_cluster.primary
180+
]
181+
}
182+
{% endif %}
183+
173184
{% if private_cluster %}
174185

175186
output "master_ipv4_cidr_block" {

‎autogen/main/variables.tf.tmpl

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,14 @@ variable "identity_namespace" {
466466
default = "enabled"
467467
}
468468

469+
{% if autopilot_cluster != true %}
470+
variable "enable_mesh_certificates" {
471+
type = bool
472+
default = false
473+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
474+
}
475+
{% endif %}
476+
469477
variable "release_channel" {
470478
type = string
471479
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -763,7 +771,6 @@ variable "enable_pod_security_policy" {
763771
default = false
764772
}
765773

766-
767774
variable "enable_l4_ilb_subsetting" {
768775
type = bool
769776
description = "Enable L4 ILB Subsetting on the cluster"

‎autogen/safer-cluster/main.tf.tmpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,9 @@ module "gke" {
185185
// We enable Workload Identity by default.
186186
identity_namespace = "${var.project_id}.svc.id.goog"
187187

188+
// Enabling mesh certificates requires Workload Identity
189+
enable_mesh_certificates = var.enable_mesh_certificates
190+
188191
authenticator_security_group = var.authenticator_security_group
189192

190193
enable_shielded_nodes = var.enable_shielded_nodes

‎autogen/safer-cluster/outputs.tf.tmpl

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,3 +122,8 @@ output "peering_name" {
122122
description = "The name of the peering between this cluster and the Google owned VPC."
123123
value = module.gke.peering_name
124124
}
125+
126+
output "enable_mesh_certificates" {
127+
description = "Mesh certificate configuration value"
128+
value = var.enable_mesh_certificates
129+
}

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -484,3 +484,9 @@ variable "timeouts" {
484484
error_message = "Only create, update, delete timeouts can be specified."
485485
}
486486
}
487+
488+
variable "enable_mesh_certificates" {
489+
type = bool
490+
default = false
491+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
492+
}

‎cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,6 +361,14 @@ resource "google_container_cluster" "primary" {
361361
}
362362
}
363363

364+
dynamic "mesh_certificates" {
365+
for_each = local.cluster_mesh_certificates_config
366+
367+
content {
368+
enable_certificates = mesh_certificates.value.enable_certificates
369+
}
370+
}
371+
364372
dynamic "authenticator_groups_config" {
365373
for_each = local.cluster_authenticator_security_group
366374
content {

‎main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,10 @@ locals {
162162
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
163163
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
164164
}]
165+
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
166+
enable_certificates = var.enable_mesh_certificates
167+
}] : []
168+
165169

166170
cluster_maintenance_window_is_recurring = var.maintenance_recurrence != "" && var.maintenance_end_time != "" ? [1] : []
167171
cluster_maintenance_window_is_daily = length(local.cluster_maintenance_window_is_recurring) > 0 ? [] : [1]

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,7 @@ resource "google_container_cluster" "primary" {
228228
}
229229

230230

231+
231232
dynamic "authenticator_groups_config" {
232233
for_each = local.cluster_authenticator_security_group
233234
content {

‎modules/beta-autopilot-private-cluster/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ locals {
121121
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
122122
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
123123
}]
124+
124125
# BETA features
125126
cluster_istio_enabled = !local.cluster_output_istio_disabled
126127
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-autopilot-private-cluster/outputs.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@ output "identity_namespace" {
142142
]
143143
}
144144

145+
146+
145147
output "master_ipv4_cidr_block" {
146148
description = "The IP range in CIDR notation used for the hosted master network"
147149
value = var.master_ipv4_cidr_block

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -299,6 +299,7 @@ variable "identity_namespace" {
299299
default = "enabled"
300300
}
301301

302+
302303
variable "release_channel" {
303304
type = string
304305
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,7 @@ resource "google_container_cluster" "primary" {
209209
}
210210

211211

212+
212213
dynamic "authenticator_groups_config" {
213214
for_each = local.cluster_authenticator_security_group
214215
content {

‎modules/beta-autopilot-public-cluster/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ locals {
120120
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
121121
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
122122
}]
123+
123124
# BETA features
124125
cluster_istio_enabled = !local.cluster_output_istio_disabled
125126
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-autopilot-public-cluster/outputs.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@ output "identity_namespace" {
142142
]
143143
}
144144

145+
146+
145147
output "cloudrun_enabled" {
146148
description = "Whether CloudRun enabled"
147149
value = false

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,7 @@ variable "identity_namespace" {
269269
default = "enabled"
270270
}
271271

272+
272273
variable "release_channel" {
273274
type = string
274275
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ Then perform the following commands on the root folder:
195195
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
196196
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
197197
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
198+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
198199
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
199200
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
200201
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
@@ -296,6 +297,7 @@ Then perform the following commands on the root folder:
296297
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
297298
| master\_ipv4\_cidr\_block | The IP range in CIDR notation used for the hosted master network |
298299
| master\_version | Current master kubernetes version |
300+
| mesh\_certificates\_config | Mesh certificates configuration |
299301
| min\_master\_version | Minimum master kubernetes version |
300302
| monitoring\_service | Monitoring service used |
301303
| name | Cluster name |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,14 @@ resource "google_container_cluster" "primary" {
445445
}
446446
}
447447

448+
dynamic "mesh_certificates" {
449+
for_each = local.cluster_mesh_certificates_config
450+
451+
content {
452+
enable_certificates = mesh_certificates.value.enable_certificates
453+
}
454+
}
455+
448456
dynamic "authenticator_groups_config" {
449457
for_each = local.cluster_authenticator_security_group
450458
content {

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,10 @@ locals {
181181
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
182182
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
183183
}]
184+
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
185+
enable_certificates = var.enable_mesh_certificates
186+
}] : []
187+
184188
# BETA features
185189
cluster_istio_enabled = !local.cluster_output_istio_disabled
186190
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-private-cluster-update-variant/outputs.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,15 @@ output "identity_namespace" {
161161
]
162162
}
163163

164+
output "mesh_certificates_config" {
165+
description = "Mesh certificates configuration"
166+
value = local.cluster_mesh_certificates_config
167+
depends_on = [
168+
google_container_cluster.primary
169+
]
170+
}
171+
172+
164173
output "master_ipv4_cidr_block" {
165174
description = "The IP range in CIDR notation used for the hosted master network"
166175
value = var.master_ipv4_cidr_block

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,12 @@ variable "identity_namespace" {
439439
default = "enabled"
440440
}
441441

442+
variable "enable_mesh_certificates" {
443+
type = bool
444+
default = false
445+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
446+
}
447+
442448
variable "release_channel" {
443449
type = string
444450
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -722,7 +728,6 @@ variable "enable_pod_security_policy" {
722728
default = false
723729
}
724730

725-
726731
variable "enable_l4_ilb_subsetting" {
727732
type = bool
728733
description = "Enable L4 ILB Subsetting on the cluster"

‎modules/beta-private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ Then perform the following commands on the root folder:
173173
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
174174
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
175175
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
176+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
176177
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
177178
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
178179
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
@@ -274,6 +275,7 @@ Then perform the following commands on the root folder:
274275
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
275276
| master\_ipv4\_cidr\_block | The IP range in CIDR notation used for the hosted master network |
276277
| master\_version | Current master kubernetes version |
278+
| mesh\_certificates\_config | Mesh certificates configuration |
277279
| min\_master\_version | Minimum master kubernetes version |
278280
| monitoring\_service | Monitoring service used |
279281
| name | Cluster name |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,14 @@ resource "google_container_cluster" "primary" {
445445
}
446446
}
447447

448+
dynamic "mesh_certificates" {
449+
for_each = local.cluster_mesh_certificates_config
450+
451+
content {
452+
enable_certificates = mesh_certificates.value.enable_certificates
453+
}
454+
}
455+
448456
dynamic "authenticator_groups_config" {
449457
for_each = local.cluster_authenticator_security_group
450458
content {

‎modules/beta-private-cluster/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,10 @@ locals {
181181
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
182182
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
183183
}]
184+
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
185+
enable_certificates = var.enable_mesh_certificates
186+
}] : []
187+
184188
# BETA features
185189
cluster_istio_enabled = !local.cluster_output_istio_disabled
186190
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-private-cluster/outputs.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,15 @@ output "identity_namespace" {
161161
]
162162
}
163163

164+
output "mesh_certificates_config" {
165+
description = "Mesh certificates configuration"
166+
value = local.cluster_mesh_certificates_config
167+
depends_on = [
168+
google_container_cluster.primary
169+
]
170+
}
171+
172+
164173
output "master_ipv4_cidr_block" {
165174
description = "The IP range in CIDR notation used for the hosted master network"
166175
value = var.master_ipv4_cidr_block

0 commit comments

Comments
 (0)