Skip to content

Commit a2b70dd

Browse files
NissesSenapNissesSenap
authored
Merge branch 'master' into 1527_traunc_fw
2 parents 470f742 + 2fe1715 commit a2b70dd

File tree

31 files changed

+360
-20
lines changed

31 files changed

+360
-20
lines changed

‎.github/renovate.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
"stabilityDays":0
1717
},
1818
"separateMajorMinor":false,
19+
"constraints": {
20+
"go": "1.18"
21+
},
1922
"packageRules": [
2023
{
2124
"matchPaths": ["examples/**", "test/**", ".github/**"],
@@ -35,7 +38,8 @@
3538
"postUpdateOptions": ["gomodTidy"]
3639
},
3740
{
38-
"matchPackageNames": ["go"],
41+
"matchDatasources": ["golang-version"],
42+
"rangeStrategy": "bump",
3943
"allowedVersions": "<1.19.0",
4044
"postUpdateOptions": ["gomodTidy"]
4145
},

‎.github/workflows/lint.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
- id: variables
3636
run: |
3737
MAKEFILE=$(find . -name Makefile -print -quit)
38-
if [ ! -z "$MAKEFILE" ]; then
38+
if [ -z "$MAKEFILE" ]; then
3939
echo dev-tools=gcr.io/cloud-foundation-cicd/cft/developer-tools:1 >> "$GITHUB_OUTPUT"
4040
else
4141
VERSION=$(grep "DOCKER_TAG_VERSION_DEVELOPER_TOOLS := " $MAKEFILE | cut -d\ -f3)

‎autogen/main/cluster.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ resource "google_container_cluster" "primary" {
8383
disabled = var.disable_default_snat
8484
}
8585

86-
min_master_version = var.release_channel == null || var.release_channel == "UNSPECIFIED" ? local.master_version : null
86+
min_master_version = var.release_channel == null || var.release_channel == "UNSPECIFIED" ? local.master_version : var.kubernetes_version == "latest" ? null : var.kubernetes_version
8787

8888
{% if beta_cluster and autopilot_cluster != true %}
8989
dynamic "cluster_telemetry" {

‎cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ resource "google_container_cluster" "primary" {
6969
disabled = var.disable_default_snat
7070
}
7171

72-
min_master_version = var.release_channel == null || var.release_channel == "UNSPECIFIED" ? local.master_version : null
72+
min_master_version = var.release_channel == null || var.release_channel == "UNSPECIFIED" ? local.master_version : var.kubernetes_version == "latest" ? null : var.kubernetes_version
7373

7474
# only one of logging/monitoring_service or logging/monitoring_config can be specified
7575
logging_service = local.logmon_config_is_set ? null : var.logging_service

‎examples/acm-terraform-blog-part1/terraform/gke.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ module "enabled_google_apis" {
3131

3232
module "gke" {
3333
source = "terraform-google-modules/kubernetes-engine/google"
34-
version = "~> 25.0"
34+
version = "~> 26.0"
3535
project_id = module.enabled_google_apis.project_id
3636
name = "sfl-acm-part1"
3737
region = var.region

‎examples/acm-terraform-blog-part2/terraform/gke.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ module "enabled_google_apis" {
3131

3232
module "gke" {
3333
source = "terraform-google-modules/kubernetes-engine/google"
34-
version = "~> 25.0"
34+
version = "~> 26.0"
3535
project_id = module.enabled_google_apis.project_id
3636
name = "sfl-acm-part2"
3737
region = var.region

‎examples/acm-terraform-blog-part3/terraform/gke.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ module "enabled_google_apis" {
3333

3434
module "gke" {
3535
source = "terraform-google-modules/kubernetes-engine/google//modules/beta-public-cluster"
36-
version = "~> 25.0"
36+
version = "~> 26.0"
3737
project_id = module.enabled_google_apis.project_id
3838
name = "sfl-acm-part3"
3939
region = var.region
@@ -48,7 +48,7 @@ module "gke" {
4848

4949
module "wi" {
5050
source = "terraform-google-modules/kubernetes-engine/google//modules/workload-identity"
51-
version = "~> 25.0"
51+
version = "~> 26.0"
5252
gcp_sa_name = "cnrmsa"
5353
cluster_name = module.gke.name
5454
name = "cnrm-controller-manager"

‎examples/safer_cluster_iap_bastion/network.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ module "vpc" {
4949

5050
module "cloud-nat" {
5151
source = "terraform-google-modules/cloud-nat/google"
52-
version = "~> 2.0"
52+
version = "~> 3.0"
5353
project_id = module.enabled_google_apis.project_id
5454
region = var.region
5555
router = "safer-router"

‎examples/simple_regional_private_with_cluster_version/README.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Simple Regional Cluster
2+
3+
This example illustrates how to create a simple private cluster with beta features.
4+
5+
[^]: (autogen_docs_start)
6+
7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|:----:|:-----:|:-----:|
11+
| cloudrun | Boolean to enable / disable CloudRun | string | `"true"` | no |
12+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
13+
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
14+
| credentials\_path | The path to the GCP credentials JSON file | string | n/a | yes |
15+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
16+
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
17+
| istio | Boolean to enable / disable Istio | string | `"true"` | no |
18+
| network | The VPC network to host the cluster in | string | n/a | yes |
19+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
20+
| region | The region to host the cluster in | string | n/a | yes |
21+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
22+
23+
## Outputs
24+
25+
| Name | Description |
26+
|------|-------------|
27+
| ca\_certificate | |
28+
| client\_token | |
29+
| cluster\_name | Cluster name |
30+
| credentials\_path | |
31+
| ip\_range\_pods | The secondary IP range used for pods |
32+
| ip\_range\_services | The secondary IP range used for services |
33+
| kubernetes\_endpoint | |
34+
| location | |
35+
| master\_kubernetes\_version | The master Kubernetes version |
36+
| network | |
37+
| project\_id | |
38+
| region | |
39+
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
40+
| subnetwork | |
41+
| zones | List of zones in which the cluster resides |
42+
43+
[^]: (autogen_docs_end)
44+
45+
To provision this example, run the following from within this directory:
46+
- `terraform init` to get the plugins
47+
- `terraform plan` to see the infrastructure plan
48+
- `terraform apply` to apply the infrastructure build
49+
- `terraform destroy` to destroy the built infrastructure

‎examples/simple_regional_private_with_cluster_version/main.tf

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "simple-regional-private"
19+
}
20+
21+
data "google_client_config" "default" {}
22+
23+
provider "kubernetes" {
24+
host = "https://${module.gke.endpoint}"
25+
token = data.google_client_config.default.access_token
26+
cluster_ca_certificate = base64decode(module.gke.ca_certificate)
27+
}
28+
29+
data "google_compute_subnetwork" "subnetwork" {
30+
name = var.subnetwork
31+
project = var.project_id
32+
region = var.region
33+
}
34+
35+
module "gke" {
36+
source = "../../modules/private-cluster/"
37+
project_id = var.project_id
38+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
39+
regional = true
40+
region = var.region
41+
network = var.network
42+
kubernetes_version = var.kubernetes_version
43+
subnetwork = var.subnetwork
44+
ip_range_pods = var.ip_range_pods
45+
ip_range_services = var.ip_range_services
46+
create_service_account = false
47+
service_account = var.compute_engine_service_account
48+
enable_private_endpoint = true
49+
enable_private_nodes = true
50+
master_ipv4_cidr_block = "172.16.0.0/28"
51+
default_max_pods_per_node = 20
52+
remove_default_node_pool = true
53+
54+
node_pools = [
55+
{
56+
name = "pool-01"
57+
min_count = 1
58+
max_count = 100
59+
local_ssd_count = 0
60+
disk_size_gb = 100
61+
disk_type = "pd-standard"
62+
auto_repair = true
63+
auto_upgrade = true
64+
service_account = var.compute_engine_service_account
65+
preemptible = false
66+
max_pods_per_node = 12
67+
},
68+
]
69+
70+
master_authorized_networks = [
71+
{
72+
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range
73+
display_name = "VPC"
74+
},
75+
]
76+
}

‎examples/simple_regional_private_with_cluster_version/outputs.tf

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = module.gke.endpoint
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = base64encode(data.google_client_config.default.access_token)
25+
}
26+
27+
output "ca_certificate" {
28+
value = module.gke.ca_certificate
29+
}
30+
31+
output "service_account" {
32+
description = "The default service account used for running nodes."
33+
value = module.gke.service_account
34+
}
35+

‎examples/simple_regional_private_with_cluster_version/test_outputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../test/fixtures/all_examples/test_outputs.tf

‎examples/simple_regional_private_with_cluster_version/variables.tf

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "cluster_name_suffix" {
22+
description = "A suffix to append to the default cluster name"
23+
default = ""
24+
}
25+
26+
variable "region" {
27+
description = "The region to host the cluster in"
28+
}
29+
30+
variable "network" {
31+
description = "The VPC network to host the cluster in"
32+
}
33+
34+
variable "subnetwork" {
35+
description = "The subnetwork to host the cluster in"
36+
}
37+
38+
variable "ip_range_pods" {
39+
description = "The secondary ip range to use for pods"
40+
}
41+
42+
variable "ip_range_services" {
43+
description = "The secondary ip range to use for services"
44+
}
45+
46+
variable "compute_engine_service_account" {
47+
description = "Service account to associate to the nodes in the cluster"
48+
}
49+
50+
variable "kubernetes_version" {
51+
type = string
52+
description = "The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region."
53+
default = "latest"
54+
}

‎examples/simple_regional_private_with_cluster_version/versions.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/**
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_providers {
19+
google = {
20+
source = "hashicorp/google"
21+
version = "~> 4.0"
22+
}
23+
kubernetes = {
24+
source = "hashicorp/kubernetes"
25+
}
26+
}
27+
required_version = ">= 0.13"
28+
}

‎examples/simple_zonal_with_acm/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ After applying the Terraform configuration, you can run the following commands t
3939
| Name | Description | Type | Default | Required |
4040
|------|-------------|------|---------|:--------:|
4141
| cluster\_name\_suffix | A suffix to append to the default cluster name | `string` | `""` | no |
42+
| enable\_fleet\_feature | Whether to enable the ACM feature on the fleet. | `bool` | `true` | no |
4243
| project\_id | The project ID to host the cluster in | `string` | n/a | yes |
4344
| region | The region to host the cluster in | `string` | `"us-central1"` | no |
4445
| zone | The zone to host the cluster in | `string` | `"us-central1-a"` | no |

‎examples/simple_zonal_with_acm/acm.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,11 @@ module "acm" {
2424
sync_branch = "1.0.0"
2525
policy_dir = "foo-corp"
2626

27+
enable_fleet_feature = var.enable_fleet_feature
28+
2729
secret_type = "ssh"
2830

29-
policy_bundles = ["https://github.com/GoogleCloudPlatform/acm-policy-controller-library/bundles/policy-essentials-v2022#e4094aacb91a35b0219f6f4cf6a31580e85b3c28"]
31+
policy_bundles = ["https://github.com/GoogleCloudPlatform/acm-policy-controller-library/bundles/policy-essentials-v2022?ref=59f4695394285078f7c2029ec7d0f9ed1d6d700a"]
3032

3133
create_metrics_gcp_sa = true
3234
}

‎examples/simple_zonal_with_acm/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,9 @@ variable "zone" {
3636
description = "The zone to host the cluster in"
3737
default = "us-central1-a"
3838
}
39+
40+
variable "enable_fleet_feature" {
41+
description = "Whether to enable the ACM feature on the fleet."
42+
type = bool
43+
default = true
44+
}

‎modules/acm/creds.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,12 @@ resource "tls_private_key" "k8sop_creds" {
3030
rsa_bits = 4096
3131
}
3232

33-
# Wait for the ACM operator to create the namespace
33+
# Wait for ACM
3434
resource "time_sleep" "wait_acm" {
3535
count = (var.create_ssh_key == true || var.ssh_auth_key != null || var.enable_policy_controller || var.enable_config_sync) ? 1 : 0
3636
depends_on = [google_gke_hub_feature_membership.main]
3737

38-
create_duration = "300s"
38+
create_duration = (length(var.policy_bundles) > 0) ? "600s" : "300s"
3939
}
4040

4141
resource "google_service_account_iam_binding" "ksa_iam" {

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ resource "google_container_cluster" "primary" {
6767
disabled = var.disable_default_snat
6868
}
6969

70-
min_master_version = var.release_channel == null || var.release_channel == "UNSPECIFIED" ? local.master_version : null
70+
min_master_version = var.release_channel == null || var.release_channel == "UNSPECIFIED" ? local.master_version : var.kubernetes_version == "latest" ? null : var.kubernetes_version
7171

7272
cluster_autoscaling {
7373
dynamic "auto_provisioning_defaults" {

0 commit comments

Comments
 (0)