Skip to content

Commit afd5591

Browse files
ericyzericyz
authored
Merge branch 'master' into fix/1586
2 parents c27c19d + c715a9c commit afd5591

File tree

49 files changed

+242
-98
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+242
-98
lines changed

‎.github/workflows/lint.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Copyright 2023 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'lint'
16+
17+
on:
18+
pull_request:
19+
branches:
20+
- master
21+
22+
concurrency:
23+
group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
24+
cancel-in-progress: true
25+
26+
jobs:
27+
lint:
28+
name: 'lint'
29+
runs-on: 'ubuntu-latest'
30+
steps:
31+
- uses: 'actions/checkout@v3'
32+
- id: variables
33+
run: |
34+
MAKEFILE=$(find . -name Makefile -print -quit)
35+
if [ ! -f $MAKEFILE ]; then
36+
echo dev-tools=gcr.io/cloud-foundation-cicd/cft/developer-tools:1 >> "$GITHUB_OUTPUT"
37+
else
38+
VERSION=$(grep "DOCKER_TAG_VERSION_DEVELOPER_TOOLS := " $MAKEFILE | cut -d\ -f3)
39+
IMAGE=$(grep "DOCKER_IMAGE_DEVELOPER_TOOLS := " $MAKEFILE | cut -d\ -f3)
40+
REGISTRY=$(grep "REGISTRY_URL := " $MAKEFILE | cut -d\ -f3)
41+
echo dev-tools=${REGISTRY}/${IMAGE}:${VERSION} >> "$GITHUB_OUTPUT"
42+
fi
43+
- run: docker run --rm -e EXCLUDE_LINT_DIRS -v ${{ github.workspace }}:/workspace ${{ steps.variables.outputs.dev-tools }} /usr/local/bin/test_lint.sh

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -200,10 +200,11 @@ Then perform the following commands on the root folder:
200200
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
201201
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
202202
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
203-
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
203+
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
204204
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
205205
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
206-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
206+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
207+
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
207208
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
208209
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
209210
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |

‎autogen/main/main.tf.tmpl

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -79,12 +79,8 @@ locals {
7979
cluster_type = var.regional ? "regional" : "zonal"
8080
{% if autopilot_cluster != true %}
8181
// auto upgrade by defaults only for regional cluster as long it has multiple masters versus zonal clusters have only have a single master so upgrades are more dangerous.
82-
{% if beta_cluster %}
83-
// When a release channel is used, node auto-upgrade are enabled and cannot be disabled.
84-
default_auto_upgrade = var.regional || var.release_channel != null ? true : false
85-
{% else %}
86-
default_auto_upgrade = var.regional ? true : false
87-
{% endif %}
82+
// When a release channel is used, node auto-upgrade is enabled and cannot be disabled.
83+
default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
8884
{% endif %}
8985

9086
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null

‎autogen/main/sa.tf.tmpl

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26+
service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
27+
2628
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
2729
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
2830

@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
3941
resource "google_service_account" "cluster_service_account" {
4042
count = var.create_service_account ? 1 : 0
4143
project = var.project_id
42-
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
44+
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4345
display_name = "Terraform-managed service account for cluster ${var.name}"
4446
}
4547

‎autogen/main/variables.tf.tmpl

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -379,7 +379,13 @@ variable "registry_project_ids" {
379379

380380
variable "service_account" {
381381
type = string
382-
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
382+
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
383+
default = ""
384+
}
385+
386+
variable "service_account_name" {
387+
type = string
388+
description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
383389
default = ""
384390
}
385391

@@ -458,8 +464,8 @@ variable "identity_namespace" {
458464

459465
variable "release_channel" {
460466
type = string
461-
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`."
462-
default = null
467+
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
468+
default = "REGULAR"
463469
}
464470

465471
variable "gateway_api_channel" {
@@ -732,7 +738,7 @@ variable "cloudrun_load_balancer_type" {
732738

733739
variable "enable_pod_security_policy" {
734740
type = bool
735-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
741+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0."
736742
default = false
737743
}
738744

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ variable "kubernetes_version" {
7373

7474
variable "release_channel" {
7575
type = string
76-
description = "(Beta) The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
76+
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
7777
default = "REGULAR"
7878
}
7979

‎docs/upgrading_to_v26.0.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Upgrading to v26.0
2+
The v26.0 release of *kubernetes-engine* is a backwards incompatible
3+
release.
4+
5+
### release_channel now defaults to REGULAR
6+
7+
For all clusters `release_channel` now defaults to `REGULAR`, this was already
8+
the default for safer_cluster variants.
9+
10+
To opt out of using a release channel, set `release_channel` to `"UNSPECIFIED"`.
11+
12+
```diff
13+
module "gke" {
14+
- source = "terraform-google-modules/kubernetes-engine"
15+
- version = "~> 25.0"
16+
+ source = "terraform-google-modules/kubernetes-engine"
17+
+ version = "~> 26.0"
18+
...
19+
+ release_channel = "UNSPECIFIED"
20+
}
21+
```

‎examples/deploy_service/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ resource "kubernetes_pod" "nginx-example" {
5252

5353
spec {
5454
container {
55-
image = "nginx:1.23.4"
55+
image = "nginx:1.24.0"
5656
name = "nginx-example"
5757
}
5858
}

‎main.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ locals {
7070
zone_count = length(var.zones)
7171
cluster_type = var.regional ? "regional" : "zonal"
7272
// auto upgrade by defaults only for regional cluster as long it has multiple masters versus zonal clusters have only have a single master so upgrades are more dangerous.
73-
default_auto_upgrade = var.regional ? true : false
73+
// When a release channel is used, node auto-upgrade is enabled and cannot be disabled.
74+
default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
7475

7576
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
7677
cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,10 @@ Then perform the following commands on the root folder:
118118
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
119119
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
120120
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
121-
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
121+
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
122122
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
123-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
123+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
124+
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
124125
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
125126
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
126127
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |

‎modules/beta-autopilot-private-cluster/sa.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26+
service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
27+
2628
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
2729
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
2830

@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
3941
resource "google_service_account" "cluster_service_account" {
4042
count = var.create_service_account ? 1 : 0
4143
project = var.project_id
42-
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
44+
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4345
display_name = "Terraform-managed service account for cluster ${var.name}"
4446
}
4547

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,13 @@ variable "registry_project_ids" {
222222

223223
variable "service_account" {
224224
type = string
225-
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
225+
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service_account_name variable."
226+
default = ""
227+
}
228+
229+
variable "service_account_name" {
230+
type = string
231+
description = "The name of the service account that will be created if create_service_account is true. If you wish to use an existing service account, use service_account variable."
226232
default = ""
227233
}
228234

@@ -295,8 +301,8 @@ variable "identity_namespace" {
295301

296302
variable "release_channel" {
297303
type = string
298-
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`."
299-
default = null
304+
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
305+
default = "REGULAR"
300306
}
301307

302308
variable "gateway_api_channel" {

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,10 @@ Then perform the following commands on the root folder:
107107
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
108108
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
109109
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
110-
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
110+
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
111111
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
112-
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
112+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
113+
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
113114
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
114115
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
115116
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |

‎modules/beta-autopilot-public-cluster/sa.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ locals {
2323
["dummy"],
2424
),
2525
)
26+
service_account_default_name = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
27+
2628
// if user set var.service_account it will be used even if var.create_service_account==true, so service account will be created but not used
2729
service_account = (var.service_account == "" || var.service_account == "create") && var.create_service_account ? local.service_account_list[0] : var.service_account
2830

@@ -39,7 +41,7 @@ resource "random_string" "cluster_service_account_suffix" {
3941
resource "google_service_account" "cluster_service_account" {
4042
count = var.create_service_account ? 1 : 0
4143
project = var.project_id
42-
account_id = "tf-gke-${substr(var.name, 0, min(15, length(var.name)))}-${random_string.cluster_service_account_suffix.result}"
44+
account_id = var.service_account_name == "" ? local.service_account_default_name : var.service_account_name
4345
display_name = "Terraform-managed service account for cluster ${var.name}"
4446
}
4547

0 commit comments

Comments
 (0)