Skip to content

Commit b08b0fc

Browse files
apeabodyapeabody
committed
fix: fixes for tflint and dev-tools 1.10
1 parent b23bc86 commit b08b0fc

File tree

80 files changed

+223
-386
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+223
-386
lines changed

‎Makefile

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@
1818
# Make will use bash instead of sh
1919
SHELL := /usr/bin/env bash
2020

21-
# Pin to 1.3.9 per https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/issues/1208
22-
DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.8
21+
DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.10
2322
DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
2423
REGISTRY_URL := gcr.io/cloud-foundation-cicd
2524
DOCKER_BIN ?= docker

‎README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,6 @@ Then perform the following commands on the root folder:
207207
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
208208
| shadow\_firewall\_rules\_log\_config | The log\_config for shadow firewall rules. You can set this variable to `null` to disable logging. | <pre>object({<br> metadata = string<br> })</pre> | <pre>{<br> "metadata": "INCLUDE_ALL_METADATA"<br>}</pre> | no |
209209
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
210-
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks `stub_domains` and `upstream_nameservers` variables functionality. | `bool` | `false` | no |
211210
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | `map(list(string))` | `{}` | no |
212211
| subnetwork | The subnetwork to host the cluster in (required) | `string` | n/a | yes |
213212
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -135,12 +135,12 @@ resource "google_container_cluster" "primary" {
135135
content {
136136
service_account = local.service_account
137137
oauth_scopes = local.node_pools_oauth_scopes["all"]
138-
138+
139139
management {
140140
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
141141
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade",true)
142142
}
143-
143+
144144
{% if beta_cluster %}
145145
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
146146
{% endif %}
@@ -309,7 +309,7 @@ resource "google_container_cluster" "primary" {
309309
{% endif %}
310310
}
311311
{% if autopilot_cluster != true %}
312-
312+
313313
datapath_provider = var.datapath_provider
314314
{% endif %}
315315

‎autogen/main/main.tf.tmpl

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ locals {
6868
resource_type = "memory"
6969
minimum = var.cluster_autoscaling.min_memory_gb
7070
maximum = var.cluster_autoscaling.max_memory_gb
71-
}], var.cluster_autoscaling.gpu_resources) : []
71+
}], var.cluster_autoscaling.gpu_resources) : []
7272
{% endif %}
7373

7474

@@ -77,12 +77,14 @@ locals {
7777
network_project_id = var.network_project_id != "" ? var.network_project_id : var.project_id
7878
zone_count = length(var.zones)
7979
cluster_type = var.regional ? "regional" : "zonal"
80+
{% if autopilot_cluster != true %}
8081
// auto upgrade by defaults only for regional cluster as long it has multiple masters versus zonal clusters have only have a single master so upgrades are more dangerous.
8182
{% if beta_cluster %}
8283
// When a release channel is used, node auto-upgrade are enabled and cannot be disabled.
8384
default_auto_upgrade = var.regional || var.release_channel != null ? true : false
8485
{% else %}
8586
default_auto_upgrade = var.regional ? true : false
87+
{% endif %}
8688
{% endif %}
8789

8890
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
@@ -133,14 +135,12 @@ locals {
133135
}]
134136
{% endif %}
135137

136-
cluster_output_name = google_container_cluster.primary.name
137138
cluster_output_regional_zones = google_container_cluster.primary.node_locations
138-
cluster_output_zonal_zones = local.zone_count > 1 ? slice(var.zones, 1, local.zone_count) : []
139139
cluster_output_zones = local.cluster_output_regional_zones
140140

141141
{% if private_cluster %}
142-
cluster_endpoint = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? (var.deploy_using_private_endpoint ? google_container_cluster.primary.private_cluster_config.0.private_endpoint : google_container_cluster.primary.private_cluster_config.0.public_endpoint) : google_container_cluster.primary.endpoint
143-
cluster_peering_name = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? google_container_cluster.primary.private_cluster_config.0.peering_name : null
142+
cluster_endpoint = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? (var.deploy_using_private_endpoint ? google_container_cluster.primary.private_cluster_config[0].private_endpoint : google_container_cluster.primary.private_cluster_config[0].public_endpoint) : google_container_cluster.primary.endpoint
143+
cluster_peering_name = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? google_container_cluster.primary.private_cluster_config[0].peering_name : null
144144
cluster_endpoint_for_nodes = var.master_ipv4_cidr_block
145145
{% else %}
146146
cluster_endpoint = google_container_cluster.primary.endpoint
@@ -152,17 +152,18 @@ locals {
152152
cluster_output_min_master_version = google_container_cluster.primary.min_master_version
153153
cluster_output_logging_service = google_container_cluster.primary.logging_service
154154
cluster_output_monitoring_service = google_container_cluster.primary.monitoring_service
155-
cluster_output_network_policy_enabled = google_container_cluster.primary.addons_config.0.network_policy_config.0.disabled
156-
cluster_output_http_load_balancing_enabled = google_container_cluster.primary.addons_config.0.http_load_balancing.0.disabled
157-
cluster_output_horizontal_pod_autoscaling_enabled = google_container_cluster.primary.addons_config.0.horizontal_pod_autoscaling.0.disabled
158-
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling.0.enabled : false
155+
{% if autopilot_cluster != true %}
156+
cluster_output_network_policy_enabled = google_container_cluster.primary.addons_config[0].network_policy_config[0].disabled
157+
{% endif %}
158+
cluster_output_http_load_balancing_enabled = google_container_cluster.primary.addons_config[0].http_load_balancing[0].disabled
159+
cluster_output_horizontal_pod_autoscaling_enabled = google_container_cluster.primary.addons_config[0].horizontal_pod_autoscaling[0].disabled
160+
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling[0].enabled : false
159161

160162
{% if beta_cluster %}
161163
# BETA features
162-
cluster_output_istio_disabled = google_container_cluster.primary.addons_config.0.istio_config != null && length(google_container_cluster.primary.addons_config.0.istio_config) == 1 ? google_container_cluster.primary.addons_config.0.istio_config.0.disabled : false
163-
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config.0.enabled : false
164+
cluster_output_istio_disabled = google_container_cluster.primary.addons_config[0].istio_config != null && length(google_container_cluster.primary.addons_config[0].istio_config) == 1 ? google_container_cluster.primary.addons_config[0].istio_config[0].disabled : false
165+
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config[0].enabled : false
164166
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
165-
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config.0.enabled : false
166167

167168
# /BETA features
168169
{% endif %}
@@ -176,11 +177,11 @@ locals {
176177
[for np in google_container_node_pool.pools : np.name], [""],
177178
[for np in google_container_node_pool.windows_pools : np.name], [""]
178179
)
179-
180+
180181
cluster_output_node_pools_versions = merge(
181182
{ for np in google_container_node_pool.pools : np.name => np.version },
182183
{ for np in google_container_node_pool.windows_pools : np.name => np.version },
183-
)
184+
)
184185
{% endif %}
185186

186187
cluster_master_auth_list_layer1 = local.cluster_output_master_auth
@@ -221,7 +222,9 @@ locals {
221222
# BETA features
222223
cluster_istio_enabled = ! local.cluster_output_istio_disabled
223224
cluster_dns_cache_enabled = var.dns_cache
225+
{% if autopilot_cluster != true %}
224226
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
227+
{% endif %}
225228
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
226229
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
227230
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []

‎autogen/main/variables.tf.tmpl

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -102,12 +102,14 @@ variable "service_external_ips" {
102102
default = false
103103
}
104104

105+
{% if autopilot_cluster != true %}
105106
variable "datapath_provider" {
106107
type = string
107108
description = "The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature."
108109
default = "DATAPATH_PROVIDER_UNSPECIFIED"
109110
}
110111

112+
{% endif %}
111113
variable "maintenance_start_time" {
112114
type = string
113115
description = "Time window specified for daily or recurring maintenance operations in RFC3339 format"
@@ -335,14 +337,15 @@ variable "configure_ip_masq" {
335337
default = false
336338
}
337339

338-
{% if beta_cluster %}
340+
{% if beta_cluster and autopilot_cluster != true%}
339341
variable "cluster_telemetry_type" {
340342
type = string
341343
description = "Available options include ENABLED, DISABLED, and SYSTEM_ONLY"
342344
default = null
343345
}
344346

345347
{% endif %}
348+
{% if autopilot_cluster != true%}
346349
variable "logging_service" {
347350
type = string
348351
description = "The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none"
@@ -355,6 +358,7 @@ variable "monitoring_service" {
355358
default = "monitoring.googleapis.com/kubernetes"
356359
}
357360

361+
{% endif %}
358362
variable "create_service_account" {
359363
type = bool
360364
description = "Defines if service account specified to run nodes should be created."
@@ -397,11 +401,6 @@ variable "cluster_resource_labels" {
397401
default = {}
398402
}
399403

400-
variable "skip_provisioners" {
401-
type = bool
402-
description = "Flag to skip all local-exec provisioners. It breaks `stub_domains` and `upstream_nameservers` variables functionality."
403-
default = false
404-
}
405404
{% if private_cluster %}
406405

407406
variable "deploy_using_private_endpoint" {
@@ -697,6 +696,7 @@ variable "enable_kubernetes_alpha" {
697696

698697
variable "istio" {
699698
description = "(Beta) Enable Istio addon"
699+
type = bool
700700
default = false
701701
}
702702

@@ -720,12 +720,14 @@ variable "config_connector" {
720720

721721
variable "cloudrun" {
722722
description = "(Beta) Enable CloudRun addon"
723+
type = bool
723724
default = false
724725
}
725726

726727
variable "cloudrun_load_balancer_type" {
727728
description = "(Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer."
728-
default = ""
729+
type = string
730+
default = ""
729731
}
730732

731733
variable "enable_pod_security_policy" {

‎autogen/main/versions.tf.tmpl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ terraform {
2222

2323
{% if beta_cluster %}
2424
required_providers {
25+
google = {
26+
source = "hashicorp/google"
27+
version = ">= 4.51.0, < 5.0"
28+
}
2529
google-beta = {
2630
source = "hashicorp/google-beta"
2731
version = ">= 4.51.0, < 5.0"
@@ -30,6 +34,10 @@ terraform {
3034
source = "hashicorp/kubernetes"
3135
version = "~> 2.10"
3236
}
37+
random = {
38+
source = "hashicorp/random"
39+
version = ">= 2.1"
40+
}
3341
}
3442
provider_meta "google-beta" {
3543
module_name = "blueprints/terraform/terraform-google-kubernetes-engine{% if module_registry_name %}:{{ module_registry_name }}{% endif %}/v25.0.0"
@@ -44,6 +52,10 @@ terraform {
4452
source = "hashicorp/kubernetes"
4553
version = "~> 2.10"
4654
}
55+
random = {
56+
source = "hashicorp/random"
57+
version = ">= 2.1"
58+
}
4759
}
4860
provider_meta "google" {
4961
module_name = "blueprints/terraform/terraform-google-kubernetes-engine{% if module_registry_name %}:{{ module_registry_name }}{% endif %}/v25.0.0"

‎autogen/safer-cluster/main.tf.tmpl

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,8 +188,6 @@ module "gke" {
188188

189189
enable_shielded_nodes = var.enable_shielded_nodes
190190

191-
skip_provisioners = var.skip_provisioners
192-
193191
gce_pd_csi_driver = var.gce_pd_csi_driver
194192
filestore_csi_driver = var.filestore_csi_driver
195193

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 3 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,6 @@ variable "name" {
2626
description = "The name of the cluster"
2727
}
2828

29-
variable "description" {
30-
type = string
31-
description = "The description of the cluster"
32-
default = ""
33-
}
34-
3529
variable "regional" {
3630
type = bool
3731
description = "Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!)"
@@ -306,6 +300,7 @@ variable "master_ipv4_cidr_block" {
306300

307301
variable "istio" {
308302
description = "(Beta) Enable Istio addon"
303+
type = bool
309304
default = false
310305
}
311306

@@ -341,6 +336,7 @@ variable "cluster_dns_domain" {
341336

342337
variable "default_max_pods_per_node" {
343338
description = "The maximum number of pods to schedule per node"
339+
type = number
344340
default = 110
345341
}
346342

@@ -355,6 +351,7 @@ variable "database_encryption" {
355351

356352
variable "cloudrun" {
357353
description = "(Beta) Enable CloudRun addon"
354+
type = bool
358355
default = false
359356
}
360357

@@ -364,18 +361,6 @@ variable "resource_usage_export_dataset_id" {
364361
default = ""
365362
}
366363

367-
variable "enable_network_egress_export" {
368-
type = bool
369-
description = "Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic."
370-
default = false
371-
}
372-
373-
variable "enable_resource_consumption_export" {
374-
type = bool
375-
description = "Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export."
376-
default = true
377-
}
378-
379364
variable "enable_cost_allocation" {
380365
type = bool
381366
description = "Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery"
@@ -424,12 +409,6 @@ variable "enable_private_endpoint" {
424409
default = true
425410
}
426411

427-
variable "skip_provisioners" {
428-
type = bool
429-
description = "Flag to skip all local-exec provisioners. It breaks `stub_domains` and `upstream_nameservers` variables functionality."
430-
default = false
431-
}
432-
433412
variable "enable_pod_security_policy" {
434413
type = bool
435414
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."

‎build/int.cloudbuild.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -511,6 +511,6 @@ tags:
511511
- 'integration'
512512
substitutions:
513513
_DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
514-
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.8'
514+
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.10'
515515
options:
516516
machineType: 'N1_HIGHCPU_8'

‎build/lint.cloudbuild.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ tags:
2222
- 'lint'
2323
substitutions:
2424
_DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
25-
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.8'
25+
_DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.10'
2626
options:
2727
machineType: 'N1_HIGHCPU_8'
2828
env:

‎examples/simple_autopilot_private_non_default_sa/main.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ module "gke" {
4848
enable_private_endpoint = true
4949
enable_private_nodes = true
5050
master_ipv4_cidr_block = "172.16.0.0/28"
51-
datapath_provider = "ADVANCED_DATAPATH"
5251

5352
master_authorized_networks = [
5453
{

‎examples/simple_regional/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ This example illustrates how to create a simple cluster.
1515
| network | The VPC network to host the cluster in | `any` | n/a | yes |
1616
| project\_id | The project ID to host the cluster in | `any` | n/a | yes |
1717
| region | The region to host the cluster in | `any` | n/a | yes |
18-
| skip\_provisioners | Flag to skip local-exec provisioners | `bool` | `false` | no |
1918
| subnetwork | The subnetwork to host the cluster in | `any` | n/a | yes |
2019

2120
## Outputs

‎examples/simple_regional/main.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,5 +40,4 @@ module "gke" {
4040
service_account = var.compute_engine_service_account
4141
enable_cost_allocation = true
4242
enable_binary_authorization = var.enable_binary_authorization
43-
skip_provisioners = var.skip_provisioners
4443
}

‎examples/simple_regional/variables.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,12 +47,6 @@ variable "compute_engine_service_account" {
4747
description = "Service account to associate to the nodes in the cluster"
4848
}
4949

50-
variable "skip_provisioners" {
51-
type = bool
52-
description = "Flag to skip local-exec provisioners"
53-
default = false
54-
}
55-
5650
variable "enable_binary_authorization" {
5751
description = "Enable BinAuthZ Admission controller"
5852
default = false

‎examples/simple_regional_beta/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ This example illustrates how to create a simple cluster with beta features.
1010
| cluster\_name\_suffix | A suffix to append to the default cluster name | `string` | `""` | no |
1111
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | `any` | n/a | yes |
1212
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. | `list(object({ state = string, key_name = string }))` | <pre>[<br> {<br> "key_name": "",<br> "state": "DECRYPTED"<br> }<br>]</pre> | no |
13-
| datapath\_provider | The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature. | `string` | `"DATAPATH_PROVIDER_UNSPECIFIED"` | no |
1413
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
1514
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
1615
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | `bool` | `false` | no |

‎examples/simple_regional_beta/variables.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -113,9 +113,3 @@ variable "regional" {
113113
description = "Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!)"
114114
default = true
115115
}
116-
117-
variable "datapath_provider" {
118-
type = string
119-
description = "The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature."
120-
default = "DATAPATH_PROVIDER_UNSPECIFIED"
121-
}

‎examples/simple_regional_with_gateway_api/README.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ This example illustrates how to create a simple cluster.
1616
| network | The VPC network to host the cluster in | `any` | n/a | yes |
1717
| project\_id | The project ID to host the cluster in | `any` | n/a | yes |
1818
| region | The region to host the cluster in | `any` | n/a | yes |
19-
| skip\_provisioners | Flag to skip local-exec provisioners | `bool` | `false` | no |
2019
| subnetwork | The subnetwork to host the cluster in | `any` | n/a | yes |
2120

2221
## Outputs

0 commit comments

Comments
 (0)