Skip to content

Commit c135d48

Browse files
aaron-laneaaron-lane
authored
Merge branch 'master' into master
2 parents 8a2fddc + c227c65 commit c135d48

File tree

31 files changed

+146
-117
lines changed

31 files changed

+146
-117
lines changed

‎CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ Extending the adopted spec, each change should have a link to its corresponding
1515
### Added
1616

1717
* Added [private](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/tree/master/modules/private-cluster-update-variant) and [beta private](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/tree/master/modules/beta-private-cluster-update-variant) variants which allow node pools to be created before being destroyed. [#256]
18+
* Add a parameter `registry_project_id` to allow connecting to registries in other projects. [#273]
1819

1920
## [v5.0.0] - 2019-09-25
2021
v5.0.0 is a backwards-incompatible release. Please see the [upgrading guide](./docs/upgrading_to_v5.0.md).
@@ -204,6 +205,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
204205
[v0.3.0]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/compare/v0.2.0...v0.3.0
205206
[v0.2.0]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/compare/v0.1.0...v0.2.0
206207

208+
[#273]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/273
207209
[#247]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/247
208210
[#256]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/256
209211
[#248]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/248

‎README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
167167
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
168168
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
169169
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
170+
| registry\_project\_id | Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project. | string | `""` | no |
170171
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
171172
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
172173
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
@@ -228,6 +229,9 @@ following project roles:
228229
- roles/iam.serviceAccountUser
229230
- roles/resourcemanager.projectIamAdmin (only required if `service_account` is set to `create`)
230231

232+
Additionally, if `service_account` is set to `create` and `grant_registry_access` is requested, the service account requires the following role on the `registry_project_id` project:
233+
- roles/resourcemanager.projectIamAdmin
234+
231235
### Enable APIs
232236
In order to operate with the Service Account you must activate the following APIs on the project where the Service Account was created:
233237

‎autogen/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,9 @@ following project roles:
269269
- roles/iam.serviceAccountUser
270270
- roles/resourcemanager.projectIamAdmin (only required if `service_account` is set to `create`)
271271

272+
Additionally, if `service_account` is set to `create` and `grant_registry_access` is requested, the service account requires the following role on the `registry_project_id` project:
273+
- roles/resourcemanager.projectIamAdmin
274+
272275
### Enable APIs
273276
In order to operate with the Service Account you must activate the following APIs on the project where the Service Account was created:
274277

‎autogen/cluster.tf

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -341,22 +341,14 @@ resource "google_container_node_pool" "pools" {
341341
image_type = lookup(var.node_pools[count.index], "image_type", "COS")
342342
machine_type = lookup(var.node_pools[count.index], "machine_type", "n1-standard-2")
343343
labels = merge(
344-
{
345-
"cluster_name" = var.name
346-
},
347-
{
348-
"node_pool" = var.node_pools[count.index]["name"]
349-
},
344+
lookup(lookup(var.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
345+
lookup(lookup(var.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
350346
var.node_pools_labels["all"],
351347
var.node_pools_labels[var.node_pools[count.index]["name"]],
352348
)
353349
metadata = merge(
354-
{
355-
"cluster_name" = var.name
356-
},
357-
{
358-
"node_pool" = var.node_pools[count.index]["name"]
359-
},
350+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
351+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
360352
var.node_pools_metadata["all"],
361353
var.node_pools_metadata[var.node_pools[count.index]["name"]],
362354
{
@@ -377,8 +369,8 @@ resource "google_container_node_pool" "pools" {
377369
}
378370
{% endif %}
379371
tags = concat(
380-
["gke-${var.name}"],
381-
["gke-${var.name}-${var.node_pools[count.index]["name"]}"],
372+
lookup(var.node_pools_tags, "default_values", [true, true])[0] ? ["gke-${var.name}"] : [],
373+
lookup(var.node_pools_tags, "default_values", [true, true])[1] ? ["gke-${var.name}-${var.node_pools[count.index]["name"]}"] : [],
382374
var.node_pools_tags["all"],
383375
var.node_pools_tags[var.node_pools[count.index]["name"]],
384376
)

‎autogen/sa.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ resource "google_project_iam_member" "cluster_service_account-monitoring_viewer"
6464

6565
resource "google_project_iam_member" "cluster_service_account-gcr" {
6666
count = var.create_service_account && var.grant_registry_access ? 1 : 0
67-
project = var.project_id
67+
project = var.registry_project_id == "" ? var.project_id : var.registry_project_id
6868
role = "roles/storage.objectViewer"
6969
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
7070
}

‎autogen/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,12 @@ variable "grant_registry_access" {
270270
default = false
271271
}
272272

273+
variable "registry_project_id" {
274+
type = string
275+
description = "Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project."
276+
default = ""
277+
}
278+
273279
variable "service_account" {
274280
type = string
275281
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."

‎cluster.tf

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -161,31 +161,23 @@ resource "google_container_node_pool" "pools" {
161161
image_type = lookup(var.node_pools[count.index], "image_type", "COS")
162162
machine_type = lookup(var.node_pools[count.index], "machine_type", "n1-standard-2")
163163
labels = merge(
164-
{
165-
"cluster_name" = var.name
166-
},
167-
{
168-
"node_pool" = var.node_pools[count.index]["name"]
169-
},
164+
lookup(lookup(var.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
165+
lookup(lookup(var.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
170166
var.node_pools_labels["all"],
171167
var.node_pools_labels[var.node_pools[count.index]["name"]],
172168
)
173169
metadata = merge(
174-
{
175-
"cluster_name" = var.name
176-
},
177-
{
178-
"node_pool" = var.node_pools[count.index]["name"]
179-
},
170+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
171+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
180172
var.node_pools_metadata["all"],
181173
var.node_pools_metadata[var.node_pools[count.index]["name"]],
182174
{
183175
"disable-legacy-endpoints" = var.disable_legacy_metadata_endpoints
184176
},
185177
)
186178
tags = concat(
187-
["gke-${var.name}"],
188-
["gke-${var.name}-${var.node_pools[count.index]["name"]}"],
179+
lookup(var.node_pools_tags, "default_values", [true, true])[0] ? ["gke-${var.name}"] : [],
180+
lookup(var.node_pools_tags, "default_values", [true, true])[1] ? ["gke-${var.name}-${var.node_pools[count.index]["name"]}"] : [],
189181
var.node_pools_tags["all"],
190182
var.node_pools_tags[var.node_pools[count.index]["name"]],
191183
)

‎examples/workload_metadata_config/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,9 @@ module "gke" {
4040
subnetwork = var.subnetwork
4141
ip_range_pods = var.ip_range_pods
4242
ip_range_services = var.ip_range_services
43-
create_service_account = false
44-
service_account = var.compute_engine_service_account
43+
create_service_account = true
44+
grant_registry_access = true
45+
registry_project_id = var.registry_project_id
4546
enable_private_endpoint = true
4647
enable_private_nodes = true
4748
master_ipv4_cidr_block = "172.16.0.0/28"

‎examples/workload_metadata_config/variables.tf

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ variable "ip_range_services" {
4848
description = "The secondary ip range to use for pods"
4949
}
5050

51-
variable "compute_engine_service_account" {
52-
description = "Service account to associate to the nodes in the cluster"
51+
variable "registry_project_id" {
52+
description = "Project name for the GCR registry"
5353
}
54-

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -315,22 +315,14 @@ resource "google_container_node_pool" "pools" {
315315
image_type = lookup(var.node_pools[count.index], "image_type", "COS")
316316
machine_type = lookup(var.node_pools[count.index], "machine_type", "n1-standard-2")
317317
labels = merge(
318-
{
319-
"cluster_name" = var.name
320-
},
321-
{
322-
"node_pool" = var.node_pools[count.index]["name"]
323-
},
318+
lookup(lookup(var.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
319+
lookup(lookup(var.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
324320
var.node_pools_labels["all"],
325321
var.node_pools_labels[var.node_pools[count.index]["name"]],
326322
)
327323
metadata = merge(
328-
{
329-
"cluster_name" = var.name
330-
},
331-
{
332-
"node_pool" = var.node_pools[count.index]["name"]
333-
},
324+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
325+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
334326
var.node_pools_metadata["all"],
335327
var.node_pools_metadata[var.node_pools[count.index]["name"]],
336328
{
@@ -349,8 +341,8 @@ resource "google_container_node_pool" "pools" {
349341
}
350342
}
351343
tags = concat(
352-
["gke-${var.name}"],
353-
["gke-${var.name}-${var.node_pools[count.index]["name"]}"],
344+
lookup(var.node_pools_tags, "default_values", [true, true])[0] ? ["gke-${var.name}"] : [],
345+
lookup(var.node_pools_tags, "default_values", [true, true])[1] ? ["gke-${var.name}-${var.node_pools[count.index]["name"]}"] : [],
354346
var.node_pools_tags["all"],
355347
var.node_pools_tags[var.node_pools[count.index]["name"]],
356348
)

‎modules/beta-private-cluster/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
190190
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
191191
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
192192
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
193+
| registry\_project\_id | Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project. | string | `""` | no |
193194
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
194195
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | string | `""` | no |
195196
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
@@ -258,6 +259,9 @@ following project roles:
258259
- roles/iam.serviceAccountUser
259260
- roles/resourcemanager.projectIamAdmin (only required if `service_account` is set to `create`)
260261

262+
Additionally, if `service_account` is set to `create` and `grant_registry_access` is requested, the service account requires the following role on the `registry_project_id` project:
263+
- roles/resourcemanager.projectIamAdmin
264+
261265
### Enable APIs
262266
In order to operate with the Service Account you must activate the following APIs on the project where the Service Account was created:
263267

‎modules/beta-private-cluster/cluster.tf

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -243,22 +243,14 @@ resource "google_container_node_pool" "pools" {
243243
image_type = lookup(var.node_pools[count.index], "image_type", "COS")
244244
machine_type = lookup(var.node_pools[count.index], "machine_type", "n1-standard-2")
245245
labels = merge(
246-
{
247-
"cluster_name" = var.name
248-
},
249-
{
250-
"node_pool" = var.node_pools[count.index]["name"]
251-
},
246+
lookup(lookup(var.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
247+
lookup(lookup(var.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
252248
var.node_pools_labels["all"],
253249
var.node_pools_labels[var.node_pools[count.index]["name"]],
254250
)
255251
metadata = merge(
256-
{
257-
"cluster_name" = var.name
258-
},
259-
{
260-
"node_pool" = var.node_pools[count.index]["name"]
261-
},
252+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
253+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
262254
var.node_pools_metadata["all"],
263255
var.node_pools_metadata[var.node_pools[count.index]["name"]],
264256
{
@@ -277,8 +269,8 @@ resource "google_container_node_pool" "pools" {
277269
}
278270
}
279271
tags = concat(
280-
["gke-${var.name}"],
281-
["gke-${var.name}-${var.node_pools[count.index]["name"]}"],
272+
lookup(var.node_pools_tags, "default_values", [true, true])[0] ? ["gke-${var.name}"] : [],
273+
lookup(var.node_pools_tags, "default_values", [true, true])[1] ? ["gke-${var.name}-${var.node_pools[count.index]["name"]}"] : [],
282274
var.node_pools_tags["all"],
283275
var.node_pools_tags[var.node_pools[count.index]["name"]],
284276
)

‎modules/beta-private-cluster/sa.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ resource "google_project_iam_member" "cluster_service_account-monitoring_viewer"
6464

6565
resource "google_project_iam_member" "cluster_service_account-gcr" {
6666
count = var.create_service_account && var.grant_registry_access ? 1 : 0
67-
project = var.project_id
67+
project = var.registry_project_id == "" ? var.project_id : var.registry_project_id
6868
role = "roles/storage.objectViewer"
6969
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
7070
}

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,12 @@ variable "grant_registry_access" {
268268
default = false
269269
}
270270

271+
variable "registry_project_id" {
272+
type = string
273+
description = "Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project."
274+
default = ""
275+
}
276+
271277
variable "service_account" {
272278
type = string
273279
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."

‎modules/beta-public-cluster/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
181181
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
182182
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
183183
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
184+
| registry\_project\_id | Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project. | string | `""` | no |
184185
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
185186
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | string | `""` | no |
186187
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
@@ -249,6 +250,9 @@ following project roles:
249250
- roles/iam.serviceAccountUser
250251
- roles/resourcemanager.projectIamAdmin (only required if `service_account` is set to `create`)
251252

253+
Additionally, if `service_account` is set to `create` and `grant_registry_access` is requested, the service account requires the following role on the `registry_project_id` project:
254+
- roles/resourcemanager.projectIamAdmin
255+
252256
### Enable APIs
253257
In order to operate with the Service Account you must activate the following APIs on the project where the Service Account was created:
254258

‎modules/beta-public-cluster/cluster.tf

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -238,22 +238,14 @@ resource "google_container_node_pool" "pools" {
238238
image_type = lookup(var.node_pools[count.index], "image_type", "COS")
239239
machine_type = lookup(var.node_pools[count.index], "machine_type", "n1-standard-2")
240240
labels = merge(
241-
{
242-
"cluster_name" = var.name
243-
},
244-
{
245-
"node_pool" = var.node_pools[count.index]["name"]
246-
},
241+
lookup(lookup(var.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
242+
lookup(lookup(var.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
247243
var.node_pools_labels["all"],
248244
var.node_pools_labels[var.node_pools[count.index]["name"]],
249245
)
250246
metadata = merge(
251-
{
252-
"cluster_name" = var.name
253-
},
254-
{
255-
"node_pool" = var.node_pools[count.index]["name"]
256-
},
247+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
248+
lookup(lookup(var.node_pools_metadata, "default_values", {}), "node_pool", true) ? { "node_pool" = var.node_pools[count.index]["name"] } : {},
257249
var.node_pools_metadata["all"],
258250
var.node_pools_metadata[var.node_pools[count.index]["name"]],
259251
{
@@ -272,8 +264,8 @@ resource "google_container_node_pool" "pools" {
272264
}
273265
}
274266
tags = concat(
275-
["gke-${var.name}"],
276-
["gke-${var.name}-${var.node_pools[count.index]["name"]}"],
267+
lookup(var.node_pools_tags, "default_values", [true, true])[0] ? ["gke-${var.name}"] : [],
268+
lookup(var.node_pools_tags, "default_values", [true, true])[1] ? ["gke-${var.name}-${var.node_pools[count.index]["name"]}"] : [],
277269
var.node_pools_tags["all"],
278270
var.node_pools_tags[var.node_pools[count.index]["name"]],
279271
)

‎modules/beta-public-cluster/sa.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ resource "google_project_iam_member" "cluster_service_account-monitoring_viewer"
6464

6565
resource "google_project_iam_member" "cluster_service_account-gcr" {
6666
count = var.create_service_account && var.grant_registry_access ? 1 : 0
67-
project = var.project_id
67+
project = var.registry_project_id == "" ? var.project_id : var.registry_project_id
6868
role = "roles/storage.objectViewer"
6969
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
7070
}

0 commit comments

Comments
 (0)