Skip to content

Commit cad7837

Browse files
apeabodyapeabody
authored
Merge branch 'master' into wyardley/fix_2104
2 parents 6f4e92c + eed7513 commit cad7837

File tree

33 files changed

+221
-46
lines changed

33 files changed

+221
-46
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ Then perform the following commands on the root folder:
182182
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
183183
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
184184
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
185+
| gcp\_public\_cidrs\_access\_enabled | Allow access through Google Cloud public IP addresses | `bool` | `null` | no |
185186
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
186187
| gke\_backup\_agent\_config | Whether Backup for GKE agent is enabled for this cluster. | `bool` | `false` | no |
187188
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,8 +257,9 @@ resource "google_container_cluster" "primary" {
257257
enable_autopilot = true
258258
{% endif %}
259259
dynamic "master_authorized_networks_config" {
260-
for_each = {% if private_cluster %}var.enable_private_endpoint || {% endif %}length(var.master_authorized_networks) > 0 ? [true] : []
260+
for_each = {% if private_cluster %}var.enable_private_endpoint || {% endif %}var.gcp_public_cidrs_access_enabled != null || length(var.master_authorized_networks) > 0 ? [true] : []
261261
content {
262+
gcp_public_cidrs_access_enabled = var.gcp_public_cidrs_access_enabled
262263
dynamic "cidr_blocks" {
263264
for_each = var.master_authorized_networks
264265
content {
@@ -720,7 +721,8 @@ locals {
720721
"enable_confidential_storage",
721722
"consume_reservation_type",
722723
"reservation_affinity_key",
723-
"reservation_affinity_values"
724+
"reservation_affinity_values",
725+
"enable_confidential_nodes",
724726
]
725727
}
726728

@@ -1084,6 +1086,14 @@ resource "google_container_node_pool" "windows_pools" {
10841086
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
10851087
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
10861088
}
1089+
1090+
dynamic "confidential_nodes" {
1091+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
1092+
content {
1093+
enabled = confidential_nodes.value
1094+
}
1095+
}
1096+
10871097
}
10881098

10891099
lifecycle {

‎autogen/main/variables.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ variable "master_authorized_networks" {
7878
default = []
7979
}
8080

81+
variable "gcp_public_cidrs_access_enabled" {
82+
type = bool
83+
description = "Allow access through Google Cloud public IP addresses"
84+
default = null
85+
}
86+
8187
variable "enable_vertical_pod_autoscaling" {
8288
type = bool
8389
description = "Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it"

‎build/lint.cloudbuild.yaml

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎cluster.tf

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,9 @@ resource "google_container_cluster" "primary" {
190190
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
191191

192192
dynamic "master_authorized_networks_config" {
193-
for_each = length(var.master_authorized_networks) > 0 ? [true] : []
193+
for_each = var.gcp_public_cidrs_access_enabled != null || length(var.master_authorized_networks) > 0 ? [true] : []
194194
content {
195+
gcp_public_cidrs_access_enabled = var.gcp_public_cidrs_access_enabled
195196
dynamic "cidr_blocks" {
196197
for_each = var.master_authorized_networks
197198
content {
@@ -771,6 +772,14 @@ resource "google_container_node_pool" "pools" {
771772
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
772773
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
773774
}
775+
776+
dynamic "confidential_nodes" {
777+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
778+
content {
779+
enabled = confidential_nodes.value
780+
}
781+
}
782+
774783
}
775784

776785
lifecycle {
@@ -1038,6 +1047,14 @@ resource "google_container_node_pool" "windows_pools" {
10381047
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
10391048
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
10401049
}
1050+
1051+
dynamic "confidential_nodes" {
1052+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
1053+
content {
1054+
enabled = confidential_nodes.value
1055+
}
1056+
}
1057+
10411058
}
10421059

10431060
lifecycle {

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ Then perform the following commands on the root folder:
107107
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
108108
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
109109
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
110+
| gcp\_public\_cidrs\_access\_enabled | Allow access through Google Cloud public IP addresses | `bool` | `null` | no |
110111
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
111112
| gke\_backup\_agent\_config | Whether Backup for GKE agent is enabled for this cluster. | `bool` | `false` | no |
112113
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,9 @@ resource "google_container_cluster" "primary" {
106106
enable_fqdn_network_policy = var.enable_fqdn_network_policy
107107
enable_autopilot = true
108108
dynamic "master_authorized_networks_config" {
109-
for_each = var.enable_private_endpoint || length(var.master_authorized_networks) > 0 ? [true] : []
109+
for_each = var.enable_private_endpoint || var.gcp_public_cidrs_access_enabled != null || length(var.master_authorized_networks) > 0 ? [true] : []
110110
content {
111+
gcp_public_cidrs_access_enabled = var.gcp_public_cidrs_access_enabled
111112
dynamic "cidr_blocks" {
112113
for_each = var.master_authorized_networks
113114
content {

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ variable "master_authorized_networks" {
7878
default = []
7979
}
8080

81+
variable "gcp_public_cidrs_access_enabled" {
82+
type = bool
83+
description = "Allow access through Google Cloud public IP addresses"
84+
default = null
85+
}
86+
8187
variable "enable_vertical_pod_autoscaling" {
8288
type = bool
8389
description = "Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it"

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ Then perform the following commands on the root folder:
9898
| fleet\_project | (Optional) Register the cluster with the fleet in this project. | `string` | `null` | no |
9999
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
100100
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
101+
| gcp\_public\_cidrs\_access\_enabled | Allow access through Google Cloud public IP addresses | `bool` | `null` | no |
101102
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
102103
| gke\_backup\_agent\_config | Whether Backup for GKE agent is enabled for this cluster. | `bool` | `false` | no |
103104
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,9 @@ resource "google_container_cluster" "primary" {
106106
enable_fqdn_network_policy = var.enable_fqdn_network_policy
107107
enable_autopilot = true
108108
dynamic "master_authorized_networks_config" {
109-
for_each = length(var.master_authorized_networks) > 0 ? [true] : []
109+
for_each = var.gcp_public_cidrs_access_enabled != null || length(var.master_authorized_networks) > 0 ? [true] : []
110110
content {
111+
gcp_public_cidrs_access_enabled = var.gcp_public_cidrs_access_enabled
111112
dynamic "cidr_blocks" {
112113
for_each = var.master_authorized_networks
113114
content {

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ variable "master_authorized_networks" {
7878
default = []
7979
}
8080

81+
variable "gcp_public_cidrs_access_enabled" {
82+
type = bool
83+
description = "Allow access through Google Cloud public IP addresses"
84+
default = null
85+
}
86+
8187
variable "enable_vertical_pod_autoscaling" {
8288
type = bool
8389
description = "Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,7 @@ Then perform the following commands on the root folder:
225225
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
226226
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
227227
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
228+
| gcp\_public\_cidrs\_access\_enabled | Allow access through Google Cloud public IP addresses | `bool` | `null` | no |
228229
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
229230
| gke\_backup\_agent\_config | Whether Backup for GKE agent is enabled for this cluster. | `bool` | `false` | no |
230231
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,8 +211,9 @@ resource "google_container_cluster" "primary" {
211211

212212
enable_fqdn_network_policy = var.enable_fqdn_network_policy
213213
dynamic "master_authorized_networks_config" {
214-
for_each = var.enable_private_endpoint || length(var.master_authorized_networks) > 0 ? [true] : []
214+
for_each = var.enable_private_endpoint || var.gcp_public_cidrs_access_enabled != null || length(var.master_authorized_networks) > 0 ? [true] : []
215215
content {
216+
gcp_public_cidrs_access_enabled = var.gcp_public_cidrs_access_enabled
216217
dynamic "cidr_blocks" {
217218
for_each = var.master_authorized_networks
218219
content {
@@ -616,7 +617,8 @@ locals {
616617
"enable_confidential_storage",
617618
"consume_reservation_type",
618619
"reservation_affinity_key",
619-
"reservation_affinity_values"
620+
"reservation_affinity_values",
621+
"enable_confidential_nodes",
620622
]
621623
}
622624

@@ -951,6 +953,14 @@ resource "google_container_node_pool" "pools" {
951953
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
952954
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
953955
}
956+
957+
dynamic "confidential_nodes" {
958+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
959+
content {
960+
enabled = confidential_nodes.value
961+
}
962+
}
963+
954964
}
955965

956966
lifecycle {
@@ -1232,6 +1242,14 @@ resource "google_container_node_pool" "windows_pools" {
12321242
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
12331243
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
12341244
}
1245+
1246+
dynamic "confidential_nodes" {
1247+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
1248+
content {
1249+
enabled = confidential_nodes.value
1250+
}
1251+
}
1252+
12351253
}
12361254

12371255
lifecycle {

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ variable "master_authorized_networks" {
7878
default = []
7979
}
8080

81+
variable "gcp_public_cidrs_access_enabled" {
82+
type = bool
83+
description = "Allow access through Google Cloud public IP addresses"
84+
default = null
85+
}
86+
8187
variable "enable_vertical_pod_autoscaling" {
8288
type = bool
8389
description = "Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it"

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,7 @@ Then perform the following commands on the root folder:
203203
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
204204
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
205205
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
206+
| gcp\_public\_cidrs\_access\_enabled | Allow access through Google Cloud public IP addresses | `bool` | `null` | no |
206207
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
207208
| gke\_backup\_agent\_config | Whether Backup for GKE agent is enabled for this cluster. | `bool` | `false` | no |
208209
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,8 +211,9 @@ resource "google_container_cluster" "primary" {
211211

212212
enable_fqdn_network_policy = var.enable_fqdn_network_policy
213213
dynamic "master_authorized_networks_config" {
214-
for_each = var.enable_private_endpoint || length(var.master_authorized_networks) > 0 ? [true] : []
214+
for_each = var.enable_private_endpoint || var.gcp_public_cidrs_access_enabled != null || length(var.master_authorized_networks) > 0 ? [true] : []
215215
content {
216+
gcp_public_cidrs_access_enabled = var.gcp_public_cidrs_access_enabled
216217
dynamic "cidr_blocks" {
217218
for_each = var.master_authorized_networks
218219
content {
@@ -869,6 +870,14 @@ resource "google_container_node_pool" "pools" {
869870
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
870871
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
871872
}
873+
874+
dynamic "confidential_nodes" {
875+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
876+
content {
877+
enabled = confidential_nodes.value
878+
}
879+
}
880+
872881
}
873882

874883
lifecycle {
@@ -1149,6 +1158,14 @@ resource "google_container_node_pool" "windows_pools" {
11491158
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
11501159
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
11511160
}
1161+
1162+
dynamic "confidential_nodes" {
1163+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
1164+
content {
1165+
enabled = confidential_nodes.value
1166+
}
1167+
}
1168+
11521169
}
11531170

11541171
lifecycle {

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ variable "master_authorized_networks" {
7878
default = []
7979
}
8080

81+
variable "gcp_public_cidrs_access_enabled" {
82+
type = bool
83+
description = "Allow access through Google Cloud public IP addresses"
84+
default = null
85+
}
86+
8187
variable "enable_vertical_pod_autoscaling" {
8288
type = bool
8389
description = "Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,7 @@ Then perform the following commands on the root folder:
216216
| fleet\_project\_grant\_service\_agent | (Optional) Grant the fleet project service identity the `roles/gkehub.serviceAgent` and `roles/gkehub.crossProjectServiceAgent` roles. | `bool` | `false` | no |
217217
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. | `string` | `null` | no |
218218
| gce\_pd\_csi\_driver | Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `true` | no |
219+
| gcp\_public\_cidrs\_access\_enabled | Allow access through Google Cloud public IP addresses | `bool` | `null` | no |
219220
| gcs\_fuse\_csi\_driver | Whether GCE FUSE CSI driver is enabled for this cluster. | `bool` | `false` | no |
220221
| gke\_backup\_agent\_config | Whether Backup for GKE agent is enabled for this cluster. | `bool` | `false` | no |
221222
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -211,8 +211,9 @@ resource "google_container_cluster" "primary" {
211211

212212
enable_fqdn_network_policy = var.enable_fqdn_network_policy
213213
dynamic "master_authorized_networks_config" {
214-
for_each = length(var.master_authorized_networks) > 0 ? [true] : []
214+
for_each = var.gcp_public_cidrs_access_enabled != null || length(var.master_authorized_networks) > 0 ? [true] : []
215215
content {
216+
gcp_public_cidrs_access_enabled = var.gcp_public_cidrs_access_enabled
216217
dynamic "cidr_blocks" {
217218
for_each = var.master_authorized_networks
218219
content {
@@ -595,7 +596,8 @@ locals {
595596
"enable_confidential_storage",
596597
"consume_reservation_type",
597598
"reservation_affinity_key",
598-
"reservation_affinity_values"
599+
"reservation_affinity_values",
600+
"enable_confidential_nodes",
599601
]
600602
}
601603

@@ -930,6 +932,14 @@ resource "google_container_node_pool" "pools" {
930932
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
931933
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
932934
}
935+
936+
dynamic "confidential_nodes" {
937+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
938+
content {
939+
enabled = confidential_nodes.value
940+
}
941+
}
942+
933943
}
934944

935945
lifecycle {
@@ -1211,6 +1221,14 @@ resource "google_container_node_pool" "windows_pools" {
12111221
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
12121222
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
12131223
}
1224+
1225+
dynamic "confidential_nodes" {
1226+
for_each = lookup(each.value, "enable_confidential_nodes", null) != null ? [each.value.confidential_nodes] : []
1227+
content {
1228+
enabled = confidential_nodes.value
1229+
}
1230+
}
1231+
12141232
}
12151233

12161234
lifecycle {

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,12 @@ variable "master_authorized_networks" {
7878
default = []
7979
}
8080

81+
variable "gcp_public_cidrs_access_enabled" {
82+
type = bool
83+
description = "Allow access through Google Cloud public IP addresses"
84+
default = null
85+
}
86+
8187
variable "enable_vertical_pod_autoscaling" {
8288
type = bool
8389
description = "Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it"

0 commit comments

Comments
 (0)