Skip to content

Commit d122a55

Browse files
ferrarimarcobharathkkb
ferrarimarco
and
bharathkkb
authored
feat!: Set the provided SA when creating autopilot clusters (#1495)
Co-authored-by: Bharath KKB <[email protected]>
1 parent 21fc1f2 commit d122a55

File tree

24 files changed

+389
-22
lines changed

24 files changed

+389
-22
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,17 @@ resource "google_container_cluster" "primary" {
150150
}
151151
}
152152
{% endif %}
153+
{% if autopilot_cluster == true %}
154+
cluster_autoscaling {
155+
dynamic "auto_provisioning_defaults" {
156+
for_each = var.create_service_account ? [1] : []
157+
158+
content {
159+
service_account = local.service_account
160+
}
161+
}
162+
}
163+
{% endif %}
153164
vertical_pod_autoscaling {
154165
enabled = var.enable_vertical_pod_autoscaling
155166
}

‎autogen/main/versions.tf.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ terraform {
2424
required_providers {
2525
google-beta = {
2626
source = "hashicorp/google-beta"
27-
version = ">= 4.42.0, < 5.0"
27+
version = ">= 4.44.0, < 5.0"
2828
}
2929
kubernetes = {
3030
source = "hashicorp/kubernetes"
@@ -38,7 +38,7 @@ terraform {
3838
required_providers {
3939
google = {
4040
source = "hashicorp/google"
41-
version = ">= 4.36.0, < 5.0"
41+
version = ">= 4.44.0, < 5.0"
4242
}
4343
kubernetes = {
4444
source = "hashicorp/kubernetes"

‎build/int.cloudbuild.yaml

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -401,9 +401,26 @@ steps:
401401
- verify private-zonal-with-networking
402402
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
403403
args: ['/bin/bash', '-c', 'cft test run TestPrivateZonalWithNetworking --stage teardown --verbose --test-dir test/integration']
404-
405-
406-
404+
- id: init simple-autopilot-private-non-default-sa
405+
waitFor:
406+
- prepare
407+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
408+
args: ['/bin/bash', '-c', 'cft test run TestSimpleAutopilotPrivateNonDefaultSA --stage init --verbose']
409+
- id: apply simple-autopilot-private-non-default-sa
410+
waitFor:
411+
- init simple-autopilot-private-non-default-sa
412+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
413+
args: ['/bin/bash', '-c', 'cft test run TestSimpleAutopilotPrivateNonDefaultSA --stage apply --verbose']
414+
- id: verify simple-autopilot-private-non-default-sa
415+
waitFor:
416+
- apply simple-autopilot-private-non-default-sa
417+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
418+
args: ['/bin/bash', '-c', 'cft test run TestSimpleAutopilotPrivateNonDefaultSA --stage verify --verbose']
419+
- id: teardown simple-autopilot-private-non-default-sa
420+
waitFor:
421+
- verify simple-autopilot-private-non-default-sa
422+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
423+
args: ['/bin/bash', '-c', 'cft test run TestSimpleAutopilotPrivateNonDefaultSA --stage teardown --verbose']
407424
tags:
408425
- 'ci'
409426
- 'integration'

‎examples/simple_autopilot_private_non_default_sa/README.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Simple Regional Autopilot Cluster
2+
3+
This example illustrates how to create a simple autopilot cluster with beta features and
4+
not using the default service account.
5+
6+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|------|---------|:--------:|
11+
| project\_id | The project ID to host the cluster in | `any` | n/a | yes |
12+
13+
## Outputs
14+
15+
| Name | Description |
16+
|------|-------------|
17+
| cluster\_name | Cluster name |
18+
| kubernetes\_endpoint | The cluster endpoint |
19+
| location | n/a |
20+
| master\_kubernetes\_version | Kubernetes version of the master |
21+
| network\_name | The name of the VPC being created |
22+
| region | The region in which the cluster resides |
23+
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
24+
| subnet\_names | The names of the subnet being created |
25+
| zones | List of zones in which the cluster resides |
26+
27+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
28+
29+
To provision this example, run the following from within this directory:
30+
- `terraform init` to get the plugins
31+
- `terraform plan` to see the infrastructure plan
32+
- `terraform apply` to apply the infrastructure build
33+
- `terraform destroy` to destroy the built infrastructure

‎examples/simple_autopilot_private_non_default_sa/main.tf

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "simple-ap-private-non-default-sa"
19+
network_name = "${local.cluster_type}-network"
20+
subnet_name = "${local.cluster_type}-subnet"
21+
master_auth_subnetwork = "${local.cluster_type}-master-subnet"
22+
pods_range_name = "ip-range-pods-${local.cluster_type}"
23+
svc_range_name = "ip-range-svc-${local.cluster_type}"
24+
subnet_names = [for subnet_self_link in module.gcp-network.subnets_self_links : split("/", subnet_self_link)[length(split("/", subnet_self_link)) - 1]]
25+
}
26+
27+
28+
data "google_client_config" "default" {}
29+
30+
provider "kubernetes" {
31+
host = "https://${module.gke.endpoint}"
32+
token = data.google_client_config.default.access_token
33+
cluster_ca_certificate = base64decode(module.gke.ca_certificate)
34+
}
35+
36+
module "gke" {
37+
source = "../../modules/beta-autopilot-private-cluster/"
38+
project_id = var.project_id
39+
name = "${local.cluster_type}-cluster"
40+
regional = true
41+
region = "us-central1"
42+
network = module.gcp-network.network_name
43+
subnetwork = local.subnet_names[index(module.gcp-network.subnets_names, local.subnet_name)]
44+
ip_range_pods = local.pods_range_name
45+
ip_range_services = local.svc_range_name
46+
release_channel = "REGULAR"
47+
enable_vertical_pod_autoscaling = true
48+
enable_private_endpoint = true
49+
enable_private_nodes = true
50+
master_ipv4_cidr_block = "172.16.0.0/28"
51+
datapath_provider = "ADVANCED_DATAPATH"
52+
53+
master_authorized_networks = [
54+
{
55+
cidr_block = "10.60.0.0/17"
56+
display_name = "VPC"
57+
},
58+
]
59+
}

‎examples/simple_autopilot_private_non_default_sa/network.tf

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "gcp-network" {
18+
source = "terraform-google-modules/network/google"
19+
version = ">= 4.0.1"
20+
21+
project_id = var.project_id
22+
network_name = local.network_name
23+
24+
subnets = [
25+
{
26+
subnet_name = local.subnet_name
27+
subnet_ip = "10.0.0.0/17"
28+
subnet_region = "us-central1"
29+
subnet_private_access = true
30+
},
31+
{
32+
subnet_name = local.master_auth_subnetwork
33+
subnet_ip = "10.60.0.0/17"
34+
subnet_region = "us-central1"
35+
},
36+
]
37+
38+
secondary_ranges = {
39+
(local.subnet_name) = [
40+
{
41+
range_name = local.pods_range_name
42+
ip_cidr_range = "192.168.0.0/18"
43+
},
44+
{
45+
range_name = local.svc_range_name
46+
ip_cidr_range = "192.168.64.0/18"
47+
},
48+
]
49+
}
50+
}

‎examples/simple_autopilot_private_non_default_sa/outputs.tf

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
description = "The cluster endpoint"
19+
sensitive = true
20+
value = module.gke.endpoint
21+
}
22+
23+
output "cluster_name" {
24+
description = "Cluster name"
25+
value = module.gke.name
26+
}
27+
28+
output "location" {
29+
value = module.gke.location
30+
}
31+
32+
output "master_kubernetes_version" {
33+
description = "Kubernetes version of the master"
34+
value = module.gke.master_version
35+
}
36+
37+
output "service_account" {
38+
description = "The service account to default running nodes as if not overridden in `node_pools`."
39+
value = module.gke.service_account
40+
}
41+
42+
output "network_name" {
43+
description = "The name of the VPC being created"
44+
value = module.gcp-network.network_name
45+
}
46+
47+
output "subnet_names" {
48+
description = "The names of the subnet being created"
49+
value = module.gcp-network.subnets_names
50+
}
51+
52+
output "region" {
53+
description = "The region in which the cluster resides"
54+
value = module.gke.region
55+
}
56+
57+
output "zones" {
58+
description = "List of zones in which the cluster resides"
59+
value = module.gke.zones
60+
}

‎examples/simple_autopilot_private_non_default_sa/variables.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}

‎examples/simple_autopilot_private_non_default_sa/versions.tf

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_providers {
19+
google = {
20+
source = "hashicorp/google"
21+
version = "~> 4.0"
22+
}
23+
kubernetes = {
24+
source = "hashicorp/kubernetes"
25+
}
26+
}
27+
required_version = ">= 0.13"
28+
}

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,15 @@ resource "google_container_cluster" "primary" {
7171
}
7272
}
7373
}
74+
cluster_autoscaling {
75+
dynamic "auto_provisioning_defaults" {
76+
for_each = var.create_service_account ? [1] : []
77+
78+
content {
79+
service_account = local.service_account
80+
}
81+
}
82+
}
7483
vertical_pod_autoscaling {
7584
enabled = var.enable_vertical_pod_autoscaling
7685
}

‎modules/beta-autopilot-private-cluster/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ terraform {
2121
required_providers {
2222
google-beta = {
2323
source = "hashicorp/google-beta"
24-
version = ">= 4.42.0, < 5.0"
24+
version = ">= 4.44.0, < 5.0"
2525
}
2626
kubernetes = {
2727
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,15 @@ resource "google_container_cluster" "primary" {
7171
}
7272
}
7373
}
74+
cluster_autoscaling {
75+
dynamic "auto_provisioning_defaults" {
76+
for_each = var.create_service_account ? [1] : []
77+
78+
content {
79+
service_account = local.service_account
80+
}
81+
}
82+
}
7483
vertical_pod_autoscaling {
7584
enabled = var.enable_vertical_pod_autoscaling
7685
}

‎modules/beta-autopilot-public-cluster/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ terraform {
2121
required_providers {
2222
google-beta = {
2323
source = "hashicorp/google-beta"
24-
version = ">= 4.42.0, < 5.0"
24+
version = ">= 4.44.0, < 5.0"
2525
}
2626
kubernetes = {
2727
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster-update-variant/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ terraform {
2121
required_providers {
2222
google-beta = {
2323
source = "hashicorp/google-beta"
24-
version = ">= 4.42.0, < 5.0"
24+
version = ">= 4.44.0, < 5.0"
2525
}
2626
kubernetes = {
2727
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ terraform {
2121
required_providers {
2222
google-beta = {
2323
source = "hashicorp/google-beta"
24-
version = ">= 4.42.0, < 5.0"
24+
version = ">= 4.44.0, < 5.0"
2525
}
2626
kubernetes = {
2727
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster-update-variant/versions.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ terraform {
2121
required_providers {
2222
google-beta = {
2323
source = "hashicorp/google-beta"
24-
version = ">= 4.42.0, < 5.0"
24+
version = ">= 4.44.0, < 5.0"
2525
}
2626
kubernetes = {
2727
source = "hashicorp/kubernetes"

0 commit comments

Comments
 (0)