You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/beta-private-cluster/README.md
+100-3Lines changed: 100 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -8,6 +8,8 @@ The resources/services/activations/deletions that this module will create/trigge
8
8
- Activate network policy if `network_policy` is true
9
9
- Add `ip-masq-agent` configmap with provided `non_masquerade_cidrs` if `network_policy` is true
10
10
11
+
**Note**: You must run Terraform from a VM on the same VPC as your cluster, otherwise there will be issues connecting to the GKE master.
12
+
11
13
## Usage
12
14
There are multiple examples included in the [examples](./examples/) folder but simple usage is as follows:
13
15
@@ -49,6 +51,14 @@ module "gke" {
49
51
},
50
52
]
51
53
54
+
node_pools_oauth_scopes = {
55
+
all = []
56
+
57
+
default-node-pool = [
58
+
"https://www.googleapis.com/auth/cloud-platform",
59
+
]
60
+
}
61
+
52
62
node_pools_labels = {
53
63
all = {}
54
64
@@ -94,13 +104,98 @@ Then perform the following commands on the root folder:
94
104
-`terraform apply` to apply the infrastructure build
95
105
-`terraform destroy` to destroy the built infrastructure
96
106
107
+
## Upgrade to v2.0.0
108
+
109
+
v2.0.0 is a breaking release. Refer to the
110
+
[Upgrading to v2.0 guide][upgrading-to-v2.0] for details.
111
+
97
112
## Upgrade to v1.0.0
98
113
99
114
Version 1.0.0 of this module introduces a breaking change: adding the `disable-legacy-endpoints` metadata field to all node pools. This metadata is required by GKE and [determines whether the `/0.1/` and `/v1beta1/` paths are available in the nodes' metadata server](https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#disable-legacy-apis). If your applications do not require access to the node's metadata server, you can leave the default value of `true` provided by the module. If your applications require access to the metadata server, be sure to read the linked documentation to see if you need to set the value for this field to `false` to allow your applications access to the above metadata server paths.
100
115
101
116
In either case, upgrading to module version `v1.0.0` will trigger a recreation of all node pools in the cluster.
102
117
103
118
[^]: (autogen_docs_start)
119
+
120
+
## Inputs
121
+
122
+
| Name | Description | Type | Default | Required |
123
+
|------|-------------|:----:|:-----:|:-----:|
124
+
| basic\_auth\_password | The password to be used with Basic Authentication. | string |`""`| no |
125
+
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string |`""`| no |
| deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | string |`"false"`| no |
128
+
| description | The description of the cluster | string |`""`| no |
129
+
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string |`"true"`| no |
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | string |`"0"`| no |
136
+
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | string |`"false"`| no |
137
+
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | string |`"60s"`| no |
138
+
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | string | n/a | yes |
139
+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | string | n/a | yes |
140
+
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | string |`"false"`| no |
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | string |`"latest"`| no |
144
+
| logging\_service | The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none | string |`"logging.googleapis.com"`| no |
145
+
| maintenance\_start\_time | Time window specified for daily maintenance operations in RFC3339 format | string |`"05:00"`| no |
146
+
| master\_authorized\_networks\_config | The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists)<br><br> ### example format ### master_authorized_networks_config = [{ cidr_blocks = [{ cidr_block = "10.0.0.0/8" display_name = "example_network" }], }]| list |`<list>`| no |
147
+
| master\_ipv4\_cidr\_block | (Beta) The IP range in CIDR notation to use for the hosted master network | string |`"10.0.0.0/28"`| no |
148
+
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | string |`"monitoring.googleapis.com"`| no |
149
+
| name | The name of the cluster (required) | string | n/a | yes |
150
+
| network | The VPC network to host the cluster in (required) | string | n/a | yes |
| network\_policy\_provider | The network policy provider. | string |`"CALICO"`| no |
153
+
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | string |`""`| no |
154
+
| node\_pools | List of maps containing node pools | list |`<list>`| no |
155
+
| node\_pools\_labels | Map of maps containing node labels by node-pool name | map |`<map>`| no |
156
+
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | map |`<map>`| no |
157
+
| node\_pools\_oauth\_scopes | Map of lists containing node oauth scopes by node-pool name | map |`<map>`| no |
158
+
| node\_pools\_tags | Map of lists containing node network tags by node-pool name | map |`<map>`| no |
159
+
| node\_pools\_taints | Map of lists containing node taints by node-pool name | map |`<map>`| no |
160
+
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string |`""`| no |
161
+
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list |`<list>`| no |
162
+
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list |`<list>`| no |
163
+
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
164
+
| region | The region to host the cluster in (required) | string | n/a | yes |
165
+
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | string |`"true"`| no |
166
+
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | string |`"false"`| no |
167
+
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The default value will cause a cluster-specific service account to be created. | string |`"create"`| no |
168
+
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map |`<map>`| no |
169
+
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |
170
+
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | list |`<list>`| no |
171
+
172
+
## Outputs
173
+
174
+
| Name | Description |
175
+
|------|-------------|
176
+
| ca\_certificate | Cluster ca certificate (base64 encoded) |
177
+
| cloudrun\_enabled | Whether CloudRun enabled |
178
+
| endpoint | Cluster endpoint |
179
+
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
0 commit comments