Skip to content

Commit da4b297

Browse files
paulpalamarchukpaulpalamarchuk
committed
Fix logic of skip_provisioners behavior
1 parent eb09369 commit da4b297

File tree

26 files changed

+64
-28
lines changed

26 files changed

+64
-28
lines changed

‎autogen/README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,12 +195,14 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
195195
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
196196
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
197197
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
198-
| region | The region to host the cluster in (required) | string | n/a | yes |
198+
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
199199
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
200+
| registry\_project\_id | Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project. | string | `""` | no |
200201
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
201202
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | string | `""` | no |
202203
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
203204
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
205+
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks down `stub_domains` and `upstream_nameservers` variables functionality. | bool | `"false"` | no |
204206
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
205207
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |
206208
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | list | `<list>` | no |

‎autogen/cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -433,7 +433,7 @@ resource "google_container_node_pool" "pools" {
433433
}
434434

435435
resource "null_resource" "wait_for_cluster" {
436-
count = var.skip_provisioners ? 1 : 0
436+
count = var.skip_provisioners ? 0 : 1
437437

438438
provisioner "local-exec" {
439439
command = "${path.module}/scripts/wait-for-cluster.sh ${var.project_id} ${var.name}"

‎autogen/dns.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
resource "null_resource" "delete_default_kube_dns_configmap" {
23-
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) || var.skip_provisioners ? 1 : 0
23+
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners ? 1 : 0
2424

2525
provisioner "local-exec" {
2626
command = "${path.module}/scripts/kubectl_wrapper.sh https://${local.cluster_endpoint} ${data.google_client_config.default.access_token} ${local.cluster_ca_certificate} ${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"

‎cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ resource "google_container_node_pool" "pools" {
227227
}
228228

229229
resource "null_resource" "wait_for_cluster" {
230-
count = var.skip_provisioners ? 1 : 0
230+
count = var.skip_provisioners ? 0 : 1
231231

232232
provisioner "local-exec" {
233233
command = "${path.module}/scripts/wait-for-cluster.sh ${var.project_id} ${var.name}"

‎dns.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
resource "null_resource" "delete_default_kube_dns_configmap" {
23-
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) || var.skip_provisioners ? 1 : 0
23+
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners ? 1 : 0
2424

2525
provisioner "local-exec" {
2626
command = "${path.module}/scripts/kubectl_wrapper.sh https://${local.cluster_endpoint} ${data.google_client_config.default.access_token} ${local.cluster_ca_certificate} ${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,12 +188,14 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
188188
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
189189
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
190190
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
191-
| region | The region to host the cluster in (required) | string | n/a | yes |
191+
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
192192
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
193+
| registry\_project\_id | Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project. | string | `""` | no |
193194
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
194195
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | string | `""` | no |
195196
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
196197
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
198+
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks down `stub_domains` and `upstream_nameservers` variables functionality. | bool | `"false"` | no |
197199
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
198200
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |
199201
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | list | `<list>` | no |
@@ -258,6 +260,9 @@ following project roles:
258260
- roles/iam.serviceAccountUser
259261
- roles/resourcemanager.projectIamAdmin (only required if `service_account` is set to `create`)
260262

263+
Additionally, if `service_account` is set to `create` and `grant_registry_access` is requested, the service account requires the following role on the `registry_project_id` project:
264+
- roles/resourcemanager.projectIamAdmin
265+
261266
### Enable APIs
262267
In order to operate with the Service Account you must activate the following APIs on the project where the Service Account was created:
263268

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,7 @@ resource "google_container_node_pool" "pools" {
401401
}
402402

403403
resource "null_resource" "wait_for_cluster" {
404+
count = var.skip_provisioners ? 0 : 1
404405

405406
provisioner "local-exec" {
406407
command = "${path.module}/scripts/wait-for-cluster.sh ${var.project_id} ${var.name}"

‎modules/beta-private-cluster-update-variant/dns.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
resource "null_resource" "delete_default_kube_dns_configmap" {
23-
count = local.custom_kube_dns_config || local.upstream_nameservers_config ? 1 : 0
23+
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners ? 1 : 0
2424

2525
provisioner "local-exec" {
2626
command = "${path.module}/scripts/kubectl_wrapper.sh https://${local.cluster_endpoint} ${data.google_client_config.default.access_token} ${local.cluster_ca_certificate} ${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ data "google_compute_zones" "available" {
2323
provider = google-beta
2424

2525
project = var.project_id
26-
region = var.region
26+
region = local.region
2727
}
2828

2929
resource "random_shuffle" "available_zones" {
@@ -34,6 +34,7 @@ resource "random_shuffle" "available_zones" {
3434
locals {
3535
// location
3636
location = var.regional ? var.region : var.zones[0]
37+
region = var.region == null ? join("-", slice(split("-", var.zones[0]), 0, 2)) : var.region
3738
// for regional cluster - use var.zones if provided, use available otherwise, for zonal cluster use var.zones with first element extracted
3839
node_locations = var.regional ? coalescelist(compact(var.zones), sort(random_shuffle.available_zones.result)) : slice(var.zones, 1, length(var.zones))
3940
// kuberentes version

‎modules/beta-private-cluster-update-variant/networks.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,6 @@ data "google_compute_subnetwork" "gke_subnetwork" {
2727
provider = google-beta
2828

2929
name = var.subnetwork
30-
region = var.region
30+
region = local.region
3131
project = local.network_project_id
3232
}

‎modules/beta-private-cluster-update-variant/sa.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ resource "google_project_iam_member" "cluster_service_account-monitoring_viewer"
6464

6565
resource "google_project_iam_member" "cluster_service_account-gcr" {
6666
count = var.create_service_account && var.grant_registry_access ? 1 : 0
67-
project = var.project_id
67+
project = var.registry_project_id == "" ? var.project_id : var.registry_project_id
6868
role = "roles/storage.objectViewer"
6969
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
7070
}

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@ variable "regional" {
4040

4141
variable "region" {
4242
type = string
43-
description = "The region to host the cluster in (required)"
43+
description = "The region to host the cluster in (optional if zonal cluster / required if regional)"
44+
default = null
4445
}
4546

4647
variable "zones" {
@@ -267,6 +268,12 @@ variable "grant_registry_access" {
267268
default = false
268269
}
269270

271+
variable "registry_project_id" {
272+
type = string
273+
description = "Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project."
274+
default = ""
275+
}
276+
270277
variable "service_account" {
271278
type = string
272279
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
@@ -302,6 +309,11 @@ variable "cluster_resource_labels" {
302309
default = {}
303310
}
304311

312+
variable "skip_provisioners" {
313+
type = bool
314+
description = "Flag to skip all local-exec provisioners. It breaks down `stub_domains` and `upstream_nameservers` variables functionality."
315+
default = false
316+
}
305317

306318
variable "deploy_using_private_endpoint" {
307319
type = bool

‎modules/beta-private-cluster/cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -328,7 +328,7 @@ resource "google_container_node_pool" "pools" {
328328
}
329329

330330
resource "null_resource" "wait_for_cluster" {
331-
count = var.skip_provisioners ? 1 : 0
331+
count = var.skip_provisioners ? 0 : 1
332332

333333
provisioner "local-exec" {
334334
command = "${path.module}/scripts/wait-for-cluster.sh ${var.project_id} ${var.name}"

‎modules/beta-private-cluster/dns.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
resource "null_resource" "delete_default_kube_dns_configmap" {
23-
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) || var.skip_provisioners ? 1 : 0
23+
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners ? 1 : 0
2424

2525
provisioner "local-exec" {
2626
command = "${path.module}/scripts/kubectl_wrapper.sh https://${local.cluster_endpoint} ${data.google_client_config.default.access_token} ${local.cluster_ca_certificate} ${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"

‎modules/beta-public-cluster/cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -323,7 +323,7 @@ resource "google_container_node_pool" "pools" {
323323
}
324324

325325
resource "null_resource" "wait_for_cluster" {
326-
count = var.skip_provisioners ? 1 : 0
326+
count = var.skip_provisioners ? 0 : 1
327327

328328
provisioner "local-exec" {
329329
command = "${path.module}/scripts/wait-for-cluster.sh ${var.project_id} ${var.name}"

‎modules/beta-public-cluster/dns.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
resource "null_resource" "delete_default_kube_dns_configmap" {
23-
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) || var.skip_provisioners ? 1 : 0
23+
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners ? 1 : 0
2424

2525
provisioner "local-exec" {
2626
command = "${path.module}/scripts/kubectl_wrapper.sh https://${local.cluster_endpoint} ${data.google_client_config.default.access_token} ${local.cluster_ca_certificate} ${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"

‎modules/private-cluster-update-variant/README.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,10 +174,12 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
174174
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
175175
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
176176
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
177-
| region | The region to host the cluster in (required) | string | n/a | yes |
177+
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
178178
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
179+
| registry\_project\_id | Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project. | string | `""` | no |
179180
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
180181
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
182+
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks down `stub_domains` and `upstream_nameservers` variables functionality. | bool | `"false"` | no |
181183
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map(list(string)) | `<map>` | no |
182184
| subnetwork | The subnetwork to host the cluster in (required) | string | n/a | yes |
183185
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | list | `<list>` | no |
@@ -237,6 +239,9 @@ following project roles:
237239
- roles/iam.serviceAccountUser
238240
- roles/resourcemanager.projectIamAdmin (only required if `service_account` is set to `create`)
239241

242+
Additionally, if `service_account` is set to `create` and `grant_registry_access` is requested, the service account requires the following role on the `registry_project_id` project:
243+
- roles/resourcemanager.projectIamAdmin
244+
240245
### Enable APIs
241246
In order to operate with the Service Account you must activate the following APIs on the project where the Service Account was created:
242247

‎modules/private-cluster-update-variant/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,7 @@ resource "google_container_node_pool" "pools" {
305305
}
306306

307307
resource "null_resource" "wait_for_cluster" {
308+
count = var.skip_provisioners ? 0 : 1
308309

309310
provisioner "local-exec" {
310311
command = "${path.module}/scripts/wait-for-cluster.sh ${var.project_id} ${var.name}"

‎modules/private-cluster-update-variant/dns.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
Delete default kube-dns configmap
2121
*****************************************/
2222
resource "null_resource" "delete_default_kube_dns_configmap" {
23-
count = local.custom_kube_dns_config || local.upstream_nameservers_config ? 1 : 0
23+
count = (local.custom_kube_dns_config || local.upstream_nameservers_config) && ! var.skip_provisioners ? 1 : 0
2424

2525
provisioner "local-exec" {
2626
command = "${path.module}/scripts/kubectl_wrapper.sh https://${local.cluster_endpoint} ${data.google_client_config.default.access_token} ${local.cluster_ca_certificate} ${path.module}/scripts/delete-default-resource.sh kube-system configmap kube-dns"

‎modules/private-cluster-update-variant/main.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ data "google_compute_zones" "available" {
2323
provider = google
2424

2525
project = var.project_id
26-
region = var.region
26+
region = local.region
2727
}
2828

2929
resource "random_shuffle" "available_zones" {
@@ -34,6 +34,7 @@ resource "random_shuffle" "available_zones" {
3434
locals {
3535
// location
3636
location = var.regional ? var.region : var.zones[0]
37+
region = var.region == null ? join("-", slice(split("-", var.zones[0]), 0, 2)) : var.region
3738
// for regional cluster - use var.zones if provided, use available otherwise, for zonal cluster use var.zones with first element extracted
3839
node_locations = var.regional ? coalescelist(compact(var.zones), sort(random_shuffle.available_zones.result)) : slice(var.zones, 1, length(var.zones))
3940
// kuberentes version

‎modules/private-cluster-update-variant/networks.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,6 @@ data "google_compute_subnetwork" "gke_subnetwork" {
2727
provider = google
2828

2929
name = var.subnetwork
30-
region = var.region
30+
region = local.region
3131
project = local.network_project_id
3232
}

‎modules/private-cluster-update-variant/sa.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ resource "google_project_iam_member" "cluster_service_account-monitoring_viewer"
6464

6565
resource "google_project_iam_member" "cluster_service_account-gcr" {
6666
count = var.create_service_account && var.grant_registry_access ? 1 : 0
67-
project = var.project_id
67+
project = var.registry_project_id == "" ? var.project_id : var.registry_project_id
6868
role = "roles/storage.objectViewer"
6969
member = "serviceAccount:${google_service_account.cluster_service_account[0].email}"
7070
}

‎modules/private-cluster-update-variant/variables.tf

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@ variable "regional" {
4040

4141
variable "region" {
4242
type = string
43-
description = "The region to host the cluster in (required)"
43+
description = "The region to host the cluster in (optional if zonal cluster / required if regional)"
44+
default = null
4445
}
4546

4647
variable "zones" {
@@ -257,6 +258,12 @@ variable "grant_registry_access" {
257258
default = false
258259
}
259260

261+
variable "registry_project_id" {
262+
type = string
263+
description = "Project holding the Google Container Registry. If empty, we use the cluster project. If grant_registry_access is true, storage.objectViewer role is assigned on this project."
264+
default = ""
265+
}
266+
260267
variable "service_account" {
261268
type = string
262269
description = "The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created."
@@ -292,6 +299,11 @@ variable "cluster_resource_labels" {
292299
default = {}
293300
}
294301

302+
variable "skip_provisioners" {
303+
type = bool
304+
description = "Flag to skip all local-exec provisioners. It breaks down `stub_domains` and `upstream_nameservers` variables functionality."
305+
default = false
306+
}
295307

296308
variable "deploy_using_private_endpoint" {
297309
type = bool

‎modules/private-cluster/cluster.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@ resource "google_container_node_pool" "pools" {
232232
}
233233

234234
resource "null_resource" "wait_for_cluster" {
235-
count = var.skip_provisioners ? 1 : 0
235+
count = var.skip_provisioners ? 0 : 1
236236

237237
provisioner "local-exec" {
238238
command = "${path.module}/scripts/wait-for-cluster.sh ${var.project_id} ${var.name}"

0 commit comments

Comments
 (0)