Skip to content

Commit da84802

Browse files
bharathkkbbharathkkb
authored
Merge branch 'master' into fix/global-master-access
2 parents c4e37a8 + 5f468fd commit da84802

File tree

113 files changed

+644
-431
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

113 files changed

+644
-431
lines changed

‎.github/renovate.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,16 @@
2525
"groupName": "GO modules",
2626
"postUpdateOptions": ["gomodTidy"],
2727
"separateMajorMinor":false
28+
},
29+
{
30+
"matchPackageNames": ["go"],
31+
"allowedVersions": "<1.19.0",
32+
"postUpdateOptions": ["gomodTidy"]
33+
},
34+
{
35+
"matchPackageNames": ["google", "google-beta"],
36+
"groupName": "terraform googles",
37+
"separateMajorMinor": false
2838
}
2939
]
3040
}

‎.github/workflows/stale.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2021 Google LLC
1+
# Copyright 2022 Google LLC
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.

‎CHANGELOG.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
66

77
Extending the adopted spec, each change should have a link to its corresponding pull request appended.
88

9+
## [23.3.0](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/compare/v23.2.0...v23.3.0) (2022-10-28)
10+
11+
12+
### Features
13+
14+
* move vpa out of beta ([df16cda](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/commit/df16cda06d692842ac124bb1bb28353656ee9205))
15+
16+
17+
### Bug Fixes
18+
19+
* Exposing VPA to GA module ([#1404](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/1404)) ([df16cda](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/commit/df16cda06d692842ac124bb1bb28353656ee9205))
20+
* incorrect `node_pools` variable type ([#1424](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/1424)) ([faaee19](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/commit/faaee19d4989cb974d61f6a3f35f6f5b0a866848))
21+
* Truncating hub membership ID when greater than 63 character ([#1429](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/1429)) ([0c5660d](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/commit/0c5660d8399fc0a236eff0dbdfeacef5d5ca7706))
22+
* use dynamic block for accelerators, updates for CI ([#1428](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/1428)) ([0304a20](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/commit/0304a2074bf9d9d8e4b23b52448837c216e3d03b))
23+
924
## [23.2.0](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/compare/v23.1.0...v23.2.0) (2022-09-27)
1025

1126

‎README.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ Then perform the following commands on the root folder:
178178
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
179179
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
180180
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA"` | no |
181-
| node\_pools | List of maps containing node pools | `list(map(string))` | <pre>[<br> {<br> "name": "default-node-pool"<br> }<br>]</pre> | no |
181+
| node\_pools | List of maps containing node pools | `list(map(any))` | <pre>[<br> {<br> "name": "default-node-pool"<br> }<br>]</pre> | no |
182182
| node\_pools\_labels | Map of maps containing node labels by node-pool name | `map(map(string))` | <pre>{<br> "all": {},<br> "default-node-pool": {}<br>}</pre> | no |
183183
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name | `map(map(string))` | <pre>{<br> "all": {},<br> "default-node-pool": {}<br>}</pre> | no |
184184
| node\_pools\_oauth\_scopes | Map of lists containing node oauth scopes by node-pool name | `map(list(string))` | <pre>{<br> "all": [<br> "https://www.googleapis.com/auth/cloud-platform"<br> ],<br> "default-node-pool": []<br>}</pre> | no |
@@ -194,6 +194,7 @@ Then perform the following commands on the root folder:
194194
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
195195
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
196196
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. | `string` | `""` | no |
197+
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |
197198
| shadow\_firewall\_rules\_priority | The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000. | `number` | `999` | no |
198199
| skip\_provisioners | Flag to skip all local-exec provisioners. It breaks `stub_domains` and `upstream_nameservers` variables functionality. | `bool` | `false` | no |
199200
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | `map(list(string))` | `{}` | no |
@@ -228,6 +229,7 @@ Then perform the following commands on the root folder:
228229
| release\_channel | The release channel of this cluster |
229230
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
230231
| type | Cluster type (regional / zonal) |
232+
| vertical\_pod\_autoscaling\_enabled | Whether vertical pod autoscaling enabled |
231233
| zones | List of zones in which the cluster resides |
232234

233235
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
@@ -245,6 +247,7 @@ The node_pools variable takes the following parameters:
245247
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
246248
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
247249
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
250+
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
248251
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
249252
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
250253
| effect | Effect for the taint | | Required |

‎autogen/main/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@ The node_pools variable takes the following parameters:
186186
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
187187
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
188188
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
189+
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
189190
{% if beta_cluster %}
190191
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
191192
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |

‎autogen/main/cluster.tf.tmpl

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@ resource "google_container_cluster" "primary" {
5454
}
5555
}
5656
{% if beta_cluster %}
57+
dynamic "cost_management_config" {
58+
for_each = var.enable_cost_allocation ? [1] : []
59+
content {
60+
enabled = var.enable_cost_allocation
61+
}
62+
}
5763
dynamic "confidential_nodes" {
5864
for_each = local.confidential_node_config
5965
content {
@@ -202,6 +208,13 @@ resource "google_container_cluster" "primary" {
202208
}
203209
}
204210

211+
dynamic "service_external_ips_config" {
212+
for_each = var.service_external_ips ? [1] : []
213+
content {
214+
enabled = var.service_external_ips
215+
}
216+
}
217+
205218
addons_config {
206219
http_load_balancing {
207220
disabled = !var.http_load_balancing
@@ -616,6 +629,7 @@ resource "google_container_node_pool" "windows_pools" {
616629
content {
617630
min_node_count = lookup(autoscaling.value, "min_count", 1)
618631
max_node_count = lookup(autoscaling.value, "max_count", 100)
632+
location_policy = lookup(autoscaling.value, "location_policy", null)
619633
}
620634
}
621635

@@ -720,17 +734,14 @@ resource "google_container_node_pool" "windows_pools" {
720734
local.node_pools_oauth_scopes[each.value["name"]],
721735
)
722736

723-
guest_accelerator = [
724-
for guest_accelerator in lookup(each.value, "accelerator_count", 0) > 0 ? [{
737+
dynamic "guest_accelerator" {
738+
for_each = lookup(each.value, "accelerator_count", 0) > 0 ? [1] : []
739+
content {
725740
type = lookup(each.value, "accelerator_type", "")
726741
count = lookup(each.value, "accelerator_count", 0)
727-
gpu_partition_size = lookup(each.value, "gpu_partition_size", null)
728-
}] : [] : {
729-
type = guest_accelerator["type"]
730-
count = guest_accelerator["count"]
731-
gpu_partition_size = guest_accelerator["gpu_partition_size"]
742+
gpu_partition_size = lookup(each.value, "gpu_partition_size", null)
732743
}
733-
]
744+
}
734745

735746
dynamic "workload_metadata_config" {
736747
for_each = local.cluster_node_metadata_config
@@ -748,8 +759,6 @@ resource "google_container_node_pool" "windows_pools" {
748759
}
749760
}
750761

751-
boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")
752-
753762
dynamic "kubelet_config" {
754763
for_each = length(setintersection(
755764
keys(each.value),
@@ -780,6 +789,8 @@ resource "google_container_node_pool" "windows_pools" {
780789
{% endif %}
781790
{% endif %}
782791

792+
boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")
793+
783794
shielded_instance_config {
784795
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
785796
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)

‎autogen/main/main.tf.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -149,13 +149,13 @@ locals {
149149
cluster_output_network_policy_enabled = google_container_cluster.primary.addons_config.0.network_policy_config.0.disabled
150150
cluster_output_http_load_balancing_enabled = google_container_cluster.primary.addons_config.0.http_load_balancing.0.disabled
151151
cluster_output_horizontal_pod_autoscaling_enabled = google_container_cluster.primary.addons_config.0.horizontal_pod_autoscaling.0.disabled
152+
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling.0.enabled : false
152153

153154
{% if beta_cluster %}
154155
# BETA features
155156
cluster_output_istio_disabled = google_container_cluster.primary.addons_config.0.istio_config != null && length(google_container_cluster.primary.addons_config.0.istio_config) == 1 ? google_container_cluster.primary.addons_config.0.istio_config.0.disabled : false
156157
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config.0.enabled : false
157158
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
158-
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling.0.enabled : false
159159
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config.0.enabled : false
160160

161161
# /BETA features
@@ -206,6 +206,7 @@ locals {
206206
{% endif %}
207207
cluster_http_load_balancing_enabled = ! local.cluster_output_http_load_balancing_enabled
208208
cluster_horizontal_pod_autoscaling_enabled = ! local.cluster_output_horizontal_pod_autoscaling_enabled
209+
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
209210
workload_identity_enabled = ! (var.identity_namespace == null || var.identity_namespace == "null")
210211
cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
211212
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
@@ -217,7 +218,6 @@ locals {
217218
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
218219
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
219220
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
220-
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
221221
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
222222

223223
# /BETA features

‎autogen/main/outputs.tf.tmpl

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,11 @@ output "horizontal_pod_autoscaling_enabled" {
124124
value = local.cluster_horizontal_pod_autoscaling_enabled
125125
}
126126

127+
output "vertical_pod_autoscaling_enabled" {
128+
description = "Whether vertical pod autoscaling enabled"
129+
value = local.cluster_vertical_pod_autoscaling_enabled
130+
}
131+
127132
{% if autopilot_cluster != true %}
128133
output "node_pools_names" {
129134
description = "List of node pools names"
@@ -203,11 +208,6 @@ output "intranode_visibility_enabled" {
203208
value = local.cluster_intranode_visibility_enabled
204209
}
205210

206-
output "vertical_pod_autoscaling_enabled" {
207-
description = "Whether veritical pod autoscaling is enabled"
208-
value = local.cluster_vertical_pod_autoscaling_enabled
209-
}
210-
211211
output "identity_service_enabled" {
212212
description = "Whether Identity Service is enabled"
213213
value = local.cluster_pod_security_policy_enabled

‎autogen/main/variables.tf.tmpl

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,12 @@ variable "http_load_balancing" {
9696
default = true
9797
}
9898

99+
variable "service_external_ips" {
100+
type = bool
101+
description = "Whether external ips specified by a service will be allowed in this cluster"
102+
default = false
103+
}
104+
99105
variable "datapath_provider" {
100106
type = string
101107
description = "The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature."
@@ -138,7 +144,7 @@ variable "ip_range_services" {
138144

139145
{% if autopilot_cluster != true %}
140146
variable "node_pools" {
141-
type = list(map(string))
147+
type = list(map(any))
142148
description = "List of maps containing node pools"
143149

144150
default = [
@@ -190,6 +196,13 @@ variable "node_pools_linux_node_configs_sysctls" {
190196
{% endif %}
191197
{% endif %}
192198

199+
{% if beta_cluster %}
200+
variable "enable_cost_allocation" {
201+
type = bool
202+
description = "Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery"
203+
default = false
204+
}
205+
{% endif %}
193206
variable "resource_usage_export_dataset_id" {
194207
type = string
195208
description = "The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export."

‎autogen/main/versions.tf.tmpl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,29 +24,29 @@ terraform {
2424
required_providers {
2525
google-beta = {
2626
source = "hashicorp/google-beta"
27-
version = ">= 4.29.0, < 5.0"
27+
version = ">= 4.36.0, < 5.0"
2828
}
2929
kubernetes = {
3030
source = "hashicorp/kubernetes"
3131
version = "~> 2.10"
3232
}
3333
}
3434
provider_meta "google-beta" {
35-
module_name = "blueprints/terraform/terraform-google-kubernetes-engine{% if module_registry_name %}:{{ module_registry_name }}{% endif %}/v23.2.0"
35+
module_name = "blueprints/terraform/terraform-google-kubernetes-engine{% if module_registry_name %}:{{ module_registry_name }}{% endif %}/v23.3.0"
3636
}
3737
{% else %}
3838
required_providers {
3939
google = {
4040
source = "hashicorp/google"
41-
version = ">= 4.29.0, < 5.0"
41+
version = ">= 4.36.0, < 5.0"
4242
}
4343
kubernetes = {
4444
source = "hashicorp/kubernetes"
4545
version = "~> 2.10"
4646
}
4747
}
4848
provider_meta "google" {
49-
module_name = "blueprints/terraform/terraform-google-kubernetes-engine{% if module_registry_name %}:{{ module_registry_name }}{% endif %}/v23.2.0"
49+
module_name = "blueprints/terraform/terraform-google-kubernetes-engine{% if module_registry_name %}:{{ module_registry_name }}{% endif %}/v23.3.0"
5050
}
5151
{% endif %}
5252
}

‎autogen/safer-cluster/versions.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,6 @@ terraform {
2323
required_version = ">=0.13"
2424

2525
provider_meta "google-beta" {
26-
module_name = "blueprints/terraform/terraform-google-kubernetes-engine{% if module_registry_name %}:{{ module_registry_name }}{% endif %}/v23.2.0"
26+
module_name = "blueprints/terraform/terraform-google-kubernetes-engine{% if module_registry_name %}:{{ module_registry_name }}{% endif %}/v23.3.0"
2727
}
2828
}

‎build/int.cloudbuild.yaml

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -131,21 +131,22 @@ steps:
131131
- verify simple-regional-with-networking-local
132132
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
133133
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-regional-with-networking-local']
134-
- id: converge simple-zonal-local
135-
waitFor:
136-
- create all
137-
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
138-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge simple-zonal-local']
139-
- id: verify simple-zonal-local
140-
waitFor:
141-
- converge simple-zonal-local
142-
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
143-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify simple-zonal-local']
144-
- id: destroy simple-zonal-local
145-
waitFor:
146-
- verify simple-zonal-local
147-
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
148-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-zonal-local']
134+
# TODO(bharathkkb): https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/1431
135+
# - id: converge simple-zonal-local
136+
# waitFor:
137+
# - create all
138+
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
139+
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge simple-zonal-local']
140+
# - id: verify simple-zonal-local
141+
# waitFor:
142+
# - converge simple-zonal-local
143+
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
144+
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify simple-zonal-local']
145+
# - id: destroy simple-zonal-local
146+
# waitFor:
147+
# - verify simple-zonal-local
148+
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
149+
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-zonal-local']
149150
- id: converge simple-zonal-private-local
150151
waitFor:
151152
- create all

0 commit comments

Comments
 (0)