Skip to content

Commit e29578c

Browse files
christiangonrechristiangonre
committed
Merge branch 'master' into master
2 parents 8f2ba7e + c715a9c commit e29578c

File tree

41 files changed

+150
-69
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+150
-69
lines changed

‎.github/workflows/lint.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Copyright 2023 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'lint'
16+
17+
on:
18+
pull_request:
19+
branches:
20+
- master
21+
22+
concurrency:
23+
group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
24+
cancel-in-progress: true
25+
26+
jobs:
27+
lint:
28+
name: 'lint'
29+
runs-on: 'ubuntu-latest'
30+
steps:
31+
- uses: 'actions/checkout@v3'
32+
- id: variables
33+
run: |
34+
MAKEFILE=$(find . -name Makefile -print -quit)
35+
if [ ! -f $MAKEFILE ]; then
36+
echo dev-tools=gcr.io/cloud-foundation-cicd/cft/developer-tools:1 >> "$GITHUB_OUTPUT"
37+
else
38+
VERSION=$(grep "DOCKER_TAG_VERSION_DEVELOPER_TOOLS := " $MAKEFILE | cut -d\ -f3)
39+
IMAGE=$(grep "DOCKER_IMAGE_DEVELOPER_TOOLS := " $MAKEFILE | cut -d\ -f3)
40+
REGISTRY=$(grep "REGISTRY_URL := " $MAKEFILE | cut -d\ -f3)
41+
echo dev-tools=${REGISTRY}/${IMAGE}:${VERSION} >> "$GITHUB_OUTPUT"
42+
fi
43+
- run: docker run --rm -e EXCLUDE_LINT_DIRS -v ${{ github.workspace }}:/workspace ${{ steps.variables.outputs.dev-tools }} /usr/local/bin/test_lint.sh

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,7 @@ Then perform the following commands on the root folder:
200200
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
201201
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
202202
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
203-
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
203+
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
204204
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
205205
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
206206
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |

‎autogen/main/main.tf.tmpl

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -79,12 +79,8 @@ locals {
7979
cluster_type = var.regional ? "regional" : "zonal"
8080
{% if autopilot_cluster != true %}
8181
// auto upgrade by defaults only for regional cluster as long it has multiple masters versus zonal clusters have only have a single master so upgrades are more dangerous.
82-
{% if beta_cluster %}
83-
// When a release channel is used, node auto-upgrade are enabled and cannot be disabled.
84-
default_auto_upgrade = var.regional || var.release_channel != null ? true : false
85-
{% else %}
86-
default_auto_upgrade = var.regional ? true : false
87-
{% endif %}
82+
// When a release channel is used, node auto-upgrade is enabled and cannot be disabled.
83+
default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
8884
{% endif %}
8985

9086
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null

‎autogen/main/variables.tf.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -464,8 +464,8 @@ variable "identity_namespace" {
464464

465465
variable "release_channel" {
466466
type = string
467-
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`."
468-
default = null
467+
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
468+
default = "REGULAR"
469469
}
470470

471471
variable "gateway_api_channel" {
@@ -738,7 +738,7 @@ variable "cloudrun_load_balancer_type" {
738738

739739
variable "enable_pod_security_policy" {
740740
type = bool
741-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
741+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0."
742742
default = false
743743
}
744744

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ variable "kubernetes_version" {
7373

7474
variable "release_channel" {
7575
type = string
76-
description = "(Beta) The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
76+
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
7777
default = "REGULAR"
7878
}
7979

‎docs/upgrading_to_v26.0.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Upgrading to v26.0
2+
The v26.0 release of *kubernetes-engine* is a backwards incompatible
3+
release.
4+
5+
### release_channel now defaults to REGULAR
6+
7+
For all clusters `release_channel` now defaults to `REGULAR`, this was already
8+
the default for safer_cluster variants.
9+
10+
To opt out of using a release channel, set `release_channel` to `"UNSPECIFIED"`.
11+
12+
```diff
13+
module "gke" {
14+
- source = "terraform-google-modules/kubernetes-engine"
15+
- version = "~> 25.0"
16+
+ source = "terraform-google-modules/kubernetes-engine"
17+
+ version = "~> 26.0"
18+
...
19+
+ release_channel = "UNSPECIFIED"
20+
}
21+
```

‎examples/deploy_service/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ resource "kubernetes_pod" "nginx-example" {
5252

5353
spec {
5454
container {
55-
image = "nginx:1.23.4"
55+
image = "nginx:1.24.0"
5656
name = "nginx-example"
5757
}
5858
}

‎main.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ locals {
7070
zone_count = length(var.zones)
7171
cluster_type = var.regional ? "regional" : "zonal"
7272
// auto upgrade by defaults only for regional cluster as long it has multiple masters versus zonal clusters have only have a single master so upgrades are more dangerous.
73-
default_auto_upgrade = var.regional ? true : false
73+
// When a release channel is used, node auto-upgrade is enabled and cannot be disabled.
74+
default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
7475

7576
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
7677
cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ Then perform the following commands on the root folder:
118118
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
119119
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
120120
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
121-
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
121+
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
122122
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
123123
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
124124
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -301,8 +301,8 @@ variable "identity_namespace" {
301301

302302
variable "release_channel" {
303303
type = string
304-
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`."
305-
default = null
304+
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
305+
default = "REGULAR"
306306
}
307307

308308
variable "gateway_api_channel" {

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ Then perform the following commands on the root folder:
107107
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
108108
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
109109
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
110-
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
110+
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
111111
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
112112
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
113113
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -271,8 +271,8 @@ variable "identity_namespace" {
271271

272272
variable "release_channel" {
273273
type = string
274-
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`."
275-
default = null
274+
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
275+
default = "REGULAR"
276276
}
277277

278278
variable "gateway_api_channel" {

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ Then perform the following commands on the root folder:
191191
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
192192
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
193193
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
194-
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | `bool` | `false` | no |
194+
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
195195
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
196196
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | `bool` | `false` | no |
197197
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
@@ -250,7 +250,7 @@ Then perform the following commands on the root folder:
250250
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
251251
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
252252
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
253-
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
253+
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
254254
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
255255
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
256256
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,8 @@ locals {
7070
zone_count = length(var.zones)
7171
cluster_type = var.regional ? "regional" : "zonal"
7272
// auto upgrade by defaults only for regional cluster as long it has multiple masters versus zonal clusters have only have a single master so upgrades are more dangerous.
73-
// When a release channel is used, node auto-upgrade are enabled and cannot be disabled.
74-
default_auto_upgrade = var.regional || var.release_channel != null ? true : false
73+
// When a release channel is used, node auto-upgrade is enabled and cannot be disabled.
74+
default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
7575

7676
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
7777
cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -437,8 +437,8 @@ variable "identity_namespace" {
437437

438438
variable "release_channel" {
439439
type = string
440-
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`."
441-
default = null
440+
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
441+
default = "REGULAR"
442442
}
443443

444444
variable "gateway_api_channel" {
@@ -697,7 +697,7 @@ variable "cloudrun_load_balancer_type" {
697697

698698
variable "enable_pod_security_policy" {
699699
type = bool
700-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
700+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0."
701701
default = false
702702
}
703703

0 commit comments

Comments
 (0)