Skip to content

Commit ea8fe69

Browse files
DrFaust92DrFaust92
committed
make confidential_nodes GA
1 parent 59ca09e commit ea8fe69

File tree

27 files changed

+60
-10
lines changed

27 files changed

+60
-10
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ Then perform the following commands on the root folder:
143143
| description | The description of the cluster | `string` | `""` | no |
144144
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
145145
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
146+
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
146147
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
147148
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
148149
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,14 +53,13 @@ resource "google_container_cluster" "primary" {
5353
channel = release_channel.value.channel
5454
}
5555
}
56-
{% if beta_cluster %}
56+
5757
dynamic "confidential_nodes" {
5858
for_each = local.confidential_node_config
5959
content {
6060
enabled = confidential_nodes.value.enabled
6161
}
6262
}
63-
{% endif %}
6463

6564
subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"
6665

‎autogen/main/main.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,7 @@ locals {
200200
cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
201201
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
202202
}]
203+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
203204
{% if beta_cluster %}
204205
# BETA features
205206
cluster_istio_enabled = ! local.cluster_output_istio_disabled
@@ -208,7 +209,6 @@ locals {
208209
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
209210
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
210211
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
211-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
212212

213213
# /BETA features
214214
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -468,13 +468,13 @@ variable "shadow_firewall_rules_priority" {
468468
default = 999
469469
}
470470

471-
{% if beta_cluster %}
472471
variable "enable_confidential_nodes" {
473472
type = bool
474473
description = "An optional flag to enable confidential node config."
475474
default = false
476475
}
477476

477+
{% if beta_cluster %}
478478
variable "disable_default_snat" {
479479
type = bool
480480
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,13 @@ resource "google_container_cluster" "primary" {
4848
}
4949
}
5050

51+
dynamic "confidential_nodes" {
52+
for_each = local.confidential_node_config
53+
content {
54+
enabled = confidential_nodes.value.enabled
55+
}
56+
}
57+
5158
subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"
5259

5360
min_master_version = var.release_channel != null ? null : local.master_version

‎main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ locals {
142142
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
143143
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
144144
}]
145+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
145146

146147
cluster_maintenance_window_is_recurring = var.maintenance_recurrence != "" && var.maintenance_end_time != "" ? [1] : []
147148
cluster_maintenance_window_is_daily = length(local.cluster_maintenance_window_is_recurring) > 0 ? [] : [1]

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ resource "google_container_cluster" "primary" {
3939
channel = release_channel.value.channel
4040
}
4141
}
42+
4243
dynamic "confidential_nodes" {
4344
for_each = local.confidential_node_config
4445
content {

‎modules/beta-autopilot-private-cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,14 +121,14 @@ locals {
121121
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
122122
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
123123
}]
124+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
124125
# BETA features
125126
cluster_istio_enabled = !local.cluster_output_istio_disabled
126127
cluster_dns_cache_enabled = var.dns_cache
127128
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
128129
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
129130
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
130131
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
131-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
132132

133133
# /BETA features
134134

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ resource "google_container_cluster" "primary" {
3939
channel = release_channel.value.channel
4040
}
4141
}
42+
4243
dynamic "confidential_nodes" {
4344
for_each = local.confidential_node_config
4445
content {

‎modules/beta-autopilot-public-cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,14 +120,14 @@ locals {
120120
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
121121
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
122122
}]
123+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
123124
# BETA features
124125
cluster_istio_enabled = !local.cluster_output_istio_disabled
125126
cluster_dns_cache_enabled = var.dns_cache
126127
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
127128
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
128129
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
129130
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
130-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
131131

132132
# /BETA features
133133

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ resource "google_container_cluster" "primary" {
4747
channel = release_channel.value.channel
4848
}
4949
}
50+
5051
dynamic "confidential_nodes" {
5152
for_each = local.confidential_node_config
5253
content {

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,14 +166,14 @@ locals {
166166
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
167167
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
168168
}]
169+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
169170
# BETA features
170171
cluster_istio_enabled = !local.cluster_output_istio_disabled
171172
cluster_dns_cache_enabled = var.dns_cache
172173
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
173174
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
174175
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
175176
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
176-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
177177

178178
# /BETA features
179179

‎modules/beta-private-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ resource "google_container_cluster" "primary" {
4747
channel = release_channel.value.channel
4848
}
4949
}
50+
5051
dynamic "confidential_nodes" {
5152
for_each = local.confidential_node_config
5253
content {

‎modules/beta-private-cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,14 +166,14 @@ locals {
166166
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
167167
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
168168
}]
169+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
169170
# BETA features
170171
cluster_istio_enabled = !local.cluster_output_istio_disabled
171172
cluster_dns_cache_enabled = var.dns_cache
172173
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
173174
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
174175
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
175176
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
176-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
177177

178178
# /BETA features
179179

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ resource "google_container_cluster" "primary" {
4747
channel = release_channel.value.channel
4848
}
4949
}
50+
5051
dynamic "confidential_nodes" {
5152
for_each = local.confidential_node_config
5253
content {

‎modules/beta-public-cluster-update-variant/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,14 +165,14 @@ locals {
165165
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
166166
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
167167
}]
168+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
168169
# BETA features
169170
cluster_istio_enabled = !local.cluster_output_istio_disabled
170171
cluster_dns_cache_enabled = var.dns_cache
171172
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
172173
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
173174
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
174175
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
175-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
176176

177177
# /BETA features
178178

‎modules/beta-public-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ resource "google_container_cluster" "primary" {
4747
channel = release_channel.value.channel
4848
}
4949
}
50+
5051
dynamic "confidential_nodes" {
5152
for_each = local.confidential_node_config
5253
content {

‎modules/beta-public-cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,14 +165,14 @@ locals {
165165
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
166166
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
167167
}]
168+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
168169
# BETA features
169170
cluster_istio_enabled = !local.cluster_output_istio_disabled
170171
cluster_dns_cache_enabled = var.dns_cache
171172
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
172173
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
173174
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
174175
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
175-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
176176

177177
# /BETA features
178178

‎modules/private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ Then perform the following commands on the root folder:
172172
| description | The description of the cluster | `string` | `""` | no |
173173
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
174174
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
175+
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
175176
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
176177
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
177178
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | `bool` | `false` | no |

‎modules/private-cluster-update-variant/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,13 @@ resource "google_container_cluster" "primary" {
4848
}
4949
}
5050

51+
dynamic "confidential_nodes" {
52+
for_each = local.confidential_node_config
53+
content {
54+
enabled = confidential_nodes.value.enabled
55+
}
56+
}
57+
5158
subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"
5259

5360
min_master_version = var.release_channel != null ? null : local.master_version

‎modules/private-cluster-update-variant/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ locals {
143143
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
144144
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
145145
}]
146+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
146147

147148
cluster_maintenance_window_is_recurring = var.maintenance_recurrence != "" && var.maintenance_end_time != "" ? [1] : []
148149
cluster_maintenance_window_is_daily = length(local.cluster_maintenance_window_is_recurring) > 0 ? [] : [1]

‎modules/private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -414,6 +414,12 @@ variable "shadow_firewall_rules_priority" {
414414
default = 999
415415
}
416416

417+
variable "enable_confidential_nodes" {
418+
type = bool
419+
description = "An optional flag to enable confidential node config."
420+
default = false
421+
}
422+
417423

418424
variable "network_policy" {
419425
type = bool

‎modules/private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,7 @@ Then perform the following commands on the root folder:
150150
| description | The description of the cluster | `string` | `""` | no |
151151
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
152152
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
153+
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
153154
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
154155
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
155156
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | `bool` | `false` | no |

‎modules/private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,13 @@ resource "google_container_cluster" "primary" {
4848
}
4949
}
5050

51+
dynamic "confidential_nodes" {
52+
for_each = local.confidential_node_config
53+
content {
54+
enabled = confidential_nodes.value.enabled
55+
}
56+
}
57+
5158
subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"
5259

5360
min_master_version = var.release_channel != null ? null : local.master_version

‎modules/private-cluster/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ locals {
143143
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
144144
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
145145
}]
146+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
146147

147148
cluster_maintenance_window_is_recurring = var.maintenance_recurrence != "" && var.maintenance_end_time != "" ? [1] : []
148149
cluster_maintenance_window_is_daily = length(local.cluster_maintenance_window_is_recurring) > 0 ? [] : [1]

‎modules/private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -414,6 +414,12 @@ variable "shadow_firewall_rules_priority" {
414414
default = 999
415415
}
416416

417+
variable "enable_confidential_nodes" {
418+
type = bool
419+
description = "An optional flag to enable confidential node config."
420+
default = false
421+
}
422+
417423

418424
variable "network_policy" {
419425
type = bool

‎variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -390,6 +390,12 @@ variable "shadow_firewall_rules_priority" {
390390
default = 999
391391
}
392392

393+
variable "enable_confidential_nodes" {
394+
type = bool
395+
description = "An optional flag to enable confidential node config."
396+
default = false
397+
}
398+
393399

394400
variable "network_policy" {
395401
type = bool

0 commit comments

Comments
 (0)