diff --git a/modules/gke-cluster-autopilot/README.md b/modules/gke-cluster-autopilot/README.md index 44bfe86d03..00f6842c82 100644 --- a/modules/gke-cluster-autopilot/README.md +++ b/modules/gke-cluster-autopilot/README.md @@ -206,25 +206,25 @@ module "cluster-1" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [location](variables.tf#L117) | Autopilot clusters are always regional. | string | ✓ | | -| [name](variables.tf#L194) | Cluster name. | string | ✓ | | -| [project_id](variables.tf#L239) | Cluster project ID. | string | ✓ | | -| [vpc_config](variables.tf#L255) | VPC-level configuration. | object({…}) | ✓ | | +| [location](variables.tf#L118) | Autopilot clusters are always regional. | string | ✓ | | +| [name](variables.tf#L195) | Cluster name. | string | ✓ | | +| [project_id](variables.tf#L240) | Cluster project ID. | string | ✓ | | +| [vpc_config](variables.tf#L256) | VPC-level configuration. | object({…}) | ✓ | | | [backup_configs](variables.tf#L17) | Configuration for Backup for GKE. | object({…}) | | {} | | [deletion_protection](variables.tf#L38) | Whether or not to allow Terraform to destroy the cluster. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. | bool | | true | | [description](variables.tf#L45) | Cluster description. | string | | null | | [enable_addons](variables.tf#L51) | Addons enabled in the cluster (true means enabled). | object({…}) | | {} | -| [enable_features](variables.tf#L65) | Enable cluster-level features. Certain features allow configuration. | object({…}) | | {} | -| [issue_client_certificate](variables.tf#L105) | Enable issuing client certificate. | bool | | false | -| [labels](variables.tf#L111) | Cluster resource labels. | map(string) | | null | -| [logging_config](variables.tf#L122) | Logging configuration. | object({…}) | | {} | -| [maintenance_config](variables.tf#L133) | Maintenance window configuration. | object({…}) | | {…} | -| [min_master_version](variables.tf#L156) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null | -| [monitoring_config](variables.tf#L162) | Monitoring configuration. System metrics collection cannot be disabled. Control plane metrics are optional. Kube state metrics are optional. Google Cloud Managed Service for Prometheus is enabled by default. | object({…}) | | {} | -| [node_config](variables.tf#L199) | Configuration for nodes and nodepools. | object({…}) | | {} | -| [node_locations](variables.tf#L218) | Zones in which the cluster's nodes are located. | list(string) | | [] | -| [private_cluster_config](variables.tf#L225) | Private cluster configuration. | object({…}) | | null | -| [release_channel](variables.tf#L244) | Release channel for GKE upgrades. Clusters created in the Autopilot mode must use a release channel. Choose between \"RAPID\", \"REGULAR\", and \"STABLE\". | string | | "REGULAR" | +| [enable_features](variables.tf#L65) | Enable cluster-level features. Certain features allow configuration. | object({…}) | | {} | +| [issue_client_certificate](variables.tf#L106) | Enable issuing client certificate. | bool | | false | +| [labels](variables.tf#L112) | Cluster resource labels. | map(string) | | null | +| [logging_config](variables.tf#L123) | Logging configuration. | object({…}) | | {} | +| [maintenance_config](variables.tf#L134) | Maintenance window configuration. | object({…}) | | {…} | +| [min_master_version](variables.tf#L157) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null | +| [monitoring_config](variables.tf#L163) | Monitoring configuration. System metrics collection cannot be disabled. Control plane metrics are optional. Kube state metrics are optional. Google Cloud Managed Service for Prometheus is enabled by default. | object({…}) | | {} | +| [node_config](variables.tf#L200) | Configuration for nodes and nodepools. | object({…}) | | {} | +| [node_locations](variables.tf#L219) | Zones in which the cluster's nodes are located. | list(string) | | [] | +| [private_cluster_config](variables.tf#L226) | Private cluster configuration. | object({…}) | | null | +| [release_channel](variables.tf#L245) | Release channel for GKE upgrades. Clusters created in the Autopilot mode must use a release channel. Choose between \"RAPID\", \"REGULAR\", and \"STABLE\". | string | | "REGULAR" | ## Outputs diff --git a/modules/gke-cluster-autopilot/main.tf b/modules/gke-cluster-autopilot/main.tf index 6e73b66cad..f9c4a85f27 100644 --- a/modules/gke-cluster-autopilot/main.tf +++ b/modules/gke-cluster-autopilot/main.tf @@ -57,35 +57,30 @@ resource "google_container_cluster" "cluster" { enabled = var.backup_configs.enable_backup_agent } } - dynamic "authenticator_groups_config" { for_each = var.enable_features.groups_for_rbac != null ? [""] : [] content { security_group = var.enable_features.groups_for_rbac } } - dynamic "binary_authorization" { for_each = var.enable_features.binary_authorization ? [""] : [] content { evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE" } } - dynamic "cost_management_config" { for_each = var.enable_features.cost_management == true ? [""] : [] content { enabled = true } } - cluster_autoscaling { auto_provisioning_defaults { boot_disk_kms_key = var.node_config.boot_disk_kms_key service_account = var.node_config.service_account } } - dynamic "database_encryption" { for_each = var.enable_features.database_encryption != null ? [""] : [] content { @@ -93,14 +88,12 @@ resource "google_container_cluster" "cluster" { key_name = var.enable_features.database_encryption.key_name } } - dynamic "default_snat_status" { for_each = var.vpc_config.disable_default_snat == null ? [] : [""] content { disabled = var.vpc_config.disable_default_snat } } - dynamic "dns_config" { for_each = var.enable_features.dns != null ? [""] : [] content { @@ -121,7 +114,6 @@ resource "google_container_cluster" "cluster" { channel = "CHANNEL_STANDARD" } } - dynamic "ip_allocation_policy" { for_each = var.vpc_config.secondary_range_blocks != null ? [""] : [] content { @@ -136,7 +128,6 @@ resource "google_container_cluster" "cluster" { } } } - dynamic "ip_allocation_policy" { for_each = var.vpc_config.secondary_range_names != null ? [""] : [] content { @@ -151,7 +142,6 @@ resource "google_container_cluster" "cluster" { } } } - logging_config { enable_components = toset(compact([ var.logging_config.enable_api_server_logs ? "APISERVER" : null, @@ -161,7 +151,6 @@ resource "google_container_cluster" "cluster" { "WORKLOADS", ])) } - maintenance_policy { dynamic "daily_maintenance_window" { for_each = ( @@ -205,13 +194,11 @@ resource "google_container_cluster" "cluster" { } } } - master_auth { client_certificate_config { issue_client_certificate = var.issue_client_certificate } } - dynamic "master_authorized_networks_config" { for_each = var.vpc_config.master_authorized_ranges != null ? [""] : [] content { @@ -225,14 +212,12 @@ resource "google_container_cluster" "cluster" { } } } - dynamic "mesh_certificates" { for_each = var.enable_features.mesh_certificates != null ? [""] : [] content { enable_certificates = var.enable_features.mesh_certificates } } - monitoring_config { enable_components = toset(compact([ # System metrics collection cannot be disabled for Autopilot clusters. @@ -253,7 +238,6 @@ resource "google_container_cluster" "cluster" { enabled = var.monitoring_config.enable_managed_prometheus } } - dynamic "notification_config" { for_each = var.enable_features.upgrade_notifications != null ? [""] : [] content { @@ -267,7 +251,6 @@ resource "google_container_cluster" "cluster" { } } } - dynamic "node_pool_auto_config" { for_each = var.node_config.tags != null ? [""] : [] content { @@ -276,7 +259,6 @@ resource "google_container_cluster" "cluster" { } } } - dynamic "private_cluster_config" { for_each = ( var.private_cluster_config != null ? [""] : [] @@ -291,13 +273,18 @@ resource "google_container_cluster" "cluster" { } } } - dynamic "pod_security_policy_config" { for_each = var.enable_features.pod_security_policy ? [""] : [] content { enabled = var.enable_features.pod_security_policy } } + dynamic "secret_manager_config" { + for_each = var.enable_features.secret_manager_config != null ? [""] : [] + content { + enabled = var.enable_features.secret_manager_config + } + } dynamic "security_posture_config" { for_each = var.enable_features.security_posture_config != null ? [""] : [] content { @@ -308,7 +295,6 @@ resource "google_container_cluster" "cluster" { release_channel { channel = var.release_channel } - dynamic "resource_usage_export_config" { for_each = ( try(var.enable_features.resource_usage_export.dataset, null) != null @@ -333,7 +319,6 @@ resource "google_container_cluster" "cluster" { enabled = var.enable_features.service_external_ips } } - dynamic "vertical_pod_autoscaling" { for_each = var.enable_features.vertical_pod_autoscaling ? [""] : [] content { diff --git a/modules/gke-cluster-autopilot/variables.tf b/modules/gke-cluster-autopilot/variables.tf index 679ded6ecd..3bc87f283d 100644 --- a/modules/gke-cluster-autopilot/variables.tf +++ b/modules/gke-cluster-autopilot/variables.tf @@ -77,11 +77,12 @@ variable "enable_features" { state = string key_name = string })) - gateway_api = optional(bool, false) - groups_for_rbac = optional(string) - l4_ilb_subsetting = optional(bool, false) - mesh_certificates = optional(bool) - pod_security_policy = optional(bool, false) + gateway_api = optional(bool, false) + groups_for_rbac = optional(string) + l4_ilb_subsetting = optional(bool, false) + mesh_certificates = optional(bool) + pod_security_policy = optional(bool, false) + secret_manager_config = optional(bool) security_posture_config = optional(object({ mode = string vulnerability_mode = string diff --git a/modules/gke-cluster-standard/README.md b/modules/gke-cluster-standard/README.md index 00764e85f5..24e2fb7216 100644 --- a/modules/gke-cluster-standard/README.md +++ b/modules/gke-cluster-standard/README.md @@ -80,9 +80,10 @@ module "cluster-1" { master_global_access = false } enable_features = { - dataplane_v2 = true - fqdn_network_policy = true - workload_identity = true + dataplane_v2 = true + fqdn_network_policy = true + secret_manager_config = true + workload_identity = true } labels = { environment = "dev" @@ -93,7 +94,7 @@ module "cluster-1" { ### Managing GKE logs -This example shows you how to [control which logs are sent from your GKE cluster to Cloud Logging](https://cloud.google.com/stackdriver/docs/solutions/gke/installing). +This example shows you how to [control which logs are sent from your GKE cluster to Cloud Logging](https://cloud.google.com/stackdriver/docs/solutions/gke/installing). When you create a new GKE cluster, [Cloud Operations for GKE](https://cloud.google.com/stackdriver/docs/solutions/gke) integration with Cloud Logging is enabled by default and [System logs](https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs#what_logs) are collected. You can enable collection of several other [types of logs](https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs#what_logs). The following example enables collection of *all* optional logs. @@ -253,8 +254,8 @@ module "cluster-1" { [Backup for GKE](https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/concepts/backup-for-gke) is a service for backing up and restoring workloads in GKE clusters. It has two components: -* A [Google Cloud API](https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/reference/rest) that serves as the control plane for the service. -* A GKE add-on (the [Backup for GKE agent](https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/concepts/backup-for-gke#agent_overview)) that must be enabled in each cluster for which you wish to perform backup and restore operations. +- A [Google Cloud API](https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/reference/rest) that serves as the control plane for the service. +- A GKE add-on (the [Backup for GKE agent](https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/concepts/backup-for-gke#agent_overview)) that must be enabled in each cluster for which you wish to perform backup and restore operations. This example shows how to [enable Backup for GKE on a new zonal GKE Standard cluster](https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/how-to/install#enable_on_a_new_cluster_optional) and [plan a set of backups](https://cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/how-to/backup-plan). @@ -352,28 +353,28 @@ module "cluster-1" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [location](variables.tf#L242) | Cluster zone or region. | string | ✓ | | -| [name](variables.tf#L354) | Cluster name. | string | ✓ | | -| [project_id](variables.tf#L401) | Cluster project id. | string | ✓ | | -| [vpc_config](variables.tf#L412) | VPC-level configuration. | object({…}) | ✓ | | +| [location](variables.tf#L243) | Cluster zone or region. | string | ✓ | | +| [name](variables.tf#L355) | Cluster name. | string | ✓ | | +| [project_id](variables.tf#L402) | Cluster project id. | string | ✓ | | +| [vpc_config](variables.tf#L413) | VPC-level configuration. | object({…}) | ✓ | | | [backup_configs](variables.tf#L18) | Configuration for Backup for GKE. | object({…}) | | {} | | [cluster_autoscaling](variables.tf#L40) | Enable and configure limits for Node Auto-Provisioning with Cluster Autoscaler. | object({…}) | | null | | [default_nodepool](variables.tf#L119) | Enable default nodepool. | object({…}) | | {} | | [deletion_protection](variables.tf#L137) | Whether or not to allow Terraform to destroy the cluster. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. | bool | | true | | [description](variables.tf#L144) | Cluster description. | string | | null | | [enable_addons](variables.tf#L150) | Addons enabled in the cluster (true means enabled). | object({…}) | | {…} | -| [enable_features](variables.tf#L175) | Enable cluster-level features. Certain features allow configuration. | object({…}) | | {…} | -| [issue_client_certificate](variables.tf#L229) | Enable issuing client certificate. | bool | | false | -| [labels](variables.tf#L235) | Cluster resource labels. | map(string) | | {} | -| [logging_config](variables.tf#L247) | Logging configuration. | object({…}) | | {} | -| [maintenance_config](variables.tf#L268) | Maintenance window configuration. | object({…}) | | {…} | -| [max_pods_per_node](variables.tf#L291) | Maximum number of pods per node in this cluster. | number | | 110 | -| [min_master_version](variables.tf#L297) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null | -| [monitoring_config](variables.tf#L303) | Monitoring configuration. Google Cloud Managed Service for Prometheus is enabled by default. | object({…}) | | {} | -| [node_config](variables.tf#L359) | Node-level configuration. | object({…}) | | {} | -| [node_locations](variables.tf#L380) | Zones in which the cluster's nodes are located. | list(string) | | [] | -| [private_cluster_config](variables.tf#L387) | Private cluster configuration. | object({…}) | | null | -| [release_channel](variables.tf#L406) | Release channel for GKE upgrades. | string | | null | +| [enable_features](variables.tf#L175) | Enable cluster-level features. Certain features allow configuration. | object({…}) | | {…} | +| [issue_client_certificate](variables.tf#L230) | Enable issuing client certificate. | bool | | false | +| [labels](variables.tf#L236) | Cluster resource labels. | map(string) | | {} | +| [logging_config](variables.tf#L248) | Logging configuration. | object({…}) | | {} | +| [maintenance_config](variables.tf#L269) | Maintenance window configuration. | object({…}) | | {…} | +| [max_pods_per_node](variables.tf#L292) | Maximum number of pods per node in this cluster. | number | | 110 | +| [min_master_version](variables.tf#L298) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null | +| [monitoring_config](variables.tf#L304) | Monitoring configuration. Google Cloud Managed Service for Prometheus is enabled by default. | object({…}) | | {} | +| [node_config](variables.tf#L360) | Node-level configuration. | object({…}) | | {} | +| [node_locations](variables.tf#L381) | Zones in which the cluster's nodes are located. | list(string) | | [] | +| [private_cluster_config](variables.tf#L388) | Private cluster configuration. | object({…}) | | null | +| [release_channel](variables.tf#L407) | Release channel for GKE upgrades. | string | | null | ## Outputs diff --git a/modules/gke-cluster-standard/main.tf b/modules/gke-cluster-standard/main.tf index b864af0ae6..0ce5ab676c 100644 --- a/modules/gke-cluster-standard/main.tf +++ b/modules/gke-cluster-standard/main.tf @@ -483,6 +483,12 @@ resource "google_container_cluster" "cluster" { enabled = var.enable_features.pod_security_policy } } + dynamic "secret_manager_config" { + for_each = var.enable_features.secret_manager_config != null ? [""] : [] + content { + enabled = var.enable_features.secret_manager_config + } + } dynamic "security_posture_config" { for_each = var.enable_features.security_posture_config != null ? [""] : [] content { diff --git a/modules/gke-cluster-standard/variables.tf b/modules/gke-cluster-standard/variables.tf index dd49550fdb..0b02e0ef59 100644 --- a/modules/gke-cluster-standard/variables.tf +++ b/modules/gke-cluster-standard/variables.tf @@ -188,15 +188,16 @@ variable "enable_features" { state = string key_name = string })) - dataplane_v2 = optional(bool, false) - fqdn_network_policy = optional(bool, false) - gateway_api = optional(bool, false) - groups_for_rbac = optional(string) - image_streaming = optional(bool, false) - intranode_visibility = optional(bool, false) - l4_ilb_subsetting = optional(bool, false) - mesh_certificates = optional(bool) - pod_security_policy = optional(bool, false) + dataplane_v2 = optional(bool, false) + fqdn_network_policy = optional(bool, false) + gateway_api = optional(bool, false) + groups_for_rbac = optional(string) + image_streaming = optional(bool, false) + intranode_visibility = optional(bool, false) + l4_ilb_subsetting = optional(bool, false) + mesh_certificates = optional(bool) + pod_security_policy = optional(bool, false) + secret_manager_config = optional(bool) security_posture_config = optional(object({ mode = string vulnerability_mode = string