diff --git a/blueprints/gke/binauthz/main.tf b/blueprints/gke/binauthz/main.tf
index b9af6c41c3..92f75b2d18 100644
--- a/blueprints/gke/binauthz/main.tf
+++ b/blueprints/gke/binauthz/main.tf
@@ -83,21 +83,19 @@ module "nat" {
}
module "cluster" {
- source = "../../../modules/gke-cluster"
- project_id = module.project.project_id
- name = "${local.prefix}cluster"
- location = var.zone
- network = module.vpc.self_link
- subnetwork = module.vpc.subnet_self_links["${var.region}/subnet"]
- secondary_range_pods = "pods"
- secondary_range_services = "services"
+ source = "../../../modules/gke-cluster"
+ project_id = module.project.project_id
+ name = "${local.prefix}cluster"
+ location = var.zone
+ vpc_config = {
+ network = module.vpc.self_link
+ subnetwork = module.vpc.subnet_self_links["${var.region}/subnet"]
+ }
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = false
master_ipv4_cidr_block = var.master_cidr_block
master_global_access = false
}
- workload_identity = true
}
module "cluster_nodepool" {
diff --git a/blueprints/gke/multi-cluster-mesh-gke-fleet-api/main.tf b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/main.tf
index 6e6a5c8568..4e6742e1aa 100644
--- a/blueprints/gke/multi-cluster-mesh-gke-fleet-api/main.tf
+++ b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/main.tf
@@ -133,30 +133,27 @@ module "mgmt_server" {
}
module "clusters" {
- for_each = var.clusters_config
- source = "../../../modules/gke-cluster"
- project_id = module.fleet_project.project_id
- name = each.key
- location = var.region
- network = module.svpc.self_link
- subnetwork = module.svpc.subnet_self_links["${var.region}/subnet-${each.key}"]
- secondary_range_pods = "pods"
- secondary_range_services = "services"
+ for_each = var.clusters_config
+ source = "../../../modules/gke-cluster"
+ project_id = module.fleet_project.project_id
+ name = each.key
+ location = var.region
+ vpc_config = {
+ network = module.svpc.self_link
+ subnetwork = module.svpc.subnet_self_links["${var.region}/subnet-${each.key}"]
+ master_authorized_ranges = merge({
+ mgmt : var.mgmt_subnet_cidr_block
+ },
+ { for key, config in var.clusters_config :
+ "pods-${key}" => config.pods_cidr_block if key != each.key
+ })
+ }
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = true
master_ipv4_cidr_block = each.value.master_cidr_block
master_global_access = true
}
- master_authorized_ranges = merge({
- mgmt : var.mgmt_subnet_cidr_block
- },
- { for key, config in var.clusters_config :
- "pods-${key}" => config.pods_cidr_block if key != each.key
- })
- enable_autopilot = false
- release_channel = "REGULAR"
- workload_identity = true
+ release_channel = "REGULAR"
labels = {
mesh_id = "proj-${module.fleet_project.number}"
}
diff --git a/blueprints/gke/multitenant-fleet/gke-clusters.tf b/blueprints/gke/multitenant-fleet/gke-clusters.tf
index 8e04d780bf..d3dab082dc 100644
--- a/blueprints/gke/multitenant-fleet/gke-clusters.tf
+++ b/blueprints/gke/multitenant-fleet/gke-clusters.tf
@@ -24,93 +24,69 @@ locals {
}
module "gke-cluster" {
- source = "../../../modules/gke-cluster"
- for_each = local.clusters
- name = each.key
- project_id = module.gke-project-0.project_id
- description = each.value.description
- location = each.value.location
- network = var.vpc_config.vpc_self_link
- subnetwork = each.value.net.subnet
- secondary_range_pods = each.value.net.pods
- secondary_range_services = each.value.net.services
- labels = each.value.labels
- addons = {
- cloudrun_config = each.value.overrides.cloudrun_config
- dns_cache_config = true
- http_load_balancing = true
- gce_persistent_disk_csi_driver_config = true
- horizontal_pod_autoscaling = true
- config_connector_config = true
- kalm_config = false
- gcp_filestore_csi_driver_config = each.value.overrides.gcp_filestore_csi_driver_config
- gke_backup_agent_config = false
- # enable only if enable_dataplane_v2 is changed to false below
- network_policy_config = false
- istio_config = {
- enabled = false
- tls = false
+ source = "../../../modules/gke-cluster"
+ for_each = local.clusters
+ name = each.key
+ project_id = module.gke-project-0.project_id
+ description = each.value.description
+ location = each.value.location
+ vpc_config = {
+ network = var.vpc_config.vpc_self_link
+ subnetwork = each.value.net.subnet
+ secondary_range_names = {
+ pods = each.value.net.pods
+ services = each.value.net.services
}
+ master_authorized_ranges = each.value.overrides.master_authorized_ranges
+ }
+ labels = each.value.labels
+ enable_addons = {
+ cloudrun = each.value.overrides.cloudrun_config
+ config_connector = true
+ dns_cache = true
+ gce_persistent_disk_csi_driver = true
+ gcp_filestore_csi_driver = each.value.overrides.gcp_filestore_csi_driver_config
+ gke_backup_agent = false
+ horizontal_pod_autoscaling = true
+ http_load_balancing = true
+ }
+ enable_features = {
+ cloud_dns = var.dns_domain == null ? null : {
+ cluster_dns = "CLOUD_DNS"
+ cluster_dns_scope = "VPC_SCOPE"
+ cluster_dns_domain = "${each.key}.${var.dns_domain}"
+ }
+ database_encryption = (
+ each.value.overrides.database_encryption_key == null
+ ? null
+ : {
+ state = "ENCRYPTED"
+ key_name = each.value.overrides.database_encryption_key
+ }
+ )
+ dataplane_v2 = true
+ groups_for_rbac = var.authenticator_security_group
+ intranode_visibility = true
+ pod_security_policy = each.value.overrides.pod_security_policy
+ resource_usage_export = {
+ dataset = module.gke-dataset-resource-usage.dataset_id
+ }
+ shielded_nodes = true
+ vertical_pod_autoscaling = each.value.overrides.vertical_pod_autoscaling
+ workload_identity = true
}
- # change these here for all clusters if absolutely needed
- authenticator_security_group = var.authenticator_security_group
- enable_dataplane_v2 = true
- enable_l4_ilb_subsetting = false
- enable_intranode_visibility = true
- enable_shielded_nodes = true
- workload_identity = true
private_cluster_config = {
- enable_private_nodes = true
- enable_private_endpoint = false
+ enable_private_endpoint = true
master_ipv4_cidr_block = each.value.net.master_range
master_global_access = true
- }
- dns_config = each.value.dns_domain == null ? null : {
- cluster_dns = "CLOUD_DNS"
- cluster_dns_scope = "VPC_SCOPE"
- cluster_dns_domain = "${each.key}.${var.dns_domain}"
+ peering_config = var.peering_config == null ? null : {
+ export_routes = var.peering_config.export_routes
+ import_routes = var.peering_config.import_routes
+ project_id = var.vpc_config.host_project_id
+ }
}
logging_config = ["SYSTEM_COMPONENTS", "WORKLOADS"]
monitoring_config = ["SYSTEM_COMPONENTS", "WORKLOADS"]
-
- peering_config = var.peering_config == null ? null : {
- export_routes = var.peering_config.export_routes
- import_routes = var.peering_config.import_routes
- project_id = var.vpc_config.host_project_id
- }
- resource_usage_export_config = {
- enabled = true
- dataset = module.gke-dataset-resource-usage.dataset_id
- }
- # TODO: the attributes below are "primed" from project-level defaults
- # in locals, merge defaults with cluster-level stuff
- # TODO(jccb): change fabric module
- database_encryption = (
- each.value.overrides.database_encryption_key == null
- ? {
- enabled = false
- state = null
- key_name = null
- }
- : {
- enabled = true
- state = "ENCRYPTED"
- key_name = each.value.overrides.database_encryption_key
- }
- )
- default_max_pods_per_node = each.value.overrides.max_pods_per_node
- master_authorized_ranges = each.value.overrides.master_authorized_ranges
- pod_security_policy = each.value.overrides.pod_security_policy
- release_channel = each.value.overrides.release_channel
- vertical_pod_autoscaling = each.value.overrides.vertical_pod_autoscaling
- # dynamic "cluster_autoscaling" {
- # for_each = each.value.cluster_autoscaling == null ? {} : { 1 = 1 }
- # content {
- # enabled = true
- # cpu_min = each.value.cluster_autoscaling.cpu_min
- # cpu_max = each.value.cluster_autoscaling.cpu_max
- # memory_min = each.value.cluster_autoscaling.memory_min
- # memory_max = each.value.cluster_autoscaling.memory_max
- # }
- # }
+ max_pods_per_node = each.value.overrides.max_pods_per_node
+ release_channel = each.value.overrides.release_channel
}
diff --git a/blueprints/networking/hub-and-spoke-peering/main.tf b/blueprints/networking/hub-and-spoke-peering/main.tf
index eefc8049ae..a32eee34c0 100644
--- a/blueprints/networking/hub-and-spoke-peering/main.tf
+++ b/blueprints/networking/hub-and-spoke-peering/main.tf
@@ -237,31 +237,29 @@ module "service-account-gce" {
################################################################################
module "cluster-1" {
- source = "../../../modules/gke-cluster"
- name = "${local.prefix}cluster-1"
- project_id = module.project.project_id
- location = "${var.region}-b"
- network = module.vpc-spoke-2.self_link
- subnetwork = module.vpc-spoke-2.subnet_self_links["${var.region}/${local.prefix}spoke-2-1"]
- secondary_range_pods = "pods"
- secondary_range_services = "services"
- default_max_pods_per_node = 32
+ source = "../../../modules/gke-cluster"
+ name = "${local.prefix}cluster-1"
+ project_id = module.project.project_id
+ location = "${var.region}-b"
+ vpc_config = {
+ network = module.vpc-spoke-2.self_link
+ subnetwork = module.vpc-spoke-2.subnet_self_links["${var.region}/${local.prefix}spoke-2-1"]
+ master_authorized_ranges = {
+ for name, range in var.ip_ranges : name => range
+ }
+ }
+ max_pods_per_node = 32
labels = {
environment = "test"
}
- master_authorized_ranges = {
- for name, range in var.ip_ranges : name => range
- }
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = true
master_ipv4_cidr_block = var.private_service_ranges.spoke-2-cluster-1
master_global_access = true
- }
- peering_config = {
- export_routes = true
- import_routes = false
- project_id = null
+ peering_config = {
+ export_routes = true
+ import_routes = false
+ }
}
}
diff --git a/blueprints/networking/shared-vpc-gke/main.tf b/blueprints/networking/shared-vpc-gke/main.tf
index e4eb1a49db..ef162db3a0 100644
--- a/blueprints/networking/shared-vpc-gke/main.tf
+++ b/blueprints/networking/shared-vpc-gke/main.tf
@@ -196,28 +196,27 @@ module "vm-bastion" {
################################################################################
module "cluster-1" {
- source = "../../../modules/gke-cluster"
- count = var.cluster_create ? 1 : 0
- name = "cluster-1"
- project_id = module.project-svc-gke.project_id
- location = "${var.region}-b"
- network = module.vpc-shared.self_link
- subnetwork = module.vpc-shared.subnet_self_links["${var.region}/gke"]
- secondary_range_pods = "pods"
- secondary_range_services = "services"
- default_max_pods_per_node = 32
- labels = {
- environment = "test"
- }
- master_authorized_ranges = {
- internal-vms = var.ip_ranges.gce
+ source = "../../../modules/gke-cluster"
+ count = var.cluster_create ? 1 : 0
+ name = "cluster-1"
+ project_id = module.project-svc-gke.project_id
+ location = "${var.region}-b"
+ vpc_config = {
+ network = module.vpc-shared.self_link
+ subnetwork = module.vpc-shared.subnet_self_links["${var.region}/gke"]
+ master_authorized_ranges = {
+ internal-vms = var.ip_ranges.gce
+ }
}
+ max_pods_per_node = 32
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = true
master_ipv4_cidr_block = var.private_service_ranges.cluster-1
master_global_access = true
}
+ labels = {
+ environment = "test"
+ }
}
module "cluster-1-nodepool-1" {
diff --git a/modules/gke-cluster/README.md b/modules/gke-cluster/README.md
index a34b72b93b..d2b2d9b900 100644
--- a/modules/gke-cluster/README.md
+++ b/modules/gke-cluster/README.md
@@ -8,20 +8,23 @@ This module allows simplified creation and management of GKE clusters and should
```hcl
module "cluster-1" {
- source = "./fabric/modules/gke-cluster"
- project_id = "myproject"
- name = "cluster-1"
- location = "europe-west1-b"
- network = var.vpc.self_link
- subnetwork = var.subnet.self_link
- secondary_range_pods = "pods"
- secondary_range_services = "services"
- default_max_pods_per_node = 32
- master_authorized_ranges = {
- internal-vms = "10.0.0.0/8"
+ source = "./fabric/modules/gke-cluster"
+ project_id = "myproject"
+ name = "cluster-1"
+ location = "europe-west1-b"
+ vpc_config = {
+ network = var.vpc.self_link
+ subnetwork = var.subnet.self_link
+ secondary_range_names = {
+ pods = "pods"
+ services = "services"
+ }
+ master_authorized_ranges = {
+ internal-vms = "10.0.0.0/8"
+ }
}
+ max_pods_per_node = 32
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = true
master_ipv4_cidr_block = "192.168.0.0/28"
master_global_access = false
@@ -37,25 +40,30 @@ module "cluster-1" {
```hcl
module "cluster-1" {
- source = "./fabric/modules/gke-cluster"
- project_id = "myproject"
- name = "cluster-1"
- location = "europe-west1-b"
- network = var.vpc.self_link
- subnetwork = var.subnet.self_link
- secondary_range_pods = "pods"
- secondary_range_services = "services"
- default_max_pods_per_node = 32
- enable_dataplane_v2 = true
- master_authorized_ranges = {
- internal-vms = "10.0.0.0/8"
+ source = "./fabric/modules/gke-cluster"
+ project_id = "myproject"
+ name = "cluster-1"
+ location = "europe-west1-b"
+ vpc_config = {
+ network = var.vpc.self_link
+ subnetwork = var.subnet.self_link
+ secondary_range_names = {
+ pods = "pods"
+ services = "services"
+ }
+ master_authorized_ranges = {
+ internal-vms = "10.0.0.0/8"
+ }
}
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = true
master_ipv4_cidr_block = "192.168.0.0/28"
master_global_access = false
}
+ enable_features = {
+ dataplane_v2 = true
+ workload_identity = true
+ }
labels = {
environment = "dev"
}
@@ -68,44 +76,24 @@ module "cluster-1" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
-| [location](variables.tf#L161) | Cluster zone or region. | string | ✓ | |
-| [name](variables.tf#L228) | Cluster name. | string | ✓ | |
-| [network](variables.tf#L233) | Name or self link of the VPC used for the cluster. Use the self link for Shared VPC. | string | ✓ | |
-| [project_id](variables.tf#L277) | Cluster project id. | string | ✓ | |
-| [secondary_range_pods](variables.tf#L300) | Subnet secondary range name used for pods. | string | ✓ | |
-| [secondary_range_services](variables.tf#L305) | Subnet secondary range name used for services. | string | ✓ | |
-| [subnetwork](variables.tf#L310) | VPC subnetwork name or self link. | string | ✓ | |
-| [addons](variables.tf#L17) | Addons enabled in the cluster (true means enabled). | object({…}) | | {…} |
-| [authenticator_security_group](variables.tf#L53) | RBAC security group for Google Groups for GKE, format is gke-security-groups@yourdomain.com. | string | | null |
-| [cluster_autoscaling](variables.tf#L59) | Enable and configure limits for Node Auto-Provisioning with Cluster Autoscaler. | object({…}) | | {…} |
-| [database_encryption](variables.tf#L77) | Enable and configure GKE application-layer secrets encryption. | object({…}) | | {…} |
-| [default_max_pods_per_node](variables.tf#L91) | Maximum number of pods per node in this cluster. | number | | 110 |
-| [description](variables.tf#L97) | Cluster description. | string | | null |
-| [dns_config](variables.tf#L103) | Configuration for Using Cloud DNS for GKE. | object({…}) | | null |
-| [enable_autopilot](variables.tf#L113) | Create cluster in autopilot mode. With autopilot there's no need to create node-pools and some features are not supported (e.g. setting default_max_pods_per_node). | bool | | false |
-| [enable_binary_authorization](variables.tf#L119) | Enable Google Binary Authorization. | bool | | false |
-| [enable_dataplane_v2](variables.tf#L125) | Enable Dataplane V2 on the cluster, will disable network_policy addons config. | bool | | false |
-| [enable_intranode_visibility](variables.tf#L131) | Enable intra-node visibility to make same node pod to pod traffic visible. | bool | | null |
-| [enable_l4_ilb_subsetting](variables.tf#L137) | Enable L4ILB Subsetting. | bool | | null |
-| [enable_shielded_nodes](variables.tf#L143) | Enable Shielded Nodes features on all nodes in this cluster. | bool | | null |
-| [enable_tpu](variables.tf#L149) | Enable Cloud TPU resources in this cluster. | bool | | null |
-| [labels](variables.tf#L155) | Cluster resource labels. | map(string) | | null |
-| [logging_config](variables.tf#L166) | Logging configuration (enabled components). | list(string) | | null |
-| [logging_service](variables.tf#L172) | Logging service (disable with an empty string). | string | | "logging.googleapis.com/kubernetes" |
-| [maintenance_config](variables.tf#L178) | Maintenance window configuration. | object({…}) | | {…} |
-| [master_authorized_ranges](variables.tf#L204) | External Ip address ranges that can access the Kubernetes cluster master through HTTPS. | map(string) | | {} |
-| [min_master_version](variables.tf#L210) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null |
-| [monitoring_config](variables.tf#L216) | Monitoring configuration (enabled components). | list(string) | | null |
-| [monitoring_service](variables.tf#L222) | Monitoring service (disable with an empty string). | string | | "monitoring.googleapis.com/kubernetes" |
-| [node_locations](variables.tf#L238) | Zones in which the cluster's nodes are located. | list(string) | | [] |
-| [notification_config](variables.tf#L244) | GKE Cluster upgrade notifications via PubSub. | bool | | false |
-| [peering_config](variables.tf#L250) | Configure peering with the master VPC for private clusters. | object({…}) | | null |
-| [pod_security_policy](variables.tf#L260) | Enable the PodSecurityPolicy feature. | bool | | null |
-| [private_cluster_config](variables.tf#L266) | Enable and configure private cluster, private nodes must be true if used. | object({…}) | | null |
-| [release_channel](variables.tf#L282) | Release channel for GKE upgrades. | string | | null |
-| [resource_usage_export_config](variables.tf#L288) | Configure the ResourceUsageExportConfig feature. | object({…}) | | {…} |
-| [vertical_pod_autoscaling](variables.tf#L315) | Enable the Vertical Pod Autoscaling feature. | bool | | null |
-| [workload_identity](variables.tf#L321) | Enable the Workload Identity feature. | bool | | true |
+| [location](variables.tf#L118) | Cluster zone or region. | string | ✓ | |
+| [name](variables.tf#L170) | Cluster name. | string | ✓ | |
+| [project_id](variables.tf#L197) | Cluster project id. | string | ✓ | |
+| [vpc_config](variables.tf#L208) | VPC-level configuration. | object({…}) | ✓ | |
+| [cluster_autoscaling](variables.tf#L17) | Enable and configure limits for Node Auto-Provisioning with Cluster Autoscaler. | object({…}) | | null |
+| [description](variables.tf#L38) | Cluster description. | string | | null |
+| [enable_addons](variables.tf#L44) | Addons enabled in the cluster (true means enabled). | object({…}) | | {…} |
+| [enable_features](variables.tf#L68) | Enable cluster-level features. Certain features allow configuration. | object({…}) | | {…} |
+| [issue_client_certificate](variables.tf#L106) | Enable issuing client certificate. | bool | | false |
+| [labels](variables.tf#L112) | Cluster resource labels. | map(string) | | null |
+| [logging_config](variables.tf#L123) | Logging configuration. | list(string) | | ["SYSTEM_COMPONENTS"] |
+| [maintenance_config](variables.tf#L129) | Maintenance window configuration. | object({…}) | | {…} |
+| [max_pods_per_node](variables.tf#L152) | Maximum number of pods per node in this cluster. | number | | 110 |
+| [min_master_version](variables.tf#L158) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null |
+| [monitoring_config](variables.tf#L164) | Monitoring components. | list(string) | | ["SYSTEM_COMPONENTS"] |
+| [node_locations](variables.tf#L175) | Zones in which the cluster's nodes are located. | list(string) | | [] |
+| [private_cluster_config](variables.tf#L182) | Private cluster configuration. | object({…}) | | null |
+| [release_channel](variables.tf#L202) | Release channel for GKE upgrades. | string | | null |
## Outputs
diff --git a/modules/gke-cluster/main.tf b/modules/gke-cluster/main.tf
index e0b31a3187..118a998700 100644
--- a/modules/gke-cluster/main.tf
+++ b/modules/gke-cluster/main.tf
@@ -14,159 +14,216 @@
* limitations under the License.
*/
-locals {
- # The Google provider is unable to validate certain configurations of
- # private_cluster_config when enable_private_nodes is false (provider docs)
- is_private = try(var.private_cluster_config.enable_private_nodes, false)
- peering = try(
- google_container_cluster.cluster.private_cluster_config.0.peering_name,
- null
+resource "google_container_cluster" "cluster" {
+ provider = google-beta
+ project = var.project_id
+ name = var.name
+ description = var.description
+ location = var.location
+ node_locations = (
+ length(var.node_locations) == 0 ? null : var.node_locations
)
- peering_project_id = (
- try(var.peering_config.project_id, null) == null
- ? var.project_id
- : var.peering_config.project_id
+ min_master_version = var.min_master_version
+ network = var.vpc_config.network
+ subnetwork = var.vpc_config.subnetwork
+ resource_labels = var.labels
+ default_max_pods_per_node = (
+ var.enable_features.autopilot ? null : var.max_pods_per_node
)
-}
-
-resource "google_container_cluster" "cluster" {
- provider = google-beta
- project = var.project_id
- name = var.name
- description = var.description
- location = var.location
- node_locations = length(var.node_locations) == 0 ? null : var.node_locations
- min_master_version = var.min_master_version
- network = var.network
- subnetwork = var.subnetwork
- logging_service = var.monitoring_config != null ? null : var.logging_config == null ? var.logging_service : null
- monitoring_service = var.monitoring_config == null ? var.monitoring_service : null
- resource_labels = var.labels
- default_max_pods_per_node = var.enable_autopilot ? null : var.default_max_pods_per_node
- enable_intranode_visibility = var.enable_intranode_visibility
- enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
- enable_shielded_nodes = var.enable_shielded_nodes
- enable_tpu = var.enable_tpu
- initial_node_count = 1
- remove_default_node_pool = var.enable_autopilot ? null : true
- datapath_provider = var.enable_dataplane_v2 ? "ADVANCED_DATAPATH" : "DATAPATH_PROVIDER_UNSPECIFIED"
- enable_autopilot = var.enable_autopilot == true ? true : null
+ enable_intranode_visibility = (
+ var.enable_features.autopilot ? null : var.enable_features.intranode_visibility
+ )
+ enable_l4_ilb_subsetting = var.enable_features.l4_ilb_subsetting
+ enable_shielded_nodes = (
+ var.enable_features.autopilot ? null : var.enable_features.shielded_nodes
+ )
+ enable_tpu = var.enable_features.tpu
+ initial_node_count = 1
+ remove_default_node_pool = var.enable_features.autopilot ? null : true
+ datapath_provider = (
+ var.enable_features.dataplane_v2
+ ? "ADVANCED_DATAPATH"
+ : "DATAPATH_PROVIDER_UNSPECIFIED"
+ )
+ enable_autopilot = var.enable_features.autopilot ? true : null
+ # the default nodepool is deleted here, use the gke-nodepool module instead
# node_config {}
- # NOTE: Default node_pool is deleted, so node_config (here) is extranneous.
- # Specify that node_config as an parameter to gke-nodepool module instead.
- # TODO(ludomagno): compute addons map in locals and use a single dynamic block
addons_config {
dynamic "dns_cache_config" {
- # Pass the user-provided value when autopilot is disabled. When
- # autopilot is enabled, pass the value only when the addon is
- # set to true. This will fail but warns the user that autopilot
- # doesn't support this option, instead of silently discarding
- # and hiding the error
- for_each = !var.enable_autopilot || (var.enable_autopilot && var.addons.dns_cache_config) ? [""] : []
+ for_each = !var.enable_features.autopilot ? [""] : []
content {
- enabled = var.addons.dns_cache_config
+ enabled = var.enable_addons.dns_cache
}
}
http_load_balancing {
- disabled = !var.addons.http_load_balancing
+ disabled = !var.enable_addons.http_load_balancing
}
horizontal_pod_autoscaling {
- disabled = !var.addons.horizontal_pod_autoscaling
+ disabled = !var.enable_addons.horizontal_pod_autoscaling
}
dynamic "network_policy_config" {
- for_each = !var.enable_autopilot ? [""] : []
+ for_each = !var.enable_features.autopilot ? [""] : []
content {
- disabled = !var.addons.network_policy_config
+ disabled = !var.enable_addons.network_policy
}
}
cloudrun_config {
- disabled = !var.addons.cloudrun_config
+ disabled = !var.enable_addons.cloudrun
}
istio_config {
- disabled = !var.addons.istio_config.enabled
- auth = var.addons.istio_config.tls ? "AUTH_MUTUAL_TLS" : "AUTH_NONE"
+ disabled = var.enable_addons.istio == null
+ auth = (
+ try(var.enable_addons.istio.enable_tls, false) ? "AUTH_MUTUAL_TLS" : "AUTH_NONE"
+ )
}
gce_persistent_disk_csi_driver_config {
- enabled = var.enable_autopilot || var.addons.gce_persistent_disk_csi_driver_config
+ enabled = var.enable_addons.gce_persistent_disk_csi_driver
}
dynamic "gcp_filestore_csi_driver_config" {
- # Pass the user-provided value when autopilot is disabled. When
- # autopilot is enabled, pass the value only when the addon is
- # set to true. This will fail but warns the user that autopilot
- # doesn't support this option, instead of silently discarding
- # and hiding the error
- for_each = var.enable_autopilot && !var.addons.gcp_filestore_csi_driver_config ? [] : [""]
+ for_each = !var.enable_features.autopilot ? [""] : []
content {
- enabled = var.addons.gcp_filestore_csi_driver_config
+ enabled = var.enable_addons.gcp_filestore_csi_driver
}
}
kalm_config {
- enabled = var.addons.kalm_config
+ enabled = var.enable_addons.kalm
}
config_connector_config {
- enabled = var.addons.config_connector_config
+ enabled = var.enable_addons.config_connector
}
gke_backup_agent_config {
- enabled = var.addons.gke_backup_agent_config
+ enabled = var.enable_addons.gke_backup_agent
+ }
+ }
+
+ dynamic "authenticator_groups_config" {
+ for_each = var.enable_features.groups_for_rbac != null ? [""] : []
+ content {
+ security_group = var.enable_features.groups_for_rbac
}
}
- # TODO(ludomagno): support setting address ranges instead of range names
- # https://www.terraform.io/docs/providers/google/r/container_cluster.html#cluster_ipv4_cidr_block
- ip_allocation_policy {
- cluster_secondary_range_name = var.secondary_range_pods
- services_secondary_range_name = var.secondary_range_services
+ dynamic "binary_authorization" {
+ for_each = var.enable_features.binary_authorization ? [""] : []
+ content {
+ evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
+ }
+ }
+
+ dynamic "cluster_autoscaling" {
+ for_each = var.cluster_autoscaling == null ? [] : [""]
+ content {
+ enabled = true
+ dynamic "resource_limits" {
+ for_each = var.cluster_autoscaling.cpu_limits != null ? [""] : []
+ content {
+ resource_type = "cpu"
+ minimum = var.cluster_autoscaling.cpu_limits.min
+ maximum = var.cluster_autoscaling.cpu_limits.max
+ }
+ }
+ dynamic "resource_limits" {
+ for_each = var.cluster_autoscaling.mem_limits != null ? [""] : []
+ content {
+ resource_type = "cpu"
+ minimum = var.cluster_autoscaling.mem_limits.min
+ maximum = var.cluster_autoscaling.mem_limits.max
+ }
+ }
+ // TODO: support GPUs too
+ }
+ }
+
+ dynamic "database_encryption" {
+ for_each = var.enable_features.database_encryption != null ? [""] : []
+ content {
+ state = var.enable_features.database_encryption.state
+ key_name = var.enable_features.database_encryption.key_name
+ }
+ }
+
+ dynamic "dns_config" {
+ for_each = var.enable_features.cloud_dns != null ? [""] : []
+ content {
+ cluster_dns = enable_features.cloud_dns.cluster_dns
+ cluster_dns_scope = enable_features.cloud_dns.cluster_dns_scope
+ cluster_dns_domain = enable_features.cloud_dns.cluster_dns_domain
+ }
+ }
+
+ dynamic "ip_allocation_policy" {
+ for_each = var.vpc_config.secondary_range_blocks != null ? [""] : []
+ content {
+ cluster_ipv4_cidr_block = var.vpc_config.secondary_range_blocks.pods
+ services_ipv4_cidr_block = var.vpc_config.secondary_range_blocks.services
+ }
+ }
+ dynamic "ip_allocation_policy" {
+ for_each = var.vpc_config.secondary_range_names != null ? [""] : []
+ content {
+ cluster_secondary_range_name = var.vpc_config.secondary_range_names.pods
+ services_secondary_range_name = var.vpc_config.secondary_range_names.services
+ }
+ }
+
+ dynamic "logging_config" {
+ for_each = var.logging_config != null ? [""] : []
+ content {
+ enable_components = var.logging_config
+ }
}
- # https://www.terraform.io/docs/providers/google/r/container_cluster.html#daily_maintenance_window
maintenance_policy {
dynamic "daily_maintenance_window" {
- for_each = var.maintenance_config != null && lookup(var.maintenance_config, "daily_maintenance_window", null) != null ? [var.maintenance_config.daily_maintenance_window] : []
- iterator = config
+ for_each = (
+ try(var.maintenance_config.daily_window_start_time, null) != null
+ ? [""]
+ : []
+ )
content {
- start_time = config.value.start_time
+ start_time = var.maintenance_config.daily_window_start_time
}
}
-
dynamic "recurring_window" {
- for_each = var.maintenance_config != null && lookup(var.maintenance_config, "recurring_window", null) != null ? [var.maintenance_config.recurring_window] : []
- iterator = config
+ for_each = (
+ try(var.maintenance_config.recurring_window, null) != null
+ ? [""]
+ : []
+ )
content {
- start_time = config.value.start_time
- end_time = config.value.end_time
- recurrence = config.value.recurrence
+ start_time = var.maintenance_config.recurring_window.start_time
+ end_time = var.maintenance_config.recurring_window.end_time
+ recurrence = var.maintenance_config.recurring_window.recurrence
}
}
-
dynamic "maintenance_exclusion" {
- for_each = var.maintenance_config != null && lookup(var.maintenance_config, "maintenance_exclusion", null) != null ? var.maintenance_config.maintenance_exclusion : []
- iterator = config
+ for_each = (
+ try(var.maintenance_config.maintenance_exclusions, null) == null
+ ? []
+ : var.maintenance_config.maintenance_exclusions
+ )
+ iterator = exclusion
content {
- exclusion_name = config.value.exclusion_name
- start_time = config.value.start_time
- end_time = config.value.end_time
+ exclusion_name = exclusion.value.name
+ start_time = exclusion.value.start_time
+ end_time = exclusion.value.end_time
}
}
}
master_auth {
client_certificate_config {
- issue_client_certificate = false
+ issue_client_certificate = var.issue_client_certificate
}
}
dynamic "master_authorized_networks_config" {
- for_each = (
- length(var.master_authorized_ranges) == 0
- ? []
- : [var.master_authorized_ranges]
- )
- iterator = ranges
+ for_each = var.vpc_config.master_authorized_ranges != null ? [""] : []
content {
dynamic "cidr_blocks" {
- for_each = ranges.value
+ for_each = var.vpc_config.master_authorized_ranges
iterator = range
content {
cidr_block = range.value
@@ -176,69 +233,58 @@ resource "google_container_cluster" "cluster" {
}
}
- #the network_policy block is enabled if network_policy_config and network_dataplane_v2 is set to false. Dataplane V2 has built-in network policies.
- dynamic "network_policy" {
- for_each = var.addons.network_policy_config ? [""] : []
- content {
- enabled = var.enable_dataplane_v2 ? false : true
- provider = var.enable_dataplane_v2 ? "PROVIDER_UNSPECIFIED" : "CALICO"
- }
- }
-
- dynamic "private_cluster_config" {
- for_each = local.is_private ? [var.private_cluster_config] : []
- iterator = config
+ dynamic "monitoring_config" {
+ for_each = var.monitoring_config != null ? [""] : []
content {
- enable_private_nodes = config.value.enable_private_nodes
- enable_private_endpoint = config.value.enable_private_endpoint
- master_ipv4_cidr_block = config.value.master_ipv4_cidr_block
- master_global_access_config {
- enabled = config.value.master_global_access
- }
+ enable_components = var.monitoring_config
}
}
- # beta features
-
- dynamic "authenticator_groups_config" {
- for_each = var.authenticator_security_group == null ? [] : [""]
+ # dataplane v2 has bult-in network policies
+ dynamic "network_policy" {
+ for_each = (
+ var.enable_addons.network_policy && !var.enable_features.dataplane_v2
+ ? [""]
+ : []
+ )
content {
- security_group = var.authenticator_security_group
+ enabled = true
+ provider = "CALICO"
}
}
- dynamic "cluster_autoscaling" {
- for_each = var.cluster_autoscaling.enabled ? [var.cluster_autoscaling] : []
- iterator = config
+ dynamic "notification_config" {
+ for_each = var.enable_features.upgrade_notifications != null ? [""] : []
content {
- enabled = true
- resource_limits {
- resource_type = "cpu"
- minimum = config.value.cpu_min
- maximum = config.value.cpu_max
- }
- resource_limits {
- resource_type = "memory"
- minimum = config.value.memory_min
- maximum = config.value.memory_max
+ pubsub {
+ enabled = true
+ topic = (
+ try(var.enable_features.upgrade_notifications.topic_id, null) != null
+ ? var.enable_features.upgrade_notifications.topic_id
+ : google_pubsub_topic.notifications[0].id
+ )
}
- // TODO: support GPUs too
}
}
- dynamic "database_encryption" {
- for_each = var.database_encryption.enabled ? [var.database_encryption] : []
- iterator = config
+ dynamic "private_cluster_config" {
+ for_each = (
+ var.private_cluster_config != null ? [""] : []
+ )
content {
- state = config.value.state
- key_name = config.value.key_name
+ enable_private_nodes = true
+ enable_private_endpoint = var.private_cluster_config.enable_private_endpoint
+ master_ipv4_cidr_block = var.private_cluster_config.master_ipv4_cidr_block
+ master_global_access_config {
+ enabled = var.private_cluster_config.master_global_access
+ }
}
}
dynamic "pod_security_policy_config" {
- for_each = var.pod_security_policy != null ? [""] : []
+ for_each = var.enable_features.pod_security_policy ? [""] : []
content {
- enabled = var.pod_security_policy
+ enabled = var.enable_features.pod_security_policy
}
}
@@ -251,86 +297,61 @@ resource "google_container_cluster" "cluster" {
dynamic "resource_usage_export_config" {
for_each = (
- var.resource_usage_export_config.enabled != null
- &&
- var.resource_usage_export_config.dataset != null
- ? [""] : []
+ try(var.enable_features.resource_usage_export.dataset, null) != null
+ ? [""]
+ : []
)
content {
- enable_network_egress_metering = var.resource_usage_export_config.enabled
+ enable_network_egress_metering = (
+ var.enable_features.resource_usage_export.enable_network_egress_metering
+ )
+ enable_resource_consumption_metering = (
+ var.enable_features.resource_usage_export.enable_resource_consumption_metering
+ )
bigquery_destination {
- dataset_id = var.resource_usage_export_config.dataset
+ dataset_id = var.enable_features.resource_usage_export.dataset
}
}
}
dynamic "vertical_pod_autoscaling" {
- for_each = var.vertical_pod_autoscaling == null ? [] : [""]
+ for_each = var.enable_features.vertical_pod_autoscaling ? [""] : []
content {
- enabled = var.vertical_pod_autoscaling
+ enabled = var.enable_features.vertical_pod_autoscaling
}
}
dynamic "workload_identity_config" {
- for_each = var.workload_identity && !var.enable_autopilot ? [""] : []
+ for_each = var.enable_features.workload_identity ? [""] : []
content {
workload_pool = "${var.project_id}.svc.id.goog"
}
}
-
- dynamic "monitoring_config" {
- for_each = var.monitoring_config != null ? [""] : []
- content {
- enable_components = var.monitoring_config
- }
- }
-
- dynamic "logging_config" {
- for_each = var.logging_config != null ? [""] : []
- content {
- enable_components = var.logging_config
- }
- }
-
- dynamic "binary_authorization" {
- for_each = var.enable_binary_authorization ? [""] : []
- content {
- evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
- }
- }
-
- dynamic "dns_config" {
- for_each = var.dns_config != null ? [""] : []
- content {
- cluster_dns = var.dns_config.cluster_dns
- cluster_dns_scope = var.dns_config.cluster_dns_scope
- cluster_dns_domain = var.dns_config.cluster_dns_domain
- }
- }
-
- dynamic "notification_config" {
- for_each = var.notification_config ? [""] : []
- content {
- pubsub {
- enabled = var.notification_config
- topic = var.notification_config ? google_pubsub_topic.notifications[0].id : null
- }
- }
- }
}
resource "google_compute_network_peering_routes_config" "gke_master" {
- count = local.is_private && var.peering_config != null ? 1 : 0
- project = local.peering_project_id
- peering = local.peering
- network = element(reverse(split("/", var.network)), 0)
- import_custom_routes = var.peering_config.import_routes
- export_custom_routes = var.peering_config.export_routes
+ count = (
+ try(var.private_cluster_config.peering_config, null) != null ? 1 : 0
+ )
+ project = (
+ try(var.private_cluster_config.peering_config, null) == null
+ ? var.project_id
+ : var.private_cluster_config.peering_config.project_id
+ )
+ peering = try(
+ google_container_cluster.cluster.private_cluster_config.0.peering_name,
+ null
+ )
+ network = element(reverse(split("/", var.vpc_config.network)), 0)
+ import_custom_routes = var.private_cluster_config.peering_config.import_routes
+ export_custom_routes = var.private_cluster_config.peering_config.export_routes
}
resource "google_pubsub_topic" "notifications" {
- count = var.notification_config ? 1 : 0
- name = "gke-pubsub-notifications"
+ count = (
+ try(var.enable_features.upgrade_notifications.topic_id, null) == null ? 0 : 1
+ )
+ name = "gke-pubsub-notifications"
labels = {
content = "gke-notifications"
}
diff --git a/modules/gke-cluster/outputs.tf b/modules/gke-cluster/outputs.tf
index 2a5fd55144..f98f4f54c7 100644
--- a/modules/gke-cluster/outputs.tf
+++ b/modules/gke-cluster/outputs.tf
@@ -53,7 +53,7 @@ output "name" {
output "notifications" {
description = "GKE PubSub notifications topic."
- value = var.notification_config ? google_pubsub_topic.notifications[0].id : null
+ value = try(google_pubsub_topic.notifications[0].id, null)
}
output "self_link" {
diff --git a/modules/gke-cluster/variables.tf b/modules/gke-cluster/variables.tf
index 2c9fccbe4a..97332266eb 100644
--- a/modules/gke-cluster/variables.tf
+++ b/modules/gke-cluster/variables.tf
@@ -14,144 +14,101 @@
* limitations under the License.
*/
-variable "addons" {
- description = "Addons enabled in the cluster (true means enabled)."
+variable "cluster_autoscaling" {
+ description = "Enable and configure limits for Node Auto-Provisioning with Cluster Autoscaler."
type = object({
- cloudrun_config = bool
- dns_cache_config = bool
- horizontal_pod_autoscaling = bool
- http_load_balancing = bool
- istio_config = object({
- enabled = bool
- tls = bool
- })
- network_policy_config = bool
- gce_persistent_disk_csi_driver_config = bool
- gcp_filestore_csi_driver_config = bool
- config_connector_config = bool
- kalm_config = bool
- gke_backup_agent_config = bool
+ auto_provisioning_defaults = optional(object({
+ boot_disk_kms_key = optional(string)
+ image_type = optional(string)
+ oauth_scopes = optional(list(string))
+ service_account = optional(string)
+ }))
+ cpu_limits = optional(object({
+ min = number
+ max = number
+ }))
+ mem_limits = optional(object({
+ min = number
+ max = number
+ }))
})
- default = {
- cloudrun_config = false
- dns_cache_config = false
- horizontal_pod_autoscaling = true
- http_load_balancing = true
- istio_config = {
- enabled = false
- tls = false
- }
- network_policy_config = false
- gce_persistent_disk_csi_driver_config = false
- gcp_filestore_csi_driver_config = false
- config_connector_config = false
- kalm_config = false
- gke_backup_agent_config = false
- }
+ default = null
}
-variable "authenticator_security_group" {
- description = "RBAC security group for Google Groups for GKE, format is gke-security-groups@yourdomain.com."
+variable "description" {
+ description = "Cluster description."
type = string
default = null
}
-variable "cluster_autoscaling" {
- description = "Enable and configure limits for Node Auto-Provisioning with Cluster Autoscaler."
+variable "enable_addons" {
+ description = "Addons enabled in the cluster (true means enabled)."
type = object({
- enabled = bool
- cpu_min = number
- cpu_max = number
- memory_min = number
- memory_max = number
+ cloudrun = optional(bool, false)
+ config_connector = optional(bool, false)
+ dns_cache = optional(bool, false)
+ gce_persistent_disk_csi_driver = optional(bool, false)
+ gcp_filestore_csi_driver = optional(bool, false)
+ gke_backup_agent = optional(bool, false)
+ horizontal_pod_autoscaling = optional(bool, false)
+ http_load_balancing = optional(bool, false)
+ istio = optional(object({
+ enable_tls = bool
+ }))
+ kalm = optional(bool, false)
+ network_policy = optional(bool, false)
})
default = {
- enabled = false
- cpu_min = 0
- cpu_max = 0
- memory_min = 0
- memory_max = 0
+ horizontal_pod_autoscaling = true
+ http_load_balancing = true
}
+ nullable = false
}
-variable "database_encryption" {
- description = "Enable and configure GKE application-layer secrets encryption."
+variable "enable_features" {
+ description = "Enable cluster-level features. Certain features allow configuration."
type = object({
- enabled = bool
- state = string
- key_name = string
+ autopilot = optional(bool, false)
+ binary_authorization = optional(bool, false)
+ cloud_dns = optional(object({
+ provider = optional(string)
+ scope = optional(string)
+ domain = optional(string)
+ }))
+ database_encryption = optional(object({
+ state = string
+ key_name = string
+ }))
+ dataplane_v2 = optional(bool, false)
+ groups_for_rbac = optional(string)
+ intranode_visibility = optional(bool, false)
+ l4_ilb_subsetting = optional(bool, false)
+ pod_security_policy = optional(bool, false)
+ resource_usage_export = optional(object({
+ dataset = optional(string)
+ enable_network_egress_metering = optional(bool, false)
+ enable_resource_consumption_metering = optional(bool, false)
+ }))
+ shielded_nodes = optional(bool, false)
+ tpu = optional(bool, false)
+ upgrade_notifications = optional(object({
+ topic_id = optional(string)
+ }))
+ vertical_pod_autoscaling = optional(bool, false)
+ workload_identity = optional(bool, false)
})
default = {
- enabled = false
- state = "DECRYPTED"
- key_name = null
+ workload_identity = true
+ resource_usage_export = null
}
}
-variable "default_max_pods_per_node" {
- description = "Maximum number of pods per node in this cluster."
- type = number
- default = 110
-}
-
-variable "description" {
- description = "Cluster description."
- type = string
- default = null
-}
-
-variable "dns_config" {
- description = "Configuration for Using Cloud DNS for GKE."
- type = object({
- cluster_dns = string
- cluster_dns_scope = string
- cluster_dns_domain = string
- })
- default = null
-}
-
-variable "enable_autopilot" {
- description = "Create cluster in autopilot mode. With autopilot there's no need to create node-pools and some features are not supported (e.g. setting default_max_pods_per_node)."
- type = bool
- default = false
-}
-
-variable "enable_binary_authorization" {
- description = "Enable Google Binary Authorization."
+variable "issue_client_certificate" {
+ description = "Enable issuing client certificate."
type = bool
default = false
}
-variable "enable_dataplane_v2" {
- description = "Enable Dataplane V2 on the cluster, will disable network_policy addons config."
- type = bool
- default = false
-}
-
-variable "enable_intranode_visibility" {
- description = "Enable intra-node visibility to make same node pod to pod traffic visible."
- type = bool
- default = null
-}
-
-variable "enable_l4_ilb_subsetting" {
- description = "Enable L4ILB Subsetting."
- type = bool
- default = null
-}
-
-variable "enable_shielded_nodes" {
- description = "Enable Shielded Nodes features on all nodes in this cluster."
- type = bool
- default = null
-}
-
-variable "enable_tpu" {
- description = "Enable Cloud TPU resources in this cluster."
- type = bool
- default = null
-}
-
variable "labels" {
description = "Cluster resource labels."
type = map(string)
@@ -164,47 +121,38 @@ variable "location" {
}
variable "logging_config" {
- description = "Logging configuration (enabled components)."
+ description = "Logging configuration."
type = list(string)
- default = null
-}
-
-variable "logging_service" {
- description = "Logging service (disable with an empty string)."
- type = string
- default = "logging.googleapis.com/kubernetes"
+ default = ["SYSTEM_COMPONENTS"]
}
variable "maintenance_config" {
description = "Maintenance window configuration."
type = object({
- daily_maintenance_window = object({
- start_time = string
- })
- recurring_window = object({
+ daily_window_start_time = optional(string)
+ recurring_window = optional(object({
start_time = string
end_time = string
recurrence = string
- })
- maintenance_exclusion = list(object({
- exclusion_name = string
- start_time = string
- end_time = string
}))
+ maintenance_exclusions = optional(list(object({
+ name = string
+ start_time = string
+ end_time = string
+ scope = optional(string)
+ })))
})
default = {
- daily_maintenance_window = {
- start_time = "03:00"
- }
- recurring_window = null
- maintenance_exclusion = []
+ daily_window_start_time = "03:00"
+ recurring_window = null
+ maintenance_exclusion = []
}
}
-variable "master_authorized_ranges" {
- description = "External Ip address ranges that can access the Kubernetes cluster master through HTTPS."
- type = map(string)
- default = {}
+variable "max_pods_per_node" {
+ description = "Maximum number of pods per node in this cluster."
+ type = number
+ default = 110
}
variable "min_master_version" {
@@ -214,15 +162,9 @@ variable "min_master_version" {
}
variable "monitoring_config" {
- description = "Monitoring configuration (enabled components)."
+ description = "Monitoring components."
type = list(string)
- default = null
-}
-
-variable "monitoring_service" {
- description = "Monitoring service (disable with an empty string)."
- type = string
- default = "monitoring.googleapis.com/kubernetes"
+ default = ["SYSTEM_COMPONENTS"]
}
variable "name" {
@@ -230,46 +172,24 @@ variable "name" {
type = string
}
-variable "network" {
- description = "Name or self link of the VPC used for the cluster. Use the self link for Shared VPC."
- type = string
-}
-
variable "node_locations" {
description = "Zones in which the cluster's nodes are located."
type = list(string)
default = []
-}
-
-variable "notification_config" {
- description = "GKE Cluster upgrade notifications via PubSub."
- type = bool
- default = false
-}
-
-variable "peering_config" {
- description = "Configure peering with the master VPC for private clusters."
- type = object({
- export_routes = bool
- import_routes = bool
- project_id = string
- })
- default = null
-}
-
-variable "pod_security_policy" {
- description = "Enable the PodSecurityPolicy feature."
- type = bool
- default = null
+ nullable = false
}
variable "private_cluster_config" {
- description = "Enable and configure private cluster, private nodes must be true if used."
+ description = "Private cluster configuration."
type = object({
- enable_private_nodes = bool
- enable_private_endpoint = bool
- master_ipv4_cidr_block = string
- master_global_access = bool
+ enable_private_endpoint = optional(bool)
+ master_ipv4_cidr_block = optional(string)
+ master_global_access = optional(bool)
+ peering_config = optional(object({
+ export_routes = optional(bool)
+ import_routes = optional(bool)
+ project_id = optional(string)
+ }))
})
default = null
}
@@ -285,41 +205,20 @@ variable "release_channel" {
default = null
}
-variable "resource_usage_export_config" {
- description = "Configure the ResourceUsageExportConfig feature."
+variable "vpc_config" {
+ description = "VPC-level configuration."
type = object({
- enabled = bool
- dataset = string
+ network = string
+ subnetwork = string
+ secondary_range_blocks = optional(object({
+ pods = string
+ services = string
+ }), )
+ secondary_range_names = optional(object({
+ pods = string
+ services = string
+ }), { pods = "pods", services = "services" })
+ master_authorized_ranges = optional(map(string))
})
- default = {
- enabled = null
- dataset = null
- }
-}
-
-variable "secondary_range_pods" {
- description = "Subnet secondary range name used for pods."
- type = string
-}
-
-variable "secondary_range_services" {
- description = "Subnet secondary range name used for services."
- type = string
-}
-
-variable "subnetwork" {
- description = "VPC subnetwork name or self link."
- type = string
-}
-
-variable "vertical_pod_autoscaling" {
- description = "Enable the Vertical Pod Autoscaling feature."
- type = bool
- default = null
-}
-
-variable "workload_identity" {
- description = "Enable the Workload Identity feature."
- type = bool
- default = true
+ nullable = false
}
diff --git a/modules/gke-hub/README.md b/modules/gke-hub/README.md
index cd05eac149..e00c6bfc49 100644
--- a/modules/gke-hub/README.md
+++ b/modules/gke-hub/README.md
@@ -48,18 +48,20 @@ module "vpc" {
}
module "cluster_1" {
- source = "./fabric/modules/gke-cluster"
- project_id = module.project.project_id
- name = "cluster-1"
- location = "europe-west1-b"
- network = module.vpc.self_link
- subnetwork = module.vpc.subnet_self_links["europe-west1/cluster-1"]
- secondary_range_pods = "pods"
- secondary_range_services = "services"
- enable_dataplane_v2 = true
- master_authorized_ranges = { rfc1918_10_8 = "10.0.0.0/8" }
+ source = "./fabric/modules/gke-cluster"
+ project_id = module.project.project_id
+ name = "cluster-1"
+ location = "europe-west1"
+ vpc_config = {
+ network = module.vpc.self_link
+ subnetwork = module.vpc.subnet_self_links["europe-west1/cluster-1"]
+ master_authorized_ranges = { rfc1918_10_8 = "10.0.0.0/8" }
+ }
+ enable_features = {
+ dataplane_v2 = true
+ workload_identity = true
+ }
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = true
master_ipv4_cidr_block = "192.168.0.0/28"
master_global_access = false
@@ -225,27 +227,24 @@ module "firewall" {
}
module "cluster_1" {
- source = "./fabric/modules/gke-cluster"
- project_id = module.project.project_id
- name = "cluster-1"
- location = "europe-wes1"
- network = module.vpc.self_link
- subnetwork = module.vpc.subnet_self_links["europe-west1/subnet-cluster-1"]
- secondary_range_pods = "pods"
- secondary_range_services = "services"
+ source = "./fabric/modules/gke-cluster"
+ project_id = module.project.project_id
+ name = "cluster-1"
+ location = "europe-west1"
+ vpc_config = {
+ network = module.vpc.self_link
+ subnetwork = module.vpc.subnet_self_links["europe-west1/subnet-cluster-1"]
+ master_authorized_ranges = {
+ mgmt = "10.0.0.0/28"
+ pods-cluster-1 = "10.3.0.0/16"
+ }
+ }
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = false
master_ipv4_cidr_block = "192.168.1.0/28"
master_global_access = true
}
- master_authorized_ranges = {
- mgmt = "10.0.0.0/28"
- pods-cluster-1 = "10.3.0.0/16"
- }
- enable_autopilot = false
- release_channel = "REGULAR"
- workload_identity = true
+ release_channel = "REGULAR"
labels = {
mesh_id = "proj-${module.project.number}"
}
@@ -266,25 +265,22 @@ module "cluster_1_nodepool" {
module "cluster_2" {
source = "./fabric/modules/gke-cluster"
project_id = module.project.project_id
- name = "cluster-1"
- location = "europe-wes1"
- network = module.vpc.self_link
- subnetwork = module.vpc.subnet_self_links["europe-west4/subnet-cluster-2"]
- secondary_range_pods = "pods"
- secondary_range_services = "services"
+ name = "cluster-2"
+ location = "europe-west4"
+ vpc_config = {
+ network = module.vpc.self_link
+ subnetwork = module.vpc.subnet_self_links["europe-west4/subnet-cluster-2"]
+ master_authorized_ranges = {
+ mgmt = "10.0.0.0/28"
+ pods-cluster-1 = "10.3.0.0/16"
+ }
+ }
private_cluster_config = {
- enable_private_nodes = true
enable_private_endpoint = false
master_ipv4_cidr_block = "192.168.2.0/28"
master_global_access = true
}
- master_authorized_ranges = {
- mgmt = "10.0.0.0/28"
- pods-cluster-1 = "10.1.0.0/16"
- }
- enable_autopilot = false
- release_channel = "REGULAR"
- workload_identity = true
+ release_channel = "REGULAR"
labels = {
mesh_id = "proj-${module.project.number}"
}
diff --git a/tests/blueprints/networking/shared_vpc_gke/__init__.py b/tests/blueprints/gke/shared_vpc_gke/__init__.py
similarity index 100%
rename from tests/blueprints/networking/shared_vpc_gke/__init__.py
rename to tests/blueprints/gke/shared_vpc_gke/__init__.py
diff --git a/tests/blueprints/networking/shared_vpc_gke/fixture/main.tf b/tests/blueprints/gke/shared_vpc_gke/fixture/main.tf
similarity index 90%
rename from tests/blueprints/networking/shared_vpc_gke/fixture/main.tf
rename to tests/blueprints/gke/shared_vpc_gke/fixture/main.tf
index 6eca017580..ac4e647a2e 100644
--- a/tests/blueprints/networking/shared_vpc_gke/fixture/main.tf
+++ b/tests/blueprints/gke/shared_vpc_gke/fixture/main.tf
@@ -15,7 +15,7 @@
*/
module "test" {
- source = "../../../../../blueprints/networking/shared-vpc-gke"
+ source = "../../../../../blueprints/gke/shared-vpc-gke"
billing_account_id = var.billing_account_id
prefix = var.prefix
root_node = var.root_node
diff --git a/tests/blueprints/networking/shared_vpc_gke/fixture/variables.tf b/tests/blueprints/gke/shared_vpc_gke/fixture/variables.tf
similarity index 100%
rename from tests/blueprints/networking/shared_vpc_gke/fixture/variables.tf
rename to tests/blueprints/gke/shared_vpc_gke/fixture/variables.tf
diff --git a/tests/blueprints/networking/shared_vpc_gke/test_plan.py b/tests/blueprints/gke/shared_vpc_gke/test_plan.py
similarity index 100%
rename from tests/blueprints/networking/shared_vpc_gke/test_plan.py
rename to tests/blueprints/gke/shared_vpc_gke/test_plan.py
diff --git a/tests/modules/gke_cluster/fixture/main.tf b/tests/modules/gke_cluster/fixture/main.tf
index 078d470cd3..4ac38e1658 100644
--- a/tests/modules/gke_cluster/fixture/main.tf
+++ b/tests/modules/gke_cluster/fixture/main.tf
@@ -15,14 +15,14 @@
*/
module "test" {
- source = "../../../../modules/gke-cluster"
- project_id = "my-project"
- name = "cluster-1"
- location = "europe-west1-b"
- network = "mynetwork"
- subnetwork = "mysubnet"
- secondary_range_pods = "pods"
- secondary_range_services = "services"
- enable_autopilot = var.enable_autopilot
- addons = var.addons
+ source = "../../../../modules/gke-cluster"
+ project_id = "my-project"
+ name = "cluster-1"
+ location = "europe-west1-b"
+ vpc_config = {
+ network = "mynetwork"
+ subnetwork = "mysubnet"
+ }
+ enable_addons = var.enable_addons
+ enable_features = var.enable_features
}
diff --git a/tests/modules/gke_cluster/fixture/variables.tf b/tests/modules/gke_cluster/fixture/variables.tf
index 104054df87..1b539d20b3 100644
--- a/tests/modules/gke_cluster/fixture/variables.tf
+++ b/tests/modules/gke_cluster/fixture/variables.tf
@@ -14,25 +14,17 @@
* limitations under the License.
*/
-variable "enable_autopilot" {
- default = false
-}
-
-variable "addons" {
+variable "enable_addons" {
+ type = any
default = {
- cloudrun_config = false
- dns_cache_config = false
horizontal_pod_autoscaling = true
http_load_balancing = true
- istio_config = {
- enabled = false
- tls = false
- }
- network_policy_config = false
- gce_persistent_disk_csi_driver_config = false
- gcp_filestore_csi_driver_config = false
- config_connector_config = false
- kalm_config = false
- gke_backup_agent_config = false
+ }
+}
+
+variable "enable_features" {
+ type = any
+ default = {
+ workload_identity = true
}
}
diff --git a/tests/modules/gke_cluster/test_plan.py b/tests/modules/gke_cluster/test_plan.py
index 947448c184..acd97bede3 100644
--- a/tests/modules/gke_cluster/test_plan.py
+++ b/tests/modules/gke_cluster/test_plan.py
@@ -28,9 +28,8 @@ def test_standard(plan_runner):
def test_autopilot(plan_runner):
"Test resources created with variable defaults."
- _, resources = plan_runner(enable_autopilot="true")
+ _, resources = plan_runner(enable_features='{ autopilot=true }')
assert len(resources) == 1
-
cluster_config = resources[0]['values']
assert cluster_config['name'] == "cluster-1"
assert cluster_config['network'] == "mynetwork"