From 8e93ada6e8f72e0924620d48b00baae35d245729 Mon Sep 17 00:00:00 2001 From: Luis Silva Date: Tue, 21 May 2019 22:35:40 +0100 Subject: [PATCH] Add support for setting gke intranode visibility --- google-beta/resource_container_cluster.go | 45 +++++++++ .../resource_container_cluster_test.go | 97 +++++++++++++++++++ 2 files changed, 142 insertions(+) diff --git a/google-beta/resource_container_cluster.go b/google-beta/resource_container_cluster.go index 52b836a255..0fac400d6e 100644 --- a/google-beta/resource_container_cluster.go +++ b/google-beta/resource_container_cluster.go @@ -684,6 +684,12 @@ func resourceContainerCluster() *schema.Resource { }, }, }, + + "enable_intranode_visibility": { + Type: schema.TypeBool, + Default: false, + Optional: true, + }, }, } } @@ -738,6 +744,10 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er Autoscaling: expandClusterAutoscaling(d.Get("cluster_autoscaling"), d), MasterAuth: expandMasterAuth(d.Get("master_auth")), ResourceLabels: expandStringMap(d, "resource_labels"), + NetworkConfig: &containerBeta.NetworkConfig{ + EnableIntraNodeVisibility: d.Get("enable_intranode_visibility").(bool), + ForceSendFields: []string{"Enabled"}, + }, } if v, ok := d.GetOk("default_max_pods_per_node"); ok { @@ -951,6 +961,7 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro d.Set("enable_legacy_abac", cluster.LegacyAbac.Enabled) d.Set("logging_service", cluster.LoggingService) d.Set("monitoring_service", cluster.MonitoringService) + d.Set("enable_intranode_visibility", cluster.NetworkConfig.EnableIntraNodeVisibility) d.Set("network", cluster.NetworkConfig.Network) d.Set("subnetwork", cluster.NetworkConfig.Subnetwork) d.Set("enable_binary_authorization", cluster.BinaryAuthorization != nil && cluster.BinaryAuthorization.Enabled) @@ -1279,6 +1290,40 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er d.SetPartial("enable_legacy_abac") } + if d.HasChange("enable_intranode_visibility") { + enabled := d.Get("enable_intranode_visibility").(bool) + req := &containerBeta.UpdateClusterRequest{ + Update: &containerBeta.ClusterUpdate{ + DesiredIntraNodeVisibilityConfig: &containerBeta.IntraNodeVisibilityConfig{ + Enabled: enabled, + ForceSendFields: []string{"Enabled"}, + }, + }, + } + updateF := func() error { + log.Println("[DEBUG] updating enable_intranode_visibility") + name := containerClusterFullName(project, location, clusterName) + op, err := config.clientContainerBeta.Projects.Locations.Clusters.Update(name, req).Do() + if err != nil { + return err + } + + // Wait until it's updated + err = containerOperationWait(config, op, project, location, "updating GKE Intra Node Visibility", timeoutInMinutes) + log.Println("[DEBUG] done updating enable_intranode_visibility") + return err + } + + // Call update serially. + if err := lockedCall(lockKey, updateF); err != nil { + return err + } + + log.Printf("[INFO] GKE cluster %s Intra Node Visibility has been updated to %v", d.Id(), enabled) + + d.SetPartial("enable_intranode_visibility") + } + if d.HasChange("monitoring_service") || d.HasChange("logging_service") { logging := d.Get("logging_service").(string) monitoring := d.Get("monitoring_service").(string) diff --git a/google-beta/resource_container_cluster_test.go b/google-beta/resource_container_cluster_test.go index 9417c50b48..c5a1516e9f 100644 --- a/google-beta/resource_container_cluster_test.go +++ b/google-beta/resource_container_cluster_test.go @@ -606,6 +606,44 @@ func TestAccContainerCluster_withLegacyAbac(t *testing.T) { }) } +func TestAccContainerCluster_withIntraNodeVisibility(t *testing.T) { + t.Parallel() + + clusterName := fmt.Sprintf("cluster-test-%s", acctest.RandString(10)) + + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckContainerClusterDestroy, + Steps: []resource.TestStep{ + { + Config: testAccContainerCluster_withIntraNodeVisibility(clusterName), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("google_container_cluster.with_intranode_visibility", "enable_intranode_visibility", "true"), + ), + }, + { + ResourceName: "google_container_cluster.with_intranode_visibility", + ImportStateIdPrefix: "us-central1-a/", + ImportState: true, + ImportStateVerify: true, + }, + { + Config: testAccContainerCluster_updateIntraNodeVisibility(clusterName), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("google_container_cluster.with_intranode_visibility", "enable_intranode_visibility", "false"), + ), + }, + { + ResourceName: "google_container_cluster.with_intranode_visibility", + ImportStateIdPrefix: "us-central1-a/", + ImportState: true, + ImportStateVerify: true, + }, + }, + }) +} + /* Since GKE disables legacy ABAC by default in Kubernetes version 1.8+, and the default Kubernetes version for GKE is also 1.8+, this test will ensure that legacy ABAC is disabled by default to be @@ -635,6 +673,34 @@ func TestAccContainerCluster_withDefaultLegacyAbac(t *testing.T) { }) } +/* + Since GKE disables Intra Node Visibility by default, this test will ensure that Intra Node Visibility is disabled by default to be + more consistent with default settings in the Cloud Console +*/ +func TestAccContainerCluster_withDefaultIntraNodeVisibility(t *testing.T) { + t.Parallel() + + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckContainerClusterDestroy, + Steps: []resource.TestStep{ + { + Config: testAccContainerCluster_defaultIntraNodeVisibility(acctest.RandString(10)), + Check: resource.ComposeTestCheckFunc( + resource.TestCheckResourceAttr("google_container_cluster.default_intranode_visibility", "enable_intranode_visibility", "false"), + ), + }, + { + ResourceName: "google_container_cluster.default_intranode_visibility", + ImportStateIdPrefix: "us-central1-a/", + ImportState: true, + ImportStateVerify: true, + }, + }, + }) +} + func TestAccContainerCluster_withVersion(t *testing.T) { t.Parallel() @@ -2203,6 +2269,37 @@ resource "google_container_cluster" "with_legacy_abac" { }`, clusterName) } +func testAccContainerCluster_defaultIntraNodeVisibility(clusterName string) string { + return fmt.Sprintf(` +resource "google_container_cluster" "default_intranode_visibility" { + name = "cluster-test-%s" + zone = "us-central1-a" + initial_node_count = 1 +}`, clusterName) +} + +func testAccContainerCluster_withIntraNodeVisibility(clusterName string) string { + return fmt.Sprintf(` +resource "google_container_cluster" "with_intranode_visibility" { + name = "cluster-test-%s" + zone = "us-central1-a" + initial_node_count = 1 + + enable_intranode_visibility = true +}`, clusterName) +} + +func testAccContainerCluster_updateIntraNodeVisibility(clusterName string) string { + return fmt.Sprintf(` +resource "google_container_cluster" "with_intranode_visibility" { + name = "cluster-test-%s" + zone = "us-central1-a" + initial_node_count = 1 + + enable_intranode_visibility = false +}`, clusterName) +} + func testAccContainerCluster_withVersion(clusterName string) string { return fmt.Sprintf(` data "google_container_engine_versions" "central1a" {