Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for setting gke intranode visibility #747

Merged
merged 1 commit into from
Jun 4, 2019
Merged

Add support for setting gke intranode visibility #747

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions google-beta/resource_container_cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -684,6 +684,12 @@ func resourceContainerCluster() *schema.Resource {
},
},
},

"enable_intranode_visibility": {
Type: schema.TypeBool,
Default: false,
Optional: true,
},
},
}
}
Expand Down Expand Up @@ -738,6 +744,10 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
Autoscaling: expandClusterAutoscaling(d.Get("cluster_autoscaling"), d),
MasterAuth: expandMasterAuth(d.Get("master_auth")),
ResourceLabels: expandStringMap(d, "resource_labels"),
NetworkConfig: &containerBeta.NetworkConfig{
EnableIntraNodeVisibility: d.Get("enable_intranode_visibility").(bool),
ForceSendFields: []string{"Enabled"},
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this ForceSendFields is working as intended. There is no Enabled in the EnableIntraNodeVisibility object so it is ignored. However since this is in Create and false is the default there is no need to force send a falsey value.

},
}

if v, ok := d.GetOk("default_max_pods_per_node"); ok {
Expand Down Expand Up @@ -951,6 +961,7 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
d.Set("enable_legacy_abac", cluster.LegacyAbac.Enabled)
d.Set("logging_service", cluster.LoggingService)
d.Set("monitoring_service", cluster.MonitoringService)
d.Set("enable_intranode_visibility", cluster.NetworkConfig.EnableIntraNodeVisibility)
d.Set("network", cluster.NetworkConfig.Network)
d.Set("subnetwork", cluster.NetworkConfig.Subnetwork)
d.Set("enable_binary_authorization", cluster.BinaryAuthorization != nil && cluster.BinaryAuthorization.Enabled)
Expand Down Expand Up @@ -1279,6 +1290,40 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
d.SetPartial("enable_legacy_abac")
}

if d.HasChange("enable_intranode_visibility") {
enabled := d.Get("enable_intranode_visibility").(bool)
req := &containerBeta.UpdateClusterRequest{
Update: &containerBeta.ClusterUpdate{
DesiredIntraNodeVisibilityConfig: &containerBeta.IntraNodeVisibilityConfig{
Enabled: enabled,
ForceSendFields: []string{"Enabled"},
},
},
}
updateF := func() error {
log.Println("[DEBUG] updating enable_intranode_visibility")
name := containerClusterFullName(project, location, clusterName)
op, err := config.clientContainerBeta.Projects.Locations.Clusters.Update(name, req).Do()
if err != nil {
return err
}

// Wait until it's updated
err = containerOperationWait(config, op, project, location, "updating GKE Intra Node Visibility", timeoutInMinutes)
log.Println("[DEBUG] done updating enable_intranode_visibility")
return err
}

// Call update serially.
if err := lockedCall(lockKey, updateF); err != nil {
return err
}

log.Printf("[INFO] GKE cluster %s Intra Node Visibility has been updated to %v", d.Id(), enabled)

d.SetPartial("enable_intranode_visibility")
}

if d.HasChange("monitoring_service") || d.HasChange("logging_service") {
logging := d.Get("logging_service").(string)
monitoring := d.Get("monitoring_service").(string)
Expand Down
97 changes: 97 additions & 0 deletions google-beta/resource_container_cluster_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -606,6 +606,44 @@ func TestAccContainerCluster_withLegacyAbac(t *testing.T) {
})
}

func TestAccContainerCluster_withIntraNodeVisibility(t *testing.T) {
t.Parallel()

clusterName := fmt.Sprintf("cluster-test-%s", acctest.RandString(10))

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckContainerClusterDestroy,
Steps: []resource.TestStep{
{
Config: testAccContainerCluster_withIntraNodeVisibility(clusterName),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttr("google_container_cluster.with_intranode_visibility", "enable_intranode_visibility", "true"),
),
},
{
ResourceName: "google_container_cluster.with_intranode_visibility",
ImportStateIdPrefix: "us-central1-a/",
ImportState: true,
ImportStateVerify: true,
},
{
Config: testAccContainerCluster_updateIntraNodeVisibility(clusterName),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttr("google_container_cluster.with_intranode_visibility", "enable_intranode_visibility", "false"),
),
},
{
ResourceName: "google_container_cluster.with_intranode_visibility",
ImportStateIdPrefix: "us-central1-a/",
ImportState: true,
ImportStateVerify: true,
},
},
})
}

/*
Since GKE disables legacy ABAC by default in Kubernetes version 1.8+, and the default Kubernetes
version for GKE is also 1.8+, this test will ensure that legacy ABAC is disabled by default to be
Expand Down Expand Up @@ -635,6 +673,34 @@ func TestAccContainerCluster_withDefaultLegacyAbac(t *testing.T) {
})
}

/*
Since GKE disables Intra Node Visibility by default, this test will ensure that Intra Node Visibility is disabled by default to be
more consistent with default settings in the Cloud Console
*/
func TestAccContainerCluster_withDefaultIntraNodeVisibility(t *testing.T) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this field is marked as Default: false I don't think we need to assert that the default is actually sent to GCP. This is more of a test of Terraform than the provider implementation here. Since GKE tests are somewhat expensive I'll be taking this out.

t.Parallel()

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckContainerClusterDestroy,
Steps: []resource.TestStep{
{
Config: testAccContainerCluster_defaultIntraNodeVisibility(acctest.RandString(10)),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttr("google_container_cluster.default_intranode_visibility", "enable_intranode_visibility", "false"),
),
},
{
ResourceName: "google_container_cluster.default_intranode_visibility",
ImportStateIdPrefix: "us-central1-a/",
ImportState: true,
ImportStateVerify: true,
},
},
})
}

func TestAccContainerCluster_withVersion(t *testing.T) {
t.Parallel()

Expand Down Expand Up @@ -2203,6 +2269,37 @@ resource "google_container_cluster" "with_legacy_abac" {
}`, clusterName)
}

func testAccContainerCluster_defaultIntraNodeVisibility(clusterName string) string {
return fmt.Sprintf(`
resource "google_container_cluster" "default_intranode_visibility" {
name = "cluster-test-%s"
zone = "us-central1-a"
initial_node_count = 1
}`, clusterName)
}

func testAccContainerCluster_withIntraNodeVisibility(clusterName string) string {
return fmt.Sprintf(`
resource "google_container_cluster" "with_intranode_visibility" {
name = "cluster-test-%s"
zone = "us-central1-a"
initial_node_count = 1

enable_intranode_visibility = true
}`, clusterName)
}

func testAccContainerCluster_updateIntraNodeVisibility(clusterName string) string {
return fmt.Sprintf(`
resource "google_container_cluster" "with_intranode_visibility" {
name = "cluster-test-%s"
zone = "us-central1-a"
initial_node_count = 1

enable_intranode_visibility = false
}`, clusterName)
}

func testAccContainerCluster_withVersion(clusterName string) string {
return fmt.Sprintf(`
data "google_container_engine_versions" "central1a" {
Expand Down