infra/clusters: upgrade terraform to 0.15 for all but k8s-infra-public-pii

[spiffxp]

Migration was performed by editing required versions, then running:

terraform init -reconfigure
terraform apply

The following folders have been migrated

• modules/gke-cluster
• modules/gke-nodepool
• modules/gke-project
• projects/k8s-infra-ii-sandbox
• projects/k8s-infra-prow-build
• projects/k8s-infra-prow-build-trusted

The one folder not migrated is projects/k8s-infra-public-pii since
that's still being deployed. However, since it doesn't depend on
modules/ it can be done as a followup

[spiffxp]

/cc @ameukam
FYI, going to try and push us to 1.0 today if this doesn't change too much.

[spiffxp]

Read-only verify for k8s-infra-prow-build

$ terraform init -reconfigure # avoid migrating backend state
$ terraform validate
$ terraform plan

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the last "terraform apply":

  # google_project_iam_member.kubernetes_external_secrets_for_prow_build_trusted has been changed
  ~ resource "google_project_iam_member" "kubernetes_external_secrets_for_prow_build_trusted" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/roles/secretmanager.secretAccessor/serviceAccount:kubernetes-external-secrets@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
        # (3 unchanged attributes hidden)
    }
  # google_project_iam_member.k8s_infra_prow_oncall has been changed
  ~ resource "google_project_iam_member" "k8s_infra_prow_oncall" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/roles/owner/group:[email protected]"
        # (3 unchanged attributes hidden)
    }
  # module.project.google_project_iam_member.cluster_admins_as_compute_viewer has been changed
  ~ resource "google_project_iam_member" "cluster_admins_as_compute_viewer" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/roles/compute.viewer/group:[email protected]"
        # (3 unchanged attributes hidden)
    }
  # module.project.google_project_iam_member.cluster_users_as_container_cluster_viewer has been changed
  ~ resource "google_project_iam_member" "cluster_users_as_container_cluster_viewer" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/roles/container.clusterViewer/group:[email protected]"
        # (3 unchanged attributes hidden)
    }
  # module.project.google_project_iam_member.cluster_admins_as_service_account_lister has been changed
  ~ resource "google_project_iam_member" "cluster_admins_as_service_account_lister" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/organizations/758905017065/roles/iam.serviceAccountLister/group:[email protected]"
        # (3 unchanged attributes hidden)
    }
  # module.project.google_project_iam_member.cluster_admins_as_container_admin has been changed
  ~ resource "google_project_iam_member" "cluster_admins_as_container_admin" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/roles/container.admin/group:[email protected]"
        # (3 unchanged attributes hidden)
    }
  # module.prow_build_cluster.google_project_iam_member.cluster_node_sa_logging has been changed
  ~ resource "google_project_iam_member" "cluster_node_sa_logging" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/roles/logging.logWriter/serviceaccount:gke-nodes-prow-build-trusted@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
        # (3 unchanged attributes hidden)
    }
  # module.prow_build_cluster.google_project_iam_member.cluster_node_sa_monitoring_metricwriter has been changed
  ~ resource "google_project_iam_member" "cluster_node_sa_monitoring_metricwriter" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/roles/monitoring.metricWriter/serviceaccount:gke-nodes-prow-build-trusted@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
        # (3 unchanged attributes hidden)
    }
  # module.prow_build_cluster.google_project_iam_member.cluster_node_sa_monitoring_viewer has been changed
  ~ resource "google_project_iam_member" "cluster_node_sa_monitoring_viewer" {
      ~ etag    = "BwXEb82K4FA=" -> "BwXEb+Jpc74="
        id      = "k8s-infra-prow-build-trusted/roles/monitoring.viewer/serviceaccount:gke-nodes-prow-build-trusted@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
        # (3 unchanged attributes hidden)
    }

Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the following plan may include actions to undo or respond to these changes.

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.prow_build_nodepool.google_container_node_pool.node_pool will be updated in-place
  ~ resource "google_container_node_pool" "node_pool" {
      # Warning: this attribute value will be marked as sensitive and will not
      # display in UI output after applying this change. The value is unchanged.
      ~ cluster             = (sensitive)
        id                  = "projects/k8s-infra-prow-build-trusted/locations/us-central1/clusters/prow-build-trusted/nodePools/trusted-pool1-20200430235251092500000001"
      # Warning: this attribute value will be marked as sensitive and will not
      # display in UI output after applying this change. The value is unchanged.
      ~ location            = (sensitive)
        name                = "trusted-pool1-20200430235251092500000001"
        # (7 unchanged attributes hidden)




        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Kinda nice that it warns about etag changes. Nothing looks objectionable here, so I'm going to apply

[spiffxp]

$ terraform apply

module.prow_build_nodepool.google_container_node_pool.node_pool: Modifying... [id=projects/k8s-infra-prow-build-trusted/locations/us-central1/clusters/prow-build-trusted/nodePools/trusted-pool1-20200430235251092500000001]
module.prow_build_nodepool.google_container_node_pool.node_pool: Modifications complete after 0s [id=projects/k8s-infra-prow-build-trusted/locations/us-central1/clusters/prow-build-trusted/nodePools/trusted-pool1-20200430235251092500000001]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

[spiffxp]

OK at this point I'm blocked on successful deployment of #2031

EDIT: so I've opted to split migrating that out to a followup PR, this is ready to merge

[ameukam]

/lgtm
/hold

[dims]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/clusters/OWNERS [dims,spiffxp]
• infra/gcp/prow/OWNERS [dims,spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spiffxp]

/hold cancel

[spiffxp]

Upgrading terraform ref: #2020