diff --git a/modules/gke-cluster-autopilot/README.md b/modules/gke-cluster-autopilot/README.md
index 0baad308..78e15e67 100644
--- a/modules/gke-cluster-autopilot/README.md
+++ b/modules/gke-cluster-autopilot/README.md
@@ -208,8 +208,8 @@ module "cluster-1" {
|---|---|:---:|:---:|:---:|
| [location](variables.tf#L110) | Autopilot clusters are always regional. | string
| ✓ | |
| [name](variables.tf#L187) | Cluster name. | string
| ✓ | |
-| [project_id](variables.tf#L213) | Cluster project ID. | string
| ✓ | |
-| [vpc_config](variables.tf#L242) | VPC-level configuration. | object({…})
| ✓ | |
+| [project_id](variables.tf#L223) | Cluster project ID. | string
| ✓ | |
+| [vpc_config](variables.tf#L239) | VPC-level configuration. | object({…})
| ✓ | |
| [backup_configs](variables.tf#L17) | Configuration for Backup for GKE. | object({…})
| | {}
|
| [deletion_protection](variables.tf#L37) | Whether or not to allow Terraform to destroy the cluster. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. | bool
| | true
|
| [description](variables.tf#L44) | Cluster description. | string
| | null
|
@@ -221,11 +221,10 @@ module "cluster-1" {
| [maintenance_config](variables.tf#L126) | Maintenance window configuration. | object({…})
| | {…}
|
| [min_master_version](variables.tf#L149) | Minimum version of the master, defaults to the version of the most recent official release. | string
| | null
|
| [monitoring_config](variables.tf#L155) | Monitoring configuration. System metrics collection cannot be disabled. Control plane metrics are optional. Kube state metrics are optional. Google Cloud Managed Service for Prometheus is enabled by default. | object({…})
| | {}
|
-| [node_locations](variables.tf#L192) | Zones in which the cluster's nodes are located. | list(string)
| | []
|
-| [private_cluster_config](variables.tf#L199) | Private cluster configuration. | object({…})
| | null
|
-| [release_channel](variables.tf#L218) | Release channel for GKE upgrades. Clusters created in the Autopilot mode must use a release channel. Choose between \"RAPID\", \"REGULAR\", and \"STABLE\". | string
| | "REGULAR"
|
-| [service_account](variables.tf#L229) | The Google Cloud Platform Service Account to be used by the node VMs created by GKE Autopilot. | string
| | null
|
-| [tags](variables.tf#L235) | Network tags applied to nodes. | list(string)
| | []
|
+| [node_config](variables.tf#L192) | Configuration for nodes and nodepools. | object({…})
| | {}
|
+| [node_locations](variables.tf#L202) | Zones in which the cluster's nodes are located. | list(string)
| | []
|
+| [private_cluster_config](variables.tf#L209) | Private cluster configuration. | object({…})
| | null
|
+| [release_channel](variables.tf#L228) | Release channel for GKE upgrades. Clusters created in the Autopilot mode must use a release channel. Choose between \"RAPID\", \"REGULAR\", and \"STABLE\". | string
| | "REGULAR"
|
## Outputs
diff --git a/modules/gke-cluster-autopilot/main.tf b/modules/gke-cluster-autopilot/main.tf
index 5bb03c9e..4abd4ef4 100644
--- a/modules/gke-cluster-autopilot/main.tf
+++ b/modules/gke-cluster-autopilot/main.tf
@@ -80,11 +80,9 @@ resource "google_container_cluster" "cluster" {
}
cluster_autoscaling {
- dynamic "auto_provisioning_defaults" {
- for_each = var.service_account != null ? [""] : []
- content {
- service_account = var.service_account
- }
+ auto_provisioning_defaults {
+ boot_disk_kms_key = var.node_config.boot_disk_kms_key
+ service_account = var.node_config.service_account
}
}
@@ -241,10 +239,10 @@ resource "google_container_cluster" "cluster" {
}
dynamic "node_pool_auto_config" {
- for_each = length(var.tags) > 0 ? [""] : []
+ for_each = var.node_config.tags != null ? [""] : []
content {
network_tags {
- tags = toset(var.tags)
+ tags = toset(var.node_config.tags)
}
}
}
diff --git a/modules/gke-cluster-autopilot/variables.tf b/modules/gke-cluster-autopilot/variables.tf
index ebc71968..fed9bd1f 100644
--- a/modules/gke-cluster-autopilot/variables.tf
+++ b/modules/gke-cluster-autopilot/variables.tf
@@ -189,6 +189,16 @@ variable "name" {
type = string
}
+variable "node_config" {
+ description = "Configuration for nodes and nodepools."
+ type = object({
+ boot_disk_kms_key = optional(string)
+ service_account = optional(string)
+ tags = optional(list(string))
+ })
+ default = {}
+}
+
variable "node_locations" {
description = "Zones in which the cluster's nodes are located."
type = list(string)
@@ -226,19 +236,6 @@ variable "release_channel" {
}
}
-variable "service_account" {
- description = "The Google Cloud Platform Service Account to be used by the node VMs created by GKE Autopilot."
- type = string
- default = null
-}
-
-variable "tags" {
- description = "Network tags applied to nodes."
- type = list(string)
- default = []
- nullable = false
-}
-
variable "vpc_config" {
description = "VPC-level configuration."
type = object({
diff --git a/modules/gke-cluster-standard/README.md b/modules/gke-cluster-standard/README.md
index e895b481..e2b505cd 100644
--- a/modules/gke-cluster-standard/README.md
+++ b/modules/gke-cluster-standard/README.md
@@ -312,8 +312,8 @@ module "cluster-1" {
|---|---|:---:|:---:|:---:|
| [location](variables.tf#L178) | Cluster zone or region. | string
| ✓ | |
| [name](variables.tf#L289) | Cluster name. | string
| ✓ | |
-| [project_id](variables.tf#L315) | Cluster project id. | string
| ✓ | |
-| [vpc_config](variables.tf#L338) | VPC-level configuration. | object({…})
| ✓ | |
+| [project_id](variables.tf#L325) | Cluster project id. | string
| ✓ | |
+| [vpc_config](variables.tf#L336) | VPC-level configuration. | object({…})
| ✓ | |
| [backup_configs](variables.tf#L17) | Configuration for Backup for GKE. | object({…})
| | {}
|
| [cluster_autoscaling](variables.tf#L38) | Enable and configure limits for Node Auto-Provisioning with Cluster Autoscaler. | object({…})
| | null
|
| [deletion_protection](variables.tf#L83) | Whether or not to allow Terraform to destroy the cluster. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. | bool
| | true
|
@@ -327,11 +327,10 @@ module "cluster-1" {
| [max_pods_per_node](variables.tf#L227) | Maximum number of pods per node in this cluster. | number
| | 110
|
| [min_master_version](variables.tf#L233) | Minimum version of the master, defaults to the version of the most recent official release. | string
| | null
|
| [monitoring_config](variables.tf#L239) | Monitoring configuration. Google Cloud Managed Service for Prometheus is enabled by default. | object({…})
| | {}
|
-| [node_locations](variables.tf#L294) | Zones in which the cluster's nodes are located. | list(string)
| | []
|
-| [private_cluster_config](variables.tf#L301) | Private cluster configuration. | object({…})
| | null
|
-| [release_channel](variables.tf#L320) | Release channel for GKE upgrades. | string
| | null
|
-| [service_account](variables.tf#L326) | Service account used for the default node pool, only useful if the default GCE service account has been disabled. | string
| | null
|
-| [tags](variables.tf#L332) | Network tags applied to nodes. | list(string)
| | null
|
+| [node_config](variables.tf#L294) | Node-level configuration. | object({…})
| | {}
|
+| [node_locations](variables.tf#L304) | Zones in which the cluster's nodes are located. | list(string)
| | []
|
+| [private_cluster_config](variables.tf#L311) | Private cluster configuration. | object({…})
| | null
|
+| [release_channel](variables.tf#L330) | Release channel for GKE upgrades. | string
| | null
|
## Outputs
diff --git a/modules/gke-cluster-standard/main.tf b/modules/gke-cluster-standard/main.tf
index 42f115e2..7be29da5 100644
--- a/modules/gke-cluster-standard/main.tf
+++ b/modules/gke-cluster-standard/main.tf
@@ -42,9 +42,11 @@ resource "google_container_cluster" "cluster" {
)
# the default node pool is deleted here, use the gke-nodepool module instead.
- # the default node pool configuration is based on a shielded_nodes variable.
+ # shielded nodes are controlled by the cluster-level enable_features variable
node_config {
- service_account = var.service_account
+ boot_disk_kms_key = var.node_config.boot_disk_kms_key
+ service_account = var.node_config.service_account
+ tags = var.node_config.tags
dynamic "shielded_instance_config" {
for_each = var.enable_features.shielded_nodes ? [""] : []
content {
@@ -52,7 +54,6 @@ resource "google_container_cluster" "cluster" {
enable_integrity_monitoring = true
}
}
- tags = var.tags
}
addons_config {
diff --git a/modules/gke-cluster-standard/variables.tf b/modules/gke-cluster-standard/variables.tf
index eebd595a..ecf110af 100644
--- a/modules/gke-cluster-standard/variables.tf
+++ b/modules/gke-cluster-standard/variables.tf
@@ -291,6 +291,16 @@ variable "name" {
type = string
}
+variable "node_config" {
+ description = "Node-level configuration."
+ type = object({
+ boot_disk_kms_key = optional(string)
+ service_account = optional(string)
+ tags = optional(list(string))
+ })
+ default = {}
+}
+
variable "node_locations" {
description = "Zones in which the cluster's nodes are located."
type = list(string)
@@ -323,18 +333,6 @@ variable "release_channel" {
default = null
}
-variable "service_account" {
- description = "Service account used for the default node pool, only useful if the default GCE service account has been disabled."
- type = string
- default = null
-}
-
-variable "tags" {
- description = "Network tags applied to nodes."
- type = list(string)
- default = null
-}
-
variable "vpc_config" {
description = "VPC-level configuration."
type = object({
diff --git a/tests/modules/gke_cluster_autopilot/network_tags.tfvars b/tests/modules/gke_cluster_autopilot/network_tags.tfvars
index 4b188f31..97d53c22 100644
--- a/tests/modules/gke_cluster_autopilot/network_tags.tfvars
+++ b/tests/modules/gke_cluster_autopilot/network_tags.tfvars
@@ -5,10 +5,12 @@ vpc_config = {
network = "default"
subnetwork = "default"
}
-tags = [
- "deep-dark-wood",
- "hello-gruffalo",
- "my--precious---nodes",
- "cluster-1-nodes",
- "nodes-cluster-1",
-]
+node_config = {
+ tags = [
+ "deep-dark-wood",
+ "hello-gruffalo",
+ "my--precious---nodes",
+ "cluster-1-nodes",
+ "nodes-cluster-1",
+ ]
+}