From 637926fb68f6908ef3bb7352343416ab787075c2 Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Thu, 23 Nov 2023 12:52:13 +0100 Subject: [PATCH] Support boot disk KMS key in GKE cluster modules (#1881) * gke cluster standard * tfdoc * gke cluster autopilot * fix autopilot tags test --- modules/gke-cluster-autopilot/README.md | 13 +++++------ modules/gke-cluster-autopilot/main.tf | 12 ++++------ modules/gke-cluster-autopilot/variables.tf | 23 ++++++++----------- modules/gke-cluster-standard/README.md | 13 +++++------ modules/gke-cluster-standard/main.tf | 7 +++--- modules/gke-cluster-standard/variables.tf | 22 ++++++++---------- .../gke_cluster_autopilot/network_tags.tfvars | 16 +++++++------ 7 files changed, 50 insertions(+), 56 deletions(-) diff --git a/modules/gke-cluster-autopilot/README.md b/modules/gke-cluster-autopilot/README.md index 0baad308..78e15e67 100644 --- a/modules/gke-cluster-autopilot/README.md +++ b/modules/gke-cluster-autopilot/README.md @@ -208,8 +208,8 @@ module "cluster-1" { |---|---|:---:|:---:|:---:| | [location](variables.tf#L110) | Autopilot clusters are always regional. | string | ✓ | | | [name](variables.tf#L187) | Cluster name. | string | ✓ | | -| [project_id](variables.tf#L213) | Cluster project ID. | string | ✓ | | -| [vpc_config](variables.tf#L242) | VPC-level configuration. | object({…}) | ✓ | | +| [project_id](variables.tf#L223) | Cluster project ID. | string | ✓ | | +| [vpc_config](variables.tf#L239) | VPC-level configuration. | object({…}) | ✓ | | | [backup_configs](variables.tf#L17) | Configuration for Backup for GKE. | object({…}) | | {} | | [deletion_protection](variables.tf#L37) | Whether or not to allow Terraform to destroy the cluster. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. | bool | | true | | [description](variables.tf#L44) | Cluster description. | string | | null | @@ -221,11 +221,10 @@ module "cluster-1" { | [maintenance_config](variables.tf#L126) | Maintenance window configuration. | object({…}) | | {…} | | [min_master_version](variables.tf#L149) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null | | [monitoring_config](variables.tf#L155) | Monitoring configuration. System metrics collection cannot be disabled. Control plane metrics are optional. Kube state metrics are optional. Google Cloud Managed Service for Prometheus is enabled by default. | object({…}) | | {} | -| [node_locations](variables.tf#L192) | Zones in which the cluster's nodes are located. | list(string) | | [] | -| [private_cluster_config](variables.tf#L199) | Private cluster configuration. | object({…}) | | null | -| [release_channel](variables.tf#L218) | Release channel for GKE upgrades. Clusters created in the Autopilot mode must use a release channel. Choose between \"RAPID\", \"REGULAR\", and \"STABLE\". | string | | "REGULAR" | -| [service_account](variables.tf#L229) | The Google Cloud Platform Service Account to be used by the node VMs created by GKE Autopilot. | string | | null | -| [tags](variables.tf#L235) | Network tags applied to nodes. | list(string) | | [] | +| [node_config](variables.tf#L192) | Configuration for nodes and nodepools. | object({…}) | | {} | +| [node_locations](variables.tf#L202) | Zones in which the cluster's nodes are located. | list(string) | | [] | +| [private_cluster_config](variables.tf#L209) | Private cluster configuration. | object({…}) | | null | +| [release_channel](variables.tf#L228) | Release channel for GKE upgrades. Clusters created in the Autopilot mode must use a release channel. Choose between \"RAPID\", \"REGULAR\", and \"STABLE\". | string | | "REGULAR" | ## Outputs diff --git a/modules/gke-cluster-autopilot/main.tf b/modules/gke-cluster-autopilot/main.tf index 5bb03c9e..4abd4ef4 100644 --- a/modules/gke-cluster-autopilot/main.tf +++ b/modules/gke-cluster-autopilot/main.tf @@ -80,11 +80,9 @@ resource "google_container_cluster" "cluster" { } cluster_autoscaling { - dynamic "auto_provisioning_defaults" { - for_each = var.service_account != null ? [""] : [] - content { - service_account = var.service_account - } + auto_provisioning_defaults { + boot_disk_kms_key = var.node_config.boot_disk_kms_key + service_account = var.node_config.service_account } } @@ -241,10 +239,10 @@ resource "google_container_cluster" "cluster" { } dynamic "node_pool_auto_config" { - for_each = length(var.tags) > 0 ? [""] : [] + for_each = var.node_config.tags != null ? [""] : [] content { network_tags { - tags = toset(var.tags) + tags = toset(var.node_config.tags) } } } diff --git a/modules/gke-cluster-autopilot/variables.tf b/modules/gke-cluster-autopilot/variables.tf index ebc71968..fed9bd1f 100644 --- a/modules/gke-cluster-autopilot/variables.tf +++ b/modules/gke-cluster-autopilot/variables.tf @@ -189,6 +189,16 @@ variable "name" { type = string } +variable "node_config" { + description = "Configuration for nodes and nodepools." + type = object({ + boot_disk_kms_key = optional(string) + service_account = optional(string) + tags = optional(list(string)) + }) + default = {} +} + variable "node_locations" { description = "Zones in which the cluster's nodes are located." type = list(string) @@ -226,19 +236,6 @@ variable "release_channel" { } } -variable "service_account" { - description = "The Google Cloud Platform Service Account to be used by the node VMs created by GKE Autopilot." - type = string - default = null -} - -variable "tags" { - description = "Network tags applied to nodes." - type = list(string) - default = [] - nullable = false -} - variable "vpc_config" { description = "VPC-level configuration." type = object({ diff --git a/modules/gke-cluster-standard/README.md b/modules/gke-cluster-standard/README.md index e895b481..e2b505cd 100644 --- a/modules/gke-cluster-standard/README.md +++ b/modules/gke-cluster-standard/README.md @@ -312,8 +312,8 @@ module "cluster-1" { |---|---|:---:|:---:|:---:| | [location](variables.tf#L178) | Cluster zone or region. | string | ✓ | | | [name](variables.tf#L289) | Cluster name. | string | ✓ | | -| [project_id](variables.tf#L315) | Cluster project id. | string | ✓ | | -| [vpc_config](variables.tf#L338) | VPC-level configuration. | object({…}) | ✓ | | +| [project_id](variables.tf#L325) | Cluster project id. | string | ✓ | | +| [vpc_config](variables.tf#L336) | VPC-level configuration. | object({…}) | ✓ | | | [backup_configs](variables.tf#L17) | Configuration for Backup for GKE. | object({…}) | | {} | | [cluster_autoscaling](variables.tf#L38) | Enable and configure limits for Node Auto-Provisioning with Cluster Autoscaler. | object({…}) | | null | | [deletion_protection](variables.tf#L83) | Whether or not to allow Terraform to destroy the cluster. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. | bool | | true | @@ -327,11 +327,10 @@ module "cluster-1" { | [max_pods_per_node](variables.tf#L227) | Maximum number of pods per node in this cluster. | number | | 110 | | [min_master_version](variables.tf#L233) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null | | [monitoring_config](variables.tf#L239) | Monitoring configuration. Google Cloud Managed Service for Prometheus is enabled by default. | object({…}) | | {} | -| [node_locations](variables.tf#L294) | Zones in which the cluster's nodes are located. | list(string) | | [] | -| [private_cluster_config](variables.tf#L301) | Private cluster configuration. | object({…}) | | null | -| [release_channel](variables.tf#L320) | Release channel for GKE upgrades. | string | | null | -| [service_account](variables.tf#L326) | Service account used for the default node pool, only useful if the default GCE service account has been disabled. | string | | null | -| [tags](variables.tf#L332) | Network tags applied to nodes. | list(string) | | null | +| [node_config](variables.tf#L294) | Node-level configuration. | object({…}) | | {} | +| [node_locations](variables.tf#L304) | Zones in which the cluster's nodes are located. | list(string) | | [] | +| [private_cluster_config](variables.tf#L311) | Private cluster configuration. | object({…}) | | null | +| [release_channel](variables.tf#L330) | Release channel for GKE upgrades. | string | | null | ## Outputs diff --git a/modules/gke-cluster-standard/main.tf b/modules/gke-cluster-standard/main.tf index 42f115e2..7be29da5 100644 --- a/modules/gke-cluster-standard/main.tf +++ b/modules/gke-cluster-standard/main.tf @@ -42,9 +42,11 @@ resource "google_container_cluster" "cluster" { ) # the default node pool is deleted here, use the gke-nodepool module instead. - # the default node pool configuration is based on a shielded_nodes variable. + # shielded nodes are controlled by the cluster-level enable_features variable node_config { - service_account = var.service_account + boot_disk_kms_key = var.node_config.boot_disk_kms_key + service_account = var.node_config.service_account + tags = var.node_config.tags dynamic "shielded_instance_config" { for_each = var.enable_features.shielded_nodes ? [""] : [] content { @@ -52,7 +54,6 @@ resource "google_container_cluster" "cluster" { enable_integrity_monitoring = true } } - tags = var.tags } addons_config { diff --git a/modules/gke-cluster-standard/variables.tf b/modules/gke-cluster-standard/variables.tf index eebd595a..ecf110af 100644 --- a/modules/gke-cluster-standard/variables.tf +++ b/modules/gke-cluster-standard/variables.tf @@ -291,6 +291,16 @@ variable "name" { type = string } +variable "node_config" { + description = "Node-level configuration." + type = object({ + boot_disk_kms_key = optional(string) + service_account = optional(string) + tags = optional(list(string)) + }) + default = {} +} + variable "node_locations" { description = "Zones in which the cluster's nodes are located." type = list(string) @@ -323,18 +333,6 @@ variable "release_channel" { default = null } -variable "service_account" { - description = "Service account used for the default node pool, only useful if the default GCE service account has been disabled." - type = string - default = null -} - -variable "tags" { - description = "Network tags applied to nodes." - type = list(string) - default = null -} - variable "vpc_config" { description = "VPC-level configuration." type = object({ diff --git a/tests/modules/gke_cluster_autopilot/network_tags.tfvars b/tests/modules/gke_cluster_autopilot/network_tags.tfvars index 4b188f31..97d53c22 100644 --- a/tests/modules/gke_cluster_autopilot/network_tags.tfvars +++ b/tests/modules/gke_cluster_autopilot/network_tags.tfvars @@ -5,10 +5,12 @@ vpc_config = { network = "default" subnetwork = "default" } -tags = [ - "deep-dark-wood", - "hello-gruffalo", - "my--precious---nodes", - "cluster-1-nodes", - "nodes-cluster-1", -] +node_config = { + tags = [ + "deep-dark-wood", + "hello-gruffalo", + "my--precious---nodes", + "cluster-1-nodes", + "nodes-cluster-1", + ] +}