140 lines
10 KiB
Markdown
140 lines
10 KiB
Markdown
# GKE nodepool module
|
|
|
|
This module allows simplified creation and management of individual GKE nodepools, setting sensible defaults (eg a service account is created for nodes if none is set) and allowing for less verbose usage in most use cases.
|
|
|
|
## Example usage
|
|
|
|
### Module defaults
|
|
|
|
If no specific node configuration is set via variables, the module uses the provider's defaults only setting OAuth scopes to a minimal working set and the node machine type to `n1-standard-1`. The service account set by the provider in this case is the GCE default service account.
|
|
|
|
```hcl
|
|
module "cluster-1-nodepool-1" {
|
|
source = "./fabric/modules/gke-nodepool"
|
|
project_id = "myproject"
|
|
cluster_name = "cluster-1"
|
|
location = "europe-west1-b"
|
|
name = "nodepool-1"
|
|
}
|
|
# tftest modules=1 resources=1 inventory=basic.yaml
|
|
```
|
|
|
|
### Internally managed service account
|
|
|
|
There are three different approaches to defining the nodes service account, all depending on the `service_account` variable where the `create` attribute controls creation of a new service account by this module, and the `email` attribute controls the actual service account to use.
|
|
|
|
If you create a new service account, its resource and email (in both plain and IAM formats) are then available in outputs to reference it in other modules or resources.
|
|
|
|
#### GCE default service account
|
|
|
|
To use the GCE default service account, you can ignore the variable which is equivalent to `{ create = null, email = null }`. This is what the first example of this document does.
|
|
|
|
#### Externally defined service account
|
|
|
|
To use an existing service account, pass in just the `email` attribute. If you do this, will most likely want to use the `cloud-platform` scope.
|
|
|
|
```hcl
|
|
module "cluster-1-nodepool-1" {
|
|
source = "./fabric/modules/gke-nodepool"
|
|
project_id = "myproject"
|
|
cluster_name = "cluster-1"
|
|
location = "europe-west1-b"
|
|
name = "nodepool-1"
|
|
service_account = {
|
|
email = "foo-bar@myproject.iam.gserviceaccount.com"
|
|
oauth_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
|
}
|
|
}
|
|
# tftest modules=1 resources=1 inventory=external-sa.yaml
|
|
```
|
|
|
|
#### Auto-created service account
|
|
|
|
To have the module create a service account, set the `create` attribute to `true` and optionally pass the desired account id in `email`.
|
|
|
|
```hcl
|
|
module "cluster-1-nodepool-1" {
|
|
source = "./fabric/modules/gke-nodepool"
|
|
project_id = "myproject"
|
|
cluster_name = "cluster-1"
|
|
location = "europe-west1-b"
|
|
name = "nodepool-1"
|
|
service_account = {
|
|
create = true
|
|
email = "spam-eggs" # optional
|
|
oauth_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=create-sa.yaml
|
|
```
|
|
### Node & node pool configuration
|
|
|
|
```hcl
|
|
module "cluster-1-nodepool-1" {
|
|
source = "./fabric/modules/gke-nodepool"
|
|
project_id = "myproject"
|
|
cluster_name = "cluster-1"
|
|
location = "europe-west1-b"
|
|
name = "nodepool-1"
|
|
labels = { environment = "dev" }
|
|
service_account = {
|
|
create = true
|
|
email = "nodepool-1" # optional
|
|
oauth_scopes = ["https://www.googleapis.com/auth/cloud-platform"]
|
|
}
|
|
node_config = {
|
|
machine_type = "n2-standard-2"
|
|
disk_size_gb = 50
|
|
disk_type = "pd-ssd"
|
|
ephemeral_ssd_count = 1
|
|
gvnic = true
|
|
spot = true
|
|
}
|
|
nodepool_config = {
|
|
autoscaling = {
|
|
max_node_count = 10
|
|
min_node_count = 1
|
|
}
|
|
management = {
|
|
auto_repair = true
|
|
auto_upgrade = false
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=2 inventory=config.yaml
|
|
```
|
|
<!-- BEGIN TFDOC -->
|
|
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [cluster_name](variables.tf#L23) | Cluster name. | <code>string</code> | ✓ | |
|
|
| [location](variables.tf#L41) | Cluster location. | <code>string</code> | ✓ | |
|
|
| [project_id](variables.tf#L149) | Cluster project id. | <code>string</code> | ✓ | |
|
|
| [cluster_id](variables.tf#L17) | Cluster id. Optional, but providing cluster_id is recommended to prevent cluster misconfiguration in some of the edge cases. | <code>string</code> | | <code>null</code> |
|
|
| [gke_version](variables.tf#L28) | Kubernetes nodes version. Ignored if auto_upgrade is set in management_config. | <code>string</code> | | <code>null</code> |
|
|
| [labels](variables.tf#L34) | Kubernetes labels applied to each node. | <code>map(string)</code> | | <code>{}</code> |
|
|
| [max_pods_per_node](variables.tf#L46) | Maximum number of pods per node. | <code>number</code> | | <code>null</code> |
|
|
| [name](variables.tf#L52) | Optional nodepool name. | <code>string</code> | | <code>null</code> |
|
|
| [node_config](variables.tf#L58) | Node-level configuration. | <code title="object({ boot_disk_kms_key = optional(string) disk_size_gb = optional(number) disk_type = optional(string) ephemeral_ssd_count = optional(number) gcfs = optional(bool, false) guest_accelerator = optional(object({ count = number type = string gpu_partition_size = optional(string) })) gvnic = optional(bool, false) image_type = optional(string) kubelet_config = optional(object({ cpu_manager_policy = string cpu_cfs_quota = optional(bool) cpu_cfs_quota_period = optional(string) })) linux_node_config_sysctls = optional(map(string)) local_ssd_count = optional(number) machine_type = optional(string) metadata = optional(map(string)) min_cpu_platform = optional(string) preemptible = optional(bool) sandbox_config_gvisor = optional(bool) shielded_instance_config = optional(object({ enable_integrity_monitoring = optional(bool) enable_secure_boot = optional(bool) })) spot = optional(bool) workload_metadata_config_mode = optional(string) })">object({…})</code> | | <code title="{ disk_type = "pd-balanced" }">{…}</code> |
|
|
| [node_count](variables.tf#L97) | Number of nodes per instance group. Initial value can only be changed by recreation, current is ignored when autoscaling is used. | <code title="object({ current = optional(number) initial = number })">object({…})</code> | | <code title="{ initial = 1 }">{…}</code> |
|
|
| [node_locations](variables.tf#L109) | Node locations. | <code>list(string)</code> | | <code>null</code> |
|
|
| [nodepool_config](variables.tf#L115) | Nodepool-level configuration. | <code title="object({ autoscaling = optional(object({ location_policy = optional(string) max_node_count = optional(number) min_node_count = optional(number) use_total_nodes = optional(bool, false) })) management = optional(object({ auto_repair = optional(bool) auto_upgrade = optional(bool) })) upgrade_settings = optional(object({ max_surge = number max_unavailable = number })) })">object({…})</code> | | <code>null</code> |
|
|
| [pod_range](variables.tf#L137) | Pod secondary range configuration. | <code title="object({ secondary_pod_range = object({ cidr = optional(string) create = optional(bool) name = string }) })">object({…})</code> | | <code>null</code> |
|
|
| [reservation_affinity](variables.tf#L154) | Configuration of the desired reservation which instances could take capacity from. | <code title="object({ consume_reservation_type = string key = optional(string) values = optional(list(string)) })">object({…})</code> | | <code>null</code> |
|
|
| [service_account](variables.tf#L164) | Nodepool service account. If this variable is set to null, the default GCE service account will be used. If set and email is null, a service account will be created. If scopes are null a default will be used. | <code title="object({ create = optional(bool, false) email = optional(string) oauth_scopes = optional(list(string)) })">object({…})</code> | | <code>{}</code> |
|
|
| [sole_tenant_nodegroup](variables.tf#L175) | Sole tenant node group. | <code>string</code> | | <code>null</code> |
|
|
| [tags](variables.tf#L181) | Network tags applied to nodes. | <code>list(string)</code> | | <code>null</code> |
|
|
| [taints](variables.tf#L187) | Kubernetes taints applied to all nodes. | <code title="list(object({ key = string value = string effect = string }))">list(object({…}))</code> | | <code>null</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [name](outputs.tf#L17) | Nodepool name. | |
|
|
| [service_account_email](outputs.tf#L22) | Service account email. | |
|
|
| [service_account_iam_email](outputs.tf#L27) | Service account email. | |
|
|
|
|
<!-- END TFDOC -->
|