Skip to content

Commit 9a4ca42

Browse files
morgantemorgante
authored
Merge branch 'master' into aaron-lane-6.0.0
2 parents d426a1e + 27786a6 commit 9a4ca42

File tree

15 files changed

+583
-19
lines changed

15 files changed

+583
-19
lines changed

‎.kitchen.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,19 @@ suites:
162162
systems:
163163
- name: workload_metadata_config
164164
backend: local
165+
- name: "beta_cluster"
166+
driver:
167+
root_module_directory: test/fixtures/beta_cluster
168+
verifier:
169+
systems:
170+
- name: gcloud
171+
backend: local
172+
controls:
173+
- gcloud
174+
- name: gcp
175+
backend: gcp
176+
controls:
177+
- gcp
165178
- name: "deploy_service"
166179
driver:
167180
root_module_directory: test/fixtures/deploy_service

‎build/int.cloudbuild.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,26 @@ steps:
264264
- verify workload-metadata-config-local
265265
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
266266
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy workload-metadata-config-local']
267+
- id: create beta-cluster-local
268+
waitFor:
269+
- prepare
270+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
271+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create beta-cluster-local']
272+
- id: converge beta-cluster-local
273+
waitFor:
274+
- create beta-cluster-local
275+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
276+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge beta-cluster-local']
277+
- id: verify beta-cluster-local
278+
waitFor:
279+
- converge beta-cluster-local
280+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
281+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify beta-cluster-local']
282+
#- id: destroy beta-cluster-local
283+
# waitFor:
284+
# - verify beta-cluster-local
285+
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
286+
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy beta-cluster-local']
267287
- id: create deploy-service-local
268288
waitFor:
269289
- prepare

‎examples/simple_regional_beta/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,22 @@ This example illustrates how to create a simple cluster with beta features.
1010
| cloudrun | Boolean to enable / disable CloudRun | string | `"true"` | no |
1111
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
1212
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
13+
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. | object | `<list>` | no |
14+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
1315
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
1416
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
1517
| istio | Boolean to enable / disable Istio | string | `"true"` | no |
1618
| network | The VPC network to host the cluster in | string | n/a | yes |
1719
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"SECURE"` | no |
1820
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
21+
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
1922
| project\_id | The project ID to host the cluster in | string | n/a | yes |
2023
| region | The region to host the cluster in | string | n/a | yes |
24+
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
2125
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
2226
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
2327
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
28+
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | list(string) | `<list>` | no |
2429

2530
## Outputs
2631

‎examples/simple_regional_beta/main.tf

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -24,23 +24,27 @@ provider "google-beta" {
2424
}
2525

2626
module "gke" {
27-
source = "../../modules/beta-public-cluster/"
28-
project_id = var.project_id
29-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30-
regional = true
31-
region = var.region
32-
network = var.network
33-
subnetwork = var.subnetwork
34-
ip_range_pods = var.ip_range_pods
35-
ip_range_services = var.ip_range_services
36-
create_service_account = false
37-
service_account = var.compute_engine_service_account
38-
istio = var.istio
39-
cloudrun = var.cloudrun
40-
node_metadata = var.node_metadata
41-
sandbox_enabled = var.sandbox_enabled
42-
remove_default_node_pool = var.remove_default_node_pool
43-
node_pools = var.node_pools
27+
source = "../../modules/beta-public-cluster/"
28+
project_id = var.project_id
29+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30+
regional = var.regional
31+
region = var.region
32+
zones = var.zones
33+
network = var.network
34+
subnetwork = var.subnetwork
35+
ip_range_pods = var.ip_range_pods
36+
ip_range_services = var.ip_range_services
37+
create_service_account = var.compute_engine_service_account == "create"
38+
service_account = var.compute_engine_service_account
39+
istio = var.istio
40+
cloudrun = var.cloudrun
41+
node_metadata = var.node_metadata
42+
sandbox_enabled = var.sandbox_enabled
43+
remove_default_node_pool = var.remove_default_node_pool
44+
node_pools = var.node_pools
45+
database_encryption = var.database_encryption
46+
enable_binary_authorization = var.enable_binary_authorization
47+
pod_security_policy_config = var.pod_security_policy_config
4448
}
4549

4650
data "google_client_config" "default" {

‎examples/simple_regional_beta/variables.tf

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,36 @@ variable "node_pools" {
8585
},
8686
]
8787
}
88+
89+
variable "database_encryption" {
90+
description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key."
91+
type = list(object({ state = string, key_name = string }))
92+
default = [{
93+
state = "DECRYPTED"
94+
key_name = ""
95+
}]
96+
}
97+
98+
variable "enable_binary_authorization" {
99+
description = "Enable BinAuthZ Admission controller"
100+
default = false
101+
}
102+
103+
variable "pod_security_policy_config" {
104+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
105+
default = [{
106+
"enabled" = false
107+
}]
108+
}
109+
110+
variable "zones" {
111+
type = list(string)
112+
description = "The zones to host the cluster in (optional if regional cluster / required if zonal)"
113+
default = []
114+
}
115+
116+
variable "regional" {
117+
type = bool
118+
description = "Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!)"
119+
default = true
120+
}

‎test/ci/beta-cluster.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
3+
platform: linux
4+
5+
inputs:
6+
- name: pull-request
7+
path: terraform-google-kubernetes-engine
8+
9+
run:
10+
path: make
11+
args: ['test_integration']
12+
dir: terraform-google-kubernetes-engine
13+
14+
params:
15+
SUITE: "beta-cluster-local"
16+
COMPUTE_ENGINE_SERVICE_ACCOUNT: ""
17+
REGION: "us-east4"
18+
ZONES: '["us-east4-a", "us-east4-b", "us-east4-c"]'

‎test/fixtures/beta_cluster/main.tf

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
name = "beta-cluster-${random_string.suffix.result}"
19+
project_id = var.project_ids[0]
20+
}
21+
22+
resource "google_kms_key_ring" "db" {
23+
location = var.region
24+
name = "${local.name}-db"
25+
project = local.project_id
26+
}
27+
28+
resource "google_kms_crypto_key" "db" {
29+
name = local.name
30+
key_ring = google_kms_key_ring.db.self_link
31+
}
32+
33+
module "this" {
34+
source = "../../../examples/simple_regional_beta"
35+
36+
cluster_name_suffix = "-${random_string.suffix.result}"
37+
project_id = local.project_id
38+
regional = false
39+
region = var.region
40+
zones = slice(var.zones, 0, 1)
41+
network = google_compute_network.main.name
42+
subnetwork = google_compute_subnetwork.main.name
43+
ip_range_pods = google_compute_subnetwork.main.secondary_ip_range[0].range_name
44+
ip_range_services = google_compute_subnetwork.main.secondary_ip_range[1].range_name
45+
compute_engine_service_account = "create"
46+
47+
// Beta features
48+
istio = true
49+
50+
database_encryption = [{
51+
state = "ENCRYPTED"
52+
key_name = google_kms_crypto_key.db.self_link
53+
}]
54+
55+
cloudrun = true
56+
57+
enable_binary_authorization = true
58+
59+
pod_security_policy_config = [{
60+
enabled = true
61+
}]
62+
63+
node_metadata = "EXPOSE"
64+
}
65+
66+
data "google_client_config" "default" {
67+
}

‎test/fixtures/beta_cluster/network.tf

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "random_string" "suffix" {
18+
length = 4
19+
special = false
20+
upper = false
21+
}
22+
23+
resource "google_compute_network" "main" {
24+
name = "cft-gke-test-${random_string.suffix.result}"
25+
auto_create_subnetworks = false
26+
project = local.project_id
27+
}
28+
29+
resource "google_compute_subnetwork" "main" {
30+
name = "cft-gke-test-${random_string.suffix.result}"
31+
ip_cidr_range = "10.0.0.0/17"
32+
region = var.region
33+
network = google_compute_network.main.self_link
34+
project = local.project_id
35+
36+
secondary_ip_range {
37+
range_name = "cft-gke-test-pods-${random_string.suffix.result}"
38+
ip_cidr_range = "192.168.0.0/18"
39+
}
40+
41+
secondary_ip_range {
42+
range_name = "cft-gke-test-services-${random_string.suffix.result}"
43+
ip_cidr_range = "192.168.64.0/18"
44+
}
45+
}

‎test/fixtures/beta_cluster/outputs.tf

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "project_id" {
18+
value = local.project_id
19+
}
20+
21+
output "region" {
22+
value = module.this.region
23+
}
24+
25+
output "cluster_name" {
26+
description = "Cluster name"
27+
value = module.this.cluster_name
28+
}
29+
30+
output "network" {
31+
value = google_compute_network.main.name
32+
}
33+
34+
output "subnetwork" {
35+
value = google_compute_subnetwork.main.name
36+
}
37+
38+
output "location" {
39+
value = module.this.location
40+
}
41+
42+
output "ip_range_pods" {
43+
description = "The secondary IP range used for pods"
44+
value = google_compute_subnetwork.main.secondary_ip_range[0].range_name
45+
}
46+
47+
output "ip_range_services" {
48+
description = "The secondary IP range used for services"
49+
value = google_compute_subnetwork.main.secondary_ip_range[1].range_name
50+
}
51+
52+
output "zones" {
53+
description = "List of zones in which the cluster resides"
54+
value = module.this.zones
55+
}
56+
57+
output "master_kubernetes_version" {
58+
description = "The master Kubernetes version"
59+
value = module.this.master_kubernetes_version
60+
}
61+
62+
output "kubernetes_endpoint" {
63+
sensitive = true
64+
value = module.this.kubernetes_endpoint
65+
}
66+
67+
output "client_token" {
68+
sensitive = true
69+
value = base64encode(data.google_client_config.default.access_token)
70+
}
71+
72+
output "ca_certificate" {
73+
description = "The cluster CA certificate"
74+
value = module.this.ca_certificate
75+
}
76+
77+
output "service_account" {
78+
description = "The service account to default running nodes as if not overridden in `node_pools`."
79+
value = module.this.service_account
80+
}
81+
82+
output "database_encryption_key_name" {
83+
value = google_kms_crypto_key.db.self_link
84+
}

‎test/fixtures/beta_cluster/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../deploy_service/variables.tf

0 commit comments

Comments
 (0)