Skip to content

Commit 8764b76

Browse files
ZhengzheYangZhengzheYang
authored
feat: add enable_namespace_creation flag for ASM module (terraform-google-modules#968)
* add enable_namespace_creation flag and start testing with 1.10 * address comments
1 parent 57fca4b commit 8764b76

File tree

5 files changed

+38
-18
lines changed

5 files changed

+38
-18
lines changed

‎examples/simple_zonal_with_asm/main.tf

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -67,15 +67,16 @@ module "gke" {
6767
}
6868

6969
module "asm" {
70-
source = "../../modules/asm"
71-
cluster_name = module.gke.name
72-
cluster_endpoint = module.gke.endpoint
73-
project_id = var.project_id
74-
location = module.gke.location
75-
enable_cluster_roles = true
76-
enable_cluster_labels = true
77-
enable_gcp_apis = true
78-
enable_gcp_components = true
79-
options = ["envoy-access-log"]
80-
outdir = "./${module.gke.name}-outdir"
70+
source = "../../modules/asm"
71+
cluster_name = module.gke.name
72+
cluster_endpoint = module.gke.endpoint
73+
project_id = var.project_id
74+
location = module.gke.location
75+
enable_cluster_roles = true
76+
enable_cluster_labels = true
77+
enable_gcp_apis = true
78+
enable_gcp_components = true
79+
enable_namespace_creation = true
80+
options = ["envoy-access-log"]
81+
outdir = "./${module.gke.name}-outdir"
8182
}

‎modules/asm/README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ To deploy this config:
4949

5050
| Name | Description | Type | Default | Required |
5151
|------|-------------|------|---------|:--------:|
52-
| asm\_git\_tag | ASM git tag to deploy. This module supports versions `1.8` and `1.9`. You can get the exact `asm_git_tag` by running the command `install_asm --version`. The ASM git tab should be of the form `1.9.3-asm.2+config5`. You can also see all ASM git tags by running `curl https://storage.googleapis.com/csm-artifacts/asm/STABLE_VERSIONS`. You must provide the full and exact git tag. This variable is optional. Leaving it empty (default) will download the latest `install_asm` script for the version provided by the `asm_version` variable. | `string` | `""` | no |
53-
| asm\_version | ASM version to deploy. This module supports versions `1.8` and `1.9`. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages | `string` | `"1.9"` | no |
52+
| asm\_git\_tag | ASM git tag to deploy. This module supports versions `1.8`, `1.9` and `1.10`. You can get the exact `asm_git_tag` by running the command `install_asm --version`. The ASM git tab should be of the form `1.9.3-asm.2+config5`. You can also see all ASM git tags by running `curl https://storage.googleapis.com/csm-artifacts/asm/STABLE_VERSIONS`. You must provide the full and exact git tag. This variable is optional. Leaving it empty (default) will download the latest `install_asm` script for the version provided by the `asm_version` variable. | `string` | `""` | no |
53+
| asm\_version | ASM version to deploy. This module supports versions `1.8`, `1.9` and `1.10`. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages | `string` | `"1.9"` | no |
5454
| ca | Sets CA option. Possible values are `meshca` or `citadel`. Additional documentation on Citadel is available at https://cloud.google.com/service-mesh/docs/scripted-install/gke-install#installation_with_citadel_as_the_ca. | `string` | `"meshca"` | no |
5555
| ca\_certs | Sets CA certificate file paths when `ca` is set to `citadel`. These values must be provided when using Citadel as CA. Additional documentation on Citadel is available at https://cloud.google.com/service-mesh/docs/scripted-install/gke-install#installation_with_citadel_as_the_ca. | `map(any)` | `{}` | no |
5656
| cluster\_endpoint | The GKE cluster endpoint. | `string` | n/a | yes |
@@ -62,6 +62,7 @@ To deploy this config:
6262
| enable\_gcp\_apis | Sets `--enable_gcp_apis` option if true. | `bool` | `false` | no |
6363
| enable\_gcp\_components | Sets --enable\_gcp\_components option if true. Can be true or false. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages | `bool` | `false` | no |
6464
| enable\_gcp\_iam\_roles | Grants IAM roles required for ASM if true. If enable\_gcp\_iam\_roles, one of impersonate\_service\_account, service\_account, or iam\_member must be set. | `bool` | `false` | no |
65+
| enable\_namespace\_creation | Sets `--enable_namespace_creation` option if true. | `bool` | `false` | no |
6566
| enable\_registration | Sets `--enable_registration` option if true. | `bool` | `false` | no |
6667
| gcloud\_sdk\_version | The gcloud sdk version to use. Minimum required version is 293.0.0 | `string` | `"296.0.1"` | no |
6768
| iam\_member | The GCP member email address to grant IAM roles to. If impersonate\_service\_account or service\_account is set, roles are granted to that SA. | `string` | `""` | no |

‎modules/asm/main.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ locals {
2929
root_cert = lookup(var.ca_certs, "root_cert", "none")
3030
cert_chain = lookup(var.ca_certs, "cert_chain", "none")
3131
revision_name_string = (var.revision_name == "" ? "none" : var.revision_name)
32+
asm_minor_version = tonumber(split(".", var.asm_version)[1])
3233
# https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages/blob/1cf61b679cd369f42a0e735f8e201de1a6a6433b/scripts/asm-installer/install_asm#L1970
3334
iam_roles = [
3435
"roles/container.admin",
@@ -48,6 +49,8 @@ locals {
4849
asm_iam_member = var.enable_gcp_iam_roles ? coalesce(var.impersonate_service_account, var.service_account, var.iam_member) : ""
4950
# compute any additonal resources that ASM provisioner should depend on
5051
additional_depends_on = concat(var.enable_gcp_apis ? [module.asm-services[0].project_id] : [], local.asm_iam_member != "" ? [for k, v in google_project_iam_member.asm_iam : v.etag] : [])
52+
# base command template for ASM installation
53+
kubectl_create_command_base = "${path.module}/scripts/install_asm.sh ${var.project_id} ${var.cluster_name} ${var.location} ${var.asm_version} ${var.mode} ${var.managed_control_plane} ${var.skip_validation} ${local.options_string} ${local.custom_overlays_string} ${var.enable_all} ${var.enable_cluster_roles} ${var.enable_cluster_labels} ${var.enable_gcp_components} ${var.enable_registration} ${var.outdir} ${var.ca} ${local.ca_cert} ${local.ca_key} ${local.root_cert} ${local.cert_chain} ${local.service_account_string} ${local.key_file_string} ${local.asm_git_tag_string} ${local.revision_name_string}"
5154
}
5255

5356
resource "google_project_iam_member" "asm_iam" {
@@ -97,6 +100,7 @@ module "asm_install" {
97100
service_account_key_file = var.service_account_key_file
98101
impersonate_service_account = var.impersonate_service_account
99102

100-
kubectl_create_command = "${path.module}/scripts/install_asm.sh ${var.project_id} ${var.cluster_name} ${var.location} ${var.asm_version} ${var.mode} ${var.managed_control_plane} ${var.skip_validation} ${local.options_string} ${local.custom_overlays_string} ${var.enable_all} ${var.enable_cluster_roles} ${var.enable_cluster_labels} ${var.enable_gcp_components} ${var.enable_registration} ${var.outdir} ${var.ca} ${local.ca_cert} ${local.ca_key} ${local.root_cert} ${local.cert_chain} ${local.service_account_string} ${local.key_file_string} ${local.asm_git_tag_string} ${local.revision_name_string}"
103+
# enable_namespace_creation flag is only available starting 1.10
104+
kubectl_create_command = (local.asm_minor_version > 9 ? "${local.kubectl_create_command_base} ${var.enable_namespace_creation}" : local.kubectl_create_command_base)
101105
kubectl_destroy_command = "${path.module}/scripts/destroy_asm.sh"
102106
}

‎modules/asm/scripts/install_asm.sh

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ SERVICE_ACCOUNT=${21}
4545
KEY_FILE=${22}
4646
ASM_GIT_TAG=${23}
4747
REVISION_NAME=${24}
48+
ENABLE_NAMESPACE_CREATION=${25}
4849

4950
# Set SKIP_VALIDATION variable
5051
if [[ ${SKIP_VALIDATION} = "true" ]]; then
@@ -91,6 +92,7 @@ echo -e "ENABLE_CLUSTER_ROLES is $ENABLE_CLUSTER_ROLES"
9192
echo -e "ENABLE_CLUSTER_LABELS is $ENABLE_CLUSTER_LABELS"
9293
echo -e "ENABLE_GCP_COMPONENTS is $ENABLE_GCP_COMPONENTS"
9394
echo -e "ENABLE_REGISTRATION is $ENABLE_REGISTRATION"
95+
echo -e "ENABLE_NAMESPACE_CREATION is $ENABLE_NAMESPACE_CREATION"
9496
echo -e "OUTDIR is $OUTDIR"
9597
echo -e "SERVICE_ACCOUNT is $SERVICE_ACCOUNT"
9698
echo -e "KEY_FILE is $KEY_FILE"
@@ -176,6 +178,12 @@ else
176178
ENABLE_REGISTRATION_COMMAND_SNIPPET="--enable_registration"
177179
fi
178180

181+
if [[ "${ENABLE_NAMESPACE_CREATION}" = true ]]; then
182+
ENABLE_NAMESPACE_CREATION_COMMAND_SNIPPET="--enable_namespace_creation"
183+
else
184+
ENABLE_NAMESPACE_CREATION_COMMAND_SNIPPET=""
185+
fi
186+
179187
if [[ "${OUTDIR}" = "none" ]]; then
180188
OUTDIR_COMMAND_SNIPPET=""
181189
else
@@ -196,8 +204,8 @@ else
196204
fi
197205

198206
# Echo the command before executing
199-
echo -e "install_asm_${ASM_VERSION} --verbose --project_id ${PROJECT_ID} --cluster_name ${CLUSTER_NAME} --cluster_location ${CLUSTER_LOCATION} --mode ${MODE} ${MCP_COMMAND_SNIPPET} ${OPTIONS_COMMAND_SNIPPET} ${CUSTOM_OVERLAYS_COMMAND_SNIPPET} ${OUTDIR_COMMAND_SNIPPET} ${ENABLE_ALL_COMMAND_SNIPPET} ${ENABLE_CLUSTER_ROLES_COMMAND_SNIPPET} ${ENABLE_CLUSTER_LABELS_COMMAND_SNIPPET} ${ENABLE_GCP_COMPONENTS_COMMAND_SNIPPET} ${ENABLE_REGISTRATION_COMMAND_SNIPPET} ${CA_COMMAND_SNIPPET} ${CA_CERTS_COMMAND_SNIPPET} ${SERVICE_ACCOUNT_COMMAND_SNIPPET} ${KEY_FILE_COMMAND_SNIPPET} ${REVISION_NAME_COMMAND_SNIPPET}"
207+
echo -e "install_asm_${ASM_VERSION} --verbose --project_id ${PROJECT_ID} --cluster_name ${CLUSTER_NAME} --cluster_location ${CLUSTER_LOCATION} --mode ${MODE} ${MCP_COMMAND_SNIPPET} ${OPTIONS_COMMAND_SNIPPET} ${CUSTOM_OVERLAYS_COMMAND_SNIPPET} ${OUTDIR_COMMAND_SNIPPET} ${ENABLE_ALL_COMMAND_SNIPPET} ${ENABLE_CLUSTER_ROLES_COMMAND_SNIPPET} ${ENABLE_CLUSTER_LABELS_COMMAND_SNIPPET} ${ENABLE_GCP_COMPONENTS_COMMAND_SNIPPET} ${ENABLE_REGISTRATION_COMMAND_SNIPPET} ${ENABLE_NAMESPACE_CREATION_COMMAND_SNIPPET} ${CA_COMMAND_SNIPPET} ${CA_CERTS_COMMAND_SNIPPET} ${SERVICE_ACCOUNT_COMMAND_SNIPPET} ${KEY_FILE_COMMAND_SNIPPET} ${REVISION_NAME_COMMAND_SNIPPET}"
200208

201209
# run the script with appropriate flags
202210
# shellcheck disable=SC2086
203-
./install_asm_${ASM_VERSION} --verbose --project_id ${PROJECT_ID} --cluster_name ${CLUSTER_NAME} --cluster_location ${CLUSTER_LOCATION} --mode ${MODE} ${MCP_COMMAND_SNIPPET} ${OPTIONS_COMMAND_SNIPPET} ${CUSTOM_OVERLAYS_COMMAND_SNIPPET} ${OUTDIR_COMMAND_SNIPPET} ${ENABLE_ALL_COMMAND_SNIPPET} ${ENABLE_CLUSTER_ROLES_COMMAND_SNIPPET} ${ENABLE_CLUSTER_LABELS_COMMAND_SNIPPET} ${ENABLE_GCP_COMPONENTS_COMMAND_SNIPPET} ${ENABLE_REGISTRATION_COMMAND_SNIPPET} ${CA_COMMAND_SNIPPET} ${CA_CERTS_COMMAND_SNIPPET} ${SERVICE_ACCOUNT_COMMAND_SNIPPET} ${KEY_FILE_COMMAND_SNIPPET} ${REVISION_NAME_COMMAND_SNIPPET}
211+
./install_asm_${ASM_VERSION} --verbose --project_id ${PROJECT_ID} --cluster_name ${CLUSTER_NAME} --cluster_location ${CLUSTER_LOCATION} --mode ${MODE} ${MCP_COMMAND_SNIPPET} ${OPTIONS_COMMAND_SNIPPET} ${CUSTOM_OVERLAYS_COMMAND_SNIPPET} ${OUTDIR_COMMAND_SNIPPET} ${ENABLE_ALL_COMMAND_SNIPPET} ${ENABLE_CLUSTER_ROLES_COMMAND_SNIPPET} ${ENABLE_CLUSTER_LABELS_COMMAND_SNIPPET} ${ENABLE_GCP_COMPONENTS_COMMAND_SNIPPET} ${ENABLE_REGISTRATION_COMMAND_SNIPPET} ${ENABLE_NAMESPACE_CREATION_COMMAND_SNIPPET} ${CA_COMMAND_SNIPPET} ${CA_CERTS_COMMAND_SNIPPET} ${SERVICE_ACCOUNT_COMMAND_SNIPPET} ${KEY_FILE_COMMAND_SNIPPET} ${REVISION_NAME_COMMAND_SNIPPET}

‎modules/asm/variables.tf

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,13 @@ variable "service_account_key_file" {
5252
}
5353

5454
variable "asm_version" {
55-
description = "ASM version to deploy. This module supports versions `1.8` and `1.9`. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages"
55+
description = "ASM version to deploy. This module supports versions `1.8`, `1.9` and `1.10`. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages"
5656
type = string
5757
default = "1.9"
5858
}
5959

6060
variable "asm_git_tag" {
61-
description = "ASM git tag to deploy. This module supports versions `1.8` and `1.9`. You can get the exact `asm_git_tag` by running the command `install_asm --version`. The ASM git tab should be of the form `1.9.3-asm.2+config5`. You can also see all ASM git tags by running `curl https://storage.googleapis.com/csm-artifacts/asm/STABLE_VERSIONS`. You must provide the full and exact git tag. This variable is optional. Leaving it empty (default) will download the latest `install_asm` script for the version provided by the `asm_version` variable."
61+
description = "ASM git tag to deploy. This module supports versions `1.8`, `1.9` and `1.10`. You can get the exact `asm_git_tag` by running the command `install_asm --version`. The ASM git tab should be of the form `1.9.3-asm.2+config5`. You can also see all ASM git tags by running `curl https://storage.googleapis.com/csm-artifacts/asm/STABLE_VERSIONS`. You must provide the full and exact git tag. This variable is optional. Leaving it empty (default) will download the latest `install_asm` script for the version provided by the `asm_version` variable."
6262
type = string
6363
default = ""
6464
}
@@ -153,6 +153,12 @@ variable "enable_registration" {
153153
default = false
154154
}
155155

156+
variable "enable_namespace_creation" {
157+
description = "Sets `--enable_namespace_creation` option if true."
158+
type = bool
159+
default = false
160+
}
161+
156162
variable "outdir" {
157163
description = "Sets `--outdir` option."
158164
type = string

0 commit comments

Comments
 (0)