Skip to content

Commit ec76ee2

Browse files
morgantemorgante
authored
Merge pull request terraform-google-modules#286 from paulpalamarchuk/add_sanbox_tests
Add test for sandbox
2 parents 6912022 + 8d8451c commit ec76ee2

File tree

16 files changed

+323
-62
lines changed

16 files changed

+323
-62
lines changed

‎.kitchen.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,3 +131,10 @@ suites:
131131
systems:
132132
- name: workload_metadata_config
133133
backend: local
134+
- name: "sandbox_enabled"
135+
driver:
136+
root_module_directory: test/fixtures/sandbox_enabled
137+
verifier:
138+
systems:
139+
- name: sandbox_enabled
140+
backend: local

‎autogen/cluster.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -167,14 +167,6 @@ resource "google_container_cluster" "primary" {
167167
node_metadata = workload_metadata_config.value.node_metadata
168168
}
169169
}
170-
171-
dynamic "sandbox_config" {
172-
for_each = local.cluster_sandbox_enabled
173-
174-
content {
175-
sandbox_type = sandbox_config.value
176-
}
177-
}
178170
{% endif %}
179171
}
180172
}
@@ -407,6 +399,14 @@ resource "google_container_node_pool" "pools" {
407399
node_metadata = workload_metadata_config.value.node_metadata
408400
}
409401
}
402+
403+
dynamic "sandbox_config" {
404+
for_each = local.cluster_sandbox_enabled
405+
406+
content {
407+
sandbox_type = sandbox_config.value
408+
}
409+
}
410410
{% endif %}
411411
}
412412

‎build/int.cloudbuild.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,26 @@ steps:
221221
- verify workload-metadata-config-local
222222
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
223223
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy workload-metadata-config-local']
224+
- id: create sandbox-enabled-local
225+
waitFor:
226+
- prepare
227+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
228+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create sandbox-enabled-local']
229+
- id: converge sandbox-enabled-local
230+
waitFor:
231+
- create sandbox-enabled-local
232+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
233+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge sandbox-enabled-local']
234+
- id: verify sandbox-enabled-local
235+
waitFor:
236+
- converge sandbox-enabled-local
237+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
238+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify sandbox-enabled-local']
239+
- id: destroy sandbox-enabled-local
240+
waitFor:
241+
- verify sandbox-enabled-local
242+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
243+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy sandbox-enabled-local']
224244
tags:
225245
- 'ci'
226246
- 'integration'

‎examples/simple_regional_beta/README.md

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,24 @@
22

33
This example illustrates how to create a simple cluster with beta features.
44

5-
[^]: (autogen_docs_start)
6-
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
76
## Inputs
87

98
| Name | Description | Type | Default | Required |
109
|------|-------------|:----:|:-----:|:-----:|
1110
| cloudrun | Boolean to enable / disable CloudRun | string | `"true"` | no |
1211
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
1312
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
14-
| credentials\_path | The path to the GCP credentials JSON file | string | n/a | yes |
1513
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
1614
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
1715
| istio | Boolean to enable / disable Istio | string | `"true"` | no |
1816
| network | The VPC network to host the cluster in | string | n/a | yes |
17+
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | string | `"SECURE"` | no |
18+
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
1919
| project\_id | The project ID to host the cluster in | string | n/a | yes |
2020
| region | The region to host the cluster in | string | n/a | yes |
21+
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
22+
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it). | bool | `"false"` | no |
2123
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
2224

2325
## Outputs
@@ -27,7 +29,6 @@ This example illustrates how to create a simple cluster with beta features.
2729
| ca\_certificate | |
2830
| client\_token | |
2931
| cluster\_name | Cluster name |
30-
| credentials\_path | |
3132
| ip\_range\_pods | The secondary IP range used for pods |
3233
| ip\_range\_services | The secondary IP range used for services |
3334
| kubernetes\_endpoint | |
@@ -36,11 +37,11 @@ This example illustrates how to create a simple cluster with beta features.
3637
| network | |
3738
| project\_id | |
3839
| region | |
39-
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
40+
| service\_account | The default service account used for running nodes. |
4041
| subnetwork | |
4142
| zones | List of zones in which the cluster resides |
4243

43-
[^]: (autogen_docs_end)
44+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4445

4546
To provision this example, run the following from within this directory:
4647
- `terraform init` to get the plugins

‎examples/simple_regional_beta/main.tf

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,25 +19,28 @@ locals {
1919
}
2020

2121
provider "google-beta" {
22-
version = "~> 2.12.0"
23-
credentials = file(var.credentials_path)
24-
region = var.region
22+
version = "~> 2.12.0"
23+
region = var.region
2524
}
2625

2726
module "gke" {
28-
source = "../../modules/beta-public-cluster/"
29-
project_id = var.project_id
30-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
31-
regional = true
32-
region = var.region
33-
network = var.network
34-
subnetwork = var.subnetwork
35-
ip_range_pods = var.ip_range_pods
36-
ip_range_services = var.ip_range_services
37-
create_service_account = false
38-
service_account = var.compute_engine_service_account
39-
istio = var.istio
40-
cloudrun = var.cloudrun
27+
source = "../../modules/beta-public-cluster/"
28+
project_id = var.project_id
29+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30+
regional = true
31+
region = var.region
32+
network = var.network
33+
subnetwork = var.subnetwork
34+
ip_range_pods = var.ip_range_pods
35+
ip_range_services = var.ip_range_services
36+
create_service_account = false
37+
service_account = var.compute_engine_service_account
38+
istio = var.istio
39+
cloudrun = var.cloudrun
40+
node_metadata = var.node_metadata
41+
sandbox_enabled = var.sandbox_enabled
42+
remove_default_node_pool = var.remove_default_node_pool
43+
node_pools = var.node_pools
4144
}
4245

4346
data "google_client_config" "default" {

‎examples/simple_regional_beta/test_outputs.tf

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,6 @@ output "project_id" {
2121
value = var.project_id
2222
}
2323

24-
output "credentials_path" {
25-
value = var.credentials_path
26-
}
27-
2824
output "region" {
2925
value = module.gke.region
3026
}

‎examples/simple_regional_beta/variables.tf

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,6 @@ variable "project_id" {
1818
description = "The project ID to host the cluster in"
1919
}
2020

21-
variable "credentials_path" {
22-
description = "The path to the GCP credentials JSON file"
23-
}
24-
2521
variable "cluster_name_suffix" {
2622
description = "A suffix to append to the default cluster name"
2723
default = ""
@@ -60,3 +56,32 @@ variable "cloudrun" {
6056
description = "Boolean to enable / disable CloudRun"
6157
default = true
6258
}
59+
60+
variable "node_metadata" {
61+
description = "Specifies how node metadata is exposed to the workload running on the node"
62+
default = "SECURE"
63+
type = string
64+
}
65+
66+
variable "sandbox_enabled" {
67+
type = bool
68+
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` and `node_version` = `1.12.7-gke.17` or later to use it)."
69+
default = false
70+
}
71+
72+
variable "remove_default_node_pool" {
73+
type = bool
74+
description = "Remove default node pool while setting up the cluster"
75+
default = false
76+
}
77+
78+
variable "node_pools" {
79+
type = list(map(string))
80+
description = "List of maps containing node pools"
81+
82+
default = [
83+
{
84+
name = "default-node-pool"
85+
},
86+
]
87+
}

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -158,14 +158,6 @@ resource "google_container_cluster" "primary" {
158158
node_metadata = workload_metadata_config.value.node_metadata
159159
}
160160
}
161-
162-
dynamic "sandbox_config" {
163-
for_each = local.cluster_sandbox_enabled
164-
165-
content {
166-
sandbox_type = sandbox_config.value
167-
}
168-
}
169161
}
170162
}
171163

@@ -378,6 +370,14 @@ resource "google_container_node_pool" "pools" {
378370
node_metadata = workload_metadata_config.value.node_metadata
379371
}
380372
}
373+
374+
dynamic "sandbox_config" {
375+
for_each = local.cluster_sandbox_enabled
376+
377+
content {
378+
sandbox_type = sandbox_config.value
379+
}
380+
}
381381
}
382382

383383
lifecycle {

‎modules/beta-private-cluster/cluster.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -158,14 +158,6 @@ resource "google_container_cluster" "primary" {
158158
node_metadata = workload_metadata_config.value.node_metadata
159159
}
160160
}
161-
162-
dynamic "sandbox_config" {
163-
for_each = local.cluster_sandbox_enabled
164-
165-
content {
166-
sandbox_type = sandbox_config.value
167-
}
168-
}
169161
}
170162
}
171163

@@ -306,6 +298,14 @@ resource "google_container_node_pool" "pools" {
306298
node_metadata = workload_metadata_config.value.node_metadata
307299
}
308300
}
301+
302+
dynamic "sandbox_config" {
303+
for_each = local.cluster_sandbox_enabled
304+
305+
content {
306+
sandbox_type = sandbox_config.value
307+
}
308+
}
309309
}
310310

311311
lifecycle {

‎modules/beta-public-cluster/cluster.tf

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -158,14 +158,6 @@ resource "google_container_cluster" "primary" {
158158
node_metadata = workload_metadata_config.value.node_metadata
159159
}
160160
}
161-
162-
dynamic "sandbox_config" {
163-
for_each = local.cluster_sandbox_enabled
164-
165-
content {
166-
sandbox_type = sandbox_config.value
167-
}
168-
}
169161
}
170162
}
171163

@@ -301,6 +293,14 @@ resource "google_container_node_pool" "pools" {
301293
node_metadata = workload_metadata_config.value.node_metadata
302294
}
303295
}
296+
297+
dynamic "sandbox_config" {
298+
for_each = local.cluster_sandbox_enabled
299+
300+
content {
301+
sandbox_type = sandbox_config.value
302+
}
303+
}
304304
}
305305

306306
lifecycle {

‎test/fixtures/sandbox_enabled/example.tf

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "example" {
18+
source = "../../../examples/simple_regional_beta"
19+
20+
project_id = var.project_id
21+
cluster_name_suffix = "-${random_string.suffix.result}"
22+
region = var.region
23+
network = google_compute_network.main.name
24+
subnetwork = google_compute_subnetwork.main.name
25+
ip_range_pods = google_compute_subnetwork.main.secondary_ip_range[0].range_name
26+
ip_range_services = google_compute_subnetwork.main.secondary_ip_range[1].range_name
27+
compute_engine_service_account = var.compute_engine_service_account
28+
istio = false
29+
cloudrun = false
30+
node_metadata = "UNSPECIFIED"
31+
sandbox_enabled = true
32+
remove_default_node_pool = true
33+
34+
node_pools = [
35+
{
36+
name = "default-node-pool"
37+
image_type = "COS_CONTAINERD"
38+
},
39+
]
40+
}

‎test/fixtures/sandbox_enabled/network.tf

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "random_string" "suffix" {
18+
length = 4
19+
special = false
20+
upper = false
21+
}
22+
23+
provider "google" {
24+
project = var.project_id
25+
}
26+
27+
resource "google_compute_network" "main" {
28+
name = "cft-gke-test-${random_string.suffix.result}"
29+
auto_create_subnetworks = false
30+
}
31+
32+
resource "google_compute_subnetwork" "main" {
33+
name = "cft-gke-test-${random_string.suffix.result}"
34+
ip_cidr_range = "10.0.0.0/17"
35+
region = var.region
36+
network = google_compute_network.main.self_link
37+
38+
secondary_ip_range {
39+
range_name = "cft-gke-test-pods-${random_string.suffix.result}"
40+
ip_cidr_range = "192.168.0.0/18"
41+
}
42+
43+
secondary_ip_range {
44+
range_name = "cft-gke-test-services-${random_string.suffix.result}"
45+
ip_cidr_range = "192.168.64.0/18"
46+
}
47+
}
48+

0 commit comments

Comments
 (0)