| advanced_datapath_observability_config |
Config for Advanced Datapath Monitoring. |
object({
enable = optional(bool, false)
enable_metrics = optional(bool, true)
enable_relay = optional(bool, true)
}) |
{} |
no |
| cluster_autoscaling |
Enabling of node auto-provisioning |
bool |
false |
no |
| cluster_autoscaling_cpu_limits |
Cluster autoscaling cpu limits |
object({
resource_type = optional(string, "cpu")
minimum = optional(number, 4)
maximum = optional(number, 10)
}) |
{} |
no |
| cluster_autoscaling_gpu_limits |
GPU resource limits for cluster autoscaling NAP. Each entry specifies a GPU resource type and its min/max limits. |
list(object({
resource_type = string
minimum = number
maximum = number
})) |
[] |
no |
| cluster_autoscaling_memory_limits |
Cluster autoscaling memory limits |
object({
resource_type = optional(string, "memory"),
minimum = optional(number, 8)
maximum = optional(number, 80)
}) |
null |
no |
| cluster_autoscaling_profile |
Cluster autoscaler profile (BALANCED or OPTIMIZE_UTILIZATION). Governs the standard per-node-pool cluster autoscaler, so it is settable independently of node auto-provisioning (var.cluster_autoscaling). |
string |
null |
no |
| cluster_autoscaling_provisioning_defaults |
Cluster autoscaling provisioning defaults |
object({
disk_size = optional(number, null)
disk_type = optional(string, null)
shielded_instance_config = optional(object({
enable_secure_boot = optional(bool, null)
enable_integrity_monitoring = optional(bool, null)
}), null)
management = optional(object({
auto_upgrade = optional(bool, null)
auto_repair = optional(bool, null)
}), null)
}) |
null |
no |
| cluster_secondary_range_name |
Name of an existing subnet secondary range to use for Pods. When null, GKE auto-allocates a pod range. Required on a Shared VPC, where secondary ranges are pre-created on the host subnet and referenced by name (GKE cannot create ranges on a subnet it does not own). |
string |
null |
no |
| database_encryption_key |
Cloud KMS key resource ID for application-layer Secrets encryption (e.g. projects/P/locations/L/keyRings/R/cryptoKeys/K). When null (default), Secrets use Google-managed etcd encryption only. The GKE service agent must hold roles/cloudkms.cryptoKeyEncrypterDecrypter on the key, and the key must outlive the cluster. |
string |
null |
no |
| default_compute_class_enabled |
Specifies whether default compute class behavior is enabled. If enabled, cluster autoscaler will use Compute Class with name default for all the workloads, if not overridden. |
bool |
false |
no |
| deletion_protection |
Toggle to prevent accidental deletion of resources. |
bool |
true |
no |
| disable_horizontal_pod_autoscaling |
Whether to disable the HPA addon on this cluster. When true, the metrics-server is not deployed and HPA resources will not function. |
bool |
null |
no |
| enable_dns_cache |
Enable the NodeLocal DNSCache addon. Reduces external DNS lookup latency and load on kube-dns by caching responses on each node. |
bool |
false |
no |
| enable_fqdn_network_policy |
Enable FQDN-based network policies on Dataplane V2 clusters. When true, the FQDNNetworkPolicy CRD (networking.gke.io/v1alpha1) becomes available for restricting pod egress to specific domains. |
bool |
false |
no |
| enable_private_nodes |
Enable private nodes by default |
bool |
false |
no |
| extra_roles |
Extra roles to add to the cluster's default service account |
map(string) |
{} |
no |
| labels |
Labels to apply to the gke resources. |
map(string) |
{} |
no |
| name |
n/a |
string |
n/a |
yes |
| network |
The network to deploy the cluster in. |
string |
n/a |
yes |
| pools |
n/a |
map(object({
min_node_count = optional(number, 1)
max_node_count = optional(number, 1)
machine_type = optional(string, "c3-standard-4")
disk_type = optional(string, "pd-balanced")
disk_size = optional(number, 100)
ephemeral_storage_local_ssd_count = optional(number, 0)
node_locations = optional(list(string), null)
spot = optional(bool, false)
gvisor = optional(bool, false)
enable_nested_virtualization = optional(bool, null)
enable_secure_boot = optional(bool, false)
enable_integrity_monitoring = optional(bool, true)
labels = optional(map(string), {})
tags = optional(list(string), [])
taints = optional(list(object({
key = string
value = string
effect = string
})), [])
network_config = optional(object({
enable_private_nodes = optional(bool, false)
create_pod_range = optional(bool, true)
pod_ipv4_cidr_block = optional(string, null)
}), null)
guest_accelerator = optional(list(object({
type = string
count = number
gpu_driver_installation_config = optional(list(object({
gpu_driver_version = string
})), [])
})), [])
})) |
n/a |
yes |
| product |
Product label to apply to the service. |
string |
"unknown" |
no |
| project |
n/a |
string |
n/a |
yes |
| region |
Always create a regional cluster since GKE doesn't charge differently for regional/zonal clusters. Rather, we configure the node locations using var.zones |
any |
n/a |
yes |
| release_channel |
GKE release channel |
string |
"REGULAR" |
no |
| resource_manager_tags |
Resource Manager tags to bind to the GKE cluster, as tagKeys/ => tagValues/. |
map(string) |
{} |
no |
| resource_usage_export_config |
Config for exporting resource usage. |
object({
bigquery_dataset_id = optional(string, "")
enable_network_egress_metering = optional(bool, false)
enable_resource_consumption_metering = optional(bool, true)
}) |
{} |
no |
| service_account_impersonation_email |
Service account email impersonation for the service account created by this module. |
string |
null |
no |
| service_account_suffix |
Suffix appended to var.name to form the node service account ID. When null (the default), uses the region as the suffix (e.g. "-us-central1") so clusters sharing a project (e.g. the same name across regions) don't collide on this project-global resource. Set explicitly to pin a specific service account ID. |
string |
null |
no |
| services_secondary_range_name |
Name of an existing subnet secondary range to use for Services. When null, GKE auto-allocates a service range. Required on a Shared VPC, where secondary ranges are pre-created on the host subnet and referenced by name. |
string |
null |
no |
| subnetwork |
The subnetwork to deploy the cluster in. |
string |
n/a |
yes |
| team |
Team label to apply to resources (replaces deprecated 'squad'). |
string |
n/a |
yes |
| zones |
If specified, will spread nodes across these zones |
list(string) |
null |
no |