Skip to content

Commit 5ceb93e

Browse files
modular-magicianpaulwilljones
modular-magician
and
paulwilljones
authored
Add support for GKE Autopilot in google_container_cluster resource (#4591) (#3101)
Co-authored-by: Paul Jones <[email protected]> Signed-off-by: Modular Magician <[email protected]> Co-authored-by: Paul Jones <[email protected]>
1 parent 38ba450 commit 5ceb93e

File tree

5 files changed

+214
-45
lines changed

5 files changed

+214
-45
lines changed

‎.changelog/4591.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
```release-note:enhancement
2+
container: add support for GKE Autopilot in `google_container_cluster`
3+
container: promoted `networking_mode` to GA in `google_container_cluster`
4+
```

‎google-beta/data_source_google_container_cluster_test.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ func TestAccContainerClusterDatasource_zonal(t *testing.T) {
2222
"google_container_cluster.kubes",
2323
// Remove once https://github.com/hashicorp/terraform/issues/21347 is fixed.
2424
map[string]struct{}{
25+
"enable_autopilot": {},
2526
"enable_tpu": {},
2627
"enable_binary_authorization": {},
2728
"pod_security_policy_config.#": {},
@@ -48,6 +49,7 @@ func TestAccContainerClusterDatasource_regional(t *testing.T) {
4849
"google_container_cluster.kubes",
4950
// Remove once https://github.com/hashicorp/terraform/issues/21347 is fixed.
5051
map[string]struct{}{
52+
"enable_autopilot": {},
5153
"enable_tpu": {},
5254
"enable_binary_authorization": {},
5355
"pod_security_policy_config.#": {},

‎google-beta/resource_container_cluster.go‎

Lines changed: 96 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ func resourceContainerCluster() *schema.Resource {
122122
resourceNodeConfigEmptyGuestAccelerator,
123123
containerClusterPrivateClusterConfigCustomDiff,
124124
customdiff.ForceNewIfChange("enable_l4_ilb_subsetting", isBeenEnabled),
125+
containerClusterAutopilotCustomizeDiff,
125126
),
126127

127128
Timeouts: &schema.ResourceTimeout{
@@ -229,12 +230,13 @@ func resourceContainerCluster() *schema.Resource {
229230
},
230231
},
231232
"network_policy_config": {
232-
Type: schema.TypeList,
233-
Optional: true,
234-
Computed: true,
235-
AtLeastOneOf: addonsConfigKeys,
236-
MaxItems: 1,
237-
Description: `Whether we should enable the network policy addon for the master. This must be enabled in order to enable network policy for the nodes. To enable this, you must also define a network_policy block, otherwise nothing will happen. It can only be disabled if the nodes already do not have network policies enabled. Defaults to disabled; set disabled = false to enable.`,
233+
Type: schema.TypeList,
234+
Optional: true,
235+
Computed: true,
236+
AtLeastOneOf: addonsConfigKeys,
237+
MaxItems: 1,
238+
Description: `Whether we should enable the network policy addon for the master. This must be enabled in order to enable network policy for the nodes. To enable this, you must also define a network_policy block, otherwise nothing will happen. It can only be disabled if the nodes already do not have network policies enabled. Defaults to disabled; set disabled = false to enable.`,
239+
ConflictsWith: []string{"enable_autopilot"},
238240
Elem: &schema.Resource{
239241
Schema: map[string]*schema.Schema{
240242
"disabled": {
@@ -363,9 +365,10 @@ func resourceContainerCluster() *schema.Resource {
363365
MaxItems: 1,
364366
// This field is Optional + Computed because we automatically set the
365367
// enabled value to false if the block is not returned in API responses.
366-
Optional: true,
367-
Computed: true,
368-
Description: `Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster's workload. See the guide to using Node Auto-Provisioning for more details.`,
368+
Optional: true,
369+
Computed: true,
370+
Description: `Per-cluster configuration of Node Auto-Provisioning with Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs of the cluster's workload. See the guide to using Node Auto-Provisioning for more details.`,
371+
ConflictsWith: []string{"enable_autopilot"},
369372
Elem: &schema.Resource{
370373
Schema: map[string]*schema.Schema{
371374
"enabled": {
@@ -457,10 +460,11 @@ func resourceContainerCluster() *schema.Resource {
457460
},
458461

459462
"enable_binary_authorization": {
460-
Default: false,
461-
Type: schema.TypeBool,
462-
Optional: true,
463-
Description: `Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization.`,
463+
Default: false,
464+
Type: schema.TypeBool,
465+
Optional: true,
466+
Description: `Enable Binary Authorization for this cluster. If enabled, all container images will be validated by Google Binary Authorization.`,
467+
ConflictsWith: []string{"enable_autopilot"},
464468
},
465469

466470
"enable_kubernetes_alpha": {
@@ -487,19 +491,29 @@ func resourceContainerCluster() *schema.Resource {
487491
},
488492

489493
"enable_shielded_nodes": {
494+
Type: schema.TypeBool,
495+
Optional: true,
496+
Computed: true,
497+
Description: `Enable Shielded Nodes features on all nodes in this cluster.`,
498+
ConflictsWith: []string{"enable_autopilot"},
499+
},
500+
501+
"enable_autopilot": {
490502
Type: schema.TypeBool,
491503
Optional: true,
492-
Default: false,
493-
Description: `Enable Shielded Nodes features on all nodes in this cluster. Defaults to false.`,
504+
ForceNew: true,
505+
Description: `Enable Autopilot for this cluster.`,
506+
// ConflictsWith: many fields, see https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison. The conflict is only set one-way, on other fields w/ this field.
494507
},
495508

496509
"authenticator_groups_config": {
497-
Type: schema.TypeList,
498-
Optional: true,
499-
Computed: true,
500-
ForceNew: true,
501-
MaxItems: 1,
502-
Description: `Configuration for the Google Groups for GKE feature.`,
510+
Type: schema.TypeList,
511+
Optional: true,
512+
Computed: true,
513+
ForceNew: true,
514+
MaxItems: 1,
515+
Description: `Configuration for the Google Groups for GKE feature.`,
516+
ConflictsWith: []string{"enable_autopilot"},
503517
Elem: &schema.Resource{
504518
Schema: map[string]*schema.Schema{
505519
"security_group": {
@@ -769,11 +783,12 @@ func resourceContainerCluster() *schema.Resource {
769783
},
770784

771785
"network_policy": {
772-
Type: schema.TypeList,
773-
Optional: true,
774-
Computed: true,
775-
MaxItems: 1,
776-
Description: `Configuration options for the NetworkPolicy feature.`,
786+
Type: schema.TypeList,
787+
Optional: true,
788+
Computed: true,
789+
MaxItems: 1,
790+
Description: `Configuration options for the NetworkPolicy feature.`,
791+
ConflictsWith: []string{"enable_autopilot"},
777792
Elem: &schema.Resource{
778793
Schema: map[string]*schema.Schema{
779794
"enabled": {
@@ -803,7 +818,8 @@ func resourceContainerCluster() *schema.Resource {
803818
Elem: &schema.Resource{
804819
Schema: schemaNodePool,
805820
},
806-
Description: `List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say "these are the only node pools associated with this cluster", use the google_container_node_pool resource instead of this property.`,
821+
Description: `List of node pools associated with this cluster. See google_container_node_pool for schema. Warning: node pools defined inside a cluster can't be changed (or added/removed) after cluster creation without deleting and recreating the entire cluster. Unless you absolutely need the ability to say "these are the only node pools associated with this cluster", use the google_container_node_pool resource instead of this property.`,
822+
ConflictsWith: []string{"enable_autopilot"},
807823
},
808824

809825
"node_version": {
@@ -882,6 +898,7 @@ func resourceContainerCluster() *schema.Resource {
882898
Type: schema.TypeList,
883899
MaxItems: 1,
884900
ForceNew: true,
901+
Computed: true,
885902
Optional: true,
886903
ConflictsWith: []string{"cluster_ipv4_cidr"},
887904
Description: `Configuration of cluster IP allocation for VPC-native clusters. Adding this block enables IP aliasing, making the cluster VPC-native instead of routes-based.`,
@@ -940,9 +957,10 @@ func resourceContainerCluster() *schema.Resource {
940957
},
941958

942959
"remove_default_node_pool": {
943-
Type: schema.TypeBool,
944-
Optional: true,
945-
Description: `If true, deletes the default node pool upon cluster creation. If you're using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1.`,
960+
Type: schema.TypeBool,
961+
Optional: true,
962+
Description: `If true, deletes the default node pool upon cluster creation. If you're using google_container_node_pool resources with no default node pool, this should be set to true, alongside setting initial_node_count to at least 1.`,
963+
ConflictsWith: []string{"enable_autopilot"},
946964
},
947965

948966
"private_cluster_config": {
@@ -1024,11 +1042,12 @@ func resourceContainerCluster() *schema.Resource {
10241042
},
10251043

10261044
"default_max_pods_per_node": {
1027-
Type: schema.TypeInt,
1028-
Optional: true,
1029-
ForceNew: true,
1030-
Computed: true,
1031-
Description: `The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled.`,
1045+
Type: schema.TypeInt,
1046+
Optional: true,
1047+
ForceNew: true,
1048+
Computed: true,
1049+
Description: `The default maximum number of pods per node in this cluster. This doesn't work on "routes-based" clusters, clusters that don't have IP Aliasing enabled.`,
1050+
ConflictsWith: []string{"enable_autopilot"},
10321051
},
10331052

10341053
"vertical_pod_autoscaling": {
@@ -1047,10 +1066,12 @@ func resourceContainerCluster() *schema.Resource {
10471066
},
10481067
},
10491068
"workload_identity_config": {
1050-
Type: schema.TypeList,
1051-
MaxItems: 1,
1052-
Optional: true,
1053-
Description: `Configuration for the use of Kubernetes Service Accounts in GCP IAM policies.`,
1069+
Type: schema.TypeList,
1070+
MaxItems: 1,
1071+
Optional: true,
1072+
Computed: true,
1073+
Description: `Configuration for the use of Kubernetes Service Accounts in GCP IAM policies.`,
1074+
ConflictsWith: []string{"enable_autopilot"},
10541075
Elem: &schema.Resource{
10551076
Schema: map[string]*schema.Schema{
10561077
"identity_namespace": {
@@ -1158,10 +1179,11 @@ func resourceContainerCluster() *schema.Resource {
11581179
},
11591180

11601181
"enable_intranode_visibility": {
1161-
Type: schema.TypeBool,
1162-
Optional: true,
1163-
Description: `Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.`,
1164-
Default: false,
1182+
Type: schema.TypeBool,
1183+
Optional: true,
1184+
Computed: true,
1185+
Description: `Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.`,
1186+
ConflictsWith: []string{"enable_autopilot"},
11651187
},
11661188
"enable_l4_ilb_subsetting": {
11671189
Type: schema.TypeBool,
@@ -1322,8 +1344,8 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
13221344
Enabled: d.Get("enable_binary_authorization").(bool),
13231345
ForceSendFields: []string{"Enabled"},
13241346
},
1325-
ShieldedNodes: &containerBeta.ShieldedNodes{
1326-
Enabled: d.Get("enable_shielded_nodes").(bool),
1347+
Autopilot: &containerBeta.Autopilot{
1348+
Enabled: d.Get("enable_autopilot").(bool),
13271349
ForceSendFields: []string{"Enabled"},
13281350
},
13291351
ReleaseChannel: expandReleaseChannel(d.Get("release_channel")),
@@ -1342,6 +1364,13 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
13421364
ResourceLabels: expandStringMap(d, "resource_labels"),
13431365
}
13441366

1367+
if v, ok := d.GetOk("enable_shielded_nodes"); ok {
1368+
cluster.ShieldedNodes = &containerBeta.ShieldedNodes{
1369+
Enabled: v.(bool),
1370+
ForceSendFields: []string{"Enabled"},
1371+
}
1372+
}
1373+
13451374
if v, ok := d.GetOk("default_max_pods_per_node"); ok {
13461375
cluster.DefaultMaxPodsConstraint = expandDefaultMaxPodsConstraint(v)
13471376
}
@@ -1651,6 +1680,11 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
16511680
if err := d.Set("enable_binary_authorization", cluster.BinaryAuthorization != nil && cluster.BinaryAuthorization.Enabled); err != nil {
16521681
return fmt.Errorf("Error setting enable_binary_authorization: %s", err)
16531682
}
1683+
if cluster.Autopilot != nil {
1684+
if err := d.Set("enable_autopilot", cluster.Autopilot.Enabled); err != nil {
1685+
return fmt.Errorf("Error setting enable_autopilot: %s", err)
1686+
}
1687+
}
16541688
if cluster.ShieldedNodes != nil {
16551689
if err := d.Set("enable_shielded_nodes", cluster.ShieldedNodes.Enabled); err != nil {
16561690
return fmt.Errorf("Error setting enable_shielded_nodes: %s", err)
@@ -3021,6 +3055,9 @@ func expandMaintenancePolicy(d *schema.ResourceData, meta interface{}) *containe
30213055
func expandClusterAutoscaling(configured interface{}, d *schema.ResourceData) *containerBeta.ClusterAutoscaling {
30223056
l, ok := configured.([]interface{})
30233057
if !ok || l == nil || len(l) == 0 || l[0] == nil {
3058+
if v, ok := d.GetOk("enable_autopilot"); ok && v == true {
3059+
return nil
3060+
}
30243061
return &containerBeta.ClusterAutoscaling{
30253062
EnableNodeAutoprovisioning: false,
30263063
ForceSendFields: []string{"EnableNodeAutoprovisioning"},
@@ -3936,6 +3973,20 @@ func containerClusterPrivateClusterConfigCustomDiff(_ context.Context, d *schema
39363973
return nil
39373974
}
39383975

3976+
// Autopilot clusters have preconfigured defaults: https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#comparison.
3977+
// This function modifies the diff so users can see what these will be during plan time.
3978+
func containerClusterAutopilotCustomizeDiff(_ context.Context, d *schema.ResourceDiff, meta interface{}) error {
3979+
if d.HasChange("enable_autopilot") && d.Get("enable_autopilot").(bool) {
3980+
if err := d.SetNew("enable_intranode_visibility", true); err != nil {
3981+
return err
3982+
}
3983+
if err := d.SetNew("enable_shielded_nodes", true); err != nil {
3984+
return err
3985+
}
3986+
}
3987+
return nil
3988+
}
3989+
39393990
func podSecurityPolicyCfgSuppress(k, old, new string, r *schema.ResourceData) bool {
39403991
if k == "pod_security_policy_config.#" && old == "1" && new == "0" {
39413992
if v, ok := r.GetOk("pod_security_policy_config"); ok {

0 commit comments

Comments
 (0)