Skip to content

Commit 5d8ea7f

Browse files
diegolnascbharathkkb
diegolnasc
and
bharathkkb
authored
feat: support IP Masquerade agent (#54)
* feature: support IP Masquerade agent * feature: support IP Masquerade agent * feature: support IP Masquerade agent * feature: support IP Masquerade agent * feature: private_ip_google_access Co-authored-by: Bharath KKB <[email protected]>
1 parent a482a8a commit 5d8ea7f

File tree

19 files changed

+1595
-226
lines changed

19 files changed

+1595
-226
lines changed

‎build/int.cloudbuild.yaml‎

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
timeout: 3600s
15+
timeout: 7200s
1616
steps:
1717
- id: prepare
1818
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
@@ -30,39 +30,49 @@ steps:
3030

3131
# ----- SUITE simple-composer-env-v1-local
3232

33-
- id: converge simple-composer-env-v1-local
33+
- id: init-simple-composer-env-v1
3434
waitFor:
35-
- create all
35+
- prepare
36+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
37+
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV1Module --stage init --verbose']
38+
- id: apply-simple-composer-env-v1
39+
waitFor:
40+
- init-simple-composer-env-v1
3641
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
37-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge simple-composer-env-v1-local']
38-
- id: verify simple-composer-env-v1-local
42+
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV1Module --stage apply --verbose']
43+
- id: verify-simple-composer-env-v1
3944
waitFor:
40-
- converge simple-composer-env-v1-local
45+
- apply-simple-composer-env-v1
4146
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
42-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify simple-composer-env-v1-local']
43-
- id: destroy simple-composer-env-v1-local
47+
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV1Module --stage verify --verbose']
48+
- id: destroy-simple-composer-env-v1
4449
waitFor:
45-
- verify simple-composer-env-v1-local
50+
- verify-simple-composer-env-v1
4651
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
47-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-composer-env-v1-local']
52+
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV1Module --stage destroy --verbose']
4853

4954
# ----- SUITE simple-composer-env-v2-local
5055

51-
- id: converge simple-composer-env-v2-local
56+
- id: init-simple-composer-env-v2
5257
waitFor:
53-
- create all
58+
- prepare
59+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
60+
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV2Module --stage init --verbose']
61+
- id: apply-simple-composer-env-v2
62+
waitFor:
63+
- init-simple-composer-env-v2
5464
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
55-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge simple-composer-env-v2-local']
56-
- id: verify simple-composer-env-v2-local
65+
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV2Module --stage apply --verbose']
66+
- id: verify-simple-composer-env-v2
5767
waitFor:
58-
- converge simple-composer-env-v2-local
68+
- apply-simple-composer-env-v2
5969
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
60-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify simple-composer-env-v2-local']
61-
- id: destroy simple-composer-env-v2-local
70+
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV2Module --stage verify --verbose']
71+
- id: destroy-simple-composer-env-v2
6272
waitFor:
63-
- verify simple-composer-env-v2-local
73+
- verify-simple-composer-env-v2
6474
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
65-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-composer-env-v2-local']
75+
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV2Module --stage destroy --verbose']
6676

6777
# ----- SUITE airflow-connection-local
6878

‎kitchen.yml‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -24,30 +24,6 @@ platforms:
2424
- name: local
2525

2626
suites:
27-
- name: simple-composer-env-v1
28-
driver:
29-
name: terraform
30-
command_timeout: 3600
31-
root_module_directory: test/fixtures/simple-composer-env-v1
32-
verifier:
33-
name: terraform
34-
systems:
35-
- name: simple-composer-env-v1
36-
backend: local
37-
provisioner:
38-
name: terraform
39-
- name: simple-composer-env-v2
40-
driver:
41-
name: terraform
42-
command_timeout: 3600
43-
root_module_directory: test/fixtures/simple-composer-env-v2
44-
verifier:
45-
name: terraform
46-
systems:
47-
- name: simple-composer-env-v2
48-
backend: local
49-
provisioner:
50-
name: terraform
5127
- name: airflow-connection
5228
driver:
5329
name: terraform

‎modules/create_environment_v1/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ module "composer" {
3232
| composer\_env\_name | Name of Cloud Composer Environment | `string` | n/a | yes |
3333
| composer\_service\_account | Service Account for running Cloud Composer. | `string` | `null` | no |
3434
| disk\_size | The disk size for nodes. | `string` | `"100"` | no |
35+
| enable\_ip\_masq\_agent | Deploys 'ip-masq-agent' daemon set in the GKE cluster and defines nonMasqueradeCIDRs equals to pod IP range so IP masquerading is used for all destination addresses, except between pods traffic. | `bool` | `false` | no |
3536
| enable\_private\_endpoint | Configure public access to the cluster endpoint. | `bool` | `false` | no |
3637
| env\_variables | Variables of the airflow environment. | `map(string)` | `{}` | no |
3738
| image\_version | The version of the aiflow running in the cloud composer environment. | `string` | `null` | no |

‎modules/create_environment_v1/main.tf‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,14 +31,15 @@ resource "google_composer_environment" "composer_env" {
3131
node_count = var.node_count
3232

3333
node_config {
34-
zone = var.zone
35-
machine_type = var.machine_type
36-
network = "projects/${local.network_project_id}/global/networks/${var.network}"
37-
subnetwork = "projects/${local.network_project_id}/regions/${local.subnetwork_region}/subnetworks/${var.subnetwork}"
38-
service_account = var.composer_service_account
39-
disk_size_gb = var.disk_size
40-
oauth_scopes = var.oauth_scopes
41-
tags = var.tags
34+
zone = var.zone
35+
machine_type = var.machine_type
36+
network = "projects/${local.network_project_id}/global/networks/${var.network}"
37+
subnetwork = "projects/${local.network_project_id}/regions/${local.subnetwork_region}/subnetworks/${var.subnetwork}"
38+
service_account = var.composer_service_account
39+
disk_size_gb = var.disk_size
40+
oauth_scopes = var.oauth_scopes
41+
tags = var.tags
42+
enable_ip_masq_agent = var.enable_ip_masq_agent
4243

4344
dynamic "ip_allocation_policy" {
4445
for_each = var.use_ip_aliases ? [1] : []

‎modules/create_environment_v1/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,12 @@ variable "tags" {
100100
default = []
101101
}
102102

103+
variable "enable_ip_masq_agent" {
104+
description = "Deploys 'ip-masq-agent' daemon set in the GKE cluster and defines nonMasqueradeCIDRs equals to pod IP range so IP masquerading is used for all destination addresses, except between pods traffic."
105+
type = bool
106+
default = false
107+
}
108+
103109
variable "use_ip_aliases" {
104110
description = "Enable Alias IPs in the GKE cluster. If true, a VPC-native cluster is created."
105111
type = bool

‎modules/create_environment_v1/versions.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,4 +33,8 @@ terraform {
3333
module_name = "blueprints/terraform/terraform-google-composer:create_environment_v1/v3.2.0"
3434
}
3535

36+
provider_meta "google-beta" {
37+
module_name = "blueprints/terraform/terraform-google-composer:create_environment_v1/v3.2.0"
38+
}
39+
3640
}

‎modules/create_environment_v2/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ module "composer" {
2222
| cloud\_sql\_ipv4\_cidr | The CIDR block from which IP range in tenant project will be reserved for Cloud SQL. | `string` | `null` | no |
2323
| composer\_env\_name | Name of Cloud Composer Environment | `string` | n/a | yes |
2424
| composer\_service\_account | Service Account for running Cloud Composer. | `string` | `null` | no |
25+
| enable\_ip\_masq\_agent | Deploys 'ip-masq-agent' daemon set in the GKE cluster and defines nonMasqueradeCIDRs equals to pod IP range so IP masquerading is used for all destination addresses, except between pods traffic. | `bool` | `false` | no |
2526
| enable\_private\_endpoint | Configure public access to the cluster endpoint. | `bool` | `false` | no |
2627
| env\_variables | Variables of the airflow environment. | `map(string)` | `{}` | no |
2728
| environment\_size | The environment size controls the performance parameters of the managed Cloud Composer infrastructure that includes the Airflow database. Values for environment size are: ENVIRONMENT\_SIZE\_SMALL, ENVIRONMENT\_SIZE\_MEDIUM, and ENVIRONMENT\_SIZE\_LARGE. | `string` | `"ENVIRONMENT_SIZE_MEDIUM"` | no |

‎modules/create_environment_v2/main.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,11 @@ resource "google_composer_environment" "composer_env" {
3737
environment_size = var.environment_size
3838

3939
node_config {
40-
network = "projects/${local.network_project_id}/global/networks/${var.network}"
41-
subnetwork = "projects/${local.network_project_id}/regions/${local.subnetwork_region}/subnetworks/${var.subnetwork}"
42-
service_account = var.composer_service_account
43-
tags = var.tags
40+
network = "projects/${local.network_project_id}/global/networks/${var.network}"
41+
subnetwork = "projects/${local.network_project_id}/regions/${local.subnetwork_region}/subnetworks/${var.subnetwork}"
42+
service_account = var.composer_service_account
43+
tags = var.tags
44+
enable_ip_masq_agent = var.enable_ip_masq_agent
4445

4546
dynamic "ip_allocation_policy" {
4647
for_each = (var.pod_ip_allocation_range_name != null || var.service_ip_allocation_range_name != null) ? [1] : []

‎modules/create_environment_v2/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,12 @@ variable "tags" {
4242
default = []
4343
}
4444

45+
variable "enable_ip_masq_agent" {
46+
description = "Deploys 'ip-masq-agent' daemon set in the GKE cluster and defines nonMasqueradeCIDRs equals to pod IP range so IP masquerading is used for all destination addresses, except between pods traffic."
47+
type = bool
48+
default = false
49+
}
50+
4551
variable "network" {
4652
type = string
4753
description = "The VPC network to host the composer cluster."

‎test/fixtures/simple-composer-env-v1/network.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,12 @@ resource "google_compute_network" "main" {
2121
}
2222

2323
resource "google_compute_subnetwork" "main" {
24-
project = var.project_id
25-
name = "ci-composer-test-${random_string.suffix.result}"
26-
ip_cidr_range = "10.0.0.0/17"
27-
region = var.region
28-
network = google_compute_network.main.self_link
24+
project = var.project_id
25+
name = "ci-composer-test-${random_string.suffix.result}"
26+
ip_cidr_range = "10.0.0.0/17"
27+
region = var.region
28+
network = google_compute_network.main.self_link
29+
private_ip_google_access = true
2930

3031
secondary_ip_range {
3132
range_name = "ci-composer-test-pods-${random_string.suffix.result}"

0 commit comments

Comments
 (0)