Skip to content

Commit 0005ab9

Browse files
michaellzcmichaellzc
authored
fix: avoid auto_provisioning_defaults drift (#1806)
1 parent 4fab404 commit 0005ab9

File tree

23 files changed

+327
-255
lines changed

23 files changed

+327
-255
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ Then perform the following commands on the root folder:
143143
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
144144
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
145145
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
146-
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
146+
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
147147
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
148148
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
149149
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,11 @@ resource "google_container_cluster" "primary" {
166166
}
167167
}
168168

169+
shielded_instance_config {
170+
enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
171+
enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
172+
}
173+
169174
{% if beta_cluster %}
170175
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
171176
{% endif %}

‎autogen/main/variables.tf.tmpl‎

Lines changed: 35 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -244,39 +244,43 @@ variable "enable_resource_consumption_export" {
244244
{% if autopilot_cluster != true %}
245245
variable "cluster_autoscaling" {
246246
type = object({
247-
enabled = bool
248-
autoscaling_profile = string
249-
min_cpu_cores = number
250-
max_cpu_cores = number
251-
min_memory_gb = number
252-
max_memory_gb = number
253-
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
254-
auto_repair = bool
255-
auto_upgrade = bool
256-
disk_size = optional(number)
257-
disk_type = optional(string)
258-
image_type = optional(string)
259-
strategy = optional(string)
260-
max_surge = optional(number)
261-
max_unavailable = optional(number)
262-
node_pool_soak_duration = optional(string)
263-
batch_soak_duration = optional(string)
264-
batch_percentage = optional(number)
265-
batch_node_count = optional(number)
247+
enabled = bool
248+
autoscaling_profile = string
249+
min_cpu_cores = number
250+
max_cpu_cores = number
251+
min_memory_gb = number
252+
max_memory_gb = number
253+
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
254+
auto_repair = bool
255+
auto_upgrade = bool
256+
disk_size = optional(number)
257+
disk_type = optional(string)
258+
image_type = optional(string)
259+
strategy = optional(string)
260+
max_surge = optional(number)
261+
max_unavailable = optional(number)
262+
node_pool_soak_duration = optional(string)
263+
batch_soak_duration = optional(string)
264+
batch_percentage = optional(number)
265+
batch_node_count = optional(number)
266+
enable_secure_boot = optional(bool, false)
267+
enable_integrity_monitoring = optional(bool, true)
266268
})
267269
default = {
268-
enabled = false
269-
autoscaling_profile = "BALANCED"
270-
max_cpu_cores = 0
271-
min_cpu_cores = 0
272-
max_memory_gb = 0
273-
min_memory_gb = 0
274-
gpu_resources = []
275-
auto_repair = true
276-
auto_upgrade = true
277-
disk_size = 100
278-
disk_type = "pd-standard"
279-
image_type = "COS_CONTAINERD"
270+
enabled = false
271+
autoscaling_profile = "BALANCED"
272+
max_cpu_cores = 0
273+
min_cpu_cores = 0
274+
max_memory_gb = 0
275+
min_memory_gb = 0
276+
gpu_resources = []
277+
auto_repair = true
278+
auto_upgrade = true
279+
disk_size = 100
280+
disk_type = "pd-standard"
281+
image_type = "COS_CONTAINERD"
282+
enable_secure_boot = false
283+
enable_integrity_monitoring = true
280284
}
281285
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
282286
}

‎cluster.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,11 @@ resource "google_container_cluster" "primary" {
139139
}
140140
}
141141

142+
shielded_instance_config {
143+
enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
144+
enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
145+
}
146+
142147

143148
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")
144149
}

‎modules/beta-private-cluster-update-variant/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ Then perform the following commands on the root folder:
176176
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
177177
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
178178
| cloudrun\_load\_balancer\_type | (Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer. | `string` | `""` | no |
179-
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
179+
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
180180
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
181181
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
182182
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,11 @@ resource "google_container_cluster" "primary" {
145145
}
146146
}
147147

148+
shielded_instance_config {
149+
enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
150+
enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
151+
}
152+
148153
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
149154

150155
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")

‎modules/beta-private-cluster-update-variant/variables.tf‎

Lines changed: 35 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -239,39 +239,43 @@ variable "enable_resource_consumption_export" {
239239

240240
variable "cluster_autoscaling" {
241241
type = object({
242-
enabled = bool
243-
autoscaling_profile = string
244-
min_cpu_cores = number
245-
max_cpu_cores = number
246-
min_memory_gb = number
247-
max_memory_gb = number
248-
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
249-
auto_repair = bool
250-
auto_upgrade = bool
251-
disk_size = optional(number)
252-
disk_type = optional(string)
253-
image_type = optional(string)
254-
strategy = optional(string)
255-
max_surge = optional(number)
256-
max_unavailable = optional(number)
257-
node_pool_soak_duration = optional(string)
258-
batch_soak_duration = optional(string)
259-
batch_percentage = optional(number)
260-
batch_node_count = optional(number)
242+
enabled = bool
243+
autoscaling_profile = string
244+
min_cpu_cores = number
245+
max_cpu_cores = number
246+
min_memory_gb = number
247+
max_memory_gb = number
248+
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
249+
auto_repair = bool
250+
auto_upgrade = bool
251+
disk_size = optional(number)
252+
disk_type = optional(string)
253+
image_type = optional(string)
254+
strategy = optional(string)
255+
max_surge = optional(number)
256+
max_unavailable = optional(number)
257+
node_pool_soak_duration = optional(string)
258+
batch_soak_duration = optional(string)
259+
batch_percentage = optional(number)
260+
batch_node_count = optional(number)
261+
enable_secure_boot = optional(bool, false)
262+
enable_integrity_monitoring = optional(bool, true)
261263
})
262264
default = {
263-
enabled = false
264-
autoscaling_profile = "BALANCED"
265-
max_cpu_cores = 0
266-
min_cpu_cores = 0
267-
max_memory_gb = 0
268-
min_memory_gb = 0
269-
gpu_resources = []
270-
auto_repair = true
271-
auto_upgrade = true
272-
disk_size = 100
273-
disk_type = "pd-standard"
274-
image_type = "COS_CONTAINERD"
265+
enabled = false
266+
autoscaling_profile = "BALANCED"
267+
max_cpu_cores = 0
268+
min_cpu_cores = 0
269+
max_memory_gb = 0
270+
min_memory_gb = 0
271+
gpu_resources = []
272+
auto_repair = true
273+
auto_upgrade = true
274+
disk_size = 100
275+
disk_type = "pd-standard"
276+
image_type = "COS_CONTAINERD"
277+
enable_secure_boot = false
278+
enable_integrity_monitoring = true
275279
}
276280
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
277281
}

0 commit comments

Comments
 (0)