Skip to content

Commit 1859b17

Browse files
daniel-citdaniel-cit
authored
feat: Simple GKE modules for ADC (#2397)
1 parent e5ade9c commit 1859b17

File tree

80 files changed

+9235
-12
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+9235
-12
lines changed

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,8 @@ crash.log
5050
**/.kitchen.local.yml
5151
**/Gemfile.lock
5252

53-
test/fixtures/shared/terraform.tfvars
53+
test/fixtures/**/terraform.tfvars
54+
modules/**/terraform.tfvars
5455

5556
test/integration/gcloud/config.sh
5657
test/integration/tmp

‎build/int.cloudbuild.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,36 @@ steps:
270270
- verify beta-cluster
271271
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
272272
args: ['/bin/bash', '-c', 'cft test run TestBetaCluster --stage teardown --verbose']
273+
- id: apply gke-standard-cluster
274+
waitFor:
275+
- teardown beta-cluster
276+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
277+
args: ['/bin/bash', '-c', 'cft test run TestGKEStandardCluster --stage apply --verbose']
278+
- id: verify gke-standard-cluster
279+
waitFor:
280+
- apply gke-standard-cluster
281+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
282+
args: ['/bin/bash', '-c', 'cft test run TestGKEStandardCluster --stage verify --verbose']
283+
- id: teardown gke-standard-cluster
284+
waitFor:
285+
- verify gke-standard-cluster
286+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
287+
args: ['/bin/bash', '-c', 'cft test run TestGKEStandardCluster --stage teardown --verbose']
288+
- id: apply gke-autopilot-cluster
289+
waitFor:
290+
- teardown gke-standard-cluster
291+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
292+
args: ['/bin/bash', '-c', 'cft test run TestGKEAutopilotCluster --stage apply --verbose']
293+
- id: verify gke-autopilot-cluster
294+
waitFor:
295+
- apply gke-autopilot-cluster
296+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
297+
args: ['/bin/bash', '-c', 'cft test run TestGKEAutopilotCluster --stage verify --verbose']
298+
- id: teardown gke-autopilot-cluster
299+
waitFor:
300+
- verify gke-autopilot-cluster
301+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
302+
args: ['/bin/bash', '-c', 'cft test run TestGKEAutopilotCluster --stage teardown --verbose']
273303
- id: apply simple-windows-node-pool-local
274304
waitFor:
275305
- init-all

‎examples/gke_autopilot_cluster/README.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# GKE Autopilot Cluster
2+
3+
This example creates a GKE private Autopilot clusterwith beta features.
4+
For a full example see [simple_autopilot_private](../simple_autopilot_private/README.md) example.
5+
6+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|------|---------|:--------:|
11+
| project\_id | The project ID to host the cluster in | `any` | n/a | yes |
12+
| region | The region to host the cluster in | `any` | n/a | yes |
13+
14+
## Outputs
15+
16+
| Name | Description |
17+
|------|-------------|
18+
| addons\_config | The configuration for addons supported by GKE Autopilot. |
19+
| ca\_certificate | The cluster ca certificate (base64 encoded) |
20+
| cluster\_name | Cluster name |
21+
| endpoint | The cluster endpoint |
22+
| location | Cluster location |
23+
| master\_version | The master Kubernetes version |
24+
| network\_name | The name of the VPC being created |
25+
| node\_locations | Cluster node locations |
26+
| project\_id | The project ID the cluster is in |
27+
| subnets\_names | The names of the subnet being created |
28+
29+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
30+
31+
To provision this example, run the following from within this directory:
32+
- `terraform init` to get the plugins
33+
- `terraform plan` to see the infrastructure plan
34+
- `terraform apply` to apply the infrastructure build
35+
- `terraform destroy` to destroy the built infrastructure

‎examples/gke_autopilot_cluster/main.tf‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "gke-autopilot"
19+
default_workload_pool = "${var.project_id}.svc.id.goog"
20+
network_name = "autopilot-network"
21+
subnet_name = "autopilot-subnet"
22+
master_auth_subnetwork = "autopilot-master-subnet"
23+
pods_range_name = "ip-range-pods-autopilot"
24+
svc_range_name = "ip-range-svc-autopilot"
25+
}
26+
27+
data "google_client_config" "default" {}
28+
29+
provider "kubernetes" {
30+
host = "https://${module.gke.endpoint}"
31+
token = data.google_client_config.default.access_token
32+
cluster_ca_certificate = base64decode(module.gke.ca_certificate)
33+
}
34+
35+
module "gke" {
36+
source = "../../modules/gke-autopilot-cluster"
37+
38+
project = var.project_id
39+
name = "${local.cluster_type}-cluster"
40+
location = var.region
41+
network = module.gcp-network.network_self_link
42+
subnetwork = module.gcp-network.subnets_self_links[index(module.gcp-network.subnets_names, local.subnet_name)]
43+
44+
ip_allocation_policy = {
45+
cluster_secondary_range_name = local.pods_range_name
46+
services_secondary_range_name = local.svc_range_name
47+
}
48+
49+
private_cluster_config = {
50+
enable_private_endpoint = true
51+
enable_private_nodes = true
52+
master_ipv4_cidr_block = "172.16.0.0/28"
53+
master_global_access_config = {
54+
enabled = true
55+
}
56+
}
57+
58+
master_authorized_networks_config = {
59+
cidr_blocks = [{
60+
cidr_block = "10.60.0.0/17"
61+
display_name = "VPC"
62+
}]
63+
}
64+
65+
confidential_nodes = {
66+
enabled = true
67+
}
68+
69+
workload_identity_config = {
70+
workload_pool = local.default_workload_pool
71+
}
72+
}

‎examples/gke_autopilot_cluster/network.tf‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "gcp-network" {
18+
source = "terraform-google-modules/network/google"
19+
version = ">= 7.5"
20+
21+
project_id = var.project_id
22+
network_name = local.network_name
23+
24+
subnets = [
25+
{
26+
subnet_name = local.subnet_name
27+
subnet_ip = "10.0.0.0/17"
28+
subnet_region = var.region
29+
subnet_private_access = true
30+
},
31+
{
32+
subnet_name = local.master_auth_subnetwork
33+
subnet_ip = "10.60.0.0/17"
34+
subnet_region = var.region
35+
},
36+
]
37+
38+
secondary_ranges = {
39+
(local.subnet_name) = [
40+
{
41+
range_name = local.pods_range_name
42+
ip_cidr_range = "192.168.0.0/18"
43+
},
44+
{
45+
range_name = local.svc_range_name
46+
ip_cidr_range = "192.168.64.0/18"
47+
},
48+
]
49+
}
50+
}

‎examples/gke_autopilot_cluster/outputs.tf‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "endpoint" {
18+
sensitive = true
19+
description = "The cluster endpoint"
20+
value = module.gke.endpoint
21+
}
22+
23+
output "ca_certificate" {
24+
sensitive = true
25+
description = "The cluster ca certificate (base64 encoded)"
26+
value = module.gke.ca_certificate
27+
}
28+
29+
output "project_id" {
30+
description = "The project ID the cluster is in"
31+
value = var.project_id
32+
}
33+
34+
output "location" {
35+
description = "Cluster location"
36+
value = module.gke.location
37+
}
38+
39+
output "node_locations" {
40+
description = "Cluster node locations"
41+
value = module.gke.node_locations
42+
}
43+
44+
output "addons_config" {
45+
description = "The configuration for addons supported by GKE Autopilot."
46+
value = module.gke.addons_config
47+
}
48+
49+
output "cluster_name" {
50+
description = "Cluster name"
51+
value = module.gke.cluster_name
52+
}
53+
54+
output "network_name" {
55+
description = "The name of the VPC being created"
56+
value = module.gcp-network.network_name
57+
}
58+
59+
output "subnets_names" {
60+
description = "The names of the subnet being created"
61+
value = module.gcp-network.subnets_names
62+
}
63+
64+
output "master_version" {
65+
description = "The master Kubernetes version"
66+
value = module.gke.master_version
67+
}

‎examples/gke_autopilot_cluster/variables.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "region" {
22+
description = "The region to host the cluster in"
23+
}

‎examples/gke_autopilot_cluster/versions.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 1.3"
19+
required_providers {
20+
google = {
21+
source = "hashicorp/google"
22+
}
23+
google-beta = {
24+
source = "hashicorp/google-beta"
25+
}
26+
kubernetes = {
27+
source = "hashicorp/kubernetes"
28+
}
29+
}
30+
}

‎examples/gke_standard_cluster/README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# GKE Standard Cluster and Node Pool
2+
3+
This example creates a GKE private cluster and Node Pool with beta features.
4+
For a full example see [simple_regional_private_beta](../simple_regional_private_beta/README.md) example.
5+
6+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|------|---------|:--------:|
11+
| cluster\_name\_suffix | A suffix to append to the default cluster name | `string` | `""` | no |
12+
| dns\_cache | Boolean to enable / disable NodeLocal DNSCache | `bool` | `false` | no |
13+
| gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no |
14+
| ip\_range\_pods | The secondary ip range to use for pods | `any` | n/a | yes |
15+
| ip\_range\_services | The secondary ip range to use for services | `any` | n/a | yes |
16+
| network | The VPC network to host the cluster in | `any` | n/a | yes |
17+
| project\_id | The project ID to host the cluster in | `any` | n/a | yes |
18+
| region | The region to host the cluster in | `any` | n/a | yes |
19+
| service\_account | Service account to associate to the nodes in the cluster | `any` | n/a | yes |
20+
| subnetwork | The subnetwork to host the cluster in | `any` | n/a | yes |
21+
22+
## Outputs
23+
24+
| Name | Description |
25+
|------|-------------|
26+
| addons\_config | The configuration for addons supported by GKE Autopilot. |
27+
| ca\_certificate | The cluster ca certificate (base64 encoded) |
28+
| cluster\_name | Cluster name |
29+
| endpoint | The cluster endpoint |
30+
| location | Cluster location |
31+
| master\_version | The master Kubernetes version |
32+
| node\_locations | Cluster node locations |
33+
| project\_id | The project ID the cluster is in |
34+
35+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
36+
37+
To provision this example, run the following from within this directory:
38+
- `terraform init` to get the plugins
39+
- `terraform plan` to see the infrastructure plan
40+
- `terraform apply` to apply the infrastructure build
41+
- `terraform destroy` to destroy the built infrastructure

0 commit comments

Comments
 (0)