Skip to content

Commit 3a719ff

Browse files
aaron-laneaaron-lane
authored
Merge pull request #136 from terraform-google-modules/aaron-lane-deploy-with-private-endpoint
Add deploy_using_private_endpoint variable
2 parents 2ec2037 + c0570d0 commit 3a719ff

File tree

18 files changed

+544
-2
lines changed

18 files changed

+544
-2
lines changed

‎.kitchen.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ driver:
2020
provisioner:
2121
name: "terraform"
2222

23+
verifier:
24+
name: terraform
25+
color: false
26+
2327
platforms:
2428
- name: local
2529

@@ -147,3 +151,9 @@ suites:
147151
backend: local
148152
provisioner:
149153
name: terraform
154+
- name: stub_domains_private
155+
driver:
156+
root_module_directory: test/fixtures/stub_domains_private
157+
systems:
158+
- name: stub_domains_private
159+
backend: local

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ Extending the adopted spec, each change should have a link to its corresponding
1111
### Added
1212

1313
* Support for v2.6 and v2.7 of the Google providers. [#152]
14+
* `deploy_using_private_endpoint` variable on `private-cluster`
15+
submodule. [#136]
1416

1517
### Fixed
1618

@@ -122,6 +124,7 @@ Extending the adopted spec, each change should have a link to its corresponding
122124
[#152]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/152
123125
[#151]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/151
124126
[#148]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/148
127+
[#136]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/136
125128
[#132]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/132
126129
[#121]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/121
127130
[#109]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/109

‎autogen/main.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,26 @@ locals {
6363
zonal = "${concat(google_container_cluster.zonal_primary.*.zone, local.cluster_type_output_zonal_zones)}"
6464
}
6565

66+
{% if private_cluster %}
67+
cluster_type_output_endpoint = {
68+
regional = "${
69+
var.deploy_using_private_endpoint ?
70+
element(concat(google_container_cluster.primary.*.private_cluster_config.0.private_endpoint, list("")), 0) :
71+
element(concat(google_container_cluster.primary.*.endpoint, list("")), 0)
72+
}"
73+
74+
zonal = "${
75+
var.deploy_using_private_endpoint ?
76+
element(concat(google_container_cluster.zonal_primary.*.private_cluster_config.0.private_endpoint, list("")), 0) :
77+
element(concat(google_container_cluster.zonal_primary.*.endpoint, list("")), 0)
78+
}"
79+
}
80+
{% else %}
6681
cluster_type_output_endpoint = {
6782
regional = "${element(concat(google_container_cluster.primary.*.endpoint, list("")), 0)}"
6883
zonal = "${element(concat(google_container_cluster.zonal_primary.*.endpoint, list("")), 0)}"
6984
}
85+
{% endif %}
7086

7187
cluster_type_output_master_auth = {
7288
regional = "${concat(google_container_cluster.primary.*.master_auth, list())}"

‎autogen/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,11 @@ variable "service_account" {
228228
}
229229
{% if private_cluster %}
230230

231+
variable "deploy_using_private_endpoint" {
232+
description = "(Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment."
233+
default = "false"
234+
}
235+
231236
variable "enable_private_endpoint" {
232237
description = "(Beta) Whether the master's internal IP address is used as the cluster endpoint"
233238
default = false

‎examples/stub_domains_private/README.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Stub Domains Private Cluster
2+
3+
This example illustrates how to create a private cluster that adds
4+
custom stub domains to kube-dns.
5+
6+
It will:
7+
8+
- Create a private cluster
9+
- Remove the default kube-dns configmap
10+
- Add a new kube-dns configmap with custom stub domains
11+
12+
[^]: (autogen_docs_start)
13+
14+
## Inputs
15+
16+
| Name | Description | Type | Default | Required |
17+
|------|-------------|:----:|:-----:|:-----:|
18+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
19+
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
20+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
21+
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
22+
| network | The VPC network to host the cluster in | string | n/a | yes |
23+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
24+
| region | The region to host the cluster in | string | n/a | yes |
25+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
26+
27+
## Outputs
28+
29+
| Name | Description |
30+
|------|-------------|
31+
| ca\_certificate | |
32+
| client\_token | |
33+
| cluster\_name | Cluster name |
34+
| ip\_range\_pods | The secondary IP range used for pods |
35+
| ip\_range\_services | The secondary IP range used for services |
36+
| kubernetes\_endpoint | |
37+
| location | |
38+
| master\_kubernetes\_version | The master Kubernetes version |
39+
| network | |
40+
| project\_id | |
41+
| region | |
42+
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
43+
| subnetwork | |
44+
| zones | List of zones in which the cluster resides |
45+
46+
[^]: (autogen_docs_end)
47+
48+
To provision this example, run the following from within this directory:
49+
50+
- `terraform init` to get the plugins
51+
- `terraform plan` to see the infrastructure plan
52+
- `terraform apply` to apply the infrastructure build
53+
- `terraform destroy` to destroy the built infrastructure

‎examples/stub_domains_private/main.tf‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
provider "google-beta" {
18+
version = "~> 2.2"
19+
region = "${var.region}"
20+
}
21+
22+
provider "random" {
23+
version = "~> 2.1"
24+
}
25+
26+
data "google_compute_subnetwork" "subnetwork" {
27+
name = "${var.subnetwork}"
28+
project = "${var.project_id}"
29+
region = "${var.region}"
30+
}
31+
32+
module "gke" {
33+
source = "../../modules/private-cluster"
34+
35+
ip_range_pods = "${var.ip_range_pods}"
36+
ip_range_services = "${var.ip_range_services}"
37+
name = "stub-domains-private-cluster${var.cluster_name_suffix}"
38+
network = "${var.network}"
39+
project_id = "${var.project_id}"
40+
region = "${var.region}"
41+
subnetwork = "${var.subnetwork}"
42+
43+
deploy_using_private_endpoint = "true"
44+
enable_private_endpoint = "false"
45+
enable_private_nodes = "true"
46+
47+
master_authorized_networks_config = [{
48+
cidr_blocks = [{
49+
cidr_block = "${data.google_compute_subnetwork.subnetwork.ip_cidr_range}"
50+
display_name = "VPC"
51+
}]
52+
}]
53+
54+
master_ipv4_cidr_block = "172.16.0.0/28"
55+
56+
network_policy = "true"
57+
service_account = "${var.compute_engine_service_account}"
58+
59+
stub_domains {
60+
"example.com" = [
61+
"10.254.154.11",
62+
"10.254.154.12",
63+
]
64+
65+
"example.net" = [
66+
"10.254.154.11",
67+
"10.254.154.12",
68+
]
69+
}
70+
}
71+
72+
data "google_client_config" "default" {}

‎examples/stub_domains_private/outputs.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = "${module.gke.endpoint}"
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = "${base64encode(data.google_client_config.default.access_token)}"
25+
}
26+
27+
output "ca_certificate" {
28+
value = "${module.gke.ca_certificate}"
29+
}
30+
31+
output "service_account" {
32+
description = "The service account to default running nodes as if not overridden in `node_pools`."
33+
value = "${module.gke.service_account}"
34+
}

‎examples/stub_domains_private/test_outputs.tf‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
// These outputs are used to test the module with kitchen-terraform
18+
// They do not need to be included in real-world uses of this module
19+
20+
output "project_id" {
21+
value = "${var.project_id}"
22+
}
23+
24+
output "region" {
25+
value = "${module.gke.region}"
26+
}
27+
28+
output "cluster_name" {
29+
description = "Cluster name"
30+
value = "${module.gke.name}"
31+
}
32+
33+
output "network" {
34+
value = "${var.network}"
35+
}
36+
37+
output "subnetwork" {
38+
value = "${var.subnetwork}"
39+
}
40+
41+
output "location" {
42+
value = "${module.gke.location}"
43+
}
44+
45+
output "ip_range_pods" {
46+
description = "The secondary IP range used for pods"
47+
value = "${var.ip_range_pods}"
48+
}
49+
50+
output "ip_range_services" {
51+
description = "The secondary IP range used for services"
52+
value = "${var.ip_range_services}"
53+
}
54+
55+
output "zones" {
56+
description = "List of zones in which the cluster resides"
57+
value = "${module.gke.zones}"
58+
}
59+
60+
output "master_kubernetes_version" {
61+
description = "The master Kubernetes version"
62+
value = "${module.gke.master_version}"
63+
}

‎examples/stub_domains_private/variables.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "cluster_name_suffix" {
22+
description = "A suffix to append to the default cluster name"
23+
default = ""
24+
}
25+
26+
variable "region" {
27+
description = "The region to host the cluster in"
28+
}
29+
30+
variable "network" {
31+
description = "The VPC network to host the cluster in"
32+
}
33+
34+
variable "subnetwork" {
35+
description = "The subnetwork to host the cluster in"
36+
}
37+
38+
variable "ip_range_pods" {
39+
description = "The secondary ip range to use for pods"
40+
}
41+
42+
variable "ip_range_services" {
43+
description = "The secondary ip range to use for pods"
44+
}
45+
46+
variable "compute_engine_service_account" {
47+
description = "Service account to associate to the nodes in the cluster"
48+
}

‎modules/private-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
121121
|------|-------------|:----:|:-----:|:-----:|
122122
| basic\_auth\_password | The password to be used with Basic Authentication. | string | `""` | no |
123123
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string | `""` | no |
124+
| deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | string | `"false"` | no |
124125
| description | The description of the cluster | string | `""` | no |
125126
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
126127
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | string | `"false"` | no |

0 commit comments

Comments
 (0)