Skip to content

Commit 5069034

Browse files
AmeausooneAmeausoone
authored
feat(cgroup): add support for configuring Linux cgroup mode in autopilot clusters (#2282)
1 parent 260be87 commit 5069034

File tree

12 files changed

+89
-9
lines changed

12 files changed

+89
-9
lines changed

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -286,10 +286,13 @@ resource "google_container_cluster" "primary" {
286286
}
287287
{% if autopilot_cluster %}
288288
dynamic "node_pool_auto_config" {
289-
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
289+
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null || var.node_pools_cgroup_mode != null ? [1] : []
290290
content {
291-
network_tags {
292-
tags = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules ? concat(var.network_tags, [local.cluster_network_tag]) : length(var.network_tags) > 0 ? var.network_tags : null
291+
dynamic "network_tags" {
292+
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
293+
content {
294+
tags = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules ? concat(var.network_tags, [local.cluster_network_tag]) : length(var.network_tags) > 0 ? var.network_tags : null
295+
}
293296
}
294297

295298
dynamic "node_kubelet_config" {
@@ -298,6 +301,12 @@ resource "google_container_cluster" "primary" {
298301
insecure_kubelet_readonly_port_enabled = upper(tostring(var.insecure_kubelet_readonly_port_enabled))
299302
}
300303
}
304+
dynamic "linux_node_config" {
305+
for_each = var.node_pools_cgroup_mode != null ? [1] : []
306+
content {
307+
cgroup_mode = var.node_pools_cgroup_mode
308+
}
309+
}
301310
}
302311
}
303312
{% endif %}

‎autogen/main/variables.tf.tmpl‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,23 @@ variable "insecure_kubelet_readonly_port_enabled" {
114114
default = null
115115
}
116116

117+
{% if autopilot_cluster %}
118+
variable "node_pools_cgroup_mode" {
119+
type = string
120+
description = "Specifies the Linux cgroup mode for autopilot Kubernetes nodes in the cluster. Accepted values are `CGROUP_MODE_UNSPECIFIED`, `CGROUP_MODE_V1`, and `CGROUP_MODE_V2`, which determine the control group hierarchy used for resource management."
121+
validation {
122+
condition = var.node_pools_cgroup_mode == null || contains([
123+
"",
124+
"CGROUP_MODE_UNSPECIFIED",
125+
"CGROUP_MODE_V1",
126+
"CGROUP_MODE_V2"
127+
], var.node_pools_cgroup_mode != null ? var.node_pools_cgroup_mode : "")
128+
error_message = "The node_pools_cgroup_mode must be one of CGROUP_MODE_UNSPECIFIED, CGROUP_MODE_V1, or CGROUP_MODE_V2."
129+
}
130+
default = null
131+
}
132+
133+
{% endif %}
117134
{% if autopilot_cluster != true %}
118135
variable "datapath_provider" {
119136
type = string

‎examples/simple_autopilot_private/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ module "gke" {
5050
enable_private_endpoint = true
5151
enable_private_nodes = true
5252
network_tags = [local.cluster_type]
53+
node_pools_cgroup_mode = "CGROUP_MODE_V2"
5354
deletion_protection = false
5455
insecure_kubelet_readonly_port_enabled = false
5556
}

‎examples/simple_autopilot_private_cmek/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ module "gke" {
7171
enable_private_endpoint = true
7272
enable_private_nodes = true
7373
network_tags = [local.cluster_type]
74+
node_pools_cgroup_mode = "CGROUP_MODE_V2"
7475
deletion_protection = false
7576
boot_disk_kms_key = values(module.kms.keys)[0]
7677
depends_on = [google_kms_crypto_key_iam_member.main]

‎examples/simple_autopilot_private_non_default_sa/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ module "gke" {
4949
enable_vertical_pod_autoscaling = true
5050
enable_private_endpoint = true
5151
enable_private_nodes = true
52+
node_pools_cgroup_mode = "CGROUP_MODE_V2"
5253
deletion_protection = false
5354

5455
master_authorized_networks = [

‎examples/simple_autopilot_public/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ module "gke" {
4747
release_channel = "RAPID"
4848
enable_vertical_pod_autoscaling = true
4949
network_tags = [local.cluster_type]
50+
node_pools_cgroup_mode = "CGROUP_MODE_V2"
5051
deletion_protection = false
5152
enable_l4_ilb_subsetting = true
5253
stateful_ha = false

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ Then perform the following commands on the root folder:
136136
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
137137
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
138138
| network\_tags | (Optional) - List of network tags applied to auto-provisioned node pools. | `list(string)` | `[]` | no |
139+
| node\_pools\_cgroup\_mode | Specifies the Linux cgroup mode for autopilot Kubernetes nodes in the cluster. Accepted values are `CGROUP_MODE_UNSPECIFIED`, `CGROUP_MODE_V1`, and `CGROUP_MODE_V2`, which determine the control group hierarchy used for resource management. | `string` | `null` | no |
139140
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
140141
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
141142
| notification\_filter\_event\_type | Choose what type of notifications you want to receive. If no filters are applied, you'll receive all notification types. Can be used to filter what notifications are sent. Accepted values are UPGRADE\_AVAILABLE\_EVENT, UPGRADE\_EVENT, and SECURITY\_BULLETIN\_EVENT. | `list(string)` | `[]` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -142,10 +142,13 @@ resource "google_container_cluster" "primary" {
142142
}
143143
}
144144
dynamic "node_pool_auto_config" {
145-
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
145+
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null || var.node_pools_cgroup_mode != null ? [1] : []
146146
content {
147-
network_tags {
148-
tags = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules ? concat(var.network_tags, [local.cluster_network_tag]) : length(var.network_tags) > 0 ? var.network_tags : null
147+
dynamic "network_tags" {
148+
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
149+
content {
150+
tags = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules ? concat(var.network_tags, [local.cluster_network_tag]) : length(var.network_tags) > 0 ? var.network_tags : null
151+
}
149152
}
150153

151154
dynamic "node_kubelet_config" {
@@ -154,6 +157,12 @@ resource "google_container_cluster" "primary" {
154157
insecure_kubelet_readonly_port_enabled = upper(tostring(var.insecure_kubelet_readonly_port_enabled))
155158
}
156159
}
160+
dynamic "linux_node_config" {
161+
for_each = var.node_pools_cgroup_mode != null ? [1] : []
162+
content {
163+
cgroup_mode = var.node_pools_cgroup_mode
164+
}
165+
}
157166
}
158167
}
159168

‎modules/beta-autopilot-private-cluster/variables.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,21 @@ variable "insecure_kubelet_readonly_port_enabled" {
114114
default = null
115115
}
116116

117+
variable "node_pools_cgroup_mode" {
118+
type = string
119+
description = "Specifies the Linux cgroup mode for autopilot Kubernetes nodes in the cluster. Accepted values are `CGROUP_MODE_UNSPECIFIED`, `CGROUP_MODE_V1`, and `CGROUP_MODE_V2`, which determine the control group hierarchy used for resource management."
120+
validation {
121+
condition = var.node_pools_cgroup_mode == null || contains([
122+
"",
123+
"CGROUP_MODE_UNSPECIFIED",
124+
"CGROUP_MODE_V1",
125+
"CGROUP_MODE_V2"
126+
], var.node_pools_cgroup_mode != null ? var.node_pools_cgroup_mode : "")
127+
error_message = "The node_pools_cgroup_mode must be one of CGROUP_MODE_UNSPECIFIED, CGROUP_MODE_V1, or CGROUP_MODE_V2."
128+
}
129+
default = null
130+
}
131+
117132
variable "maintenance_start_time" {
118133
type = string
119134
description = "Time window specified for daily or recurring maintenance operations in RFC3339 format"

‎modules/beta-autopilot-public-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ Then perform the following commands on the root folder:
126126
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
127127
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
128128
| network\_tags | (Optional) - List of network tags applied to auto-provisioned node pools. | `list(string)` | `[]` | no |
129+
| node\_pools\_cgroup\_mode | Specifies the Linux cgroup mode for autopilot Kubernetes nodes in the cluster. Accepted values are `CGROUP_MODE_UNSPECIFIED`, `CGROUP_MODE_V1`, and `CGROUP_MODE_V2`, which determine the control group hierarchy used for resource management. | `string` | `null` | no |
129130
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
130131
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
131132
| notification\_filter\_event\_type | Choose what type of notifications you want to receive. If no filters are applied, you'll receive all notification types. Can be used to filter what notifications are sent. Accepted values are UPGRADE\_AVAILABLE\_EVENT, UPGRADE\_EVENT, and SECURITY\_BULLETIN\_EVENT. | `list(string)` | `[]` | no |

0 commit comments

Comments
 (0)