Skip to content

Commit 76bb697

Browse files
morgantemorgante
authored
Merge pull request #188 from chrislovecnm/enable-features-in-public-clusters
Enabling two features in beta clusters
2 parents ce40193 + 48bfedf commit 76bb697

File tree

22 files changed

+78
-84
lines changed

22 files changed

+78
-84
lines changed

‎autogen/cluster_regional.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,10 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
{% if private_cluster %}
45+
{% if beta_cluster %}
4646
enable_binary_authorization = "${var.enable_binary_authorization}"
4747
pod_security_policy_config = "${var.pod_security_policy_config}"
48-
{% endif %}
48+
{% endif %}
4949
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
5050

5151
master_auth {

‎autogen/cluster_zonal.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,11 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
{% if private_cluster %}
45+
{% if beta_cluster %}
4646
enable_binary_authorization = "${var.enable_binary_authorization}"
4747
pod_security_policy_config = "${var.pod_security_policy_config}"
48-
{% endif %}
48+
{% endif %}
49+
4950
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
5051

5152
master_auth {

‎autogen/main.tf‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,10 @@ locals {
140140
regional = "${element(concat(google_container_cluster.primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
141141
zonal = "${element(concat(google_container_cluster.zonal_primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
142142
}
143+
cluster_type_output_pod_security_policy_enabled = {
144+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
145+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
146+
}
143147
# /BETA features
144148
{% endif %}
145149

@@ -153,13 +157,6 @@ locals {
153157
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
154158
}
155159

156-
{% if private_cluster %}
157-
cluster_type_output_pod_security_policy_enabled = {
158-
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
159-
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
160-
}
161-
162-
{% endif %}
163160
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
164161
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
165162
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -184,10 +181,9 @@ locals {
184181
# BETA features
185182
cluster_istio_enabled = "${local.cluster_type_output_istio_enabled[local.cluster_type] ? false : true}"
186183
cluster_cloudrun_enabled = "${local.cluster_type_output_cloudrun_enabled[local.cluster_type] ? false : true}"
187-
# /BETA features
188-
{% endif %}
189-
{% if private_cluster %}
184+
190185
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
186+
# /BETA features
191187
{% endif %}
192188
}
193189

‎autogen/outputs.tf‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,6 @@ output "service_account" {
113113
value = "${local.service_account}"
114114
}
115115
{% if beta_cluster %}
116-
117116
output "istio_enabled" {
118117
description = "Whether Istio is enabled"
119118
value = "${local.cluster_istio_enabled}"
@@ -123,8 +122,6 @@ output "cloudrun_enabled" {
123122
description = "Whether CloudRun enabled"
124123
value = "${local.cluster_cloudrun_enabled}"
125124
}
126-
{% endif %}
127-
{% if private_cluster %}
128125

129126
output "pod_security_policy_enabled" {
130127
description = "Whether pod security policy is enabled"

‎autogen/variables.tf‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -86,21 +86,6 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89-
{% if private_cluster %}
90-
variable "enable_binary_authorization" {
91-
description = "Enable BinAuthZ Admission controller"
92-
default = false
93-
}
94-
95-
variable "pod_security_policy_config" {
96-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
97-
98-
default = [{
99-
"enabled" = false
100-
}]
101-
}
102-
103-
{% endif %}
10489
variable "horizontal_pod_autoscaling" {
10590
description = "Enable horizontal pod autoscaling addon"
10691
default = true
@@ -279,7 +264,6 @@ variable "master_ipv4_cidr_block" {
279264
}
280265
{% endif %}
281266
{% if beta_cluster %}
282-
283267
variable "istio" {
284268
description = "(Beta) Enable Istio addon"
285269
default = false
@@ -304,6 +288,18 @@ variable "database_encryption" {
304288
key_name = ""
305289
}]
306290
}
291+
292+
variable "enable_binary_authorization" {
293+
description = "Enable BinAuthZ Admission controller"
294+
default = false
295+
}
296+
297+
variable "pod_security_policy_config" {
298+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
299+
default = [{
300+
"enabled" = false
301+
}]
302+
}
307303
{% endif %}
308304

309305
variable "basic_auth_username" {

‎cluster_zonal.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45+
4546
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4647

4748
master_auth {

‎modules/beta-private-cluster/cluster_zonal.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ resource "google_container_cluster" "zonal_primary" {
4444

4545
enable_binary_authorization = "${var.enable_binary_authorization}"
4646
pod_security_policy_config = "${var.pod_security_policy_config}"
47+
4748
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4849

4950
master_auth {

‎modules/beta-private-cluster/main.tf‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,11 @@ locals {
133133
zonal = "${element(concat(google_container_cluster.zonal_primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
134134
}
135135

136+
cluster_type_output_pod_security_policy_enabled = {
137+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
138+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
139+
}
140+
136141
# /BETA features
137142

138143
cluster_type_output_node_pools_names = {
@@ -143,10 +148,6 @@ locals {
143148
regional = "${concat(google_container_node_pool.pools.*.version, list(""))}"
144149
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
145150
}
146-
cluster_type_output_pod_security_policy_enabled = {
147-
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
148-
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
149-
}
150151
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
151152
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
152153
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -170,8 +171,9 @@ locals {
170171
# BETA features
171172
cluster_istio_enabled = "${local.cluster_type_output_istio_enabled[local.cluster_type] ? false : true}"
172173
cluster_cloudrun_enabled = "${local.cluster_type_output_cloudrun_enabled[local.cluster_type] ? false : true}"
173-
# /BETA features
174174
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
175+
176+
# /BETA features
175177
}
176178

177179
/******************************************

‎modules/beta-private-cluster/outputs.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,6 @@ output "service_account" {
112112
description = "The service account to default running nodes as if not overridden in `node_pools`."
113113
value = "${local.service_account}"
114114
}
115-
116115
output "istio_enabled" {
117116
description = "Whether Istio is enabled"
118117
value = "${local.cluster_istio_enabled}"

‎modules/beta-private-cluster/variables.tf‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -86,19 +86,6 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89-
variable "enable_binary_authorization" {
90-
description = "Enable BinAuthZ Admission controller"
91-
default = false
92-
}
93-
94-
variable "pod_security_policy_config" {
95-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
96-
97-
default = [{
98-
"enabled" = false
99-
}]
100-
}
101-
10289
variable "horizontal_pod_autoscaling" {
10390
description = "Enable horizontal pod autoscaling addon"
10491
default = true
@@ -302,6 +289,19 @@ variable "database_encryption" {
302289
}]
303290
}
304291

292+
variable "enable_binary_authorization" {
293+
description = "Enable BinAuthZ Admission controller"
294+
default = false
295+
}
296+
297+
variable "pod_security_policy_config" {
298+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
299+
300+
default = [{
301+
"enabled" = false
302+
}]
303+
}
304+
305305
variable "basic_auth_username" {
306306
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
307307
default = ""

0 commit comments

Comments
 (0)