Skip to content

Commit 923eff4

Browse files
kaarigerbharathkkb
kaariger
and
bharathkkb
authored
feat!: Add support for asm v1.8 to the asm module (#824)
* Initial changes to asm module to support installing asm ver 1.8. * Updated changes to support ASM 1.8 * -updated provider version in the safer_cluster_iap_bastion example -added readme for v14.0 release * -updated readme for v14.0 release Co-authored-by: kaariger <[email protected]> Co-authored-by: Bharath KKB <[email protected]>
1 parent b303449 commit 923eff4

File tree

8 files changed

+49
-60
lines changed

8 files changed

+49
-60
lines changed

‎docs/upgrading_to_v14.0.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Upgrading to v14.0
2+
3+
The v14.0 release of *kubernetes-engine* is a backwards incompatible
4+
release for some versions of Anthos Service Mesh (ASM).
5+
6+
### ASM default version changed to 1.8
7+
8+
[ASM submodule](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/tree/master/modules/asm) has been changed to use ASM v1.8 as default.
9+
10+
The module now uses the new ASM [installation script](https://cloud.google.com/service-mesh/docs/scripted-install/asm-onboarding) which:
11+
- Does not support installation and upgrades for ASM versions older than 1.7.3.
12+
- Supports upgrades only from versions 1.7.3+ or a 1.8 patch release.
13+
- Supports migrations from open source Istio 1.7 or 1.8 to ASM
14+
15+
Please see the script page for up to date details.

‎examples/safer_cluster_iap_bastion/provider.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
*/
1616

1717
provider "google" {
18-
version = "~> 3.50.0"
18+
version = "~> 3.52.0"
1919
}
2020

2121
provider "google-beta" {

‎modules/asm/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ To deploy this config:
3838
| Name | Description | Type | Default | Required |
3939
|------|-------------|------|---------|:--------:|
4040
| asm\_dir | Name of directory to keep ASM resource config files. | `string` | `"asm-dir"` | no |
41-
| asm\_version | ASM version to deploy. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages | `string` | `"release-1.6-asm"` | no |
41+
| asm\_version | ASM version to deploy. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages | `string` | `"1.8"` | no |
4242
| cluster\_endpoint | The GKE cluster endpoint. | `string` | n/a | yes |
4343
| cluster\_name | The unique name to identify the cluster in ASM. | `string` | n/a | yes |
4444
| gcloud\_sdk\_version | The gcloud sdk version to use. Minimum required version is 293.0.0 | `string` | `"296.0.1"` | no |

‎modules/asm/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,6 @@ module "asm_install" {
3333
service_account_key_file = var.service_account_key_file
3434

3535

36-
kubectl_create_command = "${path.module}/scripts/install_asm.sh ${var.project_id} ${var.cluster_name} ${var.location} ${var.asm_dir} ${var.asm_version} ${data.google_project.asm_project.number}"
36+
kubectl_create_command = "${path.module}/scripts/install_asm.sh ${var.project_id} ${var.cluster_name} ${var.location} ${var.asm_version}"
3737
kubectl_destroy_command = "kubectl delete ns istio-system"
3838
}

‎modules/asm/scripts/install_asm.sh‎

Lines changed: 10 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -15,59 +15,20 @@
1515

1616
set -e
1717

18-
if [ "$#" -lt 6 ]; then
18+
if [ "$#" -lt 4 ]; then
1919
>&2 echo "Not all expected arguments set."
2020
exit 1
2121
fi
2222

2323
PROJECT_ID=$1
2424
CLUSTER_NAME=$2
2525
CLUSTER_LOCATION=$3
26-
ASM_RESOURCES=$4
27-
ASM_VERSION=$5
28-
PROJECT_NUM=$6
29-
BASE_DIR="asm-base-dir"
30-
# check for needed binaries
31-
# kustomize is a requirement for installing ASM and is not available via gcloud. Safely exit if not available.
32-
if [[ -z $(command -v kustomize) ]]; then
33-
echo "kustomize is unavailable. Skipping ASM installation. Please install kustomize, add to PATH and rerun terraform apply."
34-
exit 1
35-
fi
36-
# # check docker which is optionally used for validating asm yaml using gcr.io/kustomize-functions/validate-asm:v0.1.0
37-
# if [[ $(command -v docker) ]]; then
38-
# echo "Docker is available. ASM yaml validation will be performed."
39-
# else
40-
# echo "ASM yaml validation will be skipped as Docker is unavailable"
41-
# SKIP_ASM_VALIDATION=true
42-
# fi
43-
mkdir -p "${ASM_RESOURCES}"
44-
pushd "${ASM_RESOURCES}"
45-
gcloud config set project "${PROJECT_ID}"
46-
if [[ -d ./asm-patch ]]; then
47-
echo "ASM patch directory exists. Skipping download..."
48-
else
49-
echo "Downloading ASM patch"
50-
kpt pkg get https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages.git/asm-patch@"${ASM_VERSION}" .
51-
fi
52-
gcloud beta anthos export "${CLUSTER_NAME}" --output-directory ${BASE_DIR} --project "${PROJECT_ID}" --location "${CLUSTER_LOCATION}"
53-
kpt cfg set asm-patch/ base-dir ../${BASE_DIR}
54-
kpt cfg set asm-patch/ gcloud.core.project "${PROJECT_ID}"
55-
kpt cfg set asm-patch/ gcloud.container.cluster "${CLUSTER_NAME}"
56-
kpt cfg set asm-patch/ gcloud.compute.location "${CLUSTER_LOCATION}"
57-
kpt cfg set asm-patch/ gcloud.project.environProjectNumber "${PROJECT_NUM}"
58-
kpt cfg list-setters asm-patch/
59-
pushd ${BASE_DIR}
60-
kustomize create --autodetect --namespace "${PROJECT_ID}"
61-
popd
62-
pushd asm-patch
63-
kustomize build -o ../${BASE_DIR}/all.yaml
64-
popd
65-
# # skip validate as we should investigate if we can check this without having to resort to dind
66-
# if [[ ${SKIP_ASM_VALIDATION} ]]; then
67-
# echo "Skipping ASM validation..."
68-
# else
69-
# echo "Running ASM validation..."
70-
# kpt fn source ${BASE_DIR} | kpt fn run --image gcr.io/kustomize-functions/validate-asm:v0.1.0
71-
# fi
72-
gcloud beta anthos apply ${BASE_DIR}
73-
kubectl wait --for=condition=available --timeout=600s deployment --all -n istio-system
26+
ASM_VERSION=$4
27+
MODE="install"
28+
29+
#download the correct version of the install_asm script
30+
curl https://storage.googleapis.com/csm-artifacts/asm/install_asm_"${ASM_VERSION}" > install_asm
31+
chmod u+x install_asm
32+
33+
#run the script with appropriate flags
34+
./install_asm --verbose --project_id "${PROJECT_ID}" --cluster_name "${CLUSTER_NAME}" --cluster_location "${CLUSTER_LOCATION}" --mode "${MODE}" --enable_cluster_labels --enable_cluster_roles

‎modules/asm/variables.tf‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46,14 +46,13 @@ variable "asm_dir" {
4646
default = "asm-dir"
4747
}
4848

49-
variable "asm_version" {
50-
description = "ASM version to deploy. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages"
51-
type = string
52-
default = "release-1.6-asm"
53-
}
54-
5549
variable "service_account_key_file" {
5650
description = "Path to service account key file to auth as for running `gcloud container clusters get-credentials`."
5751
default = ""
5852
}
5953

54+
variable "asm_version" {
55+
description = "ASM version to deploy. Available versions are documented in https://github.com/GoogleCloudPlatform/anthos-service-mesh-packages"
56+
type = string
57+
default = "1.8"
58+
}

‎test/setup/iam.tf‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,20 @@ locals {
3535
"roles/iap.admin",
3636
"roles/gkehub.admin",
3737
]
38-
# roles as documented https://cloud.google.com/service-mesh/docs/gke-install-new-cluster#setting_up_your_project
38+
39+
# roles as documented https://cloud.google.com/service-mesh/docs/installation-permissions
3940
int_asm_required_roles = [
4041
"roles/editor",
42+
"roles/compute.admin",
4143
"roles/container.admin",
4244
"roles/resourcemanager.projectIamAdmin",
45+
"roles/servicemanagement.admin",
46+
"roles/serviceusage.serviceUsageAdmin",
4347
"roles/iam.serviceAccountAdmin",
4448
"roles/iam.serviceAccountKeyAdmin",
49+
"roles/meshconfig.admin",
4550
"roles/gkehub.admin",
51+
"roles/privateca.admin",
4652
]
4753
}
4854

‎test/setup/main.tf‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ module "gke-project-2" {
7575
]
7676
}
7777

78-
# apis as documented https://cloud.google.com/service-mesh/docs/gke-install-new-cluster#setting_up_your_project
78+
# apis as documented https://cloud.google.com/service-mesh/docs/scripted-install/reference#setting_up_your_project
7979
module "gke-project-asm" {
8080
source = "terraform-google-modules/project-factory/google"
8181
version = "~> 9.1.0"
@@ -94,5 +94,13 @@ module "gke-project-asm" {
9494
"meshconfig.googleapis.com",
9595
"anthos.googleapis.com",
9696
"cloudresourcemanager.googleapis.com",
97+
"monitoring.googleapis.com",
98+
"stackdriver.googleapis.com",
99+
"cloudtrace.googleapis.com",
100+
"meshca.googleapis.com",
101+
"iamcredentials.googleapis.com",
102+
"gkeconnect.googleapis.com",
103+
"privateca.googleapis.com",
104+
"gkehub.googleapis.com",
97105
]
98106
}

0 commit comments

Comments
 (0)