Skip to content

Commit 9af9330

Browse files
adrientheboadrienthebo
authored
Merge branch 'master' into implicit_depends_on
2 parents 55ba609 + de467d9 commit 9af9330

File tree

38 files changed

+471
-52
lines changed

38 files changed

+471
-52
lines changed

‎Makefile‎

Lines changed: 37 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -74,12 +74,7 @@ check_headers:
7474
# Integration tests
7575
.PHONY: test_integration
7676
test_integration:
77-
bundle install
78-
bundle exec kitchen create
79-
bundle exec kitchen converge
80-
bundle exec kitchen converge
81-
bundle exec kitchen verify
82-
bundle exec kitchen destroy
77+
test/ci_integration.sh
8378

8479
.PHONY: generate_docs
8580
generate_docs:
@@ -112,15 +107,25 @@ docker_push_kitchen_terraform:
112107
.PHONY: docker_run
113108
docker_run:
114109
docker run --rm -it \
110+
-e COMPUTE_ENGINE_SERVICE_ACCOUNT \
111+
-e PROJECT_ID \
112+
-e REGION \
113+
-e ZONES \
114+
-e SERVICE_ACCOUNT_JSON \
115115
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
116116
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
117117
-v $(CURDIR):/cft/workdir \
118118
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
119-
/bin/bash
119+
/bin/bash -c "source test/ci_integration.sh && setup_environment && exec /bin/bash"
120120

121121
.PHONY: docker_create
122122
docker_create: docker_build_kitchen_terraform
123123
docker run --rm -it \
124+
-e COMPUTE_ENGINE_SERVICE_ACCOUNT \
125+
-e PROJECT_ID \
126+
-e REGION \
127+
-e ZONES \
128+
-e SERVICE_ACCOUNT_JSON \
124129
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
125130
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
126131
-v $(CURDIR):/cft/workdir \
@@ -130,6 +135,11 @@ docker_create: docker_build_kitchen_terraform
130135
.PHONY: docker_converge
131136
docker_converge:
132137
docker run --rm -it \
138+
-e COMPUTE_ENGINE_SERVICE_ACCOUNT \
139+
-e PROJECT_ID \
140+
-e REGION \
141+
-e ZONES \
142+
-e SERVICE_ACCOUNT_JSON \
133143
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
134144
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
135145
-v $(CURDIR):/cft/workdir \
@@ -139,6 +149,11 @@ docker_converge:
139149
.PHONY: docker_verify
140150
docker_verify:
141151
docker run --rm -it \
152+
-e COMPUTE_ENGINE_SERVICE_ACCOUNT \
153+
-e PROJECT_ID \
154+
-e REGION \
155+
-e ZONES \
156+
-e SERVICE_ACCOUNT_JSON \
142157
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
143158
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
144159
-v $(CURDIR):/cft/workdir \
@@ -148,12 +163,25 @@ docker_verify:
148163
.PHONY: docker_destroy
149164
docker_destroy:
150165
docker run --rm -it \
166+
-e COMPUTE_ENGINE_SERVICE_ACCOUNT \
167+
-e PROJECT_ID \
168+
-e REGION \
169+
-e ZONES \
170+
-e SERVICE_ACCOUNT_JSON \
151171
-e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE=${CREDENTIALS_PATH} \
152172
-e GOOGLE_APPLICATION_CREDENTIALS=${CREDENTIALS_PATH} \
153173
-v $(CURDIR):/cft/workdir \
154174
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
155175
/bin/bash -c "kitchen destroy"
156176

157177
.PHONY: test_integration_docker
158-
test_integration_docker: docker_create docker_converge docker_verify docker_destroy
159-
@echo "Running test-kitchen tests in docker"
178+
test_integration_docker:
179+
docker run --rm -it \
180+
-e COMPUTE_ENGINE_SERVICE_ACCOUNT \
181+
-e PROJECT_ID \
182+
-e REGION \
183+
-e ZONES \
184+
-e SERVICE_ACCOUNT_JSON \
185+
-v $(CURDIR):/cft/workdir \
186+
${DOCKER_IMAGE_KITCHEN_TERRAFORM}:${DOCKER_TAG_KITCHEN_TERRAFORM} \
187+
/bin/bash -c "test/ci_integration.sh"

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ Then perform the following commands on the root folder:
125125
| region | The region to host the cluster in (required) | string | - | yes |
126126
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | string | `true` | no |
127127
| remove_default_node_pool | Remove default node pool while setting up the cluster | string | `false` | no |
128-
| service_account | The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account | string | `` | no |
128+
| service_account | The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account. May also specify `create` to automatically create a cluster-specific service account | string | `` | no |
129129
| stub_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server | map | `<map>` | no |
130130
| subnetwork | The subnetwork to host the cluster in (required) | string | - | yes |
131131
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | list | `<list>` | no |
@@ -179,6 +179,7 @@ following project roles:
179179
- roles/compute.viewer
180180
- roles/container.clusterAdmin
181181
- roles/container.developer
182+
- roles/iam.serviceAccountAdmin
182183
- roles/iam.serviceAccountUser
183184

184185
### Enable APIs

‎autogen/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Terraform Kubernetes Engine Module
22

3-
This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, IP MASQ, Network Policy, etc. {% if private_cluster %}This particular submodule creates a [private cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters){% endif %}
3+
This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, IP MASQ, Network Policy, etc.{% if private_cluster %} This particular submodule creates a [private cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters){% endif %}
44

55
The resources/services/activations/deletions that this module will create/trigger are:
66
- Create a GKE cluster with the provided addons
@@ -189,6 +189,7 @@ following project roles:
189189
- roles/compute.viewer
190190
- roles/container.clusterAdmin
191191
- roles/container.developer
192+
- roles/iam.serviceAccountAdmin
192193
- roles/iam.serviceAccountUser
193194

194195
### Enable APIs

‎autogen/cluster_regional.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ resource "google_container_cluster" "primary" {
8181
name = "default-pool"
8282

8383
node_config {
84-
service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"
84+
service_account = "${lookup(var.node_pools[0], "service_account", local.service_account)}"
8585
}
8686
}
8787
{% if private_cluster %}
@@ -127,7 +127,7 @@ resource "google_container_node_pool" "pools" {
127127

128128
disk_size_gb = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"
129129
disk_type = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"
130-
service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"
130+
service_account = "${lookup(var.node_pools[count.index], "service_account", local.service_account)}"
131131
preemptible = "${lookup(var.node_pools[count.index], "preemptible", false)}"
132132

133133
oauth_scopes = [

‎autogen/cluster_zonal.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ resource "google_container_cluster" "zonal_primary" {
8181
name = "default-pool"
8282

8383
node_config {
84-
service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"
84+
service_account = "${lookup(var.node_pools[0], "service_account", local.service_account)}"
8585
}
8686
}
8787
{% if private_cluster %}
@@ -127,7 +127,7 @@ resource "google_container_node_pool" "zonal_pools" {
127127

128128
disk_size_gb = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"
129129
disk_type = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"
130-
service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"
130+
service_account = "${lookup(var.node_pools[count.index], "service_account", local.service_account)}"
131131
preemptible = "${lookup(var.node_pools[count.index], "preemptible", false)}"
132132

133133
oauth_scopes = [

‎autogen/sa.tf‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
{{ autogeneration_note }}
18+
19+
locals {
20+
service_account_list = "${compact(concat(google_service_account.cluster_service_account.*.email, list("dummy")))}"
21+
service_account = "${var.service_account == "create" ? element(local.service_account_list, 0) : var.service_account}"
22+
}
23+
24+
resource "google_service_account" "cluster_service_account" {
25+
count = "${var.service_account == "create" ? 1 : 0}"
26+
project = "${var.project_id}"
27+
account_id = "tf-gke-${substr(var.name, 0, min(20, length(var.name)))}"
28+
display_name = "Terraform-managed service account for cluster ${var.name}"
29+
}
30+
31+
resource "google_project_iam_member" "cluster_service_account-log_writer" {
32+
count = "${var.service_account == "create" ? 1 : 0}"
33+
project = "${google_service_account.cluster_service_account.project}"
34+
role = "roles/logging.logWriter"
35+
member = "serviceAccount:${google_service_account.cluster_service_account.email}"
36+
}
37+
38+
resource "google_project_iam_member" "cluster_service_account-metric_writer" {
39+
count = "${var.service_account == "create" ? 1 : 0}"
40+
project = "${google_project_iam_member.cluster_service_account-log_writer.project}"
41+
role = "roles/monitoring.metricWriter"
42+
member = "serviceAccount:${google_service_account.cluster_service_account.email}"
43+
}
44+
45+
resource "google_project_iam_member" "cluster_service_account-monitoring_viewer" {
46+
count = "${var.service_account == "create" ? 1 : 0}"
47+
project = "${google_project_iam_member.cluster_service_account-metric_writer.project}"
48+
role = "roles/monitoring.viewer"
49+
member = "serviceAccount:${google_service_account.cluster_service_account.email}"
50+
}

‎autogen/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ variable "monitoring_service" {
208208
}
209209

210210
variable "service_account" {
211-
description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account"
211+
description = "The service account to default running nodes as if not overridden in `node_pools`. Defaults to the compute engine default service account. May also specify `create` to automatically create a cluster-specific service account"
212212
default = ""
213213
}
214214
{% if private_cluster %}

‎cluster_regional.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ resource "google_container_cluster" "primary" {
8181
name = "default-pool"
8282

8383
node_config {
84-
service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"
84+
service_account = "${lookup(var.node_pools[0], "service_account", local.service_account)}"
8585
}
8686
}
8787

@@ -121,7 +121,7 @@ resource "google_container_node_pool" "pools" {
121121

122122
disk_size_gb = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"
123123
disk_type = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"
124-
service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"
124+
service_account = "${lookup(var.node_pools[count.index], "service_account", local.service_account)}"
125125
preemptible = "${lookup(var.node_pools[count.index], "preemptible", false)}"
126126

127127
oauth_scopes = [

‎cluster_zonal.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ resource "google_container_cluster" "zonal_primary" {
8181
name = "default-pool"
8282

8383
node_config {
84-
service_account = "${lookup(var.node_pools[0], "service_account", var.service_account)}"
84+
service_account = "${lookup(var.node_pools[0], "service_account", local.service_account)}"
8585
}
8686
}
8787

@@ -108,7 +108,7 @@ resource "google_container_node_pool" "zonal_pools" {
108108

109109
management {
110110
auto_repair = "${lookup(var.node_pools[count.index], "auto_repair", true)}"
111-
auto_upgrade = "${lookup(var.node_pools[count.index], "auto_upgrade", false)}"
111+
auto_upgrade = "${lookup(var.node_pools[count.index], "auto_upgrade", true)}"
112112
}
113113

114114
node_config {
@@ -121,7 +121,7 @@ resource "google_container_node_pool" "zonal_pools" {
121121

122122
disk_size_gb = "${lookup(var.node_pools[count.index], "disk_size_gb", 100)}"
123123
disk_type = "${lookup(var.node_pools[count.index], "disk_type", "pd-standard")}"
124-
service_account = "${lookup(var.node_pools[count.index], "service_account", var.service_account)}"
124+
service_account = "${lookup(var.node_pools[count.index], "service_account", local.service_account)}"
125125
preemptible = "${lookup(var.node_pools[count.index], "preemptible", false)}"
126126

127127
oauth_scopes = [

‎examples/deploy_service/main.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ locals {
2121
provider "google" {
2222
credentials = "${file(var.credentials_path)}"
2323
region = "${var.region}"
24+
version = "~> 1.20"
2425
}
2526

2627
provider "kubernetes" {
@@ -40,6 +41,8 @@ module "gke" {
4041
network = "${var.network}"
4142
subnetwork = "${var.subnetwork}"
4243

44+
kubernetes_version = "1.11.7-gke.12"
45+
4346
ip_range_pods = "${var.ip_range_pods}"
4447
ip_range_services = "${var.ip_range_services}"
4548
service_account = "${var.compute_engine_service_account}"

0 commit comments

Comments
 (0)