Skip to content

Commit 9b20e5a

Browse files
apeabodyapeabody
authored
Merge branch 'main' into feat/2264/cgroupv2
2 parents 469b120 + 260be87 commit 9b20e5a

File tree

35 files changed

+255
-67
lines changed

35 files changed

+255
-67
lines changed

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ Then perform the following commands on the root folder:
161161
| description | The description of the cluster | `string` | `""` | no |
162162
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
163163
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
164+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
164165
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
165166
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
166167
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
@@ -180,7 +181,7 @@ Then perform the following commands on the root folder:
180181
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no |
181182
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
182183
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no |
183-
| enterprise\_config | (Optional) Enable or disable GKE enterprise. Valid values are DEFAULT and ENTERPRISE. | `string` | `null` | no |
184+
| enterprise\_config | (Optional) Enable or disable GKE enterprise. Valid values are STANDARD and ENTERPRISE. | `string` | `null` | no |
184185
| filestore\_csi\_driver | The status of the Filestore CSI driver addon, which allows the usage of filestore instance as volumes | `bool` | `false` | no |
185186
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
186187
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -545,6 +545,7 @@ resource "google_container_cluster" "primary" {
545545
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
546546
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
547547
enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
548+
disk_type = lookup(var.node_pools[0], "disk_type", null)
548549
dynamic "gcfs_config" {
549550
for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
550551
content {
@@ -675,15 +676,20 @@ resource "google_container_cluster" "primary" {
675676
}
676677
}
677678

679+
{% endif %}
678680
dynamic "control_plane_endpoints_config" {
679-
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : []
681+
for_each = var.dns_allow_external_traffic != null {% if private_cluster %}|| (var.enable_private_endpoint && var.deploy_using_private_endpoint) {% endif %}? [1] : []
680682
content {
681683
dns_endpoint_config {
682-
allow_external_traffic = var.deploy_using_private_endpoint
684+
{% if private_cluster %}
685+
# TODO: Migrate to only dns_allow_external_traffic in next breaking release
686+
allow_external_traffic = var.dns_allow_external_traffic == true || var.deploy_using_private_endpoint
687+
{% else %}
688+
allow_external_traffic = var.dns_allow_external_traffic
689+
{% endif %}
683690
}
684691
}
685692
}
686-
{% endif %}
687693

688694
{% if autopilot_cluster != true %}
689695
remove_default_node_pool = var.remove_default_node_pool

‎autogen/main/variables.tf.tmpl‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1056,7 +1056,17 @@ variable "monitoring_metric_writer_role" {
10561056
}
10571057

10581058
variable "enterprise_config" {
1059-
description = "(Optional) Enable or disable GKE enterprise. Valid values are DEFAULT and ENTERPRISE."
1059+
description = "(Optional) Enable or disable GKE enterprise. Valid values are STANDARD and ENTERPRISE."
10601060
type = string
10611061
default = null
1062+
validation {
1063+
condition = var.enterprise_config == null ? true : contains(["STANDARD", "ENTERPRISE"], var.enterprise_config)
1064+
error_message = "The enterprise_config variable must be either null, STANDARD, or ENTERPRISE."
1065+
}
1066+
}
1067+
1068+
variable "dns_allow_external_traffic" {
1069+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
1070+
type = bool
1071+
default = null
10621072
}

‎cluster.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -412,6 +412,7 @@ resource "google_container_cluster" "primary" {
412412
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
413413
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
414414
enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
415+
disk_type = lookup(var.node_pools[0], "disk_type", null)
415416
dynamic "gcfs_config" {
416417
for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
417418
content {
@@ -508,6 +509,14 @@ resource "google_container_cluster" "primary" {
508509
}
509510
}
510511

512+
dynamic "control_plane_endpoints_config" {
513+
for_each = var.dns_allow_external_traffic != null ? [1] : []
514+
content {
515+
dns_endpoint_config {
516+
allow_external_traffic = var.dns_allow_external_traffic
517+
}
518+
}
519+
}
511520

512521
remove_default_node_pool = var.remove_default_node_pool
513522

‎examples/confidential_safer_cluster/main.tf‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,21 @@ data "google_container_engine_versions" "current" {
4545
location = var.region
4646
}
4747

48+
data "google_project" "main" {
49+
project_id = var.project_id
50+
}
51+
4852
resource "random_shuffle" "version" {
4953
input = data.google_container_engine_versions.current.valid_master_versions
5054
result_count = 1
5155
}
5256

57+
resource "google_kms_crypto_key_iam_member" "main" {
58+
crypto_key_id = module.kms.keys[local.key_name]
59+
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
60+
member = "serviceAccount:service-${data.google_project.main.number}@compute-system.iam.gserviceaccount.com"
61+
}
62+
5363
module "gke" {
5464
source = "terraform-google-modules/kubernetes-engine/google//modules/safer-cluster"
5565
version = "~> 36.0"
@@ -87,9 +97,11 @@ module "gke" {
8797

8898
node_pools = [
8999
{
90-
name = "default"
91-
machine_type = "n2d-standard-2"
92-
enable_secure_boot = true
100+
name = "default"
101+
machine_type = "n2d-standard-2"
102+
disk_type = "hyperdisk-balanced"
103+
boot_disk_kms_key = module.kms.keys[local.key_name]
104+
enable_confidential_storage = true
93105
},
94106
]
95107

‎examples/node_pool/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ module "gke" {
4545
deletion_protection = false
4646
service_account = "default"
4747
logging_variant = "MAX_THROUGHPUT"
48+
dns_allow_external_traffic = true
4849

4950
node_pools = [
5051
{

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ Then perform the following commands on the root folder:
8787
| deploy\_using\_private\_endpoint | A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | `bool` | `false` | no |
8888
| description | The description of the cluster | `string` | `""` | no |
8989
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
90+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
9091
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
9192
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
9293
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
@@ -101,7 +102,7 @@ Then perform the following commands on the root folder:
101102
| enable\_secret\_manager\_addon | Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
102103
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
103104
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `true` | no |
104-
| enterprise\_config | (Optional) Enable or disable GKE enterprise. Valid values are DEFAULT and ENTERPRISE. | `string` | `null` | no |
105+
| enterprise\_config | (Optional) Enable or disable GKE enterprise. Valid values are STANDARD and ENTERPRISE. | `string` | `null` | no |
105106
| filestore\_csi\_driver | The status of the Filestore CSI driver addon, which allows the usage of filestore instance as volumes | `bool` | `false` | no |
106107
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
107108
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -343,10 +343,11 @@ resource "google_container_cluster" "primary" {
343343
}
344344

345345
dynamic "control_plane_endpoints_config" {
346-
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : []
346+
for_each = var.dns_allow_external_traffic != null || (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []
347347
content {
348348
dns_endpoint_config {
349-
allow_external_traffic = var.deploy_using_private_endpoint
349+
# TODO: Migrate to only dns_allow_external_traffic in next breaking release
350+
allow_external_traffic = var.dns_allow_external_traffic == true || var.deploy_using_private_endpoint
350351
}
351352
}
352353
}

‎modules/beta-autopilot-private-cluster/variables.tf‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -624,7 +624,17 @@ variable "monitoring_metric_writer_role" {
624624
}
625625

626626
variable "enterprise_config" {
627-
description = "(Optional) Enable or disable GKE enterprise. Valid values are DEFAULT and ENTERPRISE."
627+
description = "(Optional) Enable or disable GKE enterprise. Valid values are STANDARD and ENTERPRISE."
628628
type = string
629629
default = null
630+
validation {
631+
condition = var.enterprise_config == null ? true : contains(["STANDARD", "ENTERPRISE"], var.enterprise_config)
632+
error_message = "The enterprise_config variable must be either null, STANDARD, or ENTERPRISE."
633+
}
634+
}
635+
636+
variable "dns_allow_external_traffic" {
637+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
638+
type = bool
639+
default = null
630640
}

‎modules/beta-autopilot-public-cluster/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ Then perform the following commands on the root folder:
8181
| deletion\_protection | Whether or not to allow Terraform to destroy the cluster. | `bool` | `true` | no |
8282
| description | The description of the cluster | `string` | `""` | no |
8383
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
84+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
8485
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
8586
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
8687
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
@@ -93,7 +94,7 @@ Then perform the following commands on the root folder:
9394
| enable\_secret\_manager\_addon | Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
9495
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
9596
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `true` | no |
96-
| enterprise\_config | (Optional) Enable or disable GKE enterprise. Valid values are DEFAULT and ENTERPRISE. | `string` | `null` | no |
97+
| enterprise\_config | (Optional) Enable or disable GKE enterprise. Valid values are STANDARD and ENTERPRISE. | `string` | `null` | no |
9798
| filestore\_csi\_driver | The status of the Filestore CSI driver addon, which allows the usage of filestore instance as volumes | `bool` | `false` | no |
9899
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
99100
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |

0 commit comments

Comments
 (0)