Skip to content

Commit c090d5b

Browse files
lindelinde
authored
feat: Add config sync module (#493)
BREAKING CHANGE: The ACM module has been refactored and resources will be recreated. This will show up in Terraform plans but is a safe no-op for Kubernetes.
1 parent 54eca6b commit c090d5b

File tree

16 files changed

+514
-85
lines changed

16 files changed

+514
-85
lines changed

‎modules/acm/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
# This fill will be always downloaded by terraform local-exec command from gc bucket
22
config-management-operator.yaml
33
/terraform.tfvars
4+
/apply.out
5+
/local.tfvars

‎modules/acm/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ By default, this module will attempt to download the ACM operator from Google di
5353
| operator\_path | Path to the operator yaml config. If unset, will download from GCS releases. | string | `"null"` | no |
5454
| policy\_dir | Subfolder containing configs in ACM Git repo | string | n/a | yes |
5555
| project\_id | The project in which the resource belongs. | string | n/a | yes |
56+
| secret\_type | git authentication secret type, is passed through to ConfigManagement spec.git.secretType. Overriden to value 'ssh' if `create_ssh_key` is true | string | `"ssh"` | no |
57+
| skip\_gcloud\_download | Whether to skip downloading gcloud (assumes gcloud and kubectl already available outside the module) | bool | `"false"` | no |
5658
| ssh\_auth\_key | Key for Git authentication. Overrides 'create_ssh_key' variable. Can be set using 'file(path/to/file)'-function. | string | `"null"` | no |
5759
| sync\_branch | ACM repo Git branch | string | `"master"` | no |
5860
| sync\_repo | ACM Git repo address | string | n/a | yes |
@@ -61,6 +63,6 @@ By default, this module will attempt to download the ACM operator from Google di
6163

6264
| Name | Description |
6365
|------|-------------|
64-
| git\_creds\_public | Public key of SSH keypair to allow the Anthos Operator to authenticate to your Git repository. |
66+
| git\_creds\_public | Public key of SSH keypair to allow the Anthos Config Management Operator to authenticate to your Git repository. |
6567

6668
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/acm/main.tf‎

Lines changed: 21 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -14,87 +14,27 @@
1414
* limitations under the License.
1515
*/
1616

17-
locals {
18-
cluster_endpoint = "https://${var.cluster_endpoint}"
19-
token = data.google_client_config.default.access_token
20-
cluster_ca_certificate = data.google_container_cluster.primary.master_auth.0.cluster_ca_certificate
21-
private_key = var.create_ssh_key && var.ssh_auth_key == null ? tls_private_key.git_creds[0].private_key_pem : var.ssh_auth_key
22-
download_operator = var.operator_path == null ? true : false
23-
operator_path = local.download_operator ? "${path.module}/config-management-operator.yaml" : var.operator_path
24-
}
25-
26-
data "google_container_cluster" "primary" {
27-
name = var.cluster_name
28-
project = var.project_id
29-
location = var.location
30-
}
31-
32-
data "google_client_config" "default" {
33-
}
34-
35-
resource "tls_private_key" "git_creds" {
36-
count = var.create_ssh_key ? 1 : 0
37-
algorithm = "RSA"
38-
rsa_bits = 4096
39-
}
40-
41-
module "acm_operator_config" {
42-
source = "terraform-google-modules/gcloud/google"
43-
version = "~> 0.5"
44-
enabled = local.download_operator
45-
46-
create_cmd_entrypoint = "gsutil"
47-
create_cmd_body = "cp gs://config-management-release/released/latest/config-management-operator.yaml ${path.module}/config-management-operator.yaml"
48-
destroy_cmd_entrypoint = "rm"
49-
destroy_cmd_body = "-f ${path.module}/config-management-operator.yaml"
50-
}
51-
5217
module "acm_operator" {
53-
source = "terraform-google-modules/gcloud/google"
54-
version = "~> 0.5"
55-
module_depends_on = [module.acm_operator_config.wait, data.google_client_config.default.project, data.google_container_cluster.primary.name]
56-
additional_components = ["kubectl"]
57-
58-
create_cmd_entrypoint = "${path.module}/scripts/kubectl_wrapper.sh"
59-
create_cmd_body = "${local.cluster_endpoint} ${local.token} ${local.cluster_ca_certificate} kubectl apply -f ${local.operator_path}"
60-
destroy_cmd_entrypoint = "${path.module}/scripts/kubectl_wrapper.sh"
61-
destroy_cmd_body = "${local.cluster_endpoint} ${local.token} ${local.cluster_ca_certificate} kubectl delete -f ${local.operator_path}"
62-
}
63-
64-
module "git_creds_secret" {
65-
source = "terraform-google-modules/gcloud/google"
66-
version = "~> 0.5"
67-
module_depends_on = [module.acm_operator.wait]
68-
additional_components = ["kubectl"]
69-
70-
create_cmd_entrypoint = "${path.module}/scripts/kubectl_wrapper.sh"
71-
create_cmd_body = "${local.cluster_endpoint} ${local.token} ${local.cluster_ca_certificate} kubectl create secret generic git-creds -n=config-management-system --from-literal=ssh='${local.private_key}'"
72-
destroy_cmd_entrypoint = "${path.module}/scripts/kubectl_wrapper.sh"
73-
destroy_cmd_body = "${local.cluster_endpoint} ${local.token} ${local.cluster_ca_certificate} kubectl delete secret git-creds -n=config-management-system"
74-
}
75-
76-
data "template_file" "acm_config" {
77-
template = file("${path.module}/templates/acm-config.yml.tpl")
78-
79-
vars = {
80-
cluster_name = var.cluster_name
81-
sync_repo = var.sync_repo
82-
sync_branch = var.sync_branch
83-
policy_dir = var.policy_dir
84-
secret_type = var.create_ssh_key ? "ssh" : "none"
85-
enable_policy_controller = var.enable_policy_controller ? "true" : "false"
86-
install_template_library = var.install_template_library ? "true" : "false"
87-
}
88-
}
89-
90-
module "acm_config" {
91-
source = "terraform-google-modules/gcloud/google"
92-
version = "~> 0.5"
93-
module_depends_on = [module.acm_operator.wait, module.git_creds_secret.wait]
94-
additional_components = ["kubectl"]
9518

96-
create_cmd_entrypoint = "echo"
97-
create_cmd_body = "'${data.template_file.acm_config.rendered}' | ${path.module}/scripts/kubectl_wrapper.sh ${local.cluster_endpoint} ${local.token} ${local.cluster_ca_certificate} kubectl apply -f -"
98-
destroy_cmd_entrypoint = "echo"
99-
destroy_cmd_body = "'${data.template_file.acm_config.rendered}' | ${path.module}/scripts/kubectl_wrapper.sh ${local.cluster_endpoint} ${local.token} ${local.cluster_ca_certificate} kubectl delete -f -"
19+
source = "../k8s-operator-crd-support"
20+
21+
cluster_name = var.cluster_name
22+
project_id = var.project_id
23+
location = var.location
24+
operator_path = var.operator_path
25+
sync_repo = var.sync_repo
26+
sync_branch = var.sync_branch
27+
policy_dir = var.policy_dir
28+
cluster_endpoint = var.cluster_endpoint
29+
create_ssh_key = var.create_ssh_key
30+
secret_type = var.secret_type
31+
ssh_auth_key = var.ssh_auth_key
32+
enable_policy_controller = var.enable_policy_controller
33+
install_template_library = var.install_template_library
34+
skip_gcloud_download = var.skip_gcloud_download
35+
36+
operator_latest_manifest_url = "gs://config-management-release/released/latest/config-management-operator.yaml"
37+
operator_cr_template_path = "${path.module}/templates/acm-config.yml.tpl"
38+
operator_credential_namespace = "config-management-system"
39+
operator_credential_name = "git-creds"
10040
}

‎modules/acm/outputs.tf‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
*/
1616

1717
output "git_creds_public" {
18-
description = "Public key of SSH keypair to allow the Anthos Operator to authenticate to your Git repository."
19-
value = var.create_ssh_key ? tls_private_key.git_creds.*.public_key_openssh : null
18+
description = "Public key of SSH keypair to allow the Anthos Config Management Operator to authenticate to your Git repository."
19+
value = module.acm_operator.git_creds_public
2020
}
21-

‎modules/acm/variables.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,12 @@ variable "create_ssh_key" {
6262
default = true
6363
}
6464

65+
variable "secret_type" {
66+
description = "git authentication secret type, is passed through to ConfigManagement spec.git.secretType. Overriden to value 'ssh' if `create_ssh_key` is true"
67+
type = string
68+
default = "ssh"
69+
}
70+
6571
variable "ssh_auth_key" {
6672
description = "Key for Git authentication. Overrides 'create_ssh_key' variable. Can be set using 'file(path/to/file)'-function."
6773
type = string
@@ -79,3 +85,9 @@ variable "install_template_library" {
7985
type = bool
8086
default = true
8187
}
88+
89+
variable "skip_gcloud_download" {
90+
description = "Whether to skip downloading gcloud (assumes gcloud and kubectl already available outside the module)"
91+
type = bool
92+
default = false
93+
}

‎modules/config-sync/.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# This fill will be always downloaded by terraform local-exec command from gc bucket
2+
config-management-operator.yaml
3+
/terraform.tfvars
4+
/apply.out
5+
/local.tfvars

‎modules/config-sync/README.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Terraform Kubernetes Engine Config Sync Submodule
2+
3+
This module installs [Config Sync](https://cloud.google.com/kubernetes-engine/docs/add-on/config-sync) in a Kubernetes cluster.
4+
5+
Specifically, this module automates the following steps for [installing Config
6+
Sync](https://cloud.google.com/kubernetes-engine/docs/add-on/config-sync/how-to/installing):
7+
1. Installing the Config Sync Operator manifest onto your cluster.
8+
2. Using an existing or generating a new SSH key for accessing Git and providing it to the Operator
9+
3. Configuring the Operator to connect to your git repository
10+
11+
## Usage
12+
13+
The following is an example minimal usage. Please see the
14+
[variables.tf](variables.tf) file for more details and expected values and
15+
types.
16+
17+
```tf
18+
module "config_sync" {
19+
source = "terraform-google-modules/kubernetes-engine/google//modules/config-sync"
20+
21+
project_id = "my-project-id"
22+
cluster_name = "my-cluster-name"
23+
location = module.gke.location
24+
cluster_endpoint = module.gke.endpoint
25+
26+
sync_repo = "[email protected]:GoogleCloudPlatform/csp-config-management.git"
27+
sync_branch = "1.0.0"
28+
policy_dir = "foo-corp"
29+
}
30+
```
31+
32+
To deploy this config:
33+
1. Run `terraform apply`
34+
2. Inspect the `git_creds_public` [output](#outputs) to retrieve the public key
35+
used for accessing Git. Whitelist this key for access to your Git
36+
repo. Instructions for some popular Git hosting providers are included for
37+
convenience:
38+
39+
* [Cloud Souce Repositories](https://cloud.google.com/source-repositories/docs/authentication#ssh)
40+
* [Bitbucket](https://confluence.atlassian.com/bitbucket/set-up-an-ssh-key-728138079.html)
41+
* [GitHub](https://help.github.com/articles/adding-a-new-ssh-key-to-your-github-account/)
42+
* [Gitlab](https://docs.gitlab.com/ee/ssh/)
43+
44+
45+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
46+
## Inputs
47+
48+
| Name | Description | Type | Default | Required |
49+
|------|-------------|:----:|:-----:|:-----:|
50+
| cluster\_endpoint | Kubernetes cluster endpoint. | string | n/a | yes |
51+
| cluster\_name | The unique name to identify the cluster in ACM. | string | n/a | yes |
52+
| create\_ssh\_key | Controls whether a key will be generated for Git authentication | bool | `"true"` | no |
53+
| location | The location (zone or region) this cluster has been created in. | string | n/a | yes |
54+
| operator\_path | Path to the operator yaml config. If unset, will download from GCS releases. | string | `"null"` | no |
55+
| policy\_dir | Subfolder containing configs in ACM Git repo | string | n/a | yes |
56+
| project\_id | The project in which the resource belongs. | string | n/a | yes |
57+
| secret\_type | credential secret type, passed through to ConfigManagement spec.git.secretType. Overriden to value 'ssh' if `create_ssh_key` is true | string | n/a | yes |
58+
| skip\_gcloud\_download | Whether to skip downloading gcloud (assumes gcloud and kubectl already available outside the module) | bool | `"false"` | no |
59+
| ssh\_auth\_key | Key for Git authentication. Overrides 'create_ssh_key' variable. Can be set using 'file(path/to/file)'-function. | string | `"null"` | no |
60+
| sync\_branch | ACM repo Git branch | string | `"master"` | no |
61+
| sync\_repo | ACM Git repo address | string | n/a | yes |
62+
63+
## Outputs
64+
65+
| Name | Description |
66+
|------|-------------|
67+
| git\_creds\_public | Public key of SSH keypair to allow the Config Sync Operator to authenticate to your Git repository. |
68+
69+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/config-sync/main.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "configsync_operator" {
18+
19+
source = "../k8s-operator-crd-support"
20+
21+
cluster_name = var.cluster_name
22+
project_id = var.project_id
23+
location = var.location
24+
operator_path = var.operator_path
25+
sync_repo = var.sync_repo
26+
sync_branch = var.sync_branch
27+
policy_dir = var.policy_dir
28+
cluster_endpoint = var.cluster_endpoint
29+
create_ssh_key = var.create_ssh_key
30+
secret_type = var.secret_type
31+
ssh_auth_key = var.ssh_auth_key
32+
skip_gcloud_download = var.skip_gcloud_download
33+
34+
operator_latest_manifest_url = "gs://config-management-release/released/latest/config-sync-operator.yaml"
35+
operator_cr_template_path = "${path.module}/templates/config-sync-config.yml.tpl"
36+
operator_credential_namespace = "config-management-system"
37+
operator_credential_name = "git-creds"
38+
}

‎modules/config-sync/outputs.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "git_creds_public" {
18+
description = "Public key of SSH keypair to allow the Config Sync Operator to authenticate to your Git repository."
19+
value = module.configsync_operator.git_creds_public
20+
}
21+

‎modules/config-sync/templates/config-sync-config.yml.tpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: configmanagement.gke.io/v1
2+
kind: ConfigManagement
3+
metadata:
4+
name: config-management
5+
spec:
6+
# clusterName is required and must be unique among all managed clusters
7+
clusterName: ${cluster_name}
8+
git:
9+
syncRepo: ${sync_repo}
10+
syncBranch: ${sync_branch}
11+
secretType: ${secret_type}
12+
policyDir: ${policy_dir}

0 commit comments

Comments
 (0)