Skip to content

Commit c22bf3a

Browse files
author
Alex Sonn
committed
feat(cgroup): Add option to set cgroup for autopilot modules
1 parent 5020f40 commit c22bf3a

File tree

8 files changed

+85
-3
lines changed

8 files changed

+85
-3
lines changed

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,7 @@ resource "google_container_cluster" "primary" {
279279
}
280280
{% if autopilot_cluster %}
281281
dynamic "node_pool_auto_config" {
282-
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
282+
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null || var.node_pools_cgroup_mode != null ? [1] : []
283283
content {
284284
network_tags {
285285
tags = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules ? concat(var.network_tags, [local.cluster_network_tag]) : length(var.network_tags) > 0 ? var.network_tags : null
@@ -291,6 +291,14 @@ resource "google_container_cluster" "primary" {
291291
insecure_kubelet_readonly_port_enabled = upper(tostring(var.insecure_kubelet_readonly_port_enabled))
292292
}
293293
}
294+
295+
dynamic "linux_node_config" {
296+
for_each = (var.node_pools_cgroup_mode != null) ? [1] : []
297+
298+
content {
299+
cgroup_mode = var.node_pools_cgroup_mode
300+
}
301+
}
294302
}
295303
}
296304
{% endif %}

‎autogen/main/variables.tf.tmpl‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -532,6 +532,26 @@ variable "identity_namespace" {
532532
default = "enabled"
533533
}
534534

535+
{% if autopilot_cluster == true %}
536+
variable "node_pools_cgroup_mode" {
537+
type = string
538+
description = "String contains cgroup node config for Autopilot node pools"
539+
540+
default = null
541+
542+
validation {
543+
condition = var.node_pools_cgroup_mode == null || contains(
544+
[
545+
"CGROUP_MODE_UNSPECIFIED",
546+
"CGROUP_MODE_V1",
547+
"CGROUP_MODE_V2"
548+
],
549+
var.node_pools_cgroup_mode
550+
)
551+
error_message = "The value for node_pools_cgroup_mode must be one of: CGROUP_MODE_UNSPECIFIED, CGROUP_MODE_V1, CGROUP_MODE_V2, or null."
552+
}
553+
}
554+
{% endif %}
535555
{% if autopilot_cluster != true %}
536556
variable "enable_mesh_certificates" {
537557
type = bool

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ Then perform the following commands on the root folder:
134134
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
135135
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
136136
| network\_tags | (Optional) - List of network tags applied to auto-provisioned node pools. | `list(string)` | `[]` | no |
137+
| node\_pools\_cgroup\_mode | String contains cgroup node config for Autopilot node pools | `string` | `null` | no |
137138
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
138139
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
139140
| notification\_filter\_event\_type | Choose what type of notifications you want to receive. If no filters are applied, you'll receive all notification types. Can be used to filter what notifications are sent. Accepted values are UPGRADE\_AVAILABLE\_EVENT, UPGRADE\_EVENT, and SECURITY\_BULLETIN\_EVENT. | `list(string)` | `[]` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ resource "google_container_cluster" "primary" {
135135
}
136136
}
137137
dynamic "node_pool_auto_config" {
138-
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
138+
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null || var.node_pools_cgroup_mode != null ? [1] : []
139139
content {
140140
network_tags {
141141
tags = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules ? concat(var.network_tags, [local.cluster_network_tag]) : length(var.network_tags) > 0 ? var.network_tags : null
@@ -147,6 +147,14 @@ resource "google_container_cluster" "primary" {
147147
insecure_kubelet_readonly_port_enabled = upper(tostring(var.insecure_kubelet_readonly_port_enabled))
148148
}
149149
}
150+
151+
dynamic "linux_node_config" {
152+
for_each = (var.node_pools_cgroup_mode != null) ? [1] : []
153+
154+
content {
155+
cgroup_mode = var.node_pools_cgroup_mode
156+
}
157+
}
150158
}
151159
}
152160

‎modules/beta-autopilot-private-cluster/variables.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,24 @@ variable "identity_namespace" {
325325
default = "enabled"
326326
}
327327

328+
variable "node_pools_cgroup_mode" {
329+
type = string
330+
description = "String contains cgroup node config for Autopilot node pools"
331+
332+
default = null
333+
334+
validation {
335+
condition = var.node_pools_cgroup_mode == null || contains(
336+
[
337+
"CGROUP_MODE_UNSPECIFIED",
338+
"CGROUP_MODE_V1",
339+
"CGROUP_MODE_V2"
340+
],
341+
var.node_pools_cgroup_mode
342+
)
343+
error_message = "The value for node_pools_cgroup_mode must be one of: CGROUP_MODE_UNSPECIFIED, CGROUP_MODE_V1, CGROUP_MODE_V2, or null."
344+
}
345+
}
328346

329347
variable "release_channel" {
330348
type = string

‎modules/beta-autopilot-public-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ Then perform the following commands on the root folder:
124124
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
125125
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
126126
| network\_tags | (Optional) - List of network tags applied to auto-provisioned node pools. | `list(string)` | `[]` | no |
127+
| node\_pools\_cgroup\_mode | String contains cgroup node config for Autopilot node pools | `string` | `null` | no |
127128
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
128129
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
129130
| notification\_filter\_event\_type | Choose what type of notifications you want to receive. If no filters are applied, you'll receive all notification types. Can be used to filter what notifications are sent. Accepted values are UPGRADE\_AVAILABLE\_EVENT, UPGRADE\_EVENT, and SECURITY\_BULLETIN\_EVENT. | `list(string)` | `[]` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ resource "google_container_cluster" "primary" {
135135
}
136136
}
137137
dynamic "node_pool_auto_config" {
138-
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
138+
for_each = length(var.network_tags) > 0 || var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules || var.insecure_kubelet_readonly_port_enabled != null || var.node_pools_cgroup_mode != null ? [1] : []
139139
content {
140140
network_tags {
141141
tags = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules || var.add_shadow_firewall_rules ? concat(var.network_tags, [local.cluster_network_tag]) : length(var.network_tags) > 0 ? var.network_tags : null
@@ -147,6 +147,14 @@ resource "google_container_cluster" "primary" {
147147
insecure_kubelet_readonly_port_enabled = upper(tostring(var.insecure_kubelet_readonly_port_enabled))
148148
}
149149
}
150+
151+
dynamic "linux_node_config" {
152+
for_each = (var.node_pools_cgroup_mode != null) ? [1] : []
153+
154+
content {
155+
cgroup_mode = var.node_pools_cgroup_mode
156+
}
157+
}
150158
}
151159
}
152160

‎modules/beta-autopilot-public-cluster/variables.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,24 @@ variable "identity_namespace" {
289289
default = "enabled"
290290
}
291291

292+
variable "node_pools_cgroup_mode" {
293+
type = string
294+
description = "String contains cgroup node config for Autopilot node pools"
295+
296+
default = null
297+
298+
validation {
299+
condition = var.node_pools_cgroup_mode == null || contains(
300+
[
301+
"CGROUP_MODE_UNSPECIFIED",
302+
"CGROUP_MODE_V1",
303+
"CGROUP_MODE_V2"
304+
],
305+
var.node_pools_cgroup_mode
306+
)
307+
error_message = "The value for node_pools_cgroup_mode must be one of: CGROUP_MODE_UNSPECIFIED, CGROUP_MODE_V1, CGROUP_MODE_V2, or null."
308+
}
309+
}
292310

293311
variable "release_channel" {
294312
type = string

0 commit comments

Comments
 (0)