Skip to content

Commit

Permalink
Moved sanbox_config to node_pool resouce (Fix terraform-google-mo…
Browse files Browse the repository at this point in the history
  • Loading branch information
paulpalamarchuk committed Oct 18, 2019
1 parent aa048e1 commit 6db2c5d
Show file tree
Hide file tree
Showing 25 changed files with 238 additions and 19 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
Expand Down
3 changes: 2 additions & 1 deletion autogen/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ data "google_compute_zones" "available" {
{% endif %}

project = var.project_id
region = var.region
region = local.region
}

resource "random_shuffle" "available_zones" {
Expand All @@ -38,6 +38,7 @@ resource "random_shuffle" "available_zones" {
locals {
// location
location = var.regional ? var.region : var.zones[0]
region = var.region == null ? join("-", slice(split("-", var.zones[0]), 0, 2)) : var.region
// for regional cluster - use var.zones if provided, use available otherwise, for zonal cluster use var.zones with first element extracted
node_locations = var.regional ? coalescelist(compact(var.zones), sort(random_shuffle.available_zones.result)) : slice(var.zones, 1, length(var.zones))
// kuberentes version
Expand Down
2 changes: 1 addition & 1 deletion autogen/networks.tf
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,6 @@ data "google_compute_subnetwork" "gke_subnetwork" {
{% endif %}

name = var.subnetwork
region = var.region
region = local.region
project = local.network_project_id
}
3 changes: 2 additions & 1 deletion autogen/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,8 @@ variable "regional" {

variable "region" {
type = string
description = "The region to host the cluster in (required)"
description = "The region to host the cluster in (optional if zonal cluster / required if regional)"
default = null
}

variable "zones" {
Expand Down
3 changes: 2 additions & 1 deletion main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ data "google_compute_zones" "available" {
provider = google

project = var.project_id
region = var.region
region = local.region
}

resource "random_shuffle" "available_zones" {
Expand All @@ -34,6 +34,7 @@ resource "random_shuffle" "available_zones" {
locals {
// location
location = var.regional ? var.region : var.zones[0]
region = var.region == null ? join("-", slice(split("-", var.zones[0]), 0, 2)) : var.region
// for regional cluster - use var.zones if provided, use available otherwise, for zonal cluster use var.zones with first element extracted
node_locations = var.regional ? coalescelist(compact(var.zones), sort(random_shuffle.available_zones.result)) : slice(var.zones, 1, length(var.zones))
// kuberentes version
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -188,7 +188,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | string | `""` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-private-cluster/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ data "google_compute_zones" "available" {
provider = google-beta

project = var.project_id
region = var.region
region = local.region
}

resource "random_shuffle" "available_zones" {
Expand All @@ -34,6 +34,7 @@ resource "random_shuffle" "available_zones" {
locals {
// location
location = var.regional ? var.region : var.zones[0]
region = var.region == null ? join("-", slice(split("-", var.zones[0]), 0, 2)) : var.region
// for regional cluster - use var.zones if provided, use available otherwise, for zonal cluster use var.zones with first element extracted
node_locations = var.regional ? coalescelist(compact(var.zones), sort(random_shuffle.available_zones.result)) : slice(var.zones, 1, length(var.zones))
// kuberentes version
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/networks.tf
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,6 @@ data "google_compute_subnetwork" "gke_subnetwork" {
provider = google-beta

name = var.subnetwork
region = var.region
region = local.region
project = local.network_project_id
}
3 changes: 2 additions & 1 deletion modules/beta-private-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,8 @@ variable "regional" {

variable "region" {
type = string
description = "The region to host the cluster in (required)"
description = "The region to host the cluster in (optional if zonal cluster / required if regional)"
default = null
}

variable "zones" {
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | string | `""` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-public-cluster/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ data "google_compute_zones" "available" {
provider = google-beta

project = var.project_id
region = var.region
region = local.region
}

resource "random_shuffle" "available_zones" {
Expand All @@ -34,6 +34,7 @@ resource "random_shuffle" "available_zones" {
locals {
// location
location = var.regional ? var.region : var.zones[0]
region = var.region == null ? join("-", slice(split("-", var.zones[0]), 0, 2)) : var.region
// for regional cluster - use var.zones if provided, use available otherwise, for zonal cluster use var.zones with first element extracted
node_locations = var.regional ? coalescelist(compact(var.zones), sort(random_shuffle.available_zones.result)) : slice(var.zones, 1, length(var.zones))
// kuberentes version
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster/networks.tf
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,6 @@ data "google_compute_subnetwork" "gke_subnetwork" {
provider = google-beta

name = var.subnetwork
region = var.region
region = local.region
project = local.network_project_id
}
3 changes: 2 additions & 1 deletion modules/beta-public-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,8 @@ variable "regional" {

variable "region" {
type = string
description = "The region to host the cluster in (required)"
description = "The region to host the cluster in (optional if zonal cluster / required if regional)"
default = null
}

variable "zones" {
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (required) | string | n/a | yes |
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | bool | `"false"` | no |
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create_service_account variable default value (true) will cause a cluster-specific service account to be created. | string | `""` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/private-cluster/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ data "google_compute_zones" "available" {
provider = google

project = var.project_id
region = var.region
region = local.region
}

resource "random_shuffle" "available_zones" {
Expand All @@ -34,6 +34,7 @@ resource "random_shuffle" "available_zones" {
locals {
// location
location = var.regional ? var.region : var.zones[0]
region = var.region == null ? join("-", slice(split("-", var.zones[0]), 0, 2)) : var.region
// for regional cluster - use var.zones if provided, use available otherwise, for zonal cluster use var.zones with first element extracted
node_locations = var.regional ? coalescelist(compact(var.zones), sort(random_shuffle.available_zones.result)) : slice(var.zones, 1, length(var.zones))
// kuberentes version
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster/networks.tf
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,6 @@ data "google_compute_subnetwork" "gke_subnetwork" {
provider = google

name = var.subnetwork
region = var.region
region = local.region
project = local.network_project_id
}
3 changes: 2 additions & 1 deletion modules/private-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,8 @@ variable "regional" {

variable "region" {
type = string
description = "The region to host the cluster in (required)"
description = "The region to host the cluster in (optional if zonal cluster / required if regional)"
default = null
}

variable "zones" {
Expand Down
2 changes: 1 addition & 1 deletion networks.tf
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,6 @@ data "google_compute_subnetwork" "gke_subnetwork" {
provider = google

name = var.subnetwork
region = var.region
region = local.region
project = local.network_project_id
}
40 changes: 40 additions & 0 deletions test/fixtures/sandbox_enabled/example.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
/**
* Copyright 2019 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

module "example" {
source = "../../../examples/simple_regional_beta"

project_id = var.project_id
cluster_name_suffix = "-${random_string.suffix.result}"
region = var.region
network = google_compute_network.main.name
subnetwork = google_compute_subnetwork.main.name
ip_range_pods = google_compute_subnetwork.main.secondary_ip_range[0].range_name
ip_range_services = google_compute_subnetwork.main.secondary_ip_range[1].range_name
compute_engine_service_account = var.compute_engine_service_account
istio = false
cloudrun = false
node_metadata = "UNSPECIFIED"
sandbox_enabled = true
remove_default_node_pool = true

node_pools = [
{
name = "default-node-pool"
image_type = "COS_CONTAINERD"
},
]
}
48 changes: 48 additions & 0 deletions test/fixtures/sandbox_enabled/network.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
/**
* Copyright 2019 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/

resource "random_string" "suffix" {
length = 4
special = false
upper = false
}

provider "google" {
project = var.project_id
}

resource "google_compute_network" "main" {
name = "cft-gke-test-${random_string.suffix.result}"
auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "main" {
name = "cft-gke-test-${random_string.suffix.result}"
ip_cidr_range = "10.0.0.0/17"
region = var.region
network = google_compute_network.main.self_link

secondary_ip_range {
range_name = "cft-gke-test-pods-${random_string.suffix.result}"
ip_cidr_range = "192.168.0.0/18"
}

secondary_ip_range {
range_name = "cft-gke-test-services-${random_string.suffix.result}"
ip_cidr_range = "192.168.64.0/18"
}
}

1 change: 1 addition & 0 deletions test/fixtures/sandbox_enabled/outputs.tf
1 change: 1 addition & 0 deletions test/fixtures/sandbox_enabled/variables.tf
102 changes: 102 additions & 0 deletions test/integration/sandbox_enabled/controls/gcloud.rb
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
# Copyright 2019 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

project_id = attribute('project_id')
location = attribute('location')
cluster_name = attribute('cluster_name')

control "gcloud" do
title "Google Compute Engine GKE configuration"
describe command("gcloud --project=#{project_id} container clusters --zone=#{location} describe #{cluster_name} --format=json") do
its(:exit_status) { should eq 0 }
its(:stderr) { should eq '' }

let!(:data) do
if subject.exit_status == 0
JSON.parse(subject.stdout)
else
{}
end
end

describe "cluster" do
it "is running" do
expect(data['status']).to eq 'RUNNING'
end

it "is regional" do
expect(data['location']).to match(/^.*[1-9]$/)
end

it "uses public nodes and master endpoint" do
expect(data['privateClusterConfig']).to eq nil
end

it "has the expected addon settings" do
expect(data['addonsConfig']).to eq({
"horizontalPodAutoscaling" => {},
"httpLoadBalancing" => {},
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {
"disabled" => true,
},
})
end
end

describe "node pool" do
let(:node_pools) { data['nodePools'].reject { |p| p['name'] == "default-pool" } }

it "is the expected image type" do
expect(node_pools).to include(
including(
"config" => including(
"imageType" => "COS_CONTAINERD",
),
)
)
end

it "has the expected labels" do
expect(node_pools).to include(
including(
"config" => including(
"labels" => including(
"cluster_name" => cluster_name,
"node_pool" => "default-node-pool",
"sandbox.gke.io/runtime" => "gvisor",
),
),
)
)
end

it "has the expected network tags" do
expect(node_pools).to include(
including(
"config" => including(
"tags" => match_array([
"gke-#{cluster_name}",
"gke-#{cluster_name}-default-node-pool",
]),
),
)
)
end

end
end
end
Loading

0 comments on commit 6db2c5d

Please sign in to comment.