Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Identity Service config to cluster #1142

Merged
merged 3 commits into from
Feb 9, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions autogen/main/cluster.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "identity_service_config" {
for_each = var.enable_identity_service ? [var.enable_identity_service] : []
content {
enabled = identity_service_config.value
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
{% endif %}
dynamic "master_authorized_networks_config" {
Expand Down
1 change: 1 addition & 0 deletions autogen/main/main.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,7 @@ locals {
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config.0.enabled : false
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling.0.enabled : false
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config.0.enabled : false

# /BETA features
{% endif %}
Expand Down
5 changes: 5 additions & 0 deletions autogen/main/outputs.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,11 @@ output "vertical_pod_autoscaling_enabled" {
value = local.cluster_vertical_pod_autoscaling_enabled
}

output "identity_service_enabled" {
description = "Whether Identity Service is enabled"
value = local.cluster_pod_security_policy_enabled
}

output "tpu_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the TPUs"
value = var.enable_tpu ? google_container_cluster.primary.tpu_ipv4_cidr_block : null
Expand Down
6 changes: 6 additions & 0 deletions autogen/main/variables.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -527,6 +527,12 @@ variable "enable_intranode_visibility" {
description = "Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network"
default = false
}

variable "enable_identity_service" {
type = bool
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
default = false
}
{% endif %}

variable "authenticator_security_group" {
Expand Down
2 changes: 1 addition & 1 deletion autogen/main/versions.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.3.0, < 5.0"
version = ">= 4.6.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions examples/simple_regional_beta/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ module "gke" {
database_encryption = var.database_encryption
enable_binary_authorization = var.enable_binary_authorization
enable_pod_security_policy = var.enable_pod_security_policy
enable_identity_service = true
release_channel = "REGULAR"

# Disable workload identity
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,7 @@ Then perform the following commands on the root folder:
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
Expand Down Expand Up @@ -264,6 +265,7 @@ Then perform the following commands on the root folder:
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
| http\_load\_balancing\_enabled | Whether http load balancing enabled |
| identity\_namespace | Workload Identity pool |
| identity\_service\_enabled | Whether Identity Service is enabled |
| instance\_group\_urls | List of GKE generated instance groups |
| intranode\_visibility\_enabled | Whether intra-node visibility is enabled |
| istio\_enabled | Whether Istio is enabled |
Expand Down
7 changes: 7 additions & 0 deletions modules/beta-private-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "identity_service_config" {
for_each = var.enable_identity_service ? [var.enable_identity_service] : []
content {
enabled = identity_service_config.value
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster-update-variant/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,7 @@ locals {
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config.0.enabled : false
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling.0.enabled : false
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config.0.enabled : false

# /BETA features

Expand Down
5 changes: 5 additions & 0 deletions modules/beta-private-cluster-update-variant/outputs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,11 @@ output "vertical_pod_autoscaling_enabled" {
value = local.cluster_vertical_pod_autoscaling_enabled
}

output "identity_service_enabled" {
description = "Whether Identity Service is enabled"
value = local.cluster_pod_security_policy_enabled
}

output "tpu_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the TPUs"
value = var.enable_tpu ? google_container_cluster.primary.tpu_ipv4_cidr_block : null
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster-update-variant/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -507,6 +507,12 @@ variable "enable_intranode_visibility" {
default = false
}

variable "enable_identity_service" {
type = bool
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
default = false
}

variable "authenticator_security_group" {
type = string
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster-update-variant/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.3.0, < 5.0"
version = ">= 4.6.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,7 @@ Then perform the following commands on the root folder:
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
Expand Down Expand Up @@ -242,6 +243,7 @@ Then perform the following commands on the root folder:
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
| http\_load\_balancing\_enabled | Whether http load balancing enabled |
| identity\_namespace | Workload Identity pool |
| identity\_service\_enabled | Whether Identity Service is enabled |
| instance\_group\_urls | List of GKE generated instance groups |
| intranode\_visibility\_enabled | Whether intra-node visibility is enabled |
| istio\_enabled | Whether Istio is enabled |
Expand Down
7 changes: 7 additions & 0 deletions modules/beta-private-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "identity_service_config" {
for_each = var.enable_identity_service ? [var.enable_identity_service] : []
content {
enabled = identity_service_config.value
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,7 @@ locals {
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config.0.enabled : false
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling.0.enabled : false
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config.0.enabled : false

# /BETA features

Expand Down
5 changes: 5 additions & 0 deletions modules/beta-private-cluster/outputs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,11 @@ output "vertical_pod_autoscaling_enabled" {
value = local.cluster_vertical_pod_autoscaling_enabled
}

output "identity_service_enabled" {
description = "Whether Identity Service is enabled"
value = local.cluster_pod_security_policy_enabled
}

output "tpu_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the TPUs"
value = var.enable_tpu ? google_container_cluster.primary.tpu_ipv4_cidr_block : null
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -507,6 +507,12 @@ variable "enable_intranode_visibility" {
default = false
}

variable "enable_identity_service" {
type = bool
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
default = false
}

variable "authenticator_security_group" {
type = string
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.3.0, < 5.0"
version = ">= 4.6.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-public-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,7 @@ Then perform the following commands on the root folder:
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
Expand Down Expand Up @@ -253,6 +254,7 @@ Then perform the following commands on the root folder:
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
| http\_load\_balancing\_enabled | Whether http load balancing enabled |
| identity\_namespace | Workload Identity pool |
| identity\_service\_enabled | Whether Identity Service is enabled |
| instance\_group\_urls | List of GKE generated instance groups |
| intranode\_visibility\_enabled | Whether intra-node visibility is enabled |
| istio\_enabled | Whether Istio is enabled |
Expand Down
7 changes: 7 additions & 0 deletions modules/beta-public-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "identity_service_config" {
for_each = var.enable_identity_service ? [var.enable_identity_service] : []
content {
enabled = identity_service_config.value
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
Expand Down
1 change: 1 addition & 0 deletions modules/beta-public-cluster-update-variant/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ locals {
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config.0.enabled : false
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling.0.enabled : false
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config.0.enabled : false

# /BETA features

Expand Down
5 changes: 5 additions & 0 deletions modules/beta-public-cluster-update-variant/outputs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,11 @@ output "vertical_pod_autoscaling_enabled" {
value = local.cluster_vertical_pod_autoscaling_enabled
}

output "identity_service_enabled" {
description = "Whether Identity Service is enabled"
value = local.cluster_pod_security_policy_enabled
}

output "tpu_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the TPUs"
value = var.enable_tpu ? google_container_cluster.primary.tpu_ipv4_cidr_block : null
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-public-cluster-update-variant/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -476,6 +476,12 @@ variable "enable_intranode_visibility" {
default = false
}

variable "enable_identity_service" {
type = bool
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
default = false
}

variable "authenticator_security_group" {
type = string
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster-update-variant/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.3.0, < 5.0"
version = ">= 4.6.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
2 changes: 2 additions & 0 deletions modules/beta-public-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,7 @@ Then perform the following commands on the root folder:
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
Expand Down Expand Up @@ -231,6 +232,7 @@ Then perform the following commands on the root folder:
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
| http\_load\_balancing\_enabled | Whether http load balancing enabled |
| identity\_namespace | Workload Identity pool |
| identity\_service\_enabled | Whether Identity Service is enabled |
| instance\_group\_urls | List of GKE generated instance groups |
| intranode\_visibility\_enabled | Whether intra-node visibility is enabled |
| istio\_enabled | Whether Istio is enabled |
Expand Down
7 changes: 7 additions & 0 deletions modules/beta-public-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,13 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "identity_service_config" {
for_each = var.enable_identity_service ? [var.enable_identity_service] : []
content {
enabled = identity_service_config.value
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
Expand Down
1 change: 1 addition & 0 deletions modules/beta-public-cluster/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ locals {
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config.0.enabled : false
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling.0.enabled : false
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config.0.enabled : false

# /BETA features

Expand Down
5 changes: 5 additions & 0 deletions modules/beta-public-cluster/outputs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,11 @@ output "vertical_pod_autoscaling_enabled" {
value = local.cluster_vertical_pod_autoscaling_enabled
}

output "identity_service_enabled" {
description = "Whether Identity Service is enabled"
value = local.cluster_pod_security_policy_enabled
}

output "tpu_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the TPUs"
value = var.enable_tpu ? google_container_cluster.primary.tpu_ipv4_cidr_block : null
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-public-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -476,6 +476,12 @@ variable "enable_intranode_visibility" {
default = false
}

variable "enable_identity_service" {
type = bool
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
default = false
}

variable "authenticator_security_group" {
type = string
description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]"
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.3.0, < 5.0"
version = ">= 4.6.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
Loading