Skip to content

Commit

Permalink
feat!: add boot_disk_kms_key variable for node pools to GA modules (#…
Browse files Browse the repository at this point in the history 
…1371)

* Add boot_disk_kms_key variable for node pools

* Update README.md for boot_disk_kms_key variable

* Bump min supported version of the provider since boot_disk_kms_key attribute is moving out of beta

* re run build

* loose match test

Co-authored-by: Andrew Peabody <andrewpeabody@google.com>
Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
  • Loading branch information
@r1c0x @apeabody @bharathkkb
3 people committed Nov 2, 2022
1 parent 335c62a commit d9a44c6
Show file tree
Hide file tree
Showing 27 changed files with 52 additions and 32 deletions.
1 change: 1 addition & 0 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,7 @@ The node_pools variable takes the following parameters:
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
Expand Down
1 change: 1 addition & 0 deletions autogen/main/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,7 @@ The node_pools variable takes the following parameters:
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
{% if beta_cluster %}
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
Expand Down
4 changes: 2 additions & 2 deletions autogen/main/cluster.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -747,8 +747,6 @@ resource "google_container_node_pool" "windows_pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand Down Expand Up @@ -779,6 +777,8 @@ resource "google_container_node_pool" "windows_pools" {
{% endif %}
{% endif %}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
4 changes: 2 additions & 2 deletions autogen/main/versions.tf.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand All @@ -38,7 +38,7 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
4 changes: 4 additions & 0 deletions cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -425,6 +425,8 @@ resource "google_container_node_pool" "pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down Expand Up @@ -575,6 +577,8 @@ resource "google_container_node_pool" "windows_pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-autopilot-private-cluster/versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-autopilot-public-cluster/versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster-update-variant/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -313,6 +313,7 @@ The node_pools variable takes the following parameters:
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
Expand Down
8 changes: 4 additions & 4 deletions modules/beta-private-cluster-update-variant/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -662,8 +662,6 @@ resource "google_container_node_pool" "pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand Down Expand Up @@ -691,6 +689,8 @@ resource "google_container_node_pool" "pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down Expand Up @@ -867,8 +867,6 @@ resource "google_container_node_pool" "windows_pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand All @@ -883,6 +881,8 @@ resource "google_container_node_pool" "windows_pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster-update-variant/versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -291,6 +291,7 @@ The node_pools variable takes the following parameters:
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
Expand Down
8 changes: 4 additions & 4 deletions modules/beta-private-cluster/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -571,8 +571,6 @@ resource "google_container_node_pool" "pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand Down Expand Up @@ -600,6 +598,8 @@ resource "google_container_node_pool" "pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down Expand Up @@ -775,8 +775,6 @@ resource "google_container_node_pool" "windows_pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand All @@ -791,6 +789,8 @@ resource "google_container_node_pool" "windows_pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-public-cluster-update-variant/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -300,6 +300,7 @@ The node_pools variable takes the following parameters:
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
Expand Down
8 changes: 4 additions & 4 deletions modules/beta-public-cluster-update-variant/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -643,8 +643,6 @@ resource "google_container_node_pool" "pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand Down Expand Up @@ -672,6 +670,8 @@ resource "google_container_node_pool" "pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down Expand Up @@ -848,8 +848,6 @@ resource "google_container_node_pool" "windows_pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand All @@ -864,6 +862,8 @@ resource "google_container_node_pool" "windows_pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster-update-variant/versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-public-cluster/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -278,6 +278,7 @@ The node_pools variable takes the following parameters:
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
Expand Down
8 changes: 4 additions & 4 deletions modules/beta-public-cluster/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -552,8 +552,6 @@ resource "google_container_node_pool" "pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand Down Expand Up @@ -581,6 +579,8 @@ resource "google_container_node_pool" "pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down Expand Up @@ -756,8 +756,6 @@ resource "google_container_node_pool" "windows_pools" {
}
}

boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

dynamic "kubelet_config" {
for_each = length(setintersection(
keys(each.value),
Expand All @@ -772,6 +770,8 @@ resource "google_container_node_pool" "windows_pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster/versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/private-cluster-update-variant/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -280,6 +280,7 @@ The node_pools variable takes the following parameters:
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
Expand Down
4 changes: 4 additions & 0 deletions modules/private-cluster-update-variant/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -529,6 +529,8 @@ resource "google_container_node_pool" "pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down Expand Up @@ -680,6 +682,8 @@ resource "google_container_node_pool" "windows_pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster-update-variant/versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/private-cluster/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -258,6 +258,7 @@ The node_pools variable takes the following parameters:
| auto_repair | Whether the nodes will be automatically repaired | true | Optional |
| autoscaling | Configuration required by cluster autoscaler to adjust the size of the node pool to the current cluster usage | true | Optional |
| auto_upgrade | Whether the nodes will be automatically upgraded | true (if cluster is regional) | Optional |
| boot_disk_kms_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. | " " | Optional |
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
| effect | Effect for the taint | | Required |
Expand Down
4 changes: 4 additions & 0 deletions modules/private-cluster/cluster.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -438,6 +438,8 @@ resource "google_container_node_pool" "pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down Expand Up @@ -588,6 +590,8 @@ resource "google_container_node_pool" "windows_pools" {
}


boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")

shielded_instance_config {
enable_secure_boot = lookup(each.value, "enable_secure_boot", false)
enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster/versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
6 changes: 3 additions & 3 deletions test/integration/node_pool/controls/gcloud.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,12 @@

describe "cluster-autoscaling" do
it "has the expected cluster autoscaling settings" do
expect(data['autoscaling']).to eq({
"autoprovisioningNodePoolDefaults" => {
expect(data['autoscaling']).to include({
"autoprovisioningNodePoolDefaults" => including({
"imageType"=>"COS_CONTAINERD",
"oauthScopes" => %w(https://www.googleapis.com/auth/cloud-platform),
"serviceAccount" => "default"
},
}),
"autoscalingProfile" => "OPTIMIZE_UTILIZATION",
"enableNodeAutoprovisioning" => true,
"resourceLimits" => [
Expand Down
2 changes: 1 addition & 1 deletion versions.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.29.0, < 5.0"
version = ">= 4.31.0, < 5.0"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down

0 comments on commit d9a44c6

Please sign in to comment.