Skip to content

Commit 61172f0

Browse files
apeabodyapeabody
authored
Merge branch 'master' into dev
2 parents 6a31423 + 654868e commit 61172f0

File tree

50 files changed

+768
-17
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+768
-17
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ Then perform the following commands on the root folder:
143143
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
144144
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
145145
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
146+
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
146147
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
147148
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
148149
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |

‎autogen/main/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,7 @@ The node_pools variable takes the following parameters:
201201
| cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional |
202202
| cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional |
203203
| cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional |
204+
| pod_pids_limit | Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304. | null | Optional |
204205
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
205206
{% endif %}
206207
| disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional |

‎autogen/main/cluster.tf.tmpl

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,8 @@ resource "google_container_cluster" "primary" {
139139
service_account = local.service_account
140140
oauth_scopes = local.node_pools_oauth_scopes["all"]
141141

142+
boot_disk_kms_key = var.boot_disk_kms_key
143+
142144
management {
143145
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
144146
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade",true)
@@ -524,7 +526,7 @@ resource "google_container_cluster" "primary" {
524526
}
525527
}
526528

527-
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
529+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
528530
{% endif %}
529531

530532
shielded_instance_config {
@@ -985,13 +987,14 @@ resource "google_container_node_pool" "windows_pools" {
985987
dynamic "kubelet_config" {
986988
for_each = length(setintersection(
987989
keys(each.value),
988-
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"]
990+
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"]
989991
)) != 0 ? [1] : []
990992

991993
content {
992994
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
993995
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
994996
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
997+
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
995998
}
996999
}
9971000
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,14 @@ variable "service_account_name" {
413413
default = ""
414414
}
415415

416+
{% if autopilot_cluster != true %}
417+
variable "boot_disk_kms_key" {
418+
type = string
419+
description = "The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption"
420+
default = null
421+
}
422+
423+
{% endif %}
416424
variable "issue_client_certificate" {
417425
type = bool
418426
description = "Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive!"

‎cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,8 @@ resource "google_container_cluster" "primary" {
112112
service_account = local.service_account
113113
oauth_scopes = local.node_pools_oauth_scopes["all"]
114114

115+
boot_disk_kms_key = var.boot_disk_kms_key
116+
115117
management {
116118
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
117119
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade", true)

‎examples/deploy_service/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ resource "kubernetes_pod" "nginx-example" {
5555

5656
spec {
5757
container {
58-
image = "nginx:1.26.0"
58+
image = "nginx:1.27.0"
5959
name = "nginx-example"
6060
}
6161
}

‎examples/island_cluster_anywhere_in_gcp_design/README.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# GKE island cluster anywhere in GCP design
2+
3+
This example provisions a cluster in an island VPC allowing reuse of the IP address space for multiple clusters across different GCP organizations.
4+
5+
## Deploy
6+
7+
1. Create NCC hub.
8+
2. Update `ncc_hub_project_id`, `ncc_hub_name`, `network_name` and gke spokes in `terraform.tfvars`.
9+
3. Run `terraform apply`.
10+
11+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
12+
## Inputs
13+
14+
| Name | Description | Type | Default | Required |
15+
|------|-------------|------|---------|:--------:|
16+
| gke\_spokes | n/a | `any` | n/a | yes |
17+
| ingress\_ip\_addrs\_subnet\_cidr | Subnet to use for reserving internal ip addresses for the ILBs. | `string` | n/a | yes |
18+
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | `list(object({ cidr_block = string, display_name = string }))` | n/a | yes |
19+
| ncc\_hub\_name | n/a | `string` | n/a | yes |
20+
| ncc\_hub\_project\_id | n/a | `string` | n/a | yes |
21+
| net\_attachment\_subnet\_cidr | Subnet for the router PSC interface network attachment in island network. | `string` | n/a | yes |
22+
| node\_locations | n/a | `list(string)` | n/a | yes |
23+
| primary\_net\_name | Primary VPC network name. | `string` | n/a | yes |
24+
| primary\_subnet | Subnet to use in primary network to deploy the router. | `string` | n/a | yes |
25+
| proxy\_subnet\_cidr | CIDR for the regional managed proxy subnet. | `string` | n/a | yes |
26+
| region | n/a | `string` | n/a | yes |
27+
| router\_machine\_type | n/a | `string` | n/a | yes |
28+
| secondary\_ranges | n/a | `map(string)` | n/a | yes |
29+
| subnet\_cidr | Primary subnet CIDR used by the cluster. | `string` | n/a | yes |
30+
31+
## Outputs
32+
33+
| Name | Description |
34+
|------|-------------|
35+
| cluster\_ids | n/a |
36+
37+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/island_cluster_anywhere_in_gcp_design/main.tf

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "random_id" "rand" {
18+
byte_length = 4
19+
}
20+
21+
resource "google_service_account" "gke-sa" {
22+
for_each = { for k, v in var.gke_spokes : k => v }
23+
24+
account_id = "gke-sa-${random_id.rand.hex}"
25+
project = each.value["project_id"]
26+
}
27+
28+
module "gke" {
29+
source = "terraform-google-modules/kubernetes-engine/google//modules/beta-private-cluster"
30+
version = "~> 31.0"
31+
32+
for_each = { for k, v in var.gke_spokes : k => v }
33+
34+
name = each.value["cluster_name"]
35+
project_id = each.value["project_id"]
36+
region = var.region
37+
release_channel = "RAPID"
38+
zones = var.node_locations
39+
network = module.net[each.key].network_name
40+
subnetwork = "${each.value["cluster_name"]}-${var.region}-snet"
41+
ip_range_pods = "${each.value["cluster_name"]}-${var.region}-snet-pods"
42+
ip_range_services = "${each.value["cluster_name"]}-${var.region}-snet-services"
43+
enable_private_endpoint = true
44+
enable_private_nodes = true
45+
datapath_provider = "ADVANCED_DATAPATH"
46+
monitoring_enable_managed_prometheus = false
47+
enable_shielded_nodes = true
48+
master_global_access_enabled = false
49+
master_ipv4_cidr_block = var.secondary_ranges["master_cidr"]
50+
master_authorized_networks = var.master_authorized_networks
51+
deletion_protection = false
52+
remove_default_node_pool = true
53+
disable_default_snat = true
54+
gateway_api_channel = "CHANNEL_STANDARD"
55+
56+
node_pools = [
57+
{
58+
name = "default"
59+
machine_type = "e2-highcpu-2"
60+
min_count = 1
61+
max_count = 100
62+
local_ssd_count = 0
63+
spot = true
64+
local_ssd_ephemeral_count = 0
65+
disk_size_gb = 100
66+
disk_type = "pd-standard"
67+
image_type = "COS_CONTAINERD"
68+
logging_variant = "DEFAULT"
69+
auto_repair = true
70+
auto_upgrade = true
71+
service_account = google_service_account.gke-sa[each.key].email
72+
initial_node_count = 1
73+
enable_secure_boot = true
74+
},
75+
]
76+
77+
node_pools_tags = {
78+
all = ["gke-${random_id.rand.hex}"]
79+
}
80+
81+
node_pools_oauth_scopes = {
82+
all = [
83+
"https://www.googleapis.com/auth/logging.write",
84+
"https://www.googleapis.com/auth/monitoring",
85+
]
86+
}
87+
88+
timeouts = {
89+
create = "15m"
90+
update = "15m"
91+
delete = "15m"
92+
}
93+
}

‎examples/island_cluster_anywhere_in_gcp_design/manifests/k8s.yaml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Copyright 2024 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: apps/v1
16+
kind: Deployment
17+
metadata:
18+
name: whereami
19+
spec:
20+
replicas: 3
21+
selector:
22+
matchLabels:
23+
app: whereami
24+
template:
25+
metadata:
26+
labels:
27+
app: whereami
28+
spec:
29+
containers:
30+
- name: whereami
31+
image: us-docker.pkg.dev/google-samples/containers/gke/whereami:v1.2.19
32+
ports:
33+
- name: http
34+
containerPort: 8080
35+
resources:
36+
requests:
37+
cpu: "50m"
38+
memory: 128Mi
39+
limits:
40+
cpu: "100m"
41+
memory: 256Mi
42+
readinessProbe:
43+
httpGet:
44+
path: /healthz
45+
port: 8080
46+
scheme: HTTP
47+
initialDelaySeconds: 5
48+
timeoutSeconds: 1
49+
---
50+
apiVersion: v1
51+
kind: Service
52+
metadata:
53+
name: whereami
54+
spec:
55+
type: ClusterIP
56+
selector:
57+
app: whereami
58+
ports:
59+
- port: 80
60+
targetPort: 8080
61+
protocol: TCP
62+
---
63+
kind: Gateway
64+
apiVersion: gateway.networking.k8s.io/v1beta1
65+
metadata:
66+
name: l7-ilb
67+
spec:
68+
gatewayClassName: gke-l7-rilb
69+
listeners:
70+
- name: http
71+
protocol: HTTP
72+
port: 80
73+
addresses:
74+
- type: NamedAddress
75+
value: gke-spoke-1-l7-rilb-ip
76+
---
77+
kind: HTTPRoute
78+
apiVersion: gateway.networking.k8s.io/v1beta1
79+
metadata:
80+
name: whereami
81+
spec:
82+
parentRefs:
83+
- kind: Gateway
84+
name: l7-ilb
85+
rules:
86+
- backendRefs:
87+
- name: whereami
88+
port: 80

0 commit comments

Comments
 (0)