Skip to content

Commit 6ee7ffb

Browse files
YpNoYpNo
committed
Fleet: Creating fleet without cluster creation
1 parent a3ae61f commit 6ee7ffb

File tree

6 files changed

+193
-0
lines changed

6 files changed

+193
-0
lines changed

‎modules/fleet/README.md

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
2+
# Terraform Kubernetes Engine Fleet submodule
3+
4+
GKE submodule to manage GKE's fleets
5+
6+
With the two mandatory parameters, the module will create a fleet on the specified project. it requires `gkehub.googleapis.com` api only.
7+
The other parameters are Anthos service features. So, if you set or enable any of them, the `anthos.googleapis.com` api will be enabled.
8+
9+
## Usage
10+
11+
```tf
12+
module "hub" {
13+
source = "terraform-google-modules/kubernetes-engine/google//modules/fleet"
14+
15+
project_id = "fleet-host-project"
16+
display_name = "GKE Fleet - Staging"
17+
}
18+
```
19+
20+
<!-- BEGIN_TF_DOCS -->
21+
## Requirements
22+
23+
| Name | Version |
24+
|------|---------|
25+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
26+
| <a name="requirement_google"></a> [google](#requirement\_google) | ~> 6.0 |
27+
28+
## Providers
29+
30+
| Name | Version |
31+
|------|---------|
32+
| <a name="provider_google"></a> [google](#provider\_google) | ~> 6.0 |
33+
34+
## Resources
35+
36+
| Name | Type |
37+
|------|------|
38+
| [google_gke_hub_fleet.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/gke_hub_fleet) | resource |
39+
| [google_project_service.anthos](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_service) | resource |
40+
| [google_project_service.gkehub](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/project_service) | resource |
41+
42+
## Inputs
43+
44+
| Name | Description | Type | Default | Required |
45+
|------|-------------|------|---------|:--------:|
46+
| <a name="input_binary_authorization_evaluation_mode"></a> [binary\_authorization\_evaluation\_mode](#input\_binary\_authorization\_evaluation\_mode) | Mode of operation for binauthz policy evaluation. Set to null to omit the attribute and use provider/API default if the block is rendered. Possible values: "DISABLED", "PROJECT\_SINGLETON\_POLICY\_ENFORCE". | `string` | `"DISABLED"` | no |
47+
| <a name="input_binary_authorization_policy_bindings"></a> [binary\_authorization\_policy\_bindings](#input\_binary\_authorization\_policy\_bindings) | A list of binauthz policy bindings. Each binding has a 'name' attribute. | <pre>list(object({<br/> name = string # Name is technically optional in API, but required for a useful binding here.<br/> }))</pre> | `[]` | no |
48+
| <a name="input_display_name"></a> [display\_name](#input\_display\_name) | A user-assigned display name of the Fleet. | `string` | n/a | yes |
49+
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | The ID of the project in which the Fleet resource belongs. If it is not provided, the provider project is used. | `string` | n/a | yes |
50+
| <a name="input_security_posture_mode"></a> [security\_posture\_mode](#input\_security\_posture\_mode) | Sets the mode for Security Posture features on the cluster. Set to null to omit the attribute. Possible values: "DISABLED", "BASIC", "ENTERPRISE". | `string` | `"DISABLED"` | no |
51+
| <a name="input_security_posture_vulnerability_mode"></a> [security\_posture\_vulnerability\_mode](#input\_security\_posture\_vulnerability\_mode) | Sets the mode for Vulnerability Scanning. Set to null to omit the attribute. Possible values: "VULNERABILITY\_DISABLED", "VULNERABILITY\_BASIC", "VULNERABILITY\_ENTERPRISE". | `string` | `"VULNERABILITY_DISABLED"` | no |
52+
53+
## Outputs
54+
55+
| Name | Description |
56+
|------|-------------|
57+
| <a name="output_fleet_id"></a> [fleet\_id](#output\_fleet\_id) | the Fleet identifier |
58+
| <a name="output_fleet_state"></a> [fleet\_state](#output\_fleet\_state) | The state of the fleet resource |
59+
| <a name="output_fleet_uid"></a> [fleet\_uid](#output\_fleet\_uid) | Unique UID across all Fleet resources |
60+
<!-- END_TF_DOCS -->

‎modules/fleet/apis.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# --- Enable GKE HUB API ---
2+
3+
resource "google_project_service" "gkehub" {
4+
project = var.project_id
5+
service = "gkehub.googleapis.com"
6+
7+
disable_on_destroy = false
8+
}
9+
10+
# --- Enable Anthos API ---
11+
12+
resource "google_project_service" "anthos" {
13+
count = ((var.security_posture_mode != "DISABLED" || var.security_posture_vulnerability_mode != "VULNERABILITY_DISABLED") || (var.binary_authorization_evaluation_mode != "DISABLED" || length(var.binary_authorization_policy_bindings) > 0)) ? 1 : 0
14+
15+
project = var.project_id
16+
service = "anthos.googleapis.com"
17+
18+
disable_on_destroy = false
19+
}

‎modules/fleet/main.tf

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
resource "google_gke_hub_fleet" "this" {
2+
project = var.project_id
3+
display_name = var.display_name
4+
5+
dynamic "default_cluster_config" {
6+
for_each = ((var.security_posture_mode != "DISABLED" || var.security_posture_vulnerability_mode != "VULNERABILITY_DISABLED") || (var.binary_authorization_evaluation_mode != "DISABLED" || length(var.binary_authorization_policy_bindings) > 0)) ? [1] : []
7+
8+
content {
9+
dynamic "binary_authorization_config" {
10+
for_each = (var.binary_authorization_evaluation_mode != null || length(var.binary_authorization_policy_bindings) > 0) ? [1] : []
11+
content {
12+
evaluation_mode = var.binary_authorization_evaluation_mode
13+
dynamic "policy_bindings" {
14+
for_each = var.binary_authorization_policy_bindings
15+
content {
16+
name = policy_bindings.value.name
17+
}
18+
}
19+
}
20+
}
21+
22+
dynamic "security_posture_config" {
23+
for_each = (var.security_posture_mode != null || var.security_posture_vulnerability_mode != null) ? [1] : []
24+
content {
25+
mode = var.security_posture_mode
26+
vulnerability_mode = var.security_posture_vulnerability_mode
27+
}
28+
}
29+
}
30+
}
31+
32+
depends_on = [
33+
google_project_service.gkehub
34+
]
35+
}

‎modules/fleet/outputs.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
output "fleet_id" {
2+
description = "the Fleet identifier"
3+
value = google_gke_hub_fleet.this.id
4+
}
5+
6+
output "fleet_state" {
7+
description = "The state of the fleet resource"
8+
value = google_gke_hub_fleet.this.state[0].code
9+
}
10+
11+
output "fleet_uid" {
12+
description = "Unique UID across all Fleet resources"
13+
value = google_gke_hub_fleet.this.uid
14+
}

‎modules/fleet/variables.tf

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
variable "project_id" {
2+
description = "The ID of the project in which the Fleet resource belongs. If it is not provided, the provider project is used."
3+
type = string
4+
}
5+
6+
variable "display_name" {
7+
description = "A user-assigned display name of the Fleet."
8+
type = string
9+
}
10+
11+
# variable "manage_default_cluster_config" {
12+
# description = "Set to true to manage default_cluster_config. If false, the entire default_cluster_config block will be omitted."
13+
# type = bool
14+
# default = true
15+
# }
16+
17+
# Variables for default_cluster_config.binary_authorization_config
18+
variable "binary_authorization_evaluation_mode" {
19+
description = "Mode of operation for binauthz policy evaluation. Set to null to omit the attribute and use provider/API default if the block is rendered. Possible values: \"DISABLED\", \"PROJECT_SINGLETON_POLICY_ENFORCE\"."
20+
type = string
21+
default = "DISABLED" # Provider default
22+
validation {
23+
condition = var.binary_authorization_evaluation_mode == null || can(regex("^(DISABLED|PROJECT_SINGLETON_POLICY_ENFORCE)$", var.binary_authorization_evaluation_mode))
24+
error_message = "Invalid binary_authorization_evaluation_mode. Must be one of: DISABLED, PROJECT_SINGLETON_POLICY_ENFORCE, or null."
25+
}
26+
}
27+
28+
variable "binary_authorization_policy_bindings" {
29+
description = "A list of binauthz policy bindings. Each binding has a 'name' attribute."
30+
type = list(object({
31+
name = string # Name is technically optional in API, but required for a useful binding here.
32+
}))
33+
default = [] # Default is no bindings
34+
}
35+
36+
# Variables for default_cluster_config.security_posture_config
37+
variable "security_posture_mode" {
38+
description = "Sets the mode for Security Posture features on the cluster. Set to null to omit the attribute. Possible values: \"DISABLED\", \"BASIC\", \"ENTERPRISE\"."
39+
type = string
40+
default = "DISABLED" # Matches original and provider default
41+
validation {
42+
condition = var.security_posture_mode == null || can(regex("^(DISABLED|BASIC|ENTERPRISE)$", var.security_posture_mode))
43+
error_message = "Invalid security_posture_mode. Must be one of: DISABLED, BASIC, ENTERPRISE, or null."
44+
}
45+
}
46+
47+
variable "security_posture_vulnerability_mode" {
48+
description = "Sets the mode for Vulnerability Scanning. Set to null to omit the attribute. Possible values: \"VULNERABILITY_DISABLED\", \"VULNERABILITY_BASIC\", \"VULNERABILITY_ENTERPRISE\"."
49+
type = string
50+
default = "VULNERABILITY_DISABLED" # Matches original and provider default
51+
validation {
52+
condition = var.security_posture_vulnerability_mode == null || can(regex("^(VULNERABILITY_DISABLED|VULNERABILITY_BASIC|VULNERABILITY_ENTERPRISE)$", var.security_posture_vulnerability_mode))
53+
error_message = "Invalid security_posture_vulnerability_mode. Must be one of: VULNERABILITY_DISABLED, VULNERABILITY_BASIC, VULNERABILITY_ENTERPRISE, or null."
54+
}
55+
}

‎modules/fleet/version.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.3"
3+
4+
required_providers {
5+
google = {
6+
source = "hashicorp/google"
7+
version = "~> 6.0"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)