Skip to content

Commit 8d0a8cc

Browse files
DrFaust92DrFaust92
authored
Merge branch 'main' into flexstart
2 parents dc1cd26 + 069d32c commit 8d0a8cc

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+421
-35
lines changed

‎README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ Then perform the following commands on the root folder:
202202
| in\_transit\_encryption\_config | Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`. | `string` | `null` | no |
203203
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
204204
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. Note: this can be set at the node pool level separately within `node_pools`. | `bool` | `null` | no |
205+
| ip\_endpoints\_enabled | (Optional) Controls whether to allow direct IP access. Defaults to `true`. | `bool` | `null` | no |
205206
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
206207
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
207208
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
@@ -402,6 +403,10 @@ The node_pools variable takes the following parameters:
402403

403404
The windows_node_pools variable takes the same parameters as [node_pools](#node\_pools-variable) but is reserved for provisioning Windows based node pools only. This variable is introduced to satisfy a [specific requirement](https://cloud.google.com/kubernetes-engine/docs/how-to/creating-a-cluster-windows#create_a_cluster_and_node_pools) for the presence of at least one linux based node pool in the cluster before a windows based node pool can be created.
404405

406+
| Name | Description | Default | Requirement |
407+
| --- | --- | --- | --- |
408+
| windows_node_config_os_version | The Windows OS version to use for the windows node pool. Valid values are OS_VERSION_UNSPECIFIED, OS_VERSION_LTSC2019 and OS_VERSION_LTSC2022. | null | Optional |
409+
405410

406411
## Requirements
407412

‎autogen/main/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,10 @@ The node_pools variable takes the following parameters:
289289

290290
The windows_node_pools variable takes the same parameters as [node_pools](#node\_pools-variable) but is reserved for provisioning Windows based node pools only. This variable is introduced to satisfy a [specific requirement](https://cloud.google.com/kubernetes-engine/docs/how-to/creating-a-cluster-windows#create_a_cluster_and_node_pools) for the presence of at least one linux based node pool in the cluster before a windows based node pool can be created.
291291

292+
| Name | Description | Default | Requirement |
293+
| --- | --- | --- | --- |
294+
| windows_node_config_os_version | The Windows OS version to use for the windows node pool. Valid values are OS_VERSION_UNSPECIFIED, OS_VERSION_LTSC2019 and OS_VERSION_LTSC2022. | null | Optional |
295+
292296
{% endif %}
293297

294298
## Requirements

‎autogen/main/cluster.tf.tmpl

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ resource "google_container_cluster" "primary" {
254254
disable_l4_lb_firewall_reconciliation = var.disable_l4_lb_firewall_reconciliation
255255

256256
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
257-
257+
258258
in_transit_encryption_config = var.in_transit_encryption_config
259259

260260
dynamic "secret_manager_config" {
@@ -664,8 +664,8 @@ resource "google_container_cluster" "primary" {
664664
}
665665
}
666666

667-
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
668667
{% endif %}
668+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
669669

670670
storage_pools = lookup(var.node_pools[0], "storage_pools", null) != null ? [var.node_pools[0].storage_pools] : []
671671

@@ -721,10 +721,19 @@ resource "google_container_cluster" "primary" {
721721

722722
{% endif %}
723723
dynamic "control_plane_endpoints_config" {
724-
for_each = var.dns_allow_external_traffic != null ? [1] : []
724+
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
725725
content {
726-
dns_endpoint_config {
727-
allow_external_traffic = var.dns_allow_external_traffic
726+
dynamic "dns_endpoint_config" {
727+
for_each = var.dns_allow_external_traffic != null ? [1] : []
728+
content {
729+
allow_external_traffic = var.dns_allow_external_traffic
730+
}
731+
}
732+
dynamic "ip_endpoints_config" {
733+
for_each = var.ip_endpoints_enabled != null ? [1] : []
734+
content {
735+
enabled = var.ip_endpoints_enabled
736+
}
728737
}
729738
}
730739
}
@@ -1215,6 +1224,14 @@ resource "google_container_node_pool" "windows_pools" {
12151224
}
12161225
{% endif %}
12171226

1227+
dynamic "windows_node_config" {
1228+
for_each = lookup(each.value, "windows_node_config_os_version", null) != null ? [true] : []
1229+
1230+
content {
1231+
osversion = lookup(each.value, "windows_node_config_os_version", null)
1232+
}
1233+
}
1234+
12181235
{% if i == 0 %}
12191236
dynamic "linux_node_config" {
12201237
for_each = length(merge(
@@ -1245,7 +1262,7 @@ resource "google_container_node_pool" "windows_pools" {
12451262
content {
12461263
hugepage_size_2m = try(coalesce(local.node_pools_hugepage_size_2m[each.value["name"]], local.node_pools_hugepage_size_2m["all"]), null)
12471264
hugepage_size_1g = try(coalesce(local.node_pools_hugepage_size_1g[each.value["name"]], local.node_pools_hugepage_size_1g["all"]), null)
1248-
}
1265+
}
12491266
}
12501267
}
12511268
}

‎autogen/main/variables.tf.tmpl

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,7 @@ variable "node_pools_linux_node_configs_sysctls" {
256256
default-node-pool = {}
257257
}
258258
}
259+
259260
variable "node_pools_cgroup_mode" {
260261
type = map(string)
261262
description = "Map of strings containing cgroup node config by node-pool name"
@@ -295,6 +296,7 @@ variable "enable_cost_allocation" {
295296
description = "Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery"
296297
default = false
297298
}
299+
298300
variable "resource_usage_export_dataset_id" {
299301
type = string
300302
description = "The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export."
@@ -1123,3 +1125,9 @@ variable "dns_allow_external_traffic" {
11231125
type = bool
11241126
default = null
11251127
}
1128+
1129+
variable "ip_endpoints_enabled" {
1130+
description = "(Optional) Controls whether to allow direct IP access. Defaults to `true`."
1131+
type = bool
1132+
default = null
1133+
}

‎cluster.tf

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -516,6 +516,7 @@ resource "google_container_cluster" "primary" {
516516

517517
metadata = local.node_pools_metadata["all"]
518518

519+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
519520

520521
storage_pools = lookup(var.node_pools[0], "storage_pools", null) != null ? [var.node_pools[0].storage_pools] : []
521522

@@ -546,10 +547,19 @@ resource "google_container_cluster" "primary" {
546547
}
547548

548549
dynamic "control_plane_endpoints_config" {
549-
for_each = var.dns_allow_external_traffic != null ? [1] : []
550+
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
550551
content {
551-
dns_endpoint_config {
552-
allow_external_traffic = var.dns_allow_external_traffic
552+
dynamic "dns_endpoint_config" {
553+
for_each = var.dns_allow_external_traffic != null ? [1] : []
554+
content {
555+
allow_external_traffic = var.dns_allow_external_traffic
556+
}
557+
}
558+
dynamic "ip_endpoints_config" {
559+
for_each = var.ip_endpoints_enabled != null ? [1] : []
560+
content {
561+
enabled = var.ip_endpoints_enabled
562+
}
553563
}
554564
}
555565
}
@@ -903,6 +913,14 @@ resource "google_container_node_pool" "pools" {
903913
}
904914
}
905915

916+
dynamic "windows_node_config" {
917+
for_each = lookup(each.value, "windows_node_config_os_version", null) != null ? [true] : []
918+
919+
content {
920+
osversion = lookup(each.value, "windows_node_config_os_version", null)
921+
}
922+
}
923+
906924
dynamic "linux_node_config" {
907925
for_each = length(merge(
908926
local.node_pools_linux_node_configs_sysctls["all"],
@@ -1258,6 +1276,14 @@ resource "google_container_node_pool" "windows_pools" {
12581276
}
12591277
}
12601278

1279+
dynamic "windows_node_config" {
1280+
for_each = lookup(each.value, "windows_node_config_os_version", null) != null ? [true] : []
1281+
1282+
content {
1283+
osversion = lookup(each.value, "windows_node_config_os_version", null)
1284+
}
1285+
}
1286+
12611287

12621288
boot_disk_kms_key = lookup(each.value, "boot_disk_kms_key", "")
12631289
storage_pools = lookup(each.value, "storage_pools", null) != null ? [each.value.storage_pools] : []

‎examples/deploy_service/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ resource "kubernetes_pod" "nginx-example" {
5555

5656
spec {
5757
container {
58-
image = "nginx:1.28.0"
58+
image = "nginx:1.29.0"
5959
name = "nginx-example"
6060
}
6161
}

‎metadata.display.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,9 @@ spec:
213213
insecure_kubelet_readonly_port_enabled:
214214
name: insecure_kubelet_readonly_port_enabled
215215
title: Insecure Kubelet Readonly Port Enabled
216+
ip_endpoints_enabled:
217+
name: ip_endpoints_enabled
218+
title: Ip Endpoints Enabled
216219
ip_masq_link_local:
217220
name: ip_masq_link_local
218221
title: Ip Masq Link Local

‎metadata.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -732,6 +732,9 @@ spec:
732732
- name: dns_allow_external_traffic
733733
description: (Optional) Controls whether external traffic is allowed over the dns endpoint.
734734
varType: bool
735+
- name: ip_endpoints_enabled
736+
description: (Optional) Controls whether to allow direct IP access. Defaults to `true`.
737+
varType: bool
735738
outputs:
736739
- name: ca_certificate
737740
description: Cluster ca certificate (base64 encoded)

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ Then perform the following commands on the root folder:
120120
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
121121
| in\_transit\_encryption\_config | Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`. | `string` | `null` | no |
122122
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. | `bool` | `null` | no |
123+
| ip\_endpoints\_enabled | (Optional) Controls whether to allow direct IP access. Defaults to `true`. | `bool` | `null` | no |
123124
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
124125
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used. | `string` | `null` | no |
125126
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -362,10 +362,19 @@ resource "google_container_cluster" "primary" {
362362
}
363363

364364
dynamic "control_plane_endpoints_config" {
365-
for_each = var.dns_allow_external_traffic != null ? [1] : []
365+
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
366366
content {
367-
dns_endpoint_config {
368-
allow_external_traffic = var.dns_allow_external_traffic
367+
dynamic "dns_endpoint_config" {
368+
for_each = var.dns_allow_external_traffic != null ? [1] : []
369+
content {
370+
allow_external_traffic = var.dns_allow_external_traffic
371+
}
372+
}
373+
dynamic "ip_endpoints_config" {
374+
for_each = var.ip_endpoints_enabled != null ? [1] : []
375+
content {
376+
enabled = var.ip_endpoints_enabled
377+
}
369378
}
370379
}
371380
}

0 commit comments

Comments
 (0)