Skip to content

Commit 7931bf4

Browse files
wyardleywyardley
authored
feat(TPG>=6.7.0)!: promote secret_manager_config to GA (#2159)
1 parent cec659e commit 7931bf4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+231
-161
lines changed

Diff for: ‎README.md

+2
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ Then perform the following commands on the root folder:
173173
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
174174
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
175175
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
176+
| enable\_secret\_manager\_addon | Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
176177
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no |
177178
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
178179
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no |
@@ -282,6 +283,7 @@ Then perform the following commands on the root folder:
282283
| node\_pools\_versions | Node pool versions by node pool name |
283284
| region | Cluster region |
284285
| release\_channel | The release channel of this cluster |
286+
| secret\_manager\_addon\_enabled | Whether Secret Manager add-on is enabled |
285287
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
286288
| tpu\_ipv4\_cidr\_block | The IP range in CIDR notation used for the TPUs |
287289
| type | Cluster type (regional / zonal) |

Diff for: ‎autogen/main/cluster.tf.tmpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -243,14 +243,14 @@ resource "google_container_cluster" "primary" {
243243

244244
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
245245

246-
{% if beta_cluster %}
247246
dynamic "secret_manager_config" {
248247
for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
249248
content {
250249
enabled = secret_manager_config.value
251250
}
252251
}
253252

253+
{% if beta_cluster %}
254254
enable_fqdn_network_policy = var.enable_fqdn_network_policy
255255
{% endif %}
256256
{% if autopilot_cluster %}

Diff for: ‎autogen/main/main.tf.tmpl

+7-7
Original file line numberDiff line numberDiff line change
@@ -167,12 +167,12 @@ locals {
167167
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling[0].enabled : false
168168
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
169169
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config[0].enabled : false
170+
cluster_output_secret_manager_addon_enabled = google_container_cluster.primary.secret_manager_config != null && length(google_container_cluster.primary.secret_manager_config) == 1 ? google_container_cluster.primary.secret_manager_config[0].enabled : false
170171

171172
{% if beta_cluster %}
172173
# BETA features
173-
cluster_output_istio_disabled = google_container_cluster.primary.addons_config[0].istio_config != null && length(google_container_cluster.primary.addons_config[0].istio_config) == 1 ? google_container_cluster.primary.addons_config[0].istio_config[0].disabled : false
174-
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config[0].enabled : false
175-
cluster_output_secret_manager_addon_enabled = google_container_cluster.primary.secret_manager_config != null && length(google_container_cluster.primary.secret_manager_config) == 1 ? google_container_cluster.primary.secret_manager_config[0].enabled : false
174+
cluster_output_istio_disabled = google_container_cluster.primary.addons_config[0].istio_config != null && length(google_container_cluster.primary.addons_config[0].istio_config) == 1 ? google_container_cluster.primary.addons_config[0].istio_config[0].disabled : false
175+
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config[0].enabled : false
176176

177177
# /BETA features
178178
{% endif %}
@@ -225,6 +225,7 @@ locals {
225225
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
226226
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
227227
cluster_identity_service_enabled = local.cluster_output_identity_service_enabled
228+
cluster_secret_manager_addon_enabled = local.cluster_output_secret_manager_addon_enabled
228229
{% if autopilot_cluster != true %}
229230
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
230231
enable_certificates = var.enable_mesh_certificates
@@ -233,12 +234,11 @@ locals {
233234

234235
{% if beta_cluster %}
235236
# BETA features
236-
cluster_istio_enabled = ! local.cluster_output_istio_disabled
237+
cluster_istio_enabled = !local.cluster_output_istio_disabled
237238
{% if autopilot_cluster != true %}
238-
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
239+
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
239240
{% endif %}
240-
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
241-
cluster_secret_manager_addon_enabled = local.cluster_output_secret_manager_addon_enabled
241+
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
242242

243243
# /BETA features
244244
{% endif %}

Diff for: ‎autogen/main/outputs.tf.tmpl

+5-5
Original file line numberDiff line numberDiff line change
@@ -223,11 +223,6 @@ output "pod_security_policy_enabled" {
223223
description = "Whether pod security policy is enabled"
224224
value = local.cluster_pod_security_policy_enabled
225225
}
226-
227-
output "secret_manager_addon_enabled" {
228-
description = "Whether Secret Manager add-on is enabled"
229-
value = local.cluster_secret_manager_addon_enabled
230-
}
231226
{% endif %}
232227

233228
output "identity_service_enabled" {
@@ -240,6 +235,11 @@ output "intranode_visibility_enabled" {
240235
value = local.cluster_intranode_visibility_enabled
241236
}
242237

238+
output "secret_manager_addon_enabled" {
239+
description = "Whether Secret Manager add-on is enabled"
240+
value = local.cluster_secret_manager_addon_enabled
241+
}
242+
243243
output "fleet_membership" {
244244
description = "Fleet membership (if registered)"
245245
value = local.fleet_membership

Diff for: ‎autogen/main/variables.tf.tmpl

+6-6
Original file line numberDiff line numberDiff line change
@@ -613,6 +613,12 @@ variable "enable_confidential_nodes" {
613613
description = "An optional flag to enable confidential node config."
614614
default = false
615615
}
616+
617+
variable "enable_secret_manager_addon" {
618+
description = "Enable the Secret Manager add-on for this cluster"
619+
type = bool
620+
default = false
621+
}
616622
{% if beta_cluster %}
617623

618624
variable "workload_vulnerability_mode" {
@@ -632,12 +638,6 @@ variable "enable_fqdn_network_policy" {
632638
description = "Enable FQDN Network Policies on the cluster"
633639
default = null
634640
}
635-
636-
variable "enable_secret_manager_addon" {
637-
description = "(Beta) Enable the Secret Manager add-on for this cluster"
638-
type = bool
639-
default = false
640-
}
641641
{% endif %}
642642

643643
variable "enable_cilium_clusterwide_network_policy" {

Diff for: ‎autogen/main/versions.tf.tmpl

+3-3
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ terraform {
2424
required_providers {
2525
google = {
2626
source = "hashicorp/google"
27-
version = ">= 5.44.2, !=6.0.0, !=6.0.1, !=6.1.0, !=6.2.0, !=6.3.0, !=6.4.0, !=6.5.0, !=6.6.0, < 7"
27+
version = ">= 6.7.0, < 7"
2828
}
2929
google-beta = {
3030
source = "hashicorp/google-beta"
31-
version = ">= 5.44.2, !=6.0.0, !=6.0.1, !=6.1.0, !=6.2.0, !=6.3.0, !=6.4.0, !=6.5.0, !=6.6.0, < 7"
31+
version = ">= 6.7.0, < 7"
3232
}
3333
kubernetes = {
3434
source = "hashicorp/kubernetes"
@@ -86,7 +86,7 @@ terraform {
8686
required_providers {
8787
google = {
8888
source = "hashicorp/google"
89-
version = ">= 5.44.2, !=6.0.0, !=6.0.1, !=6.1.0, !=6.2.0, !=6.3.0, !=6.4.0, !=6.5.0, !=6.6.0, < 7"
89+
version = ">= 6.7.0, < 7"
9090
}
9191
kubernetes = {
9292
source = "hashicorp/kubernetes"

Diff for: ‎cluster.tf

+7
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,13 @@ resource "google_container_cluster" "primary" {
189189

190190
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
191191

192+
dynamic "secret_manager_config" {
193+
for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
194+
content {
195+
enabled = secret_manager_config.value
196+
}
197+
}
198+
192199
dynamic "master_authorized_networks_config" {
193200
for_each = var.gcp_public_cidrs_access_enabled != null || length(var.master_authorized_networks) > 0 ? [true] : []
194201
content {

Diff for: ‎examples/simple_regional_private/main.tf

+17-16
Original file line numberDiff line numberDiff line change
@@ -36,22 +36,23 @@ module "gke" {
3636
source = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster"
3737
version = "~> 34.0"
3838

39-
project_id = var.project_id
40-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
41-
regional = true
42-
region = var.region
43-
network = var.network
44-
subnetwork = var.subnetwork
45-
ip_range_pods = var.ip_range_pods
46-
ip_range_services = var.ip_range_services
47-
create_service_account = false
48-
service_account = var.compute_engine_service_account
49-
enable_private_endpoint = true
50-
enable_private_nodes = true
51-
master_ipv4_cidr_block = "172.16.0.0/28"
52-
default_max_pods_per_node = 20
53-
remove_default_node_pool = true
54-
deletion_protection = false
39+
project_id = var.project_id
40+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
41+
regional = true
42+
region = var.region
43+
network = var.network
44+
subnetwork = var.subnetwork
45+
ip_range_pods = var.ip_range_pods
46+
ip_range_services = var.ip_range_services
47+
create_service_account = false
48+
service_account = var.compute_engine_service_account
49+
enable_private_endpoint = true
50+
enable_private_nodes = true
51+
enable_secret_manager_addon = true
52+
master_ipv4_cidr_block = "172.16.0.0/28"
53+
default_max_pods_per_node = 20
54+
remove_default_node_pool = true
55+
deletion_protection = false
5556

5657
node_pools = [
5758
{

Diff for: ‎main.tf

+2
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ locals {
125125
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling[0].enabled : false
126126
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
127127
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config[0].enabled : false
128+
cluster_output_secret_manager_addon_enabled = google_container_cluster.primary.secret_manager_config != null && length(google_container_cluster.primary.secret_manager_config) == 1 ? google_container_cluster.primary.secret_manager_config[0].enabled : false
128129

129130
cluster_output_node_pools_names = concat(
130131
[for np in google_container_node_pool.pools : np.name], [""],
@@ -166,6 +167,7 @@ locals {
166167
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
167168
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
168169
cluster_identity_service_enabled = local.cluster_output_identity_service_enabled
170+
cluster_secret_manager_addon_enabled = local.cluster_output_secret_manager_addon_enabled
169171
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
170172
enable_certificates = var.enable_mesh_certificates
171173
}] : []

Diff for: ‎modules/beta-autopilot-private-cluster/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ Then perform the following commands on the root folder:
9999
| enable\_private\_endpoint | Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
100100
| enable\_private\_nodes | Whether nodes have internal IP addresses only | `bool` | `true` | no |
101101
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
102-
| enable\_secret\_manager\_addon | (Beta) Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
102+
| enable\_secret\_manager\_addon | Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
103103
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
104104
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `true` | no |
105105
| filestore\_csi\_driver | The status of the Filestore CSI driver addon, which allows the usage of filestore instance as volumes | `bool` | `false` | no |

Diff for: ‎modules/beta-autopilot-private-cluster/main.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -91,11 +91,11 @@ locals {
9191
cluster_output_vertical_pod_autoscaling_enabled = google_container_cluster.primary.vertical_pod_autoscaling != null && length(google_container_cluster.primary.vertical_pod_autoscaling) == 1 ? google_container_cluster.primary.vertical_pod_autoscaling[0].enabled : false
9292
cluster_output_intranode_visbility_enabled = google_container_cluster.primary.enable_intranode_visibility
9393
cluster_output_identity_service_enabled = google_container_cluster.primary.identity_service_config != null && length(google_container_cluster.primary.identity_service_config) == 1 ? google_container_cluster.primary.identity_service_config[0].enabled : false
94+
cluster_output_secret_manager_addon_enabled = google_container_cluster.primary.secret_manager_config != null && length(google_container_cluster.primary.secret_manager_config) == 1 ? google_container_cluster.primary.secret_manager_config[0].enabled : false
9495

9596
# BETA features
96-
cluster_output_istio_disabled = google_container_cluster.primary.addons_config[0].istio_config != null && length(google_container_cluster.primary.addons_config[0].istio_config) == 1 ? google_container_cluster.primary.addons_config[0].istio_config[0].disabled : false
97-
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config[0].enabled : false
98-
cluster_output_secret_manager_addon_enabled = google_container_cluster.primary.secret_manager_config != null && length(google_container_cluster.primary.secret_manager_config) == 1 ? google_container_cluster.primary.secret_manager_config[0].enabled : false
97+
cluster_output_istio_disabled = google_container_cluster.primary.addons_config[0].istio_config != null && length(google_container_cluster.primary.addons_config[0].istio_config) == 1 ? google_container_cluster.primary.addons_config[0].istio_config[0].disabled : false
98+
cluster_output_pod_security_policy_enabled = google_container_cluster.primary.pod_security_policy_config != null && length(google_container_cluster.primary.pod_security_policy_config) == 1 ? google_container_cluster.primary.pod_security_policy_config[0].enabled : false
9999

100100
# /BETA features
101101

@@ -125,11 +125,11 @@ locals {
125125
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
126126
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
127127
cluster_identity_service_enabled = local.cluster_output_identity_service_enabled
128+
cluster_secret_manager_addon_enabled = local.cluster_output_secret_manager_addon_enabled
128129

129130
# BETA features
130-
cluster_istio_enabled = !local.cluster_output_istio_disabled
131-
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
132-
cluster_secret_manager_addon_enabled = local.cluster_output_secret_manager_addon_enabled
131+
cluster_istio_enabled = !local.cluster_output_istio_disabled
132+
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
133133

134134
# /BETA features
135135

Diff for: ‎modules/beta-autopilot-private-cluster/outputs.tf

+5-5
Original file line numberDiff line numberDiff line change
@@ -179,11 +179,6 @@ output "pod_security_policy_enabled" {
179179
value = local.cluster_pod_security_policy_enabled
180180
}
181181

182-
output "secret_manager_addon_enabled" {
183-
description = "Whether Secret Manager add-on is enabled"
184-
value = local.cluster_secret_manager_addon_enabled
185-
}
186-
187182
output "identity_service_enabled" {
188183
description = "Whether Identity Service is enabled"
189184
value = local.cluster_identity_service_enabled
@@ -194,6 +189,11 @@ output "intranode_visibility_enabled" {
194189
value = local.cluster_intranode_visibility_enabled
195190
}
196191

192+
output "secret_manager_addon_enabled" {
193+
description = "Whether Secret Manager add-on is enabled"
194+
value = local.cluster_secret_manager_addon_enabled
195+
}
196+
197197
output "fleet_membership" {
198198
description = "Fleet membership (if registered)"
199199
value = local.fleet_membership

Diff for: ‎modules/beta-autopilot-private-cluster/variables.tf

+6-6
Original file line numberDiff line numberDiff line change
@@ -382,6 +382,12 @@ variable "enable_confidential_nodes" {
382382
default = false
383383
}
384384

385+
variable "enable_secret_manager_addon" {
386+
description = "Enable the Secret Manager add-on for this cluster"
387+
type = bool
388+
default = false
389+
}
390+
385391
variable "workload_vulnerability_mode" {
386392
description = "(beta) Sets which mode to use for Protect workload vulnerability scanning feature. Accepted values are DISABLED, BASIC."
387393
type = string
@@ -400,12 +406,6 @@ variable "enable_fqdn_network_policy" {
400406
default = null
401407
}
402408

403-
variable "enable_secret_manager_addon" {
404-
description = "(Beta) Enable the Secret Manager add-on for this cluster"
405-
type = bool
406-
default = false
407-
}
408-
409409
variable "enable_cilium_clusterwide_network_policy" {
410410
type = bool
411411
description = "Enable Cilium Cluster Wide Network Policies on the cluster"

Diff for: ‎modules/beta-autopilot-public-cluster/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ Then perform the following commands on the root folder:
9090
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
9191
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
9292
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
93-
| enable\_secret\_manager\_addon | (Beta) Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
93+
| enable\_secret\_manager\_addon | Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
9494
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
9595
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `true` | no |
9696
| filestore\_csi\_driver | The status of the Filestore CSI driver addon, which allows the usage of filestore instance as volumes | `bool` | `false` | no |

0 commit comments

Comments
 (0)