Skip to content

Commit 96626d5

Browse files
wyardleywyardley
authored
feat(TPG>=5.44.2)!: add standard cluster support for insecureKubeletReadonlyPortEnabled (#2082)
1 parent 66231d5 commit 96626d5

File tree

34 files changed

+217
-111
lines changed

34 files changed

+217
-111
lines changed

Diff for: ‎README.md

+2
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ Then perform the following commands on the root folder:
190190
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
191191
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
192192
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
193+
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. Note: this can be set at the node pool level separately within `node_pools`. | `bool` | `null` | no |
193194
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
194195
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
195196
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
@@ -319,6 +320,7 @@ The node_pools variable takes the following parameters:
319320
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
320321
| image_type | The image type to use for this node. Note that changing the image type will delete and recreate all nodes in the node pool | COS_CONTAINERD | Optional |
321322
| initial_node_count | The initial number of nodes for the pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Changing this will force recreation of the resource. Defaults to the value of min_count | " " | Optional |
323+
| insecure_kubelet_readonly_port_enabled | (boolean) Whether or not to enable the insecure Kubelet readonly port. | null | Optional |
322324
| key | The key required for the taint | | Required |
323325
| logging_variant | The type of logging agent that is deployed by default for newly created node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. | DEFAULT | Optional |
324326
| local_ssd_count | The amount of local SSD disks that will be attached to each cluster node and may be used as a `hostpath` volume or a `local` PersistentVolume. | 0 | Optional |

Diff for: ‎autogen/main/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,7 @@ The node_pools variable takes the following parameters:
213213
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
214214
| image_type | The image type to use for this node. Note that changing the image type will delete and recreate all nodes in the node pool | COS_CONTAINERD | Optional |
215215
| initial_node_count | The initial number of nodes for the pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Changing this will force recreation of the resource. Defaults to the value of min_count | " " | Optional |
216+
| insecure_kubelet_readonly_port_enabled | (boolean) Whether or not to enable the insecure Kubelet readonly port. | null | Optional |
216217
| key | The key required for the taint | | Required |
217218
| logging_variant | The type of logging agent that is deployed by default for newly created node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. | DEFAULT | Optional |
218219
| local_ssd_count | The amount of local SSD disks that will be attached to each cluster node and may be used as a `hostpath` volume or a `local` PersistentVolume. | 0 | Optional |

Diff for: ‎autogen/main/cluster.tf.tmpl

+10-8
Original file line numberDiff line numberDiff line change
@@ -661,7 +661,6 @@ resource "google_container_cluster" "primary" {
661661
}
662662
}
663663
}
664-
{% if beta_cluster %}
665664

666665
node_pool_defaults {
667666
node_config_defaults {
@@ -675,15 +674,17 @@ resource "google_container_cluster" "primary" {
675674
}
676675
{% endif %}
677676
{% if autopilot_cluster != true %}
677+
{% if beta_cluster %}
678678
gcfs_config {
679679
enabled = var.enable_gcfs
680680
}
681681
{% endif %}
682+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
683+
{% endif %}
682684
}
683685
}
684-
{% endif %}
685-
{% if beta_cluster %}
686686

687+
{% if beta_cluster %}
687688
depends_on = [google_project_iam_member.service_agent]
688689
{% endif %}
689690
}
@@ -1046,14 +1047,15 @@ resource "google_container_node_pool" "windows_pools" {
10461047
dynamic "kubelet_config" {
10471048
for_each = length(setintersection(
10481049
keys(each.value),
1049-
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"]
1050+
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "insecure_kubelet_readonly_port_enabled", "pod_pids_limit"]
10501051
)) != 0 ? [1] : []
10511052

10521053
content {
1053-
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
1054-
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
1055-
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1056-
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
1054+
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
1055+
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
1056+
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1057+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1058+
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
10571059
}
10581060
}
10591061
{% if beta_cluster %}

Diff for: ‎autogen/main/variables.tf.tmpl

+6
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,12 @@ variable "service_external_ips" {
109109
}
110110

111111
{% if autopilot_cluster != true %}
112+
variable "insecure_kubelet_readonly_port_enabled" {
113+
type = bool
114+
description = "Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. Note: this can be set at the node pool level separately within `node_pools`."
115+
default = null
116+
}
117+
112118
variable "datapath_provider" {
113119
type = string
114120
description = "The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature."

Diff for: ‎autogen/main/versions.tf.tmpl

+3-3
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ terraform {
2424
required_providers {
2525
google = {
2626
source = "hashicorp/google"
27-
version = ">= 5.40.0, < 7"
27+
version = ">= 5.44.2, !=6.0.0, !=6.0.1, !=6.1.0, !=6.2.0, !=6.3.0, !=6.4.0, !=6.5.0, !=6.6.0, < 7"
2828
}
2929
google-beta = {
3030
source = "hashicorp/google-beta"
31-
version = ">= 5.40.0, < 7"
31+
version = ">= 5.44.2, !=6.0.0, !=6.0.1, !=6.1.0, !=6.2.0, !=6.3.0, !=6.4.0, !=6.5.0, !=6.6.0, < 7"
3232
}
3333
kubernetes = {
3434
source = "hashicorp/kubernetes"
@@ -89,7 +89,7 @@ terraform {
8989
required_providers {
9090
google = {
9191
source = "hashicorp/google"
92-
version = ">= 5.40.0, < 7"
92+
version = ">= 5.44.2, !=6.0.0, !=6.0.1, !=6.1.0, !=6.2.0, !=6.3.0, !=6.4.0, !=6.5.0, !=6.6.0, < 7"
9393
}
9494
kubernetes = {
9595
source = "hashicorp/kubernetes"

Diff for: ‎cluster.tf

+19-10
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,13 @@ resource "google_container_cluster" "primary" {
500500
}
501501
}
502502
}
503+
504+
node_pool_defaults {
505+
node_config_defaults {
506+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
507+
}
508+
}
509+
503510
}
504511
/******************************************
505512
Create Container Cluster node pools
@@ -739,14 +746,15 @@ resource "google_container_node_pool" "pools" {
739746
dynamic "kubelet_config" {
740747
for_each = length(setintersection(
741748
keys(each.value),
742-
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"]
749+
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "insecure_kubelet_readonly_port_enabled", "pod_pids_limit"]
743750
)) != 0 ? [1] : []
744751

745752
content {
746-
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
747-
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
748-
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
749-
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
753+
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
754+
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
755+
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
756+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
757+
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
750758
}
751759
}
752760

@@ -1029,14 +1037,15 @@ resource "google_container_node_pool" "windows_pools" {
10291037
dynamic "kubelet_config" {
10301038
for_each = length(setintersection(
10311039
keys(each.value),
1032-
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"]
1040+
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "insecure_kubelet_readonly_port_enabled", "pod_pids_limit"]
10331041
)) != 0 ? [1] : []
10341042

10351043
content {
1036-
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
1037-
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
1038-
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1039-
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
1044+
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
1045+
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
1046+
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1047+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1048+
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
10401049
}
10411050
}
10421051

Diff for: ‎examples/node_pool/main.tf

+15-14
Original file line numberDiff line numberDiff line change
@@ -67,20 +67,21 @@ module "gke" {
6767
service_account = var.compute_engine_service_account
6868
},
6969
{
70-
name = "pool-03"
71-
machine_type = "n1-standard-2"
72-
node_locations = "${var.region}-b,${var.region}-c"
73-
autoscaling = false
74-
node_count = 2
75-
disk_type = "pd-standard"
76-
auto_upgrade = true
77-
service_account = var.compute_engine_service_account
78-
pod_range = "test"
79-
sandbox_enabled = true
80-
cpu_manager_policy = "static"
81-
cpu_cfs_quota = true
82-
local_ssd_ephemeral_count = 2
83-
pod_pids_limit = 4096
70+
name = "pool-03"
71+
machine_type = "n1-standard-2"
72+
node_locations = "${var.region}-b,${var.region}-c"
73+
autoscaling = false
74+
node_count = 2
75+
disk_type = "pd-standard"
76+
auto_upgrade = true
77+
service_account = var.compute_engine_service_account
78+
pod_range = "test"
79+
sandbox_enabled = true
80+
cpu_manager_policy = "static"
81+
cpu_cfs_quota = true
82+
insecure_kubelet_readonly_port_enabled = "FALSE"
83+
local_ssd_ephemeral_count = 2
84+
pod_pids_limit = 4096
8485
},
8586
{
8687
name = "pool-04"

Diff for: ‎examples/node_pool_update_variant/main.tf

+6-5
Original file line numberDiff line numberDiff line change
@@ -61,11 +61,12 @@ module "gke" {
6161

6262
node_pools = [
6363
{
64-
name = "pool-01"
65-
min_count = 1
66-
max_count = 2
67-
service_account = var.compute_engine_service_account
68-
auto_upgrade = true
64+
name = "pool-01"
65+
min_count = 1
66+
max_count = 2
67+
service_account = var.compute_engine_service_account
68+
auto_upgrade = true
69+
insecure_kubelet_readonly_port_enabled = "FALSE"
6970
},
7071
{
7172
name = "pool-02"

Diff for: ‎modules/beta-private-cluster-update-variant/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,7 @@ Then perform the following commands on the root folder:
233233
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
234234
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
235235
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
236+
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. Note: this can be set at the node pool level separately within `node_pools`. | `bool` | `null` | no |
236237
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
237238
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
238239
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
@@ -377,6 +378,7 @@ The node_pools variable takes the following parameters:
377378
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |
378379
| image_type | The image type to use for this node. Note that changing the image type will delete and recreate all nodes in the node pool | COS_CONTAINERD | Optional |
379380
| initial_node_count | The initial number of nodes for the pool. In regional or multi-zonal clusters, this is the number of nodes per zone. Changing this will force recreation of the resource. Defaults to the value of min_count | " " | Optional |
381+
| insecure_kubelet_readonly_port_enabled | (boolean) Whether or not to enable the insecure Kubelet readonly port. | null | Optional |
380382
| key | The key required for the taint | | Required |
381383
| logging_variant | The type of logging agent that is deployed by default for newly created node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. | DEFAULT | Optional |
382384
| local_ssd_count | The amount of local SSD disks that will be attached to each cluster node and may be used as a `hostpath` volume or a `local` PersistentVolume. | 0 | Optional |

Diff for: ‎modules/beta-private-cluster-update-variant/cluster.tf

+13-10
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,7 @@ resource "google_container_cluster" "primary" {
581581
gcfs_config {
582582
enabled = var.enable_gcfs
583583
}
584+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
584585
}
585586
}
586587

@@ -915,14 +916,15 @@ resource "google_container_node_pool" "pools" {
915916
dynamic "kubelet_config" {
916917
for_each = length(setintersection(
917918
keys(each.value),
918-
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"]
919+
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "insecure_kubelet_readonly_port_enabled", "pod_pids_limit"]
919920
)) != 0 ? [1] : []
920921

921922
content {
922-
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
923-
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
924-
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
925-
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
923+
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
924+
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
925+
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
926+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
927+
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
926928
}
927929
}
928930

@@ -1219,14 +1221,15 @@ resource "google_container_node_pool" "windows_pools" {
12191221
dynamic "kubelet_config" {
12201222
for_each = length(setintersection(
12211223
keys(each.value),
1222-
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"]
1224+
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "insecure_kubelet_readonly_port_enabled", "pod_pids_limit"]
12231225
)) != 0 ? [1] : []
12241226

12251227
content {
1226-
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
1227-
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
1228-
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1229-
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
1228+
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
1229+
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
1230+
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1231+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1232+
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
12301233
}
12311234
}
12321235

Diff for: ‎modules/beta-private-cluster-update-variant/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,12 @@ variable "service_external_ips" {
108108
default = false
109109
}
110110

111+
variable "insecure_kubelet_readonly_port_enabled" {
112+
type = bool
113+
description = "Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. Note: this can be set at the node pool level separately within `node_pools`."
114+
default = null
115+
}
116+
111117
variable "datapath_provider" {
112118
type = string
113119
description = "The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature."

Diff for: ‎modules/beta-private-cluster-update-variant/versions.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 5.40.0, < 7"
24+
version = ">= 5.44.2, !=6.0.0, !=6.0.1, !=6.1.0, !=6.2.0, !=6.3.0, !=6.4.0, !=6.5.0, !=6.6.0, < 7"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 5.40.0, < 7"
28+
version = ">= 5.44.2, !=6.0.0, !=6.0.1, !=6.1.0, !=6.2.0, !=6.3.0, !=6.4.0, !=6.5.0, !=6.6.0, < 7"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

0 commit comments

Comments
 (0)