Skip to content

Commit fd777ad

Browse files
cirocloverciroclover
committed
feat: Support for GKE private clusters without default node pool
1 parent 98ffedd commit fd777ad

File tree

2 files changed

+89
-85
lines changed

2 files changed

+89
-85
lines changed

‎modules/private-cluster/cluster.tf

Lines changed: 87 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ resource "google_container_cluster" "primary" {
3232
cluster_ipv4_cidr = var.cluster_ipv4_cidr
3333
network = "projects/${local.network_project_id}/global/networks/${var.network}"
3434
deletion_protection = var.deletion_protection
35+
initial_node_count = length(var.node_pools) == 0 ? var.initial_node_count : null
3536

3637
dynamic "network_policy" {
3738
for_each = local.cluster_network_policy
@@ -439,112 +440,115 @@ resource "google_container_cluster" "primary" {
439440
update = lookup(var.timeouts, "update", "45m")
440441
delete = lookup(var.timeouts, "delete", "45m")
441442
}
442-
node_pool {
443-
name = "default-pool"
444-
initial_node_count = var.initial_node_count
445-
446-
management {
447-
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
448-
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade", true)
449-
}
450-
451-
node_config {
452-
image_type = lookup(var.node_pools[0], "image_type", "COS_CONTAINERD")
453-
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
454-
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
455-
enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
456-
disk_type = lookup(var.node_pools[0], "disk_type", null)
457-
dynamic "gcfs_config" {
458-
for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
459-
content {
460-
enabled = gcfs_config.value
443+
dynamic "node_pool" {
444+
for_each = length(var.node_pools) == 0 ? [] : [1]
445+
content {
446+
name = "default-pool"
447+
initial_node_count = var.initial_node_count
448+
449+
management {
450+
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
451+
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade", true)
452+
}
453+
454+
node_config {
455+
image_type = lookup(var.node_pools[0], "image_type", "COS_CONTAINERD")
456+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
457+
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
458+
enable_confidential_storage = lookup(var.node_pools[0], "enable_confidential_storage", false)
459+
disk_type = lookup(var.node_pools[0], "disk_type", null)
460+
dynamic "gcfs_config" {
461+
for_each = lookup(var.node_pools[0], "enable_gcfs", null) != null ? [var.node_pools[0].enable_gcfs] : []
462+
content {
463+
enabled = gcfs_config.value
464+
}
461465
}
462-
}
463466

464-
dynamic "gvnic" {
465-
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
466-
content {
467-
enabled = gvnic.value
467+
dynamic "gvnic" {
468+
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
469+
content {
470+
enabled = gvnic.value
471+
}
468472
}
469-
}
470473

471-
dynamic "fast_socket" {
472-
for_each = lookup(var.node_pools[0], "enable_fast_socket", null) != null ? [var.node_pools[0].enable_fast_socket] : []
473-
content {
474-
enabled = fast_socket.value
474+
dynamic "fast_socket" {
475+
for_each = lookup(var.node_pools[0], "enable_fast_socket", null) != null ? [var.node_pools[0].enable_fast_socket] : []
476+
content {
477+
enabled = fast_socket.value
478+
}
475479
}
476-
}
477480

478-
dynamic "kubelet_config" {
479-
for_each = length(setintersection(
480-
keys(var.node_pools[0]),
481-
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "insecure_kubelet_readonly_port_enabled", "pod_pids_limit", "container_log_max_size", "container_log_max_files", "image_gc_low_threshold_percent", "image_gc_high_threshold_percent", "image_minimum_gc_age", "image_maximum_gc_age", "allowed_unsafe_sysctls"]
482-
)) != 0 || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
481+
dynamic "kubelet_config" {
482+
for_each = length(setintersection(
483+
keys(var.node_pools[0]),
484+
["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "insecure_kubelet_readonly_port_enabled", "pod_pids_limit", "container_log_max_size", "container_log_max_files", "image_gc_low_threshold_percent", "image_gc_high_threshold_percent", "image_minimum_gc_age", "image_maximum_gc_age", "allowed_unsafe_sysctls"]
485+
)) != 0 || var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
483486

484-
content {
485-
cpu_manager_policy = lookup(var.node_pools[0], "cpu_manager_policy", "static")
486-
cpu_cfs_quota = lookup(var.node_pools[0], "cpu_cfs_quota", null)
487-
cpu_cfs_quota_period = lookup(var.node_pools[0], "cpu_cfs_quota_period", null)
488-
insecure_kubelet_readonly_port_enabled = lookup(var.node_pools[0], "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled) != null ? upper(tostring(lookup(var.node_pools[0], "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled))) : null
489-
pod_pids_limit = lookup(var.node_pools[0], "pod_pids_limit", null)
490-
container_log_max_size = lookup(var.node_pools[0], "container_log_max_size", null)
491-
container_log_max_files = lookup(var.node_pools[0], "container_log_max_files", null)
492-
image_gc_low_threshold_percent = lookup(var.node_pools[0], "image_gc_low_threshold_percent", null)
493-
image_gc_high_threshold_percent = lookup(var.node_pools[0], "image_gc_high_threshold_percent", null)
494-
image_minimum_gc_age = lookup(var.node_pools[0], "image_minimum_gc_age", null)
495-
image_maximum_gc_age = lookup(var.node_pools[0], "image_maximum_gc_age", null)
496-
allowed_unsafe_sysctls = lookup(var.node_pools[0], "allowed_unsafe_sysctls", null) == null ? null : [for s in split(",", lookup(var.node_pools[0], "allowed_unsafe_sysctls", null)) : trimspace(s)]
487+
content {
488+
cpu_manager_policy = lookup(var.node_pools[0], "cpu_manager_policy", "static")
489+
cpu_cfs_quota = lookup(var.node_pools[0], "cpu_cfs_quota", null)
490+
cpu_cfs_quota_period = lookup(var.node_pools[0], "cpu_cfs_quota_period", null)
491+
insecure_kubelet_readonly_port_enabled = lookup(var.node_pools[0], "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled) != null ? upper(tostring(lookup(var.node_pools[0], "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled))) : null
492+
pod_pids_limit = lookup(var.node_pools[0], "pod_pids_limit", null)
493+
container_log_max_size = lookup(var.node_pools[0], "container_log_max_size", null)
494+
container_log_max_files = lookup(var.node_pools[0], "container_log_max_files", null)
495+
image_gc_low_threshold_percent = lookup(var.node_pools[0], "image_gc_low_threshold_percent", null)
496+
image_gc_high_threshold_percent = lookup(var.node_pools[0], "image_gc_high_threshold_percent", null)
497+
image_minimum_gc_age = lookup(var.node_pools[0], "image_minimum_gc_age", null)
498+
image_maximum_gc_age = lookup(var.node_pools[0], "image_maximum_gc_age", null)
499+
allowed_unsafe_sysctls = lookup(var.node_pools[0], "allowed_unsafe_sysctls", null) == null ? null : [for s in split(",", lookup(var.node_pools[0], "allowed_unsafe_sysctls", null)) : trimspace(s)]
500+
}
497501
}
498-
}
499502

500-
dynamic "sole_tenant_config" {
501-
# node_affinity is currently the only member of sole_tenant_config
502-
for_each = lookup(var.node_pools[0], "node_affinity", null) != null ? [true] : []
503-
content {
504-
dynamic "node_affinity" {
505-
for_each = lookup(var.node_pools[0], "node_affinity", null) != null ? [lookup(var.node_pools[0], "node_affinity", null)] : []
506-
content {
507-
key = lookup(jsondecode(node_affinity.value), "key", null)
508-
operator = lookup(jsondecode(node_affinity.value), "operator", null)
509-
values = lookup(jsondecode(node_affinity.value), "values", [])
503+
dynamic "sole_tenant_config" {
504+
# node_affinity is currently the only member of sole_tenant_config
505+
for_each = lookup(var.node_pools[0], "node_affinity", null) != null ? [true] : []
506+
content {
507+
dynamic "node_affinity" {
508+
for_each = lookup(var.node_pools[0], "node_affinity", null) != null ? [lookup(var.node_pools[0], "node_affinity", null)] : []
509+
content {
510+
key = lookup(jsondecode(node_affinity.value), "key", null)
511+
operator = lookup(jsondecode(node_affinity.value), "operator", null)
512+
values = lookup(jsondecode(node_affinity.value), "values", [])
513+
}
510514
}
511515
}
512516
}
513-
}
514517

515-
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
518+
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
516519

517-
tags = concat(
518-
lookup(local.node_pools_tags, "default_values", [true, true])[0] ? [local.cluster_network_tag] : [],
519-
lookup(local.node_pools_tags, "default_values", [true, true])[1] ? ["${local.cluster_network_tag}-default-pool"] : [],
520-
lookup(local.node_pools_tags, "all", []),
521-
lookup(local.node_pools_tags, var.node_pools[0].name, []),
522-
)
520+
tags = concat(
521+
lookup(local.node_pools_tags, "default_values", [true, true])[0] ? [local.cluster_network_tag] : [],
522+
lookup(local.node_pools_tags, "default_values", [true, true])[1] ? ["${local.cluster_network_tag}-default-pool"] : [],
523+
lookup(local.node_pools_tags, "all", []),
524+
lookup(local.node_pools_tags, var.node_pools[0].name, []),
525+
)
523526

524-
logging_variant = lookup(var.node_pools[0], "logging_variant", "DEFAULT")
527+
logging_variant = lookup(var.node_pools[0], "logging_variant", "DEFAULT")
525528

526-
dynamic "workload_metadata_config" {
527-
for_each = local.cluster_node_metadata_config
529+
dynamic "workload_metadata_config" {
530+
for_each = local.cluster_node_metadata_config
528531

529-
content {
530-
mode = workload_metadata_config.value.mode
532+
content {
533+
mode = workload_metadata_config.value.mode
534+
}
531535
}
532-
}
533536

534-
metadata = local.node_pools_metadata["all"]
537+
metadata = local.node_pools_metadata["all"]
535538

536-
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
539+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
537540

538-
storage_pools = lookup(var.node_pools[0], "storage_pools", null) != null ? [var.node_pools[0].storage_pools] : []
541+
storage_pools = lookup(var.node_pools[0], "storage_pools", null) != null ? [var.node_pools[0].storage_pools] : []
539542

540-
shielded_instance_config {
541-
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
542-
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
543-
}
543+
shielded_instance_config {
544+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
545+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
546+
}
544547

545-
local_ssd_encryption_mode = lookup(var.node_pools[0], "local_ssd_encryption_mode", null)
546-
max_run_duration = lookup(var.node_pools[0], "max_run_duration", null)
547-
flex_start = lookup(var.node_pools[0], "flex_start", null)
548+
local_ssd_encryption_mode = lookup(var.node_pools[0], "local_ssd_encryption_mode", null)
549+
max_run_duration = lookup(var.node_pools[0], "max_run_duration", null)
550+
flex_start = lookup(var.node_pools[0], "flex_start", null)
551+
}
548552
}
549553
}
550554

‎modules/private-cluster/main.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,8 @@ locals {
152152
cluster_zones = sort(local.cluster_output_zones)
153153

154154
// node pool ID is in the form projects/<project-id>/locations/<location>/clusters/<cluster-name>/nodePools/<nodepool-name>
155-
cluster_name_parts_from_nodepool = split("/", element(values(google_container_node_pool.pools)[*].id, 0))
156-
cluster_name_computed = element(local.cluster_name_parts_from_nodepool, length(local.cluster_name_parts_from_nodepool) - 3)
155+
cluster_name_parts_from_nodepool = length(var.node_pools) == 0 ? [] : split("/", element(values(google_container_node_pool.pools)[*].id, 0))
156+
cluster_name_computed = length(var.node_pools) == 0 ? var.name : element(local.cluster_name_parts_from_nodepool, length(local.cluster_name_parts_from_nodepool) - 3)
157157
cluster_network_tag = "gke-${var.name}"
158158
cluster_ca_certificate = local.cluster_master_auth_map["cluster_ca_certificate"]
159159
cluster_master_version = local.cluster_output_master_version

0 commit comments

Comments
 (0)