Skip to content
This repository was archived by the owner on Jan 6, 2023. It is now read-only.

Commit 1cf47ca

Browse files
mmontanmmontan
committed
# This is a combination of 6 commits.
# This is the 1st commit message: Initial definition of a Safer Cluster module. # This is the commit message terraform-google-modules#2: Add a sample for using the safer-cluster module. # This is the commit message terraform-google-modules#3: Add a test kitchen instance # This is the commit message terraform-google-modules#4: Formatting TF files. # This is the commit message terraform-google-modules#5: Add a test for the safer-cluster module # This is the commit message terraform-google-modules#6: Additional fixes
1 parent 6dae1f3 commit 1cf47ca

23 files changed

+924
-1
lines changed

‎.kitchen.yml

+22-1
Original file line numberDiff line numberDiff line change
@@ -50,13 +50,34 @@ suites:
5050
systems:
5151
- name: node_pool
5252
backend: local
53-
- name: "shared_vpc"
53+
- name: "simple_regional_private"
54+
driver:
55+
root_module_directory: test/fixtures/simple_regional_private
56+
verifier:
57+
systems:
58+
- name: simple_regional_private
59+
backend: local
60+
- name: "shared_vpc"
5461
driver:
5562
root_module_directory: test/fixtures/shared_vpc
5663
verifier:
5764
systems:
5865
- name: shared_vpc
5966
backend: local
67+
- name: "safer_cluster"
68+
driver:
69+
root_module_directory: test/fixtures/safer_cluster
70+
verifier:
71+
systems:
72+
- name: safer_cluster
73+
backend: local
74+
- name: "simple_regional"
75+
driver:
76+
root_module_directory: test/fixtures/simple_regional
77+
verifier:
78+
systems:
79+
- name: simple_regional
80+
backend: local
6081
- name: "simple_regional"
6182
driver:
6283
root_module_directory: test/fixtures/simple_regional

‎examples/safer_cluster/README.md

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Simple Regional Cluster
2+
3+
This example illustrates how to create a simple private cluster with beta features.
4+
5+
[^]: (autogen_docs_start)
6+
7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|:----:|:-----:|:-----:|
11+
| cloudrun | Boolean to enable / disable CloudRun | string | `"true"` | no |
12+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
13+
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
14+
| credentials\_path | The path to the GCP credentials JSON file | string | n/a | yes |
15+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
16+
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
17+
| istio | Boolean to enable / disable Istio | string | `"true"` | no |
18+
| network | The VPC network to host the cluster in | string | n/a | yes |
19+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
20+
| region | The region to host the cluster in | string | n/a | yes |
21+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
22+
23+
## Outputs
24+
25+
| Name | Description |
26+
|------|-------------|
27+
| ca\_certificate | |
28+
| client\_token | |
29+
| cluster\_name | Cluster name |
30+
| credentials\_path | |
31+
| ip\_range\_pods | The secondary IP range used for pods |
32+
| ip\_range\_services | The secondary IP range used for services |
33+
| kubernetes\_endpoint | |
34+
| location | |
35+
| master\_kubernetes\_version | The master Kubernetes version |
36+
| network | |
37+
| project\_id | |
38+
| region | |
39+
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
40+
| subnetwork | |
41+
| zones | List of zones in which the cluster resides |
42+
43+
[^]: (autogen_docs_end)
44+
45+
To provision this example, run the following from within this directory:
46+
- `terraform init` to get the plugins
47+
- `terraform plan` to see the infrastructure plan
48+
- `terraform apply` to apply the infrastructure build
49+
- `terraform destroy` to destroy the built infrastructure

‎examples/safer_cluster/main.tf

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "safer-cluster"
19+
}
20+
21+
provider "google-beta" {
22+
version = "~> 2.12.0"
23+
credentials = file(var.credentials_path)
24+
region = var.region
25+
}
26+
27+
data "google_compute_subnetwork" "subnetwork" {
28+
name = var.subnetwork
29+
project = var.project_id
30+
region = var.region
31+
}
32+
33+
module "gke" {
34+
source = "../../modules/safer-cluster/"
35+
project_id = var.project_id
36+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
37+
regional = true
38+
region = var.region
39+
network = var.network
40+
subnetwork = var.subnetwork
41+
ip_range_pods = var.ip_range_pods
42+
ip_range_services = var.ip_range_services
43+
master_ipv4_cidr_block = "172.16.0.0/28"
44+
45+
istio = var.istio
46+
cloudrun = var.cloudrun
47+
}
48+
49+
data "google_client_config" "default" {
50+
}
51+

‎examples/safer_cluster/outputs.tf

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = module.gke.endpoint
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = base64encode(data.google_client_config.default.access_token)
25+
}
26+
27+
output "ca_certificate" {
28+
value = module.gke.ca_certificate
29+
}
30+
31+
output "service_account" {
32+
description = "The service account to default running nodes as if not overridden in `node_pools`."
33+
value = module.gke.service_account
34+
}
35+

‎examples/safer_cluster/test_outputs.tf

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../test/fixtures/all_examples/test_outputs.tf

‎examples/safer_cluster/variables.tf

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "credentials_path" {
22+
description = "The path to the GCP credentials JSON file"
23+
}
24+
25+
variable "cluster_name_suffix" {
26+
description = "A suffix to append to the default cluster name"
27+
default = ""
28+
}
29+
30+
variable "region" {
31+
description = "The region to host the cluster in"
32+
}
33+
34+
variable "network" {
35+
description = "The VPC network to host the cluster in"
36+
}
37+
38+
variable "subnetwork" {
39+
description = "The subnetwork to host the cluster in"
40+
}
41+
42+
variable "ip_range_pods" {
43+
description = "The secondary ip range to use for pods"
44+
}
45+
46+
variable "ip_range_services" {
47+
description = "The secondary ip range to use for pods"
48+
}
49+
50+
variable "istio" {
51+
description = "Boolean to enable / disable Istio"
52+
default = true
53+
}
54+
55+
variable "cloudrun" {
56+
description = "Boolean to enable / disable CloudRun"
57+
default = true
58+
}
59+

‎examples/safer_cluster/versions.tf

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 0.12"
19+
}

‎modules/safer-cluster/README.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Safer Beta Cluster
2+
3+
The module defines a safer configuration for a GKE cluster. It is based on the beta private cluster configuration, and forces certain security-relevant configurations to values that provice specific security
4+
properties.
5+
6+
[^]: (autogen_docs_start)
7+
8+
[^]: (autogen_docs_end)
9+
10+
To provision this example, run the following from within this directory:
11+
- `terraform init` to get the plugins
12+
- `terraform plan` to see the infrastructure plan
13+
- `terraform apply` to apply the infrastructure build
14+
- `terraform destroy` to destroy the built infrastructure

0 commit comments

Comments
 (0)