diff --git a/README.md b/README.md
index 5c569a14e6..cd04741814 100644
--- a/README.md
+++ b/README.md
@@ -143,7 +143,7 @@ Then perform the following commands on the root folder:
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
-| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
+| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
enable_secure_boot = optional(bool, false)
enable_integrity_monitoring = optional(bool, true)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enable_integrity_monitoring": true,
"enable_secure_boot": false,
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |
diff --git a/autogen/main/cluster.tf.tmpl b/autogen/main/cluster.tf.tmpl
index 4e8fad174d..859499c51a 100644
--- a/autogen/main/cluster.tf.tmpl
+++ b/autogen/main/cluster.tf.tmpl
@@ -166,6 +166,11 @@ resource "google_container_cluster" "primary" {
}
}
+ shielded_instance_config {
+ enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
+ enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
+ }
+
{% if beta_cluster %}
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
{% endif %}
diff --git a/autogen/main/variables.tf.tmpl b/autogen/main/variables.tf.tmpl
index 124ff5c863..375df975b5 100644
--- a/autogen/main/variables.tf.tmpl
+++ b/autogen/main/variables.tf.tmpl
@@ -244,39 +244,43 @@ variable "enable_resource_consumption_export" {
{% if autopilot_cluster != true %}
variable "cluster_autoscaling" {
type = object({
- enabled = bool
- autoscaling_profile = string
- min_cpu_cores = number
- max_cpu_cores = number
- min_memory_gb = number
- max_memory_gb = number
- gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
- auto_repair = bool
- auto_upgrade = bool
- disk_size = optional(number)
- disk_type = optional(string)
- image_type = optional(string)
- strategy = optional(string)
- max_surge = optional(number)
- max_unavailable = optional(number)
- node_pool_soak_duration = optional(string)
- batch_soak_duration = optional(string)
- batch_percentage = optional(number)
- batch_node_count = optional(number)
+ enabled = bool
+ autoscaling_profile = string
+ min_cpu_cores = number
+ max_cpu_cores = number
+ min_memory_gb = number
+ max_memory_gb = number
+ gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
+ auto_repair = bool
+ auto_upgrade = bool
+ disk_size = optional(number)
+ disk_type = optional(string)
+ image_type = optional(string)
+ strategy = optional(string)
+ max_surge = optional(number)
+ max_unavailable = optional(number)
+ node_pool_soak_duration = optional(string)
+ batch_soak_duration = optional(string)
+ batch_percentage = optional(number)
+ batch_node_count = optional(number)
+ enable_secure_boot = optional(bool, false)
+ enable_integrity_monitoring = optional(bool, true)
})
default = {
- enabled = false
- autoscaling_profile = "BALANCED"
- max_cpu_cores = 0
- min_cpu_cores = 0
- max_memory_gb = 0
- min_memory_gb = 0
- gpu_resources = []
- auto_repair = true
- auto_upgrade = true
- disk_size = 100
- disk_type = "pd-standard"
- image_type = "COS_CONTAINERD"
+ enabled = false
+ autoscaling_profile = "BALANCED"
+ max_cpu_cores = 0
+ min_cpu_cores = 0
+ max_memory_gb = 0
+ min_memory_gb = 0
+ gpu_resources = []
+ auto_repair = true
+ auto_upgrade = true
+ disk_size = 100
+ disk_type = "pd-standard"
+ image_type = "COS_CONTAINERD"
+ enable_secure_boot = false
+ enable_integrity_monitoring = true
}
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
}
diff --git a/cluster.tf b/cluster.tf
index bc391b164d..7bb3a42d4e 100644
--- a/cluster.tf
+++ b/cluster.tf
@@ -139,6 +139,11 @@ resource "google_container_cluster" "primary" {
}
}
+ shielded_instance_config {
+ enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
+ enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
+ }
+
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")
}
diff --git a/modules/beta-private-cluster-update-variant/README.md b/modules/beta-private-cluster-update-variant/README.md
index 45f5eb13d0..df021bbc49 100644
--- a/modules/beta-private-cluster-update-variant/README.md
+++ b/modules/beta-private-cluster-update-variant/README.md
@@ -176,7 +176,7 @@ Then perform the following commands on the root folder:
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
| cloudrun\_load\_balancer\_type | (Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer. | `string` | `""` | no |
-| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
+| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
enable_secure_boot = optional(bool, false)
enable_integrity_monitoring = optional(bool, true)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enable_integrity_monitoring": true,
"enable_secure_boot": false,
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |
diff --git a/modules/beta-private-cluster-update-variant/cluster.tf b/modules/beta-private-cluster-update-variant/cluster.tf
index 093d8d651e..a5b96fd63c 100644
--- a/modules/beta-private-cluster-update-variant/cluster.tf
+++ b/modules/beta-private-cluster-update-variant/cluster.tf
@@ -145,6 +145,11 @@ resource "google_container_cluster" "primary" {
}
}
+ shielded_instance_config {
+ enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
+ enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
+ }
+
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")
diff --git a/modules/beta-private-cluster-update-variant/variables.tf b/modules/beta-private-cluster-update-variant/variables.tf
index da2a3d8b97..f5bae458a5 100644
--- a/modules/beta-private-cluster-update-variant/variables.tf
+++ b/modules/beta-private-cluster-update-variant/variables.tf
@@ -239,39 +239,43 @@ variable "enable_resource_consumption_export" {
variable "cluster_autoscaling" {
type = object({
- enabled = bool
- autoscaling_profile = string
- min_cpu_cores = number
- max_cpu_cores = number
- min_memory_gb = number
- max_memory_gb = number
- gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
- auto_repair = bool
- auto_upgrade = bool
- disk_size = optional(number)
- disk_type = optional(string)
- image_type = optional(string)
- strategy = optional(string)
- max_surge = optional(number)
- max_unavailable = optional(number)
- node_pool_soak_duration = optional(string)
- batch_soak_duration = optional(string)
- batch_percentage = optional(number)
- batch_node_count = optional(number)
+ enabled = bool
+ autoscaling_profile = string
+ min_cpu_cores = number
+ max_cpu_cores = number
+ min_memory_gb = number
+ max_memory_gb = number
+ gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
+ auto_repair = bool
+ auto_upgrade = bool
+ disk_size = optional(number)
+ disk_type = optional(string)
+ image_type = optional(string)
+ strategy = optional(string)
+ max_surge = optional(number)
+ max_unavailable = optional(number)
+ node_pool_soak_duration = optional(string)
+ batch_soak_duration = optional(string)
+ batch_percentage = optional(number)
+ batch_node_count = optional(number)
+ enable_secure_boot = optional(bool, false)
+ enable_integrity_monitoring = optional(bool, true)
})
default = {
- enabled = false
- autoscaling_profile = "BALANCED"
- max_cpu_cores = 0
- min_cpu_cores = 0
- max_memory_gb = 0
- min_memory_gb = 0
- gpu_resources = []
- auto_repair = true
- auto_upgrade = true
- disk_size = 100
- disk_type = "pd-standard"
- image_type = "COS_CONTAINERD"
+ enabled = false
+ autoscaling_profile = "BALANCED"
+ max_cpu_cores = 0
+ min_cpu_cores = 0
+ max_memory_gb = 0
+ min_memory_gb = 0
+ gpu_resources = []
+ auto_repair = true
+ auto_upgrade = true
+ disk_size = 100
+ disk_type = "pd-standard"
+ image_type = "COS_CONTAINERD"
+ enable_secure_boot = false
+ enable_integrity_monitoring = true
}
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
}
diff --git a/modules/beta-private-cluster/README.md b/modules/beta-private-cluster/README.md
index 2915dd3238..2fec641037 100644
--- a/modules/beta-private-cluster/README.md
+++ b/modules/beta-private-cluster/README.md
@@ -154,7 +154,7 @@ Then perform the following commands on the root folder:
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
| cloudrun\_load\_balancer\_type | (Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer. | `string` | `""` | no |
-| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
+| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
enable_secure_boot = optional(bool, false)
enable_integrity_monitoring = optional(bool, true)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enable_integrity_monitoring": true,
"enable_secure_boot": false,
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |
diff --git a/modules/beta-private-cluster/cluster.tf b/modules/beta-private-cluster/cluster.tf
index 185f113a13..4ec2614867 100644
--- a/modules/beta-private-cluster/cluster.tf
+++ b/modules/beta-private-cluster/cluster.tf
@@ -145,6 +145,11 @@ resource "google_container_cluster" "primary" {
}
}
+ shielded_instance_config {
+ enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
+ enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
+ }
+
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")
diff --git a/modules/beta-private-cluster/variables.tf b/modules/beta-private-cluster/variables.tf
index da2a3d8b97..f5bae458a5 100644
--- a/modules/beta-private-cluster/variables.tf
+++ b/modules/beta-private-cluster/variables.tf
@@ -239,39 +239,43 @@ variable "enable_resource_consumption_export" {
variable "cluster_autoscaling" {
type = object({
- enabled = bool
- autoscaling_profile = string
- min_cpu_cores = number
- max_cpu_cores = number
- min_memory_gb = number
- max_memory_gb = number
- gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
- auto_repair = bool
- auto_upgrade = bool
- disk_size = optional(number)
- disk_type = optional(string)
- image_type = optional(string)
- strategy = optional(string)
- max_surge = optional(number)
- max_unavailable = optional(number)
- node_pool_soak_duration = optional(string)
- batch_soak_duration = optional(string)
- batch_percentage = optional(number)
- batch_node_count = optional(number)
+ enabled = bool
+ autoscaling_profile = string
+ min_cpu_cores = number
+ max_cpu_cores = number
+ min_memory_gb = number
+ max_memory_gb = number
+ gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
+ auto_repair = bool
+ auto_upgrade = bool
+ disk_size = optional(number)
+ disk_type = optional(string)
+ image_type = optional(string)
+ strategy = optional(string)
+ max_surge = optional(number)
+ max_unavailable = optional(number)
+ node_pool_soak_duration = optional(string)
+ batch_soak_duration = optional(string)
+ batch_percentage = optional(number)
+ batch_node_count = optional(number)
+ enable_secure_boot = optional(bool, false)
+ enable_integrity_monitoring = optional(bool, true)
})
default = {
- enabled = false
- autoscaling_profile = "BALANCED"
- max_cpu_cores = 0
- min_cpu_cores = 0
- max_memory_gb = 0
- min_memory_gb = 0
- gpu_resources = []
- auto_repair = true
- auto_upgrade = true
- disk_size = 100
- disk_type = "pd-standard"
- image_type = "COS_CONTAINERD"
+ enabled = false
+ autoscaling_profile = "BALANCED"
+ max_cpu_cores = 0
+ min_cpu_cores = 0
+ max_memory_gb = 0
+ min_memory_gb = 0
+ gpu_resources = []
+ auto_repair = true
+ auto_upgrade = true
+ disk_size = 100
+ disk_type = "pd-standard"
+ image_type = "COS_CONTAINERD"
+ enable_secure_boot = false
+ enable_integrity_monitoring = true
}
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
}
diff --git a/modules/beta-public-cluster-update-variant/README.md b/modules/beta-public-cluster-update-variant/README.md
index e72edde309..eb71fa8cf5 100644
--- a/modules/beta-public-cluster-update-variant/README.md
+++ b/modules/beta-public-cluster-update-variant/README.md
@@ -170,7 +170,7 @@ Then perform the following commands on the root folder:
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
| cloudrun\_load\_balancer\_type | (Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer. | `string` | `""` | no |
-| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
+| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
enable_secure_boot = optional(bool, false)
enable_integrity_monitoring = optional(bool, true)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enable_integrity_monitoring": true,
"enable_secure_boot": false,
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |
diff --git a/modules/beta-public-cluster-update-variant/cluster.tf b/modules/beta-public-cluster-update-variant/cluster.tf
index 1a5b397c70..8461ae63b7 100644
--- a/modules/beta-public-cluster-update-variant/cluster.tf
+++ b/modules/beta-public-cluster-update-variant/cluster.tf
@@ -145,6 +145,11 @@ resource "google_container_cluster" "primary" {
}
}
+ shielded_instance_config {
+ enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
+ enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
+ }
+
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")
diff --git a/modules/beta-public-cluster-update-variant/variables.tf b/modules/beta-public-cluster-update-variant/variables.tf
index 6cadf89cfd..0a3b46eefb 100644
--- a/modules/beta-public-cluster-update-variant/variables.tf
+++ b/modules/beta-public-cluster-update-variant/variables.tf
@@ -239,39 +239,43 @@ variable "enable_resource_consumption_export" {
variable "cluster_autoscaling" {
type = object({
- enabled = bool
- autoscaling_profile = string
- min_cpu_cores = number
- max_cpu_cores = number
- min_memory_gb = number
- max_memory_gb = number
- gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
- auto_repair = bool
- auto_upgrade = bool
- disk_size = optional(number)
- disk_type = optional(string)
- image_type = optional(string)
- strategy = optional(string)
- max_surge = optional(number)
- max_unavailable = optional(number)
- node_pool_soak_duration = optional(string)
- batch_soak_duration = optional(string)
- batch_percentage = optional(number)
- batch_node_count = optional(number)
+ enabled = bool
+ autoscaling_profile = string
+ min_cpu_cores = number
+ max_cpu_cores = number
+ min_memory_gb = number
+ max_memory_gb = number
+ gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
+ auto_repair = bool
+ auto_upgrade = bool
+ disk_size = optional(number)
+ disk_type = optional(string)
+ image_type = optional(string)
+ strategy = optional(string)
+ max_surge = optional(number)
+ max_unavailable = optional(number)
+ node_pool_soak_duration = optional(string)
+ batch_soak_duration = optional(string)
+ batch_percentage = optional(number)
+ batch_node_count = optional(number)
+ enable_secure_boot = optional(bool, false)
+ enable_integrity_monitoring = optional(bool, true)
})
default = {
- enabled = false
- autoscaling_profile = "BALANCED"
- max_cpu_cores = 0
- min_cpu_cores = 0
- max_memory_gb = 0
- min_memory_gb = 0
- gpu_resources = []
- auto_repair = true
- auto_upgrade = true
- disk_size = 100
- disk_type = "pd-standard"
- image_type = "COS_CONTAINERD"
+ enabled = false
+ autoscaling_profile = "BALANCED"
+ max_cpu_cores = 0
+ min_cpu_cores = 0
+ max_memory_gb = 0
+ min_memory_gb = 0
+ gpu_resources = []
+ auto_repair = true
+ auto_upgrade = true
+ disk_size = 100
+ disk_type = "pd-standard"
+ image_type = "COS_CONTAINERD"
+ enable_secure_boot = false
+ enable_integrity_monitoring = true
}
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
}
diff --git a/modules/beta-public-cluster/README.md b/modules/beta-public-cluster/README.md
index c31a9df9d9..5f1d6445f9 100644
--- a/modules/beta-public-cluster/README.md
+++ b/modules/beta-public-cluster/README.md
@@ -148,7 +148,7 @@ Then perform the following commands on the root folder:
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
| cloudrun\_load\_balancer\_type | (Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer. | `string` | `""` | no |
-| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
+| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
enable_secure_boot = optional(bool, false)
enable_integrity_monitoring = optional(bool, true)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enable_integrity_monitoring": true,
"enable_secure_boot": false,
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |
diff --git a/modules/beta-public-cluster/cluster.tf b/modules/beta-public-cluster/cluster.tf
index cef6c02d86..0a92c4d317 100644
--- a/modules/beta-public-cluster/cluster.tf
+++ b/modules/beta-public-cluster/cluster.tf
@@ -145,6 +145,11 @@ resource "google_container_cluster" "primary" {
}
}
+ shielded_instance_config {
+ enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
+ enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
+ }
+
min_cpu_platform = lookup(var.node_pools[0], "min_cpu_platform", "")
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")
diff --git a/modules/beta-public-cluster/variables.tf b/modules/beta-public-cluster/variables.tf
index 6cadf89cfd..0a3b46eefb 100644
--- a/modules/beta-public-cluster/variables.tf
+++ b/modules/beta-public-cluster/variables.tf
@@ -239,39 +239,43 @@ variable "enable_resource_consumption_export" {
variable "cluster_autoscaling" {
type = object({
- enabled = bool
- autoscaling_profile = string
- min_cpu_cores = number
- max_cpu_cores = number
- min_memory_gb = number
- max_memory_gb = number
- gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
- auto_repair = bool
- auto_upgrade = bool
- disk_size = optional(number)
- disk_type = optional(string)
- image_type = optional(string)
- strategy = optional(string)
- max_surge = optional(number)
- max_unavailable = optional(number)
- node_pool_soak_duration = optional(string)
- batch_soak_duration = optional(string)
- batch_percentage = optional(number)
- batch_node_count = optional(number)
+ enabled = bool
+ autoscaling_profile = string
+ min_cpu_cores = number
+ max_cpu_cores = number
+ min_memory_gb = number
+ max_memory_gb = number
+ gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
+ auto_repair = bool
+ auto_upgrade = bool
+ disk_size = optional(number)
+ disk_type = optional(string)
+ image_type = optional(string)
+ strategy = optional(string)
+ max_surge = optional(number)
+ max_unavailable = optional(number)
+ node_pool_soak_duration = optional(string)
+ batch_soak_duration = optional(string)
+ batch_percentage = optional(number)
+ batch_node_count = optional(number)
+ enable_secure_boot = optional(bool, false)
+ enable_integrity_monitoring = optional(bool, true)
})
default = {
- enabled = false
- autoscaling_profile = "BALANCED"
- max_cpu_cores = 0
- min_cpu_cores = 0
- max_memory_gb = 0
- min_memory_gb = 0
- gpu_resources = []
- auto_repair = true
- auto_upgrade = true
- disk_size = 100
- disk_type = "pd-standard"
- image_type = "COS_CONTAINERD"
+ enabled = false
+ autoscaling_profile = "BALANCED"
+ max_cpu_cores = 0
+ min_cpu_cores = 0
+ max_memory_gb = 0
+ min_memory_gb = 0
+ gpu_resources = []
+ auto_repair = true
+ auto_upgrade = true
+ disk_size = 100
+ disk_type = "pd-standard"
+ image_type = "COS_CONTAINERD"
+ enable_secure_boot = false
+ enable_integrity_monitoring = true
}
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
}
diff --git a/modules/private-cluster-update-variant/README.md b/modules/private-cluster-update-variant/README.md
index 88a23661c9..ad4e7d90cf 100644
--- a/modules/private-cluster-update-variant/README.md
+++ b/modules/private-cluster-update-variant/README.md
@@ -171,7 +171,7 @@ Then perform the following commands on the root folder:
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
-| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
+| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
enable_secure_boot = optional(bool, false)
enable_integrity_monitoring = optional(bool, true)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enable_integrity_monitoring": true,
"enable_secure_boot": false,
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |
diff --git a/modules/private-cluster-update-variant/cluster.tf b/modules/private-cluster-update-variant/cluster.tf
index 5289bd2255..a6bff1de29 100644
--- a/modules/private-cluster-update-variant/cluster.tf
+++ b/modules/private-cluster-update-variant/cluster.tf
@@ -139,6 +139,11 @@ resource "google_container_cluster" "primary" {
}
}
+ shielded_instance_config {
+ enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
+ enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
+ }
+
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")
}
diff --git a/modules/private-cluster-update-variant/variables.tf b/modules/private-cluster-update-variant/variables.tf
index c16ebc925e..9f3c9f0952 100644
--- a/modules/private-cluster-update-variant/variables.tf
+++ b/modules/private-cluster-update-variant/variables.tf
@@ -239,39 +239,43 @@ variable "enable_resource_consumption_export" {
variable "cluster_autoscaling" {
type = object({
- enabled = bool
- autoscaling_profile = string
- min_cpu_cores = number
- max_cpu_cores = number
- min_memory_gb = number
- max_memory_gb = number
- gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
- auto_repair = bool
- auto_upgrade = bool
- disk_size = optional(number)
- disk_type = optional(string)
- image_type = optional(string)
- strategy = optional(string)
- max_surge = optional(number)
- max_unavailable = optional(number)
- node_pool_soak_duration = optional(string)
- batch_soak_duration = optional(string)
- batch_percentage = optional(number)
- batch_node_count = optional(number)
+ enabled = bool
+ autoscaling_profile = string
+ min_cpu_cores = number
+ max_cpu_cores = number
+ min_memory_gb = number
+ max_memory_gb = number
+ gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
+ auto_repair = bool
+ auto_upgrade = bool
+ disk_size = optional(number)
+ disk_type = optional(string)
+ image_type = optional(string)
+ strategy = optional(string)
+ max_surge = optional(number)
+ max_unavailable = optional(number)
+ node_pool_soak_duration = optional(string)
+ batch_soak_duration = optional(string)
+ batch_percentage = optional(number)
+ batch_node_count = optional(number)
+ enable_secure_boot = optional(bool, false)
+ enable_integrity_monitoring = optional(bool, true)
})
default = {
- enabled = false
- autoscaling_profile = "BALANCED"
- max_cpu_cores = 0
- min_cpu_cores = 0
- max_memory_gb = 0
- min_memory_gb = 0
- gpu_resources = []
- auto_repair = true
- auto_upgrade = true
- disk_size = 100
- disk_type = "pd-standard"
- image_type = "COS_CONTAINERD"
+ enabled = false
+ autoscaling_profile = "BALANCED"
+ max_cpu_cores = 0
+ min_cpu_cores = 0
+ max_memory_gb = 0
+ min_memory_gb = 0
+ gpu_resources = []
+ auto_repair = true
+ auto_upgrade = true
+ disk_size = 100
+ disk_type = "pd-standard"
+ image_type = "COS_CONTAINERD"
+ enable_secure_boot = false
+ enable_integrity_monitoring = true
}
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
}
diff --git a/modules/private-cluster/README.md b/modules/private-cluster/README.md
index be4b37b691..692d0a0e79 100644
--- a/modules/private-cluster/README.md
+++ b/modules/private-cluster/README.md
@@ -149,7 +149,7 @@ Then perform the following commands on the root folder:
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
-| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
+| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | object({
enabled = bool
autoscaling_profile = string
min_cpu_cores = number
max_cpu_cores = number
min_memory_gb = number
max_memory_gb = number
gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
auto_repair = bool
auto_upgrade = bool
disk_size = optional(number)
disk_type = optional(string)
image_type = optional(string)
strategy = optional(string)
max_surge = optional(number)
max_unavailable = optional(number)
node_pool_soak_duration = optional(string)
batch_soak_duration = optional(string)
batch_percentage = optional(number)
batch_node_count = optional(number)
enable_secure_boot = optional(bool, false)
enable_integrity_monitoring = optional(bool, true)
}) | {
"auto_repair": true,
"auto_upgrade": true,
"autoscaling_profile": "BALANCED",
"disk_size": 100,
"disk_type": "pd-standard",
"enable_integrity_monitoring": true,
"enable_secure_boot": false,
"enabled": false,
"gpu_resources": [],
"image_type": "COS_CONTAINERD",
"max_cpu_cores": 0,
"max_memory_gb": 0,
"min_cpu_cores": 0,
"min_memory_gb": 0
} | no |
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. | `string` | `"DNS_SCOPE_UNSPECIFIED"` | no |
diff --git a/modules/private-cluster/cluster.tf b/modules/private-cluster/cluster.tf
index 18afb5e0c2..7f3f78766b 100644
--- a/modules/private-cluster/cluster.tf
+++ b/modules/private-cluster/cluster.tf
@@ -139,6 +139,11 @@ resource "google_container_cluster" "primary" {
}
}
+ shielded_instance_config {
+ enable_secure_boot = lookup(var.cluster_autoscaling, "enable_secure_boot", false)
+ enable_integrity_monitoring = lookup(var.cluster_autoscaling, "enable_integrity_monitoring", true)
+ }
+
image_type = lookup(var.cluster_autoscaling, "image_type", "COS_CONTAINERD")
}
diff --git a/modules/private-cluster/variables.tf b/modules/private-cluster/variables.tf
index c16ebc925e..9f3c9f0952 100644
--- a/modules/private-cluster/variables.tf
+++ b/modules/private-cluster/variables.tf
@@ -239,39 +239,43 @@ variable "enable_resource_consumption_export" {
variable "cluster_autoscaling" {
type = object({
- enabled = bool
- autoscaling_profile = string
- min_cpu_cores = number
- max_cpu_cores = number
- min_memory_gb = number
- max_memory_gb = number
- gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
- auto_repair = bool
- auto_upgrade = bool
- disk_size = optional(number)
- disk_type = optional(string)
- image_type = optional(string)
- strategy = optional(string)
- max_surge = optional(number)
- max_unavailable = optional(number)
- node_pool_soak_duration = optional(string)
- batch_soak_duration = optional(string)
- batch_percentage = optional(number)
- batch_node_count = optional(number)
+ enabled = bool
+ autoscaling_profile = string
+ min_cpu_cores = number
+ max_cpu_cores = number
+ min_memory_gb = number
+ max_memory_gb = number
+ gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
+ auto_repair = bool
+ auto_upgrade = bool
+ disk_size = optional(number)
+ disk_type = optional(string)
+ image_type = optional(string)
+ strategy = optional(string)
+ max_surge = optional(number)
+ max_unavailable = optional(number)
+ node_pool_soak_duration = optional(string)
+ batch_soak_duration = optional(string)
+ batch_percentage = optional(number)
+ batch_node_count = optional(number)
+ enable_secure_boot = optional(bool, false)
+ enable_integrity_monitoring = optional(bool, true)
})
default = {
- enabled = false
- autoscaling_profile = "BALANCED"
- max_cpu_cores = 0
- min_cpu_cores = 0
- max_memory_gb = 0
- min_memory_gb = 0
- gpu_resources = []
- auto_repair = true
- auto_upgrade = true
- disk_size = 100
- disk_type = "pd-standard"
- image_type = "COS_CONTAINERD"
+ enabled = false
+ autoscaling_profile = "BALANCED"
+ max_cpu_cores = 0
+ min_cpu_cores = 0
+ max_memory_gb = 0
+ min_memory_gb = 0
+ gpu_resources = []
+ auto_repair = true
+ auto_upgrade = true
+ disk_size = 100
+ disk_type = "pd-standard"
+ image_type = "COS_CONTAINERD"
+ enable_secure_boot = false
+ enable_integrity_monitoring = true
}
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
}
diff --git a/variables.tf b/variables.tf
index 8c965b8ec8..bf850ccc99 100644
--- a/variables.tf
+++ b/variables.tf
@@ -239,39 +239,43 @@ variable "enable_resource_consumption_export" {
variable "cluster_autoscaling" {
type = object({
- enabled = bool
- autoscaling_profile = string
- min_cpu_cores = number
- max_cpu_cores = number
- min_memory_gb = number
- max_memory_gb = number
- gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
- auto_repair = bool
- auto_upgrade = bool
- disk_size = optional(number)
- disk_type = optional(string)
- image_type = optional(string)
- strategy = optional(string)
- max_surge = optional(number)
- max_unavailable = optional(number)
- node_pool_soak_duration = optional(string)
- batch_soak_duration = optional(string)
- batch_percentage = optional(number)
- batch_node_count = optional(number)
+ enabled = bool
+ autoscaling_profile = string
+ min_cpu_cores = number
+ max_cpu_cores = number
+ min_memory_gb = number
+ max_memory_gb = number
+ gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))
+ auto_repair = bool
+ auto_upgrade = bool
+ disk_size = optional(number)
+ disk_type = optional(string)
+ image_type = optional(string)
+ strategy = optional(string)
+ max_surge = optional(number)
+ max_unavailable = optional(number)
+ node_pool_soak_duration = optional(string)
+ batch_soak_duration = optional(string)
+ batch_percentage = optional(number)
+ batch_node_count = optional(number)
+ enable_secure_boot = optional(bool, false)
+ enable_integrity_monitoring = optional(bool, true)
})
default = {
- enabled = false
- autoscaling_profile = "BALANCED"
- max_cpu_cores = 0
- min_cpu_cores = 0
- max_memory_gb = 0
- min_memory_gb = 0
- gpu_resources = []
- auto_repair = true
- auto_upgrade = true
- disk_size = 100
- disk_type = "pd-standard"
- image_type = "COS_CONTAINERD"
+ enabled = false
+ autoscaling_profile = "BALANCED"
+ max_cpu_cores = 0
+ min_cpu_cores = 0
+ max_memory_gb = 0
+ min_memory_gb = 0
+ gpu_resources = []
+ auto_repair = true
+ auto_upgrade = true
+ disk_size = 100
+ disk_type = "pd-standard"
+ image_type = "COS_CONTAINERD"
+ enable_secure_boot = false
+ enable_integrity_monitoring = true
}
description = "Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling)"
}