Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat!: master_ipv4_cidr_block optional for private standard clusters #2186

Merged
merged 5 commits into from
Dec 9, 2024
Merged

feat!: master_ipv4_cidr_block optional for private standard clusters #2186

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
227da31
feat: master_ipv4_cidr_block optional for private standard clusters
apeabody Nov 15, 2024
004e5aa
test coverage in example
apeabody Nov 15, 2024
c7cae83
Merge branch 'master' into ap/master_ipv4_cidr_block
apeabody Dec 7, 2024
bbf9b2c
Merge branch 'master' into ap/master_ipv4_cidr_block
apeabody Dec 9, 2024
35b5619
Merge branch 'master' into ap/master_ipv4_cidr_block
apeabody Dec 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion autogen/main/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,6 @@ module "gke" {
{% if private_cluster %}
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
{% endif %}
{% if beta_cluster and autopilot_cluster != true %}
istio = true
Expand Down
2 changes: 1 addition & 1 deletion autogen/main/main.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,7 +146,7 @@ locals {
{% if private_cluster %}
cluster_endpoint = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? (var.enable_private_endpoint || var.deploy_using_private_endpoint ? google_container_cluster.primary.private_cluster_config[0].private_endpoint : google_container_cluster.primary.private_cluster_config[0].public_endpoint) : google_container_cluster.primary.endpoint
cluster_peering_name = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? google_container_cluster.primary.private_cluster_config[0].peering_name : null
cluster_endpoint_for_nodes = var.master_ipv4_cidr_block
cluster_endpoint_for_nodes = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block
{% else %}
cluster_endpoint = google_container_cluster.primary.endpoint
cluster_endpoint_for_nodes = "${google_container_cluster.primary.endpoint}/32"
Expand Down
2 changes: 1 addition & 1 deletion autogen/main/outputs.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,7 +207,7 @@ output "mesh_certificates_config" {

output "master_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the hosted master network"
value = var.master_ipv4_cidr_block
value = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block
}

output "peering_name" {
Expand Down
6 changes: 1 addition & 5 deletions autogen/main/variables.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -495,12 +495,8 @@ variable "enable_private_nodes" {

variable "master_ipv4_cidr_block" {
type = string
description = "The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters."
{% if autopilot_cluster == true%}
description = "(Optional) The IP range in CIDR notation to use for the hosted master network."
default = null
{% else %}
default = "10.0.0.0/28"
{% endif %}
}

variable "private_endpoint_subnetwork" {
Expand Down
15 changes: 15 additions & 0 deletions docs/upgrading_to_v35.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,3 +50,18 @@ To avoid this, it is possible to edit the remote state of the `random_id` resour
1. Bump the serial number at the top
2. Push the modified state to the remote `terraform state push default.tfstate`
3. Confirm the `random_id` resource(s) no longer changes (or the corresponding `nodepool`) in a `terraform plan`

### master_ipv4_cidr_block default value
The default value for `master_ipv4_cidr_block` on private standard clusters has been changed from `"10.0.0.0/28"` to `null`. To maintain the previous default behavior, set `master_ipv4_cidr_block` to `"10.0.0.0/28"`.

```
module "gke" {
source = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster"
version = "~> 35.0"

project_id = var.project_id
name = var.cluster_name

+ master_ipv4_cidr_block = "10.0.0.0/28"
}
```
1 change: 0 additions & 1 deletion examples/simple_regional_private/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,6 @@ module "gke" {
enable_private_endpoint = true
enable_private_nodes = true
enable_secret_manager_addon = true
master_ipv4_cidr_block = "172.16.0.0/28"
default_max_pods_per_node = 20
remove_default_node_pool = true
deletion_protection = false
Expand Down
3 changes: 1 addition & 2 deletions modules/beta-autopilot-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@ module "gke" {
filestore_csi_driver = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
dns_cache = false

}
Expand Down Expand Up @@ -129,7 +128,7 @@ Then perform the following commands on the root folder:
| maintenance\_start\_time | Time window specified for daily or recurring maintenance operations in RFC3339 format | `string` | `"05:00"` | no |
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | `list(object({ cidr_block = string, display_name = string }))` | `[]` | no |
| master\_global\_access\_enabled | Whether the cluster master is accessible globally (from any region) or only within the same region as the private endpoint. | `bool` | `true` | no |
| master\_ipv4\_cidr\_block | The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters. | `string` | `null` | no |
| master\_ipv4\_cidr\_block | (Optional) The IP range in CIDR notation to use for the hosted master network. | `string` | `null` | no |
| monitoring\_enabled\_components | List of services to monitor: SYSTEM\_COMPONENTS, APISERVER, SCHEDULER, CONTROLLER\_MANAGER, STORAGE, HPA, POD, DAEMONSET, DEPLOYMENT, STATEFULSET, KUBELET, CADVISOR and DCGM. In beta provider, WORKLOADS is supported on top of those 12 values. (WORKLOADS is deprecated and removed in GKE 1.24.) KUBELET and CADVISOR are only supported in GKE 1.29.3-gke.1093000 and above. Empty list is default GKE configuration. | `list(string)` | `[]` | no |
| name | The name of the cluster (required) | `string` | n/a | yes |
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-autopilot-private-cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ locals {

cluster_endpoint = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? (var.enable_private_endpoint || var.deploy_using_private_endpoint ? google_container_cluster.primary.private_cluster_config[0].private_endpoint : google_container_cluster.primary.private_cluster_config[0].public_endpoint) : google_container_cluster.primary.endpoint
cluster_peering_name = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? google_container_cluster.primary.private_cluster_config[0].peering_name : null
cluster_endpoint_for_nodes = var.master_ipv4_cidr_block
cluster_endpoint_for_nodes = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block

cluster_output_master_auth = concat(google_container_cluster.primary[*].master_auth, [])
cluster_output_master_version = google_container_cluster.primary.master_version
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-autopilot-private-cluster/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,7 +165,7 @@ output "tpu_ipv4_cidr_block" {

output "master_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the hosted master network"
value = var.master_ipv4_cidr_block
value = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block
}

output "peering_name" {
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-autopilot-private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,7 +279,7 @@ variable "enable_private_nodes" {

variable "master_ipv4_cidr_block" {
type = string
description = "The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters."
description = "(Optional) The IP range in CIDR notation to use for the hosted master network."
default = null
}

Expand Down
3 changes: 1 addition & 2 deletions modules/beta-private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,6 @@ module "gke" {
filestore_csi_driver = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
istio = true
cloudrun = true
dns_cache = false
Expand Down Expand Up @@ -251,7 +250,7 @@ Then perform the following commands on the root folder:
| maintenance\_start\_time | Time window specified for daily or recurring maintenance operations in RFC3339 format | `string` | `"05:00"` | no |
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | `list(object({ cidr_block = string, display_name = string }))` | `[]` | no |
| master\_global\_access\_enabled | Whether the cluster master is accessible globally (from any region) or only within the same region as the private endpoint. | `bool` | `true` | no |
| master\_ipv4\_cidr\_block | The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters. | `string` | `"10.0.0.0/28"` | no |
| master\_ipv4\_cidr\_block | (Optional) The IP range in CIDR notation to use for the hosted master network. | `string` | `null` | no |
| monitoring\_enable\_managed\_prometheus | Configuration for Managed Service for Prometheus. Whether or not the managed collection is enabled. | `bool` | `null` | no |
| monitoring\_enable\_observability\_metrics | Whether or not the advanced datapath metrics are enabled. | `bool` | `false` | no |
| monitoring\_enable\_observability\_relay | Whether or not the advanced datapath relay is enabled. | `bool` | `false` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster-update-variant/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ locals {

cluster_endpoint = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? (var.enable_private_endpoint || var.deploy_using_private_endpoint ? google_container_cluster.primary.private_cluster_config[0].private_endpoint : google_container_cluster.primary.private_cluster_config[0].public_endpoint) : google_container_cluster.primary.endpoint
cluster_peering_name = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? google_container_cluster.primary.private_cluster_config[0].peering_name : null
cluster_endpoint_for_nodes = var.master_ipv4_cidr_block
cluster_endpoint_for_nodes = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block

cluster_output_master_auth = concat(google_container_cluster.primary[*].master_auth, [])
cluster_output_master_version = google_container_cluster.primary.master_version
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster-update-variant/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ output "mesh_certificates_config" {

output "master_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the hosted master network"
value = var.master_ipv4_cidr_block
value = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block
}

output "peering_name" {
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-private-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -480,8 +480,8 @@ variable "enable_private_nodes" {

variable "master_ipv4_cidr_block" {
type = string
description = "The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters."
default = "10.0.0.0/28"
description = "(Optional) The IP range in CIDR notation to use for the hosted master network."
default = null
}

variable "private_endpoint_subnetwork" {
Expand Down
3 changes: 1 addition & 2 deletions modules/beta-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,6 @@ module "gke" {
filestore_csi_driver = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
istio = true
cloudrun = true
dns_cache = false
Expand Down Expand Up @@ -229,7 +228,7 @@ Then perform the following commands on the root folder:
| maintenance\_start\_time | Time window specified for daily or recurring maintenance operations in RFC3339 format | `string` | `"05:00"` | no |
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | `list(object({ cidr_block = string, display_name = string }))` | `[]` | no |
| master\_global\_access\_enabled | Whether the cluster master is accessible globally (from any region) or only within the same region as the private endpoint. | `bool` | `true` | no |
| master\_ipv4\_cidr\_block | The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters. | `string` | `"10.0.0.0/28"` | no |
| master\_ipv4\_cidr\_block | (Optional) The IP range in CIDR notation to use for the hosted master network. | `string` | `null` | no |
| monitoring\_enable\_managed\_prometheus | Configuration for Managed Service for Prometheus. Whether or not the managed collection is enabled. | `bool` | `null` | no |
| monitoring\_enable\_observability\_metrics | Whether or not the advanced datapath metrics are enabled. | `bool` | `false` | no |
| monitoring\_enable\_observability\_relay | Whether or not the advanced datapath relay is enabled. | `bool` | `false` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@ locals {

cluster_endpoint = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? (var.enable_private_endpoint || var.deploy_using_private_endpoint ? google_container_cluster.primary.private_cluster_config[0].private_endpoint : google_container_cluster.primary.private_cluster_config[0].public_endpoint) : google_container_cluster.primary.endpoint
cluster_peering_name = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? google_container_cluster.primary.private_cluster_config[0].peering_name : null
cluster_endpoint_for_nodes = var.master_ipv4_cidr_block
cluster_endpoint_for_nodes = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block

cluster_output_master_auth = concat(google_container_cluster.primary[*].master_auth, [])
cluster_output_master_version = google_container_cluster.primary.master_version
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ output "mesh_certificates_config" {

output "master_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the hosted master network"
value = var.master_ipv4_cidr_block
value = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block
}

output "peering_name" {
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -480,8 +480,8 @@ variable "enable_private_nodes" {

variable "master_ipv4_cidr_block" {
type = string
description = "The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters."
default = "10.0.0.0/28"
description = "(Optional) The IP range in CIDR notation to use for the hosted master network."
default = null
}

variable "private_endpoint_subnetwork" {
Expand Down
3 changes: 1 addition & 2 deletions modules/private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,6 @@ module "gke" {
filestore_csi_driver = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
dns_cache = false

node_pools = [
Expand Down Expand Up @@ -239,7 +238,7 @@ Then perform the following commands on the root folder:
| maintenance\_start\_time | Time window specified for daily or recurring maintenance operations in RFC3339 format | `string` | `"05:00"` | no |
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | `list(object({ cidr_block = string, display_name = string }))` | `[]` | no |
| master\_global\_access\_enabled | Whether the cluster master is accessible globally (from any region) or only within the same region as the private endpoint. | `bool` | `true` | no |
| master\_ipv4\_cidr\_block | The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters. | `string` | `"10.0.0.0/28"` | no |
| master\_ipv4\_cidr\_block | (Optional) The IP range in CIDR notation to use for the hosted master network. | `string` | `null` | no |
| monitoring\_enable\_managed\_prometheus | Configuration for Managed Service for Prometheus. Whether or not the managed collection is enabled. | `bool` | `null` | no |
| monitoring\_enable\_observability\_metrics | Whether or not the advanced datapath metrics are enabled. | `bool` | `false` | no |
| monitoring\_enable\_observability\_relay | Whether or not the advanced datapath relay is enabled. | `bool` | `false` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster-update-variant/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ locals {

cluster_endpoint = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? (var.enable_private_endpoint || var.deploy_using_private_endpoint ? google_container_cluster.primary.private_cluster_config[0].private_endpoint : google_container_cluster.primary.private_cluster_config[0].public_endpoint) : google_container_cluster.primary.endpoint
cluster_peering_name = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? google_container_cluster.primary.private_cluster_config[0].peering_name : null
cluster_endpoint_for_nodes = var.master_ipv4_cidr_block
cluster_endpoint_for_nodes = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block

cluster_output_master_auth = concat(google_container_cluster.primary[*].master_auth, [])
cluster_output_master_version = google_container_cluster.primary.master_version
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster-update-variant/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ output "mesh_certificates_config" {

output "master_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the hosted master network"
value = var.master_ipv4_cidr_block
value = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block
}

output "peering_name" {
Expand Down
4 changes: 2 additions & 2 deletions modules/private-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -474,8 +474,8 @@ variable "enable_private_nodes" {

variable "master_ipv4_cidr_block" {
type = string
description = "The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters."
default = "10.0.0.0/28"
description = "(Optional) The IP range in CIDR notation to use for the hosted master network."
default = null
}

variable "private_endpoint_subnetwork" {
Expand Down
3 changes: 1 addition & 2 deletions modules/private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,6 @@ module "gke" {
filestore_csi_driver = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
dns_cache = false

node_pools = [
Expand Down Expand Up @@ -217,7 +216,7 @@ Then perform the following commands on the root folder:
| maintenance\_start\_time | Time window specified for daily or recurring maintenance operations in RFC3339 format | `string` | `"05:00"` | no |
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). | `list(object({ cidr_block = string, display_name = string }))` | `[]` | no |
| master\_global\_access\_enabled | Whether the cluster master is accessible globally (from any region) or only within the same region as the private endpoint. | `bool` | `true` | no |
| master\_ipv4\_cidr\_block | The IP range in CIDR notation to use for the hosted master network. Optional for Autopilot clusters. | `string` | `"10.0.0.0/28"` | no |
| master\_ipv4\_cidr\_block | (Optional) The IP range in CIDR notation to use for the hosted master network. | `string` | `null` | no |
| monitoring\_enable\_managed\_prometheus | Configuration for Managed Service for Prometheus. Whether or not the managed collection is enabled. | `bool` | `null` | no |
| monitoring\_enable\_observability\_metrics | Whether or not the advanced datapath metrics are enabled. | `bool` | `false` | no |
| monitoring\_enable\_observability\_relay | Whether or not the advanced datapath relay is enabled. | `bool` | `false` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ locals {

cluster_endpoint = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? (var.enable_private_endpoint || var.deploy_using_private_endpoint ? google_container_cluster.primary.private_cluster_config[0].private_endpoint : google_container_cluster.primary.private_cluster_config[0].public_endpoint) : google_container_cluster.primary.endpoint
cluster_peering_name = (var.enable_private_nodes && length(google_container_cluster.primary.private_cluster_config) > 0) ? google_container_cluster.primary.private_cluster_config[0].peering_name : null
cluster_endpoint_for_nodes = var.master_ipv4_cidr_block
cluster_endpoint_for_nodes = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block

cluster_output_master_auth = concat(google_container_cluster.primary[*].master_auth, [])
cluster_output_master_version = google_container_cluster.primary.master_version
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ output "mesh_certificates_config" {

output "master_ipv4_cidr_block" {
description = "The IP range in CIDR notation used for the hosted master network"
value = var.master_ipv4_cidr_block
value = google_container_cluster.primary.private_cluster_config[0].master_ipv4_cidr_block
}

output "peering_name" {
Expand Down
Loading
Loading