Skip to content

Commit 4f1e9b3

Browse files
0Delta0Delta
committed
change: ip_range_services to optional value (terraform-google-modules#1949)
As of GKE version 1.29 and Autopilot 1.27, the service ip range is given a default of 34.118.224.0/20 per cluster. Versions earlier than the specified version may be omitted, but will be rejected by the validator.
1 parent 165a4ae commit 4f1e9b3

File tree

29 files changed

+90
-21
lines changed

29 files changed

+90
-21
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ Then perform the following commands on the root folder:
189189
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
190190
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
191191
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
192-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
192+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
193193
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
194194
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | `string` | `"latest"` | no |
195195
| logging\_enabled\_components | List of services to monitor: SYSTEM\_COMPONENTS, WORKLOADS. Empty list is default GKE configuration. | `list(string)` | `[]` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -450,11 +450,21 @@ resource "google_container_cluster" "primary" {
450450
}
451451
}
452452

453-
{% if autopilot_cluster != true %}
454453
lifecycle {
454+
precondition {
455+
{% if autopilot_cluster %}
456+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 27 : true
457+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.27 or upper."
458+
{% else %}
459+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
460+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
461+
{% endif %}
462+
}
463+
464+
{% if autopilot_cluster != true %}
455465
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
466+
{% endif %}
456467
}
457-
{% endif %}
458468

459469
{% if autopilot_cluster != true %}
460470
dynamic "dns_config" {

‎autogen/main/variables.tf.tmpl

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,8 @@ variable "additional_ip_range_pods" {
147147

148148
variable "ip_range_services" {
149149
type = string
150-
description = "The _name_ of the secondary subnet range to use for services"
150+
description = "The _name_ of the secondary subnet range to use for services. Omit to use default range."
151+
default = null
151152
}
152153

153154
variable "stack_type" {

‎cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,11 @@ resource "google_container_cluster" "primary" {
335335
}
336336

337337
lifecycle {
338+
precondition {
339+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
340+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
341+
}
342+
338343
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
339344
}
340345

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ Then perform the following commands on the root folder:
111111
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
112112
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
113113
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
114-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
114+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
115115
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
116116
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | `string` | `"latest"` | no |
117117
| maintenance\_end\_time | Time window specified for recurring maintenance operations in RFC3339 format | `string` | `""` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,13 @@ resource "google_container_cluster" "primary" {
206206
}
207207
}
208208

209+
lifecycle {
210+
precondition {
211+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 27 : true
212+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.27 or upper."
213+
}
214+
215+
}
209216

210217
timeouts {
211218
create = lookup(var.timeouts, "create", "45m")

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,8 @@ variable "additional_ip_range_pods" {
139139

140140
variable "ip_range_services" {
141141
type = string
142-
description = "The _name_ of the secondary subnet range to use for services"
142+
description = "The _name_ of the secondary subnet range to use for services. Omit to use default range."
143+
default = null
143144
}
144145

145146
variable "stack_type" {

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ Then perform the following commands on the root folder:
102102
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
103103
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
104104
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
105-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
105+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
106106
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
107107
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | `string` | `"latest"` | no |
108108
| maintenance\_end\_time | Time window specified for recurring maintenance operations in RFC3339 format | `string` | `""` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,13 @@ resource "google_container_cluster" "primary" {
206206
}
207207
}
208208

209+
lifecycle {
210+
precondition {
211+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 27 : true
212+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.27 or upper."
213+
}
214+
215+
}
209216

210217
timeouts {
211218
create = lookup(var.timeouts, "create", "45m")

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,8 @@ variable "additional_ip_range_pods" {
139139

140140
variable "ip_range_services" {
141141
type = string
142-
description = "The _name_ of the secondary subnet range to use for services"
142+
description = "The _name_ of the secondary subnet range to use for services. Omit to use default range."
143+
default = null
143144
}
144145

145146
variable "stack_type" {

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@ Then perform the following commands on the root folder:
232232
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
233233
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
234234
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
235-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
235+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
236236
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
237237
| istio | (Beta) Enable Istio addon | `bool` | `false` | no |
238238
| istio\_auth | (Beta) The authentication type between services in Istio. | `string` | `"AUTH_MUTUAL_TLS"` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,11 @@ resource "google_container_cluster" "primary" {
383383
}
384384

385385
lifecycle {
386+
precondition {
387+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
388+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
389+
}
390+
386391
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
387392
}
388393

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,8 @@ variable "additional_ip_range_pods" {
145145

146146
variable "ip_range_services" {
147147
type = string
148-
description = "The _name_ of the secondary subnet range to use for services"
148+
description = "The _name_ of the secondary subnet range to use for services. Omit to use default range."
149+
default = null
149150
}
150151

151152
variable "stack_type" {

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,7 @@ Then perform the following commands on the root folder:
210210
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
211211
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
212212
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
213-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
213+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
214214
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
215215
| istio | (Beta) Enable Istio addon | `bool` | `false` | no |
216216
| istio\_auth | (Beta) The authentication type between services in Istio. | `string` | `"AUTH_MUTUAL_TLS"` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,11 @@ resource "google_container_cluster" "primary" {
383383
}
384384

385385
lifecycle {
386+
precondition {
387+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
388+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
389+
}
390+
386391
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
387392
}
388393

‎modules/beta-private-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,8 @@ variable "additional_ip_range_pods" {
145145

146146
variable "ip_range_services" {
147147
type = string
148-
description = "The _name_ of the secondary subnet range to use for services"
148+
description = "The _name_ of the secondary subnet range to use for services. Omit to use default range."
149+
default = null
149150
}
150151

151152
variable "stack_type" {

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ Then perform the following commands on the root folder:
223223
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
224224
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
225225
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
226-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
226+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
227227
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
228228
| istio | (Beta) Enable Istio addon | `bool` | `false` | no |
229229
| istio\_auth | (Beta) The authentication type between services in Istio. | `string` | `"AUTH_MUTUAL_TLS"` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,11 @@ resource "google_container_cluster" "primary" {
383383
}
384384

385385
lifecycle {
386+
precondition {
387+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
388+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
389+
}
390+
386391
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
387392
}
388393

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,8 @@ variable "additional_ip_range_pods" {
145145

146146
variable "ip_range_services" {
147147
type = string
148-
description = "The _name_ of the secondary subnet range to use for services"
148+
description = "The _name_ of the secondary subnet range to use for services. Omit to use default range."
149+
default = null
149150
}
150151

151152
variable "stack_type" {

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ Then perform the following commands on the root folder:
201201
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
202202
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
203203
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
204-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
204+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
205205
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
206206
| istio | (Beta) Enable Istio addon | `bool` | `false` | no |
207207
| istio\_auth | (Beta) The authentication type between services in Istio. | `string` | `"AUTH_MUTUAL_TLS"` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,11 @@ resource "google_container_cluster" "primary" {
383383
}
384384

385385
lifecycle {
386+
precondition {
387+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
388+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
389+
}
390+
386391
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
387392
}
388393

‎modules/beta-public-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,8 @@ variable "additional_ip_range_pods" {
145145

146146
variable "ip_range_services" {
147147
type = string
148-
description = "The _name_ of the secondary subnet range to use for services"
148+
description = "The _name_ of the secondary subnet range to use for services. Omit to use default range."
149+
default = null
149150
}
150151

151152
variable "stack_type" {

‎modules/private-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ Then perform the following commands on the root folder:
220220
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
221221
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
222222
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
223-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
223+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
224224
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
225225
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | `string` | `"latest"` | no |
226226
| logging\_enabled\_components | List of services to monitor: SYSTEM\_COMPONENTS, WORKLOADS. Empty list is default GKE configuration. | `list(string)` | `[]` | no |

‎modules/private-cluster-update-variant/cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,11 @@ resource "google_container_cluster" "primary" {
335335
}
336336

337337
lifecycle {
338+
precondition {
339+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
340+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
341+
}
342+
338343
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
339344
}
340345

‎modules/private-cluster-update-variant/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,8 @@ variable "additional_ip_range_pods" {
145145

146146
variable "ip_range_services" {
147147
type = string
148-
description = "The _name_ of the secondary subnet range to use for services"
148+
description = "The _name_ of the secondary subnet range to use for services. Omit to use default range."
149+
default = null
149150
}
150151

151152
variable "stack_type" {

‎modules/private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ Then perform the following commands on the root folder:
198198
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
199199
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
200200
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
201-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
201+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. Omit to use default range. | `string` | `null` | no |
202202
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
203203
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | `string` | `"latest"` | no |
204204
| logging\_enabled\_components | List of services to monitor: SYSTEM\_COMPONENTS, WORKLOADS. Empty list is default GKE configuration. | `list(string)` | `[]` | no |

0 commit comments

Comments
 (0)