Skip to content

Commit 9dce230

Browse files
apeabodyapeabody
authored
fix(autopilot): remove ip-masq configmap (terraform-google-modules#2364)
1 parent 8fdfd20 commit 9dce230

File tree

11 files changed

+9
-155
lines changed

11 files changed

+9
-155
lines changed

‎autogen/main/README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
# Terraform Kubernetes Engine Module
22

3-
This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, IP MASQ, Network Policy, etc.{% if private_cluster %} This particular submodule creates a [private cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters){% endif %}{% if beta_cluster %}Beta features are enabled in this submodule.{% endif %}
3+
This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, {% if autopilot_cluster != true%}IP MASQ, {% endif %}Network Policy, etc.{% if private_cluster %} This particular submodule creates a [private cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters){% endif %}{% if beta_cluster %}Beta features are enabled in this submodule.{% endif %}
44

55
The resources/services/activations/deletions that this module will create/trigger are:
66

77
- Create a GKE cluster with the provided addons
88
- Create GKE Node Pool(s) with provided configuration and attach to cluster
99
- Replace the default kube-dns configmap if `stub_domains` are provided
1010
- Activate network policy if `network_policy` is true
11+
{% if autopilot_cluster != true%}
1112
- Add `ip-masq-agent` configmap with provided `non_masquerade_cidrs` if `configure_ip_masq` is true
13+
{% endif %}
1214

1315
Sub modules are provided for creating private clusters, beta private clusters, and beta public clusters as well. Beta sub modules allow for the use of various GKE beta features. See the modules directory for the various sub modules.
1416

‎autogen/main/masq.tf.tmpl

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
*/
1616

1717
{{ autogeneration_note }}
18+
{% if autopilot_cluster != true%}
1819

1920
/******************************************
2021
Create ip-masq-agent confimap
@@ -47,3 +48,4 @@ EOF
4748
{% endif %}
4849
]
4950
}
51+
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -410,6 +410,7 @@ variable "upstream_nameservers" {
410410
}
411411
{% endif %}
412412

413+
{% if autopilot_cluster != true%}
413414
variable "non_masquerade_cidrs" {
414415
type = list(string)
415416
description = "List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading."
@@ -433,6 +434,7 @@ variable "configure_ip_masq" {
433434
description = "Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server."
434435
default = false
435436
}
437+
{% endif %}
436438

437439
{% if beta_cluster and autopilot_cluster != true%}
438440
variable "cluster_telemetry_type" {

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
# Terraform Kubernetes Engine Module
22

3-
This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, IP MASQ, Network Policy, etc. This particular submodule creates a [private cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters)Beta features are enabled in this submodule.
3+
This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, Network Policy, etc. This particular submodule creates a [private cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters)Beta features are enabled in this submodule.
44
The resources/services/activations/deletions that this module will create/trigger are:
55

66
- Create a GKE cluster with the provided addons
77
- Create GKE Node Pool(s) with provided configuration and attach to cluster
88
- Replace the default kube-dns configmap if `stub_domains` are provided
99
- Activate network policy if `network_policy` is true
10-
- Add `ip-masq-agent` configmap with provided `non_masquerade_cidrs` if `configure_ip_masq` is true
1110

1211
Sub modules are provided for creating private clusters, beta private clusters, and beta public clusters as well. Beta sub modules allow for the use of various GKE beta features. See the modules directory for the various sub modules.
1312

@@ -83,7 +82,6 @@ Then perform the following commands on the root folder:
8382
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
8483
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | `string` | `null` | no |
8584
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | `map(string)` | `{}` | no |
86-
| configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | `bool` | `false` | no |
8785
| create\_service\_account | Defines if service account specified to run nodes should be created. | `bool` | `true` | no |
8886
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. | `list(object({ state = string, key_name = string }))` | <pre>[<br> {<br> "key_name": "",<br> "state": "DECRYPTED"<br> }<br>]</pre> | no |
8987
| deletion\_protection | Whether or not to allow Terraform to destroy the cluster. | `bool` | `true` | no |
@@ -121,8 +119,6 @@ Then perform the following commands on the root folder:
121119
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
122120
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
123121
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. | `bool` | `null` | no |
124-
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
125-
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
126122
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
127123
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
128124
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
@@ -142,7 +138,6 @@ Then perform the following commands on the root folder:
142138
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
143139
| network\_tags | (Optional) - List of network tags applied to auto-provisioned node pools. | `list(string)` | `[]` | no |
144140
| node\_pools\_cgroup\_mode | Specifies the Linux cgroup mode for autopilot Kubernetes nodes in the cluster. Accepted values are `CGROUP_MODE_UNSPECIFIED`, `CGROUP_MODE_V1`, and `CGROUP_MODE_V2`, which determine the control group hierarchy used for resource management. | `string` | `null` | no |
145-
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
146141
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
147142
| notification\_filter\_event\_type | Choose what type of notifications you want to receive. If no filters are applied, you'll receive all notification types. Can be used to filter what notifications are sent. Accepted values are UPGRADE\_AVAILABLE\_EVENT, UPGRADE\_EVENT, and SECURITY\_BULLETIN\_EVENT. | `list(string)` | `[]` | no |
148143
| private\_endpoint\_subnetwork | The subnetwork to use for the hosted master network. | `string` | `null` | no |

‎modules/beta-autopilot-private-cluster/masq.tf

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -15,32 +15,3 @@
1515
*/
1616

1717
// This file was automatically generated from a template in ./autogen/main
18-
19-
/******************************************
20-
Create ip-masq-agent confimap
21-
*****************************************/
22-
resource "kubernetes_config_map" "ip_masq_agent" {
23-
count = var.configure_ip_masq ? 1 : 0
24-
25-
metadata {
26-
name = "ip-masq-agent"
27-
namespace = "kube-system"
28-
29-
labels = {
30-
maintained_by = "terraform"
31-
}
32-
}
33-
34-
data = {
35-
config = <<EOF
36-
nonMasqueradeCIDRs:
37-
- ${join("\n - ", var.non_masquerade_cidrs)}
38-
resyncInterval: ${var.ip_masq_resync_interval}
39-
masqLinkLocal: ${var.ip_masq_link_local}
40-
EOF
41-
}
42-
43-
depends_on = [
44-
google_container_cluster.primary,
45-
]
46-
}

‎modules/beta-autopilot-private-cluster/metadata.yaml

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -240,25 +240,6 @@ spec:
240240
description: (Optional) - List of network tags applied to auto-provisioned node pools.
241241
varType: list(string)
242242
defaultValue: []
243-
- name: non_masquerade_cidrs
244-
description: List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading.
245-
varType: list(string)
246-
defaultValue:
247-
- 10.0.0.0/8
248-
- 172.16.0.0/12
249-
- 192.168.0.0/16
250-
- name: ip_masq_resync_interval
251-
description: The interval at which the agent attempts to sync its ConfigMap file from the disk.
252-
varType: string
253-
defaultValue: 60s
254-
- name: ip_masq_link_local
255-
description: Whether to masquerade traffic to the link-local prefix (169.254.0.0/16).
256-
varType: bool
257-
defaultValue: false
258-
- name: configure_ip_masq
259-
description: Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server.
260-
varType: bool
261-
defaultValue: false
262243
- name: create_service_account
263244
description: Defines if service account specified to run nodes should be created.
264245
varType: bool

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -207,29 +207,6 @@ variable "network_tags" {
207207
}
208208

209209

210-
variable "non_masquerade_cidrs" {
211-
type = list(string)
212-
description = "List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading."
213-
default = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
214-
}
215-
216-
variable "ip_masq_resync_interval" {
217-
type = string
218-
description = "The interval at which the agent attempts to sync its ConfigMap file from the disk."
219-
default = "60s"
220-
}
221-
222-
variable "ip_masq_link_local" {
223-
type = bool
224-
description = "Whether to masquerade traffic to the link-local prefix (169.254.0.0/16)."
225-
default = false
226-
}
227-
228-
variable "configure_ip_masq" {
229-
type = bool
230-
description = "Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server."
231-
default = false
232-
}
233210

234211
variable "create_service_account" {
235212
type = bool

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
# Terraform Kubernetes Engine Module
22

3-
This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, IP MASQ, Network Policy, etc.Beta features are enabled in this submodule.
3+
This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, Network Policy, etc.Beta features are enabled in this submodule.
44
The resources/services/activations/deletions that this module will create/trigger are:
55

66
- Create a GKE cluster with the provided addons
77
- Create GKE Node Pool(s) with provided configuration and attach to cluster
88
- Replace the default kube-dns configmap if `stub_domains` are provided
99
- Activate network policy if `network_policy` is true
10-
- Add `ip-masq-agent` configmap with provided `non_masquerade_cidrs` if `configure_ip_masq` is true
1110

1211
Sub modules are provided for creating private clusters, beta private clusters, and beta public clusters as well. Beta sub modules allow for the use of various GKE beta features. See the modules directory for the various sub modules.
1312

@@ -77,7 +76,6 @@ Then perform the following commands on the root folder:
7776
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
7877
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | `string` | `null` | no |
7978
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | `map(string)` | `{}` | no |
80-
| configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | `bool` | `false` | no |
8179
| create\_service\_account | Defines if service account specified to run nodes should be created. | `bool` | `true` | no |
8280
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. | `list(object({ state = string, key_name = string }))` | <pre>[<br> {<br> "key_name": "",<br> "state": "DECRYPTED"<br> }<br>]</pre> | no |
8381
| deletion\_protection | Whether or not to allow Terraform to destroy the cluster. | `bool` | `true` | no |
@@ -112,8 +110,6 @@ Then perform the following commands on the root folder:
112110
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
113111
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
114112
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. | `bool` | `null` | no |
115-
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
116-
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
117113
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
118114
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
119115
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
@@ -131,7 +127,6 @@ Then perform the following commands on the root folder:
131127
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
132128
| network\_tags | (Optional) - List of network tags applied to auto-provisioned node pools. | `list(string)` | `[]` | no |
133129
| node\_pools\_cgroup\_mode | Specifies the Linux cgroup mode for autopilot Kubernetes nodes in the cluster. Accepted values are `CGROUP_MODE_UNSPECIFIED`, `CGROUP_MODE_V1`, and `CGROUP_MODE_V2`, which determine the control group hierarchy used for resource management. | `string` | `null` | no |
134-
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
135130
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
136131
| notification\_filter\_event\_type | Choose what type of notifications you want to receive. If no filters are applied, you'll receive all notification types. Can be used to filter what notifications are sent. Accepted values are UPGRADE\_AVAILABLE\_EVENT, UPGRADE\_EVENT, and SECURITY\_BULLETIN\_EVENT. | `list(string)` | `[]` | no |
137132
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |

‎modules/beta-autopilot-public-cluster/masq.tf

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -15,32 +15,3 @@
1515
*/
1616

1717
// This file was automatically generated from a template in ./autogen/main
18-
19-
/******************************************
20-
Create ip-masq-agent confimap
21-
*****************************************/
22-
resource "kubernetes_config_map" "ip_masq_agent" {
23-
count = var.configure_ip_masq ? 1 : 0
24-
25-
metadata {
26-
name = "ip-masq-agent"
27-
namespace = "kube-system"
28-
29-
labels = {
30-
maintained_by = "terraform"
31-
}
32-
}
33-
34-
data = {
35-
config = <<EOF
36-
nonMasqueradeCIDRs:
37-
- ${join("\n - ", var.non_masquerade_cidrs)}
38-
resyncInterval: ${var.ip_masq_resync_interval}
39-
masqLinkLocal: ${var.ip_masq_link_local}
40-
EOF
41-
}
42-
43-
depends_on = [
44-
google_container_cluster.primary,
45-
]
46-
}

‎modules/beta-autopilot-public-cluster/metadata.yaml

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -240,25 +240,6 @@ spec:
240240
description: (Optional) - List of network tags applied to auto-provisioned node pools.
241241
varType: list(string)
242242
defaultValue: []
243-
- name: non_masquerade_cidrs
244-
description: List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading.
245-
varType: list(string)
246-
defaultValue:
247-
- 10.0.0.0/8
248-
- 172.16.0.0/12
249-
- 192.168.0.0/16
250-
- name: ip_masq_resync_interval
251-
description: The interval at which the agent attempts to sync its ConfigMap file from the disk.
252-
varType: string
253-
defaultValue: 60s
254-
- name: ip_masq_link_local
255-
description: Whether to masquerade traffic to the link-local prefix (169.254.0.0/16).
256-
varType: bool
257-
defaultValue: false
258-
- name: configure_ip_masq
259-
description: Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server.
260-
varType: bool
261-
defaultValue: false
262243
- name: create_service_account
263244
description: Defines if service account specified to run nodes should be created.
264245
varType: bool

0 commit comments

Comments
 (0)