Skip to content

Commit fa314cd

Browse files
martin-kulich-whalebonemartin-kulich-whalebone
committed
change: ip_range_services to optional value (#1949)
1 parent 9dce230 commit fa314cd

File tree

47 files changed

+103
-64
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+103
-64
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ Then perform the following commands on the root folder:
204204
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
205205
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
206206
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
207-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
207+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used. | `string` | `null` | no |
208208
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
209209
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | `string` | `"latest"` | no |
210210
| logging\_enabled\_components | List of services to monitor: SYSTEM\_COMPONENTS, APISERVER, CONTROLLER\_MANAGER, KCP\_CONNECTION, KCP\_SSHD, KCP\_HPA, SCHEDULER, and WORKLOADS. Empty list is default GKE configuration. | `list(string)` | `[]` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -526,11 +526,21 @@ resource "google_container_cluster" "primary" {
526526
}
527527
}
528528

529-
{% if autopilot_cluster != true %}
530529
lifecycle {
530+
precondition {
531+
{% if autopilot_cluster %}
532+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 27 : true
533+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.27 or upper."
534+
{% else %}
535+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
536+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
537+
{% endif %}
538+
}
539+
540+
{% if autopilot_cluster != true %}
531541
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
542+
{% endif %}
532543
}
533-
{% endif %}
534544

535545
{% if autopilot_cluster != true %}
536546
dynamic "dns_config" {

‎autogen/main/variables.tf.tmpl

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,8 @@ variable "additional_ip_range_pods" {
176176

177177
variable "ip_range_services" {
178178
type = string
179-
description = "The _name_ of the secondary subnet range to use for services"
179+
description = "The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used."
180+
default = null
180181
}
181182

182183
variable "stack_type" {

‎cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,11 @@ resource "google_container_cluster" "primary" {
397397
}
398398

399399
lifecycle {
400+
precondition {
401+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
402+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
403+
}
404+
400405
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
401406
}
402407

‎examples/simple_autopilot_private/main.tf

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ locals {
2020
subnet_name = "simple-autopilot-private-subnet"
2121
master_auth_subnetwork = "simple-autopilot-private-master-subnet"
2222
pods_range_name = "ip-range-pods-simple-autopilot-private"
23-
svc_range_name = "ip-range-svc-simple-autopilot-private"
2423
subnet_names = [for subnet_self_link in module.gcp-network.subnets_self_links : split("/", subnet_self_link)[length(split("/", subnet_self_link)) - 1]]
2524
}
2625

@@ -44,7 +43,6 @@ module "gke" {
4443
network = module.gcp-network.network_name
4544
subnetwork = local.subnet_names[index(module.gcp-network.subnets_names, local.subnet_name)]
4645
ip_range_pods = local.pods_range_name
47-
ip_range_services = local.svc_range_name
4846
release_channel = "REGULAR"
4947
enable_vertical_pod_autoscaling = true
5048
enable_private_endpoint = true

‎examples/simple_autopilot_private/network.tf

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,6 @@ module "gcp-network" {
4141
range_name = local.pods_range_name
4242
ip_cidr_range = "192.168.0.0/18"
4343
},
44-
{
45-
range_name = local.svc_range_name
46-
ip_cidr_range = "192.168.64.0/18"
47-
},
4844
]
4945
}
5046
}

‎examples/simple_regional_private/README.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ This example illustrates how to create a simple private cluster.
1010
| cluster\_name\_suffix | A suffix to append to the default cluster name | `string` | `""` | no |
1111
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | `any` | n/a | yes |
1212
| ip\_range\_pods | The secondary ip range to use for pods | `any` | n/a | yes |
13-
| ip\_range\_services | The secondary ip range to use for services | `any` | n/a | yes |
1413
| network | The VPC network to host the cluster in | `any` | n/a | yes |
1514
| project\_id | The project ID to host the cluster in | `any` | n/a | yes |
1615
| region | The region to host the cluster in | `any` | n/a | yes |
@@ -24,7 +23,6 @@ This example illustrates how to create a simple private cluster.
2423
| client\_token | n/a |
2524
| cluster\_name | Cluster name |
2625
| ip\_range\_pods | The secondary IP range used for pods |
27-
| ip\_range\_services | The secondary IP range used for services |
2826
| kubernetes\_endpoint | n/a |
2927
| location | n/a |
3028
| master\_kubernetes\_version | The master Kubernetes version |

‎examples/simple_regional_private/main.tf

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@ module "gke" {
4343
network = var.network
4444
subnetwork = var.subnetwork
4545
ip_range_pods = var.ip_range_pods
46-
ip_range_services = var.ip_range_services
4746
create_service_account = false
4847
service_account = var.compute_engine_service_account
4948
enable_private_endpoint = true

‎examples/simple_regional_private/test_outputs.tf

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,6 @@ output "ip_range_pods" {
4747
value = var.ip_range_pods
4848
}
4949

50-
output "ip_range_services" {
51-
description = "The secondary IP range used for services"
52-
value = var.ip_range_services
53-
}
54-
5550
output "zones" {
5651
description = "List of zones in which the cluster resides"
5752
value = module.gke.zones

‎examples/simple_regional_private/variables.tf

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,6 @@ variable "ip_range_pods" {
3939
description = "The secondary ip range to use for pods"
4040
}
4141

42-
variable "ip_range_services" {
43-
description = "The secondary ip range to use for services"
44-
}
45-
4642
variable "compute_engine_service_account" {
4743
description = "Service account to associate to the nodes in the cluster"
4844
}

‎metadata.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -248,9 +248,8 @@ spec:
248248
varType: list(string)
249249
defaultValue: []
250250
- name: ip_range_services
251-
description: The _name_ of the secondary subnet range to use for services
251+
description: The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used.
252252
varType: string
253-
required: true
254253
- name: stack_type
255254
description: The stack type to use for this cluster. Either `IPV4` or `IPV4_IPV6`. Defaults to `IPV4`.
256255
varType: string

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ Then perform the following commands on the root folder:
120120
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
121121
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. | `bool` | `null` | no |
122122
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
123-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
123+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used. | `string` | `null` | no |
124124
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
125125
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | `string` | `"latest"` | no |
126126
| logging\_enabled\_components | List of services to monitor: SYSTEM\_COMPONENTS, APISERVER, CONTROLLER\_MANAGER, KCP\_CONNECTION, KCP\_SSHD, KCP\_HPA, SCHEDULER, and WORKLOADS. Empty list is default GKE configuration. | `list(string)` | `[]` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,13 @@ resource "google_container_cluster" "primary" {
307307
}
308308
}
309309

310+
lifecycle {
311+
precondition {
312+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 27 : true
313+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.27 or upper."
314+
}
315+
316+
}
310317

311318
timeouts {
312319
create = lookup(var.timeouts, "create", "45m")

‎modules/beta-autopilot-private-cluster/metadata.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -213,9 +213,8 @@ spec:
213213
varType: list(string)
214214
defaultValue: []
215215
- name: ip_range_services
216-
description: The _name_ of the secondary subnet range to use for services
216+
description: The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used.
217217
varType: string
218-
required: true
219218
- name: stack_type
220219
description: The stack type to use for this cluster. Either `IPV4` or `IPV4_IPV6`. Defaults to `IPV4`.
221220
varType: string

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,8 @@ variable "additional_ip_range_pods" {
166166

167167
variable "ip_range_services" {
168168
type = string
169-
description = "The _name_ of the secondary subnet range to use for services"
169+
description = "The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used."
170+
default = null
170171
}
171172

172173
variable "stack_type" {

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ Then perform the following commands on the root folder:
111111
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
112112
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. | `bool` | `null` | no |
113113
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
114-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
114+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used. | `string` | `null` | no |
115115
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
116116
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | `string` | `"latest"` | no |
117117
| logging\_enabled\_components | List of services to monitor: SYSTEM\_COMPONENTS, APISERVER, CONTROLLER\_MANAGER, KCP\_CONNECTION, KCP\_SSHD, KCP\_HPA, SCHEDULER, and WORKLOADS. Empty list is default GKE configuration. | `list(string)` | `[]` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,13 @@ resource "google_container_cluster" "primary" {
307307
}
308308
}
309309

310+
lifecycle {
311+
precondition {
312+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 27 : true
313+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.27 or upper."
314+
}
315+
316+
}
310317

311318
timeouts {
312319
create = lookup(var.timeouts, "create", "45m")

‎modules/beta-autopilot-public-cluster/metadata.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -213,9 +213,8 @@ spec:
213213
varType: list(string)
214214
defaultValue: []
215215
- name: ip_range_services
216-
description: The _name_ of the secondary subnet range to use for services
216+
description: The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used.
217217
varType: string
218-
required: true
219218
- name: stack_type
220219
description: The stack type to use for this cluster. Either `IPV4` or `IPV4_IPV6`. Defaults to `IPV4`.
221220
varType: string

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,8 @@ variable "additional_ip_range_pods" {
166166

167167
variable "ip_range_services" {
168168
type = string
169-
description = "The _name_ of the secondary subnet range to use for services"
169+
description = "The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used."
170+
default = null
170171
}
171172

172173
variable "stack_type" {

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ Then perform the following commands on the root folder:
243243
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
244244
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
245245
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
246-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
246+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used. | `string` | `null` | no |
247247
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
248248
| istio | (Beta) Enable Istio addon | `bool` | `false` | no |
249249
| istio\_auth | (Beta) The authentication type between services in Istio. | `string` | `"AUTH_MUTUAL_TLS"` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -434,6 +434,11 @@ resource "google_container_cluster" "primary" {
434434
}
435435

436436
lifecycle {
437+
precondition {
438+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
439+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
440+
}
441+
437442
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
438443
}
439444

‎modules/beta-private-cluster-update-variant/metadata.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,9 +214,8 @@ spec:
214214
varType: list(string)
215215
defaultValue: []
216216
- name: ip_range_services
217-
description: The _name_ of the secondary subnet range to use for services
217+
description: The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used.
218218
varType: string
219-
required: true
220219
- name: stack_type
221220
description: The stack type to use for this cluster. Either `IPV4` or `IPV4_IPV6`. Defaults to `IPV4`.
222221
varType: string

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,8 @@ variable "additional_ip_range_pods" {
157157

158158
variable "ip_range_services" {
159159
type = string
160-
description = "The _name_ of the secondary subnet range to use for services"
160+
description = "The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used."
161+
default = null
161162
}
162163

163164
variable "stack_type" {

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ Then perform the following commands on the root folder:
221221
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
222222
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
223223
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
224-
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | `string` | n/a | yes |
224+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used. | `string` | `null` | no |
225225
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
226226
| istio | (Beta) Enable Istio addon | `bool` | `false` | no |
227227
| istio\_auth | (Beta) The authentication type between services in Istio. | `string` | `"AUTH_MUTUAL_TLS"` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -434,6 +434,11 @@ resource "google_container_cluster" "primary" {
434434
}
435435

436436
lifecycle {
437+
precondition {
438+
condition = var.ip_range_services == null && var.kubernetes_version != "latest" ? tonumber(split(".", var.kubernetes_version)[0]) >= 1 && tonumber(split(".", var.kubernetes_version)[1]) >= 29 : true
439+
error_message = "The ip_range_services is require for this gke version. Please set ip_range_services or use kubernetes_version 1.29 or upper."
440+
}
441+
437442
ignore_changes = [node_pool, initial_node_count, resource_labels["asmv"]]
438443
}
439444

‎modules/beta-private-cluster/metadata.yaml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,9 +214,8 @@ spec:
214214
varType: list(string)
215215
defaultValue: []
216216
- name: ip_range_services
217-
description: The _name_ of the secondary subnet range to use for services
217+
description: The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used.
218218
varType: string
219-
required: true
220219
- name: stack_type
221220
description: The stack type to use for this cluster. Either `IPV4` or `IPV4_IPV6`. Defaults to `IPV4`.
222221
varType: string

‎modules/beta-private-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,8 @@ variable "additional_ip_range_pods" {
157157

158158
variable "ip_range_services" {
159159
type = string
160-
description = "The _name_ of the secondary subnet range to use for services"
160+
description = "The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used."
161+
default = null
161162
}
162163

163164
variable "stack_type" {

0 commit comments

Comments
 (0)