Skip to content

Commit

Permalink
container: add support for kubelet read only port
Browse files Browse the repository at this point in the history 
- Add `no_enable_insecure_kubelet_readonly_port` to google_container_cluster
- Allow setting `insecure_kubelet_readonly_port_enabled` for
  `container_node_pool`

https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port

Fixes hashicorp/terraform-provider-google#15208
  • Loading branch information
@wyardley
wyardley committed Aug 10, 2024
1 parent 2897e86 commit 0f3e4f2
Show file tree
Hide file tree
Showing 7 changed files with 358 additions and 20 deletions.
8 changes: 8 additions & 0 deletions mmv1/third_party/terraform/services/container/go/node_config.go.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -601,6 +601,11 @@ func schemaNodeConfig() *schema.Schema {
Optional: true,
Description: `Set the CPU CFS quota period value 'cpu.cfs_period_us'.`,
},
"insecure_kubelet_readonly_port_enabled": {
Type: schema.TypeBool,
Optional: true,
Description: `Enable or disable Kubelet read only port.`,
},
"pod_pids_limit": {
Type: schema.TypeInt,
Optional: true,
Expand Down Expand Up @@ -1154,6 +1159,9 @@ func expandKubeletConfig(v interface{}) *container.NodeKubeletConfig {
if cpuCfsQuotaPeriod, ok := cfg["cpu_cfs_quota_period"]; ok {
kConfig.CpuCfsQuotaPeriod = cpuCfsQuotaPeriod.(string)
}
if insecureKubeletReadonlyPortEnabled, ok := cfg["insecure_kubelet_readonly_port_enabled"]; ok {
kConfig.insecureKubeletReadonlyPortEnabled = insecureKubeletReadonlyPortEnabled.(bool)
}
if podPidsLimit, ok := cfg["pod_pids_limit"]; ok {
kConfig.PodPidsLimit = int64(podPidsLimit.(int))
}
Expand Down
153 changes: 153 additions & 0 deletions mmv1/third_party/terraform/services/container/go/resource_container_cluster_test.go.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1518,6 +1518,97 @@ func TestAccContainerCluster_withNodeConfig(t *testing.T) {
})
}

func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfigBool(t *testing.T) {
t.Parallel()
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfigBool(clusterName, networkName, subnetworkName, false),
},
{
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_in_node_config",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
},
})
}

func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(t *testing.T) {
t.Parallel()
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
nodePoolName := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(clusterName, nodePoolName, networkName, subnetworkName, false),
},
{
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_in_node_pool",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
},
})
}

func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledUpdatesBool(t *testing.T) {
t.Parallel()
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, networkName, subnetworkName, true),
},
{
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
{
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, networkName, subnetworkName, false),
},
{
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
{
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, networkName, subnetworkName, true),
},
{
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
},
})
}

func TestAccContainerCluster_withLoggingVariantInNodeConfig(t *testing.T) {
t.Parallel()
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
Expand Down Expand Up @@ -6421,6 +6512,68 @@ resource "google_container_cluster" "with_node_config" {
`, clusterName, networkName, subnetworkName)
}

func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfigBool(clusterName, networkName, subnetworkName string, insecureKubeletReadonlyPortEnabled bool) string {
return fmt.Sprintf(`
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_in_node_config" {
name = "%s"
location = "us-central1-f"
initial_node_count = 1

node_config {
kubelet_config {
cpu_manager_policy = "static"
insecure_kubelet_readonly_port_enabled = %v
}
}
deletion_protection = false
network = "%s"
subnetwork = "%s"
}
`, clusterName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
}

func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(clusterName, nodePoolName, networkName, subnetworkName string, insecureKubeletReadonlyPortEnabled bool) string {
return fmt.Sprintf(`
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_in_node_pool" {
name = "%s"
location = "us-central1-f"

node_pool {
name = "%s"
initial_node_count = 1
node_config {
kubelet_config {
cpu_manager_policy = "static"
insecure_kubelet_readonly_port_enabled = %v
}
}
}
deletion_protection = false
network = "%s"
subnetwork = "%s"
}
`, clusterName, nodePoolName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
}

func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, networkName, subnetworkName string, insecureKubeletReadonlyPortEnabled bool) string {
return fmt.Sprintf(`
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_node_pool_default" {
name = "%s"
location = "us-central1-f"
initial_node_count = 1

node_pool_defaults {
node_config_defaults {
insecure_kubelet_readonly_port_enabled = %v
}
}
deletion_protection = false
network = "%s"
subnetwork = "%s"
}
`, clusterName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
}

func testAccContainerCluster_withLoggingVariantInNodeConfig(clusterName, loggingVariant, networkName, subnetworkName string) string {
return fmt.Sprintf(`
resource "google_container_cluster" "with_logging_variant_in_node_config" {
Expand Down
25 changes: 15 additions & 10 deletions mmv1/third_party/terraform/services/container/go/resource_container_node_pool_test.go.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -526,10 +526,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, 2048),
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, true, 2048),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
"node_config.0.kubelet_config.0.cpu_cfs_quota", "true"),
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "true"),
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
"node_config.0.kubelet_config.0.pod_pids_limit", "2048"),
),
Expand All @@ -540,10 +542,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
ImportStateVerify: true,
},
{
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, 1024),
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, false, 1024),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
"node_config.0.kubelet_config.0.cpu_cfs_quota", "false"),
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "false"),
),
},
{
Expand Down Expand Up @@ -571,7 +575,7 @@ func TestAccContainerNodePool_withInvalidKubeletCpuManagerPolicy(t *testing.T) {
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "dontexist", "100us", networkName, subnetworkName, true, 1024),
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "dontexist", "100us", networkName, subnetworkName, true, false, 1024),
ExpectError: regexp.MustCompile(`.*to be one of \["?static"? "?none"? "?"?\].*`),
},
},
Expand Down Expand Up @@ -3136,7 +3140,7 @@ resource "google_container_node_pool" "with_sandbox_config" {
}
{{- end }}

func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota bool, podPidsLimit int) string {
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota, insecureKubeletReadonlyPortEnabled bool, podPidsLimit int) string {
return fmt.Sprintf(`
data "google_container_engine_versions" "central1a" {
location = "us-central1-a"
Expand All @@ -3162,10 +3166,11 @@ resource "google_container_node_pool" "with_kubelet_config" {
node_config {
image_type = "COS_CONTAINERD"
kubelet_config {
cpu_manager_policy = %q
cpu_cfs_quota = %v
cpu_cfs_quota_period = %q
pod_pids_limit = %d
cpu_manager_policy = %q
cpu_cfs_quota = %v
cpu_cfs_quota_period = %q
insecure_kubelet_readonly_port_enabled = %v
pod_pids_limit = %d
}
oauth_scopes = [
"https://www.googleapis.com/auth/logging.write",
Expand All @@ -3174,7 +3179,7 @@ resource "google_container_node_pool" "with_kubelet_config" {
logging_variant = "DEFAULT"
}
}
`, cluster, networkName, subnetworkName, np, policy, quota, period, podPidsLimit)
`, cluster, networkName, subnetworkName, np, policy, quota, insecureKubeletReadonlyPortEnabled, period, podPidsLimit)
}

func testAccContainerNodePool_withLinuxNodeConfig(cluster, np, tcpMem, networkName, subnetworkName string) string {
Expand Down Expand Up @@ -4931,4 +4936,4 @@ resource "google_container_node_pool" "np" {
}
}
`, cluster, np)
}
}
5 changes: 5 additions & 0 deletions mmv1/third_party/terraform/services/container/node_config.go.erb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -602,6 +602,11 @@ func schemaNodeConfig() *schema.Schema {
Optional: true,
Description: `Set the CPU CFS quota period value 'cpu.cfs_period_us'.`,
},
"insecure_kubelet_readonly_port_enabled": {
Type: schema.TypeBool,
Optional: true,
Description: `Enable or disable Kubelet read only port.`,
},
"pod_pids_limit": {
Type: schema.TypeInt,
Optional: true,
Expand Down
Loading

0 comments on commit 0f3e4f2

Please # to comment.