Skip to content

Commit bc4076c

Browse files
apeabodyg-awmalik
apeabody
and
g-awmalik
authored
feat: add kubectl-fleet-wrapper sub-module (#161)
Co-authored-by: Awais Malik <awmalik@google.com>
1 parent 711c204 commit bc4076c

File tree

9 files changed

+392
-3
lines changed

9 files changed

+392
-3
lines changed

‎examples/kubectl_wrapper_example/main.tf‎

Lines changed: 40 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2020 Google LLC
2+
* Copyright 2020-2023 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,6 +30,8 @@ module "enabled_google_apis" {
3030
"monitoring.googleapis.com",
3131
"container.googleapis.com",
3232
"stackdriver.googleapis.com",
33+
"gkehub.googleapis.com",
34+
"connectgateway.googleapis.com",
3335
]
3436
}
3537

@@ -97,7 +99,42 @@ module "kubectl-local-yaml" {
9799
cluster_name = module.gke.name
98100
cluster_location = module.gke.location
99101
module_depends_on = [module.kubectl-imperative.wait, module.gke.endpoint]
100-
kubectl_create_command = "kubectl apply -f ${local.manifest_path}"
101-
kubectl_destroy_command = "kubectl delete -f ${local.manifest_path}"
102+
kubectl_create_command = "kubectl apply -f ${local.manifest_path}/nginx.yaml"
103+
kubectl_destroy_command = "kubectl delete -f ${local.manifest_path}/nginx.yaml"
102104
skip_download = false
103105
}
106+
107+
module "fleet" {
108+
source = "terraform-google-modules/kubernetes-engine/google//modules/fleet-membership"
109+
version = "~> 28.0"
110+
111+
depends_on = [module.gke]
112+
113+
project_id = var.project_id
114+
cluster_name = module.gke.name
115+
location = module.gke.location
116+
}
117+
118+
module "kubectl-fleet-imperative" {
119+
source = "../../modules/kubectl-fleet-wrapper"
120+
121+
membership_name = module.fleet.cluster_membership_id
122+
membership_project_id = module.fleet.project_id
123+
membership_location = module.fleet.location
124+
module_depends_on = [module.kubectl-local-yaml.wait, module.fleet.wait]
125+
kubectl_create_command = "kubectl run nginx-fleet-imperative --image=nginx"
126+
kubectl_destroy_command = "kubectl delete pod nginx-fleet-imperative"
127+
skip_download = false
128+
}
129+
130+
module "kubectl-fleet-local-yaml" {
131+
source = "../../modules/kubectl-fleet-wrapper"
132+
133+
membership_name = module.fleet.cluster_membership_id
134+
membership_project_id = module.fleet.project_id
135+
membership_location = module.fleet.location
136+
module_depends_on = [module.kubectl-fleet-imperative.wait, module.gke.endpoint]
137+
kubectl_create_command = "kubectl apply -f ${local.manifest_path}/nginx-fleet.yaml"
138+
kubectl_destroy_command = "kubectl delete -f ${local.manifest_path}/nginx-fleet.yaml"
139+
skip_download = true
140+
}

‎examples/kubectl_wrapper_example/manifests/nginx-fleet.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Copyright 2020-2023 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: v1
16+
kind: Pod
17+
metadata:
18+
name: nginx-fleet-declarative
19+
spec:
20+
containers:
21+
- name: nginx
22+
image: nginx

‎modules/kubectl-fleet-wrapper/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# kubectl fleet wrapper
2+
3+
This submodule aims to make interactions with [GKE clusters with Fleet memberships](https://cloud.google.com/anthos/fleet-management/docs) using kubectl easier by utilizing the gcloud module and the kubectl_fleet_wrapper script.
4+
5+
This module can be used to deploy any Kubernetes resource using imperative commands or declarative yaml files. An example can be found [here](../../examples/kubectl_wrapper_example).
6+
7+
## Usage
8+
9+
Basic imperative usage of this module is as follows:
10+
11+
```hcl
12+
module "kubectl" {
13+
source = "terraform-google-modules/gcloud/google//modules/kubectl-fleet-wrapper"
14+
15+
membership_project_id = var.project_id
16+
membership_name = var.cluster_name
17+
membership_location = var.cluster_location
18+
kubectl_create_command = "kubectl create deploy nginx --image=nginx"
19+
kubectl_destroy_command = "kubectl delete deploy nginx"
20+
}
21+
```
22+
23+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
24+
## Inputs
25+
26+
| Name | Description | Type | Default | Required |
27+
|------|-------------|------|---------|:--------:|
28+
| additional\_components | Additional gcloud CLI components to install. Valid value are components listed in `gcloud components list` | `list(string)` | <pre>[<br> "kubectl"<br>]</pre> | no |
29+
| create\_cmd\_triggers | List of any additional triggers for the create command execution. | `map(any)` | `{}` | no |
30+
| enabled | Flag to optionally disable usage of this module. | `bool` | `true` | no |
31+
| gcloud\_sdk\_version | The gcloud sdk version to download. | `string` | `"434.0.0"` | no |
32+
| impersonate\_service\_account | An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials. | `string` | `null` | no |
33+
| kubectl\_create\_command | The kubectl command to create resources. | `string` | n/a | yes |
34+
| kubectl\_destroy\_command | The kubectl command to destroy resources. | `string` | n/a | yes |
35+
| membership\_location | Membership location (Global/Region). | `string` | n/a | yes |
36+
| membership\_name | Membership name. | `string` | n/a | yes |
37+
| membership\_project\_id | Membership project ID. | `string` | n/a | yes |
38+
| module\_depends\_on | List of modules or resources this module depends on. | `list(any)` | `[]` | no |
39+
| service\_account\_key\_file | Path to service account key file to auth as for running `gcloud container clusters get-credentials`. | `string` | `""` | no |
40+
| skip\_download | Whether to skip downloading gcloud (assumes `gcloud` and `kubectl` are already available outside the module). | `bool` | `true` | no |
41+
| upgrade | Whether to upgrade gcloud at runtime. | `bool` | `true` | no |
42+
| use\_tf\_google\_credentials\_env\_var | Use `GOOGLE_CREDENTIALS` environment variable to run `gcloud auth activate-service-account` with. Optional. | `bool` | `false` | no |
43+
44+
## Outputs
45+
46+
| Name | Description |
47+
|------|-------------|
48+
| bin\_dir | The full bin path of the modules executables |
49+
| create\_cmd\_bin | The full bin path & command used on create |
50+
| destroy\_cmd\_bin | The full bin path & command used on destroy |
51+
| wait | An output to use when you want to depend on cmd finishing |
52+
53+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
54+
55+
To provision this example, run the following from within this directory:
56+
- `terraform init` to get the plugins
57+
- `terraform plan` to see the infrastructure plan
58+
- `terraform apply` to apply the infrastructure build
59+
- `terraform destroy` to destroy the built infrastructure

‎modules/kubectl-fleet-wrapper/main.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/**
2+
* Copyright 2020-2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
base_cmd = "${var.membership_name} ${var.membership_location} ${var.membership_project_id} ${coalesce(var.impersonate_service_account, "false")}"
19+
}
20+
21+
module "gcloud_kubectl" {
22+
source = "../.."
23+
module_depends_on = var.module_depends_on
24+
additional_components = var.additional_components
25+
skip_download = var.skip_download
26+
gcloud_sdk_version = var.gcloud_sdk_version
27+
enabled = var.enabled
28+
upgrade = var.upgrade
29+
service_account_key_file = var.service_account_key_file
30+
use_tf_google_credentials_env_var = var.use_tf_google_credentials_env_var
31+
32+
create_cmd_entrypoint = "${path.module}/scripts/kubectl_fleet_wrapper.sh"
33+
create_cmd_body = "${local.base_cmd} ${var.kubectl_create_command}"
34+
create_cmd_triggers = var.create_cmd_triggers
35+
destroy_cmd_entrypoint = "${path.module}/scripts/kubectl_fleet_wrapper.sh"
36+
destroy_cmd_body = "${local.base_cmd} ${var.kubectl_destroy_command}"
37+
}

‎modules/kubectl-fleet-wrapper/outputs.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Copyright 2020 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "create_cmd_bin" {
18+
description = "The full bin path & command used on create"
19+
value = module.gcloud_kubectl.create_cmd_bin
20+
}
21+
22+
output "destroy_cmd_bin" {
23+
description = "The full bin path & command used on destroy"
24+
value = module.gcloud_kubectl.destroy_cmd_bin
25+
}
26+
27+
output "bin_dir" {
28+
description = "The full bin path of the modules executables"
29+
value = module.gcloud_kubectl.bin_dir
30+
}
31+
32+
output "wait" {
33+
description = "An output to use when you want to depend on cmd finishing"
34+
value = module.gcloud_kubectl.wait
35+
}

‎modules/kubectl-fleet-wrapper/scripts/kubectl_fleet_wrapper.sh‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/usr/bin/env bash
2+
# Copyright 2020-2023 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
17+
set -xeo pipefail
18+
19+
if [ "$#" -lt 4 ]; then
20+
>&2 echo "Not all expected arguments set."
21+
exit 1
22+
fi
23+
24+
NAME=$1
25+
LOCATION=$2
26+
PROJECT_ID=$3
27+
IMPERSONATE_SERVICE_ACCOUNT=$4
28+
29+
shift 4
30+
31+
RANDOM_ID="${RANDOM}_${RANDOM}"
32+
export TMPDIR="/tmp/kubectl_fleet_wrapper_${RANDOM_ID}"
33+
34+
function cleanup {
35+
rm -rf "${TMPDIR}"
36+
}
37+
trap cleanup EXIT
38+
39+
mkdir "${TMPDIR}"
40+
41+
export KUBECONFIG="${TMPDIR}/config"
42+
43+
CMD="gcloud container fleet memberships get-credentials ${NAME} --project ${PROJECT_ID} --location ${LOCATION}"
44+
45+
if [[ "${IMPERSONATE_SERVICE_ACCOUNT}" != false ]]; then
46+
CMD+=" --impersonate-service-account ${IMPERSONATE_SERVICE_ACCOUNT}"
47+
shift 2
48+
fi
49+
50+
$CMD
51+
52+
"$@"

‎modules/kubectl-fleet-wrapper/variables.tf‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
/**
2+
* Copyright 2020-2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "membership_project_id" {
18+
type = string
19+
description = "Membership project ID."
20+
}
21+
22+
variable "membership_name" {
23+
type = string
24+
description = "Membership name."
25+
}
26+
27+
variable "membership_location" {
28+
type = string
29+
description = "Membership location (Global/Region)."
30+
}
31+
32+
variable "kubectl_create_command" {
33+
type = string
34+
description = "The kubectl command to create resources."
35+
}
36+
37+
variable "kubectl_destroy_command" {
38+
type = string
39+
description = "The kubectl command to destroy resources."
40+
}
41+
42+
variable "enabled" {
43+
description = "Flag to optionally disable usage of this module."
44+
type = bool
45+
default = true
46+
}
47+
48+
variable "module_depends_on" {
49+
description = "List of modules or resources this module depends on."
50+
type = list(any)
51+
default = []
52+
}
53+
54+
variable "create_cmd_triggers" {
55+
description = "List of any additional triggers for the create command execution."
56+
type = map(any)
57+
default = {}
58+
}
59+
60+
variable "additional_components" {
61+
description = "Additional gcloud CLI components to install. Valid value are components listed in `gcloud components list`"
62+
type = list(string)
63+
default = ["kubectl"]
64+
}
65+
66+
variable "skip_download" {
67+
description = "Whether to skip downloading gcloud (assumes `gcloud` and `kubectl` are already available outside the module)."
68+
type = bool
69+
default = true
70+
}
71+
72+
variable "gcloud_sdk_version" {
73+
description = "The gcloud sdk version to download."
74+
type = string
75+
default = "434.0.0"
76+
}
77+
78+
variable "upgrade" {
79+
description = "Whether to upgrade gcloud at runtime."
80+
type = bool
81+
default = true
82+
}
83+
84+
variable "service_account_key_file" {
85+
description = "Path to service account key file to auth as for running `gcloud container clusters get-credentials`."
86+
type = string
87+
default = ""
88+
}
89+
90+
variable "use_tf_google_credentials_env_var" {
91+
description = "Use `GOOGLE_CREDENTIALS` environment variable to run `gcloud auth activate-service-account` with. Optional."
92+
type = bool
93+
default = false
94+
}
95+
96+
variable "impersonate_service_account" {
97+
type = string
98+
description = "An optional service account to impersonate for gcloud commands. If this service account is not specified, the module will use Application Default Credentials."
99+
default = null
100+
}

0 commit comments

Comments
 (0)