Skip to content

feat(TPG>=6.11)!: add endpoint_dns #2180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Dec 5, 2024
Merged

feat(TPG>=6.11)!: add endpoint_dns #2180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
17e400c
feat(TPG>=6.11)!: add endpoint_dns and control_plane_endpoints_config
apeabody Nov 20, 2024
8515153
Merge branch 'master' into ap/endpoint
apeabody Dec 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,7 @@ Then perform the following commands on the root folder:
| cluster\_id | Cluster ID |
| dns\_cache\_enabled | Whether DNS Cache enabled |
| endpoint | Cluster endpoint |
| endpoint\_dns | Cluster endpoint DNS |
| fleet\_membership | Fleet membership (if registered) |
| gateway\_api\_channel | The gateway api channel of this cluster. |
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
Expand Down
9 changes: 9 additions & 0 deletions autogen/main/cluster.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -630,6 +630,15 @@ resource "google_container_cluster" "primary" {
}
}
}

dynamic "control_plane_endpoints_config" {
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : [0]
content {
dns_endpoint_config {
allow_external_traffic = var.deploy_using_private_endpoint
}
}
}
{% endif %}

{% if autopilot_cluster != true %}
Expand Down
17 changes: 17 additions & 0 deletions autogen/main/outputs.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,23 @@ output "endpoint" {
]
}

output "endpoint_dns" {
description = "Cluster endpoint DNS"
value = google_container_cluster.primary.control_plane_endpoints_config[0].dns_endpoint_config[0].endpoint
depends_on = [
/* Nominally, the endpoint is populated as soon as it is known to Terraform.
* However, the cluster may not be in a usable state yet. Therefore any
* resources dependent on the cluster being up will fail to deploy. With
* this explicit dependency, dependent resources can wait for the cluster
* to be up.
*/
google_container_cluster.primary,
{% if autopilot_cluster != true %}
google_container_node_pool.pools,
{% endif %}
]
}

output "min_master_version" {
description = "Minimum master kubernetes version"
value = local.cluster_min_master_version
Expand Down
14 changes: 7 additions & 7 deletions autogen/main/versions.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/**
* Copyright 2022 Google LLC
* Copyright 2022-2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand All @@ -24,33 +24,33 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.7.0, < 7"
version = ">= 6.11.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.7.0, < 7"
version = ">= 6.11.0, < 7"
}
{% elif beta_cluster and autopilot_cluster %}
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.8.0, < 7"
version = ">= 6.11.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.8.0, < 7"
version = ">= 6.11.0, < 7"
}
{% elif autopilot_cluster %}
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.8.0, < 7"
version = ">= 6.11.0, < 7"
}
{% else %}
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.7.0, < 7"
version = ">= 6.11.0, < 7"
}
{% endif %}
kubernetes = {
Expand Down
5 changes: 5 additions & 0 deletions autogen/safer-cluster/outputs.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,11 @@ output "endpoint" {
value = module.gke.endpoint
}

output "endpoint_dns" {
description = "Cluster endpoint DNS"
value = module.gke.endpoint_dns
}

output "min_master_version" {
description = "Minimum master kubernetes version"
value = module.gke.min_master_version
Expand Down
1 change: 1 addition & 0 deletions examples/safer_cluster_iap_bastion/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ To deploy this example:
| ca\_certificate | Cluster ca certificate (base64 encoded) |
| cluster\_name | Cluster name |
| endpoint | Cluster endpoint |
| endpoint\_dns | Cluster endpoint DNS |
| get\_credentials\_command | gcloud get-credentials command to generate kubeconfig for the private cluster |
| keyring | The name of the keyring. |
| keyring\_resource | The location of the keyring. |
Expand Down
2 changes: 2 additions & 0 deletions examples/safer_cluster_iap_bastion/bastion.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,4 +34,6 @@ module "bastion" {
startup_script = templatefile("${path.module}/templates/startup-script.tftpl", {})
members = var.bastion_members
shielded_vm = "false"

service_account_roles = ["roles/container.viewer"]
}
6 changes: 6 additions & 0 deletions examples/safer_cluster_iap_bastion/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,12 @@ output "endpoint" {
value = module.gke.endpoint
}

output "endpoint_dns" {
sensitive = true
description = "Cluster endpoint DNS"
value = module.gke.endpoint_dns
}

output "master_authorized_networks_config" {
description = "Networks from which access to master is permitted"
value = module.gke.master_authorized_networks_config
Expand Down
6 changes: 0 additions & 6 deletions examples/simple_regional_beta/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,6 @@ locals {

data "google_client_config" "default" {}

provider "kubernetes" {
host = "https://${module.gke.endpoint}"
token = data.google_client_config.default.access_token
cluster_ca_certificate = base64decode(module.gke.ca_certificate)
}

module "gke" {
source = "terraform-google-modules/kubernetes-engine/google//modules/beta-public-cluster"
version = "~> 34.0"
Expand Down
3 changes: 0 additions & 3 deletions examples/simple_regional_beta/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,5 @@ terraform {
google-beta = {
source = "hashicorp/google-beta"
}
kubernetes = {
source = "hashicorp/kubernetes"
}
}
}
1 change: 1 addition & 0 deletions modules/beta-autopilot-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ Then perform the following commands on the root folder:
| cluster\_id | Cluster ID |
| dns\_cache\_enabled | Whether DNS Cache enabled |
| endpoint | Cluster endpoint |
| endpoint\_dns | Cluster endpoint DNS |
| fleet\_membership | Fleet membership (if registered) |
| gateway\_api\_channel | The gateway api channel of this cluster. |
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
Expand Down
9 changes: 9 additions & 0 deletions modules/beta-autopilot-private-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -326,6 +326,15 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "control_plane_endpoints_config" {
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : [0]
content {
dns_endpoint_config {
allow_external_traffic = var.deploy_using_private_endpoint
}
}
}


dynamic "database_encryption" {
for_each = var.database_encryption
Expand Down
14 changes: 14 additions & 0 deletions modules/beta-autopilot-private-cluster/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,20 @@ output "endpoint" {
]
}

output "endpoint_dns" {
description = "Cluster endpoint DNS"
value = google_container_cluster.primary.control_plane_endpoints_config[0].dns_endpoint_config[0].endpoint
depends_on = [
/* Nominally, the endpoint is populated as soon as it is known to Terraform.
* However, the cluster may not be in a usable state yet. Therefore any
* resources dependent on the cluster being up will fail to deploy. With
* this explicit dependency, dependent resources can wait for the cluster
* to be up.
*/
google_container_cluster.primary,
]
}

output "min_master_version" {
description = "Minimum master kubernetes version"
value = local.cluster_min_master_version
Expand Down
6 changes: 3 additions & 3 deletions modules/beta-autopilot-private-cluster/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/**
* Copyright 2022 Google LLC
* Copyright 2022-2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand All @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.8.0, < 7"
version = ">= 6.11.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.8.0, < 7"
version = ">= 6.11.0, < 7"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-autopilot-public-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,7 @@ Then perform the following commands on the root folder:
| cluster\_id | Cluster ID |
| dns\_cache\_enabled | Whether DNS Cache enabled |
| endpoint | Cluster endpoint |
| endpoint\_dns | Cluster endpoint DNS |
| fleet\_membership | Fleet membership (if registered) |
| gateway\_api\_channel | The gateway api channel of this cluster. |
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
Expand Down
14 changes: 14 additions & 0 deletions modules/beta-autopilot-public-cluster/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,20 @@ output "endpoint" {
]
}

output "endpoint_dns" {
description = "Cluster endpoint DNS"
value = google_container_cluster.primary.control_plane_endpoints_config[0].dns_endpoint_config[0].endpoint
depends_on = [
/* Nominally, the endpoint is populated as soon as it is known to Terraform.
* However, the cluster may not be in a usable state yet. Therefore any
* resources dependent on the cluster being up will fail to deploy. With
* this explicit dependency, dependent resources can wait for the cluster
* to be up.
*/
google_container_cluster.primary,
]
}

output "min_master_version" {
description = "Minimum master kubernetes version"
value = local.cluster_min_master_version
Expand Down
6 changes: 3 additions & 3 deletions modules/beta-autopilot-public-cluster/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/**
* Copyright 2022 Google LLC
* Copyright 2022-2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand All @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.8.0, < 7"
version = ">= 6.11.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.8.0, < 7"
version = ">= 6.11.0, < 7"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -314,6 +314,7 @@ Then perform the following commands on the root folder:
| cluster\_id | Cluster ID |
| dns\_cache\_enabled | Whether DNS Cache enabled |
| endpoint | Cluster endpoint |
| endpoint\_dns | Cluster endpoint DNS |
| fleet\_membership | Fleet membership (if registered) |
| gateway\_api\_channel | The gateway api channel of this cluster. |
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
Expand Down
9 changes: 9 additions & 0 deletions modules/beta-private-cluster-update-variant/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -546,6 +546,15 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "control_plane_endpoints_config" {
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : [0]
content {
dns_endpoint_config {
allow_external_traffic = var.deploy_using_private_endpoint
}
}
}

remove_default_node_pool = var.remove_default_node_pool

dynamic "database_encryption" {
Expand Down
15 changes: 15 additions & 0 deletions modules/beta-private-cluster-update-variant/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,21 @@ output "endpoint" {
]
}

output "endpoint_dns" {
description = "Cluster endpoint DNS"
value = google_container_cluster.primary.control_plane_endpoints_config[0].dns_endpoint_config[0].endpoint
depends_on = [
/* Nominally, the endpoint is populated as soon as it is known to Terraform.
* However, the cluster may not be in a usable state yet. Therefore any
* resources dependent on the cluster being up will fail to deploy. With
* this explicit dependency, dependent resources can wait for the cluster
* to be up.
*/
google_container_cluster.primary,
google_container_node_pool.pools,
]
}

output "min_master_version" {
description = "Minimum master kubernetes version"
value = local.cluster_min_master_version
Expand Down
6 changes: 3 additions & 3 deletions modules/beta-private-cluster-update-variant/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/**
* Copyright 2022 Google LLC
* Copyright 2022-2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
Expand All @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.7.0, < 7"
version = ">= 6.11.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.7.0, < 7"
version = ">= 6.11.0, < 7"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,6 +292,7 @@ Then perform the following commands on the root folder:
| cluster\_id | Cluster ID |
| dns\_cache\_enabled | Whether DNS Cache enabled |
| endpoint | Cluster endpoint |
| endpoint\_dns | Cluster endpoint DNS |
| fleet\_membership | Fleet membership (if registered) |
| gateway\_api\_channel | The gateway api channel of this cluster. |
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
Expand Down
9 changes: 9 additions & 0 deletions modules/beta-private-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -546,6 +546,15 @@ resource "google_container_cluster" "primary" {
}
}

dynamic "control_plane_endpoints_config" {
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : [0]
content {
dns_endpoint_config {
allow_external_traffic = var.deploy_using_private_endpoint
Copy link
Contributor

@legal90 legal90 Mar 18, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@apeabody question: Why is this feature gated by a condition var.enable_private_endpoint && var.deploy_using_private_endpoint ?

It should be possible to have "DNS-based endpoint" feature enabled without enforcing the usage of the private IP / private endpoint 🤔

Copy link
Collaborator Author

@apeabody apeabody Mar 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @legal90 - I was planning to update this behavior as part of a larger change when hashicorp/terraform-provider-google#20369 is released, but I'd be happy to review a PR for just this aspect mow.

Copy link
Contributor

@legal90 legal90 Mar 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @apeabody ,
Thank you for your reply! I found your PR, which fixes that behavior and makes it working as it really should (at least, to my view): #2313
Kudos! I don't have anything to add there.

P.s. I'm sorry if my previous message sounded unpleasant. Thank you for your hard work on this module! ❤️

Copy link
Collaborator Author

@apeabody apeabody Mar 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the feedback @legal90! Yes, had a few minutes to prototype a change, should have it committed this week.

}
}
}

remove_default_node_pool = var.remove_default_node_pool

dynamic "database_encryption" {
Expand Down
15 changes: 15 additions & 0 deletions modules/beta-private-cluster/outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,21 @@ output "endpoint" {
]
}

output "endpoint_dns" {
description = "Cluster endpoint DNS"
value = google_container_cluster.primary.control_plane_endpoints_config[0].dns_endpoint_config[0].endpoint
depends_on = [
/* Nominally, the endpoint is populated as soon as it is known to Terraform.
* However, the cluster may not be in a usable state yet. Therefore any
* resources dependent on the cluster being up will fail to deploy. With
* this explicit dependency, dependent resources can wait for the cluster
* to be up.
*/
google_container_cluster.primary,
google_container_node_pool.pools,
]
}

output "min_master_version" {
description = "Minimum master kubernetes version"
value = local.cluster_min_master_version
Expand Down
Loading
Loading