From 6708731d6d2556a9367eade09663bb6a9b80d964 Mon Sep 17 00:00:00 2001 From: Simon Roberts Date: Mon, 23 Feb 2026 22:26:38 +1100 Subject: [PATCH 1/3] Bugfix/maintenance exclusion (#3759) * Fix default maintenance_config.maintenance_exclusions in GKE. * tfdoc --- modules/gke-cluster-autopilot/README.md | 2 +- modules/gke-cluster-autopilot/variables.tf | 2 +- modules/gke-cluster-standard/README.md | 2 +- modules/gke-cluster-standard/variables.tf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/gke-cluster-autopilot/README.md b/modules/gke-cluster-autopilot/README.md index 788a8626c..5b5ad6262 100644 --- a/modules/gke-cluster-autopilot/README.md +++ b/modules/gke-cluster-autopilot/README.md @@ -308,7 +308,7 @@ module "cluster-1" { | [issue_client_certificate](variables.tf#L168) | Enable issuing client certificate. | bool | | false | | [labels](variables.tf#L174) | Cluster resource labels. | map(string) | | null | | [logging_config](variables.tf#L185) | Logging configuration. | object({…}) | | {} | -| [maintenance_config](variables.tf#L196) | Maintenance window configuration. | object({…}) | | {…} | +| [maintenance_config](variables.tf#L196) | Maintenance window configuration. | object({…}) | | {…} | | [min_master_version](variables.tf#L219) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null | | [monitoring_config](variables.tf#L225) | Monitoring configuration. System metrics collection cannot be disabled. Control plane metrics are optional. Kube state metrics are optional. Google Cloud Managed Service for Prometheus is enabled by default. | object({…}) | | {} | | [node_config](variables.tf#L264) | Configuration for nodes and nodepools. | object({…}) | | {} | diff --git a/modules/gke-cluster-autopilot/variables.tf b/modules/gke-cluster-autopilot/variables.tf index b3d41a9b3..44ac36f35 100644 --- a/modules/gke-cluster-autopilot/variables.tf +++ b/modules/gke-cluster-autopilot/variables.tf @@ -212,7 +212,7 @@ variable "maintenance_config" { default = { daily_window_start_time = "03:00" recurring_window = null - maintenance_exclusion = [] + maintenance_exclusions = [] } } diff --git a/modules/gke-cluster-standard/README.md b/modules/gke-cluster-standard/README.md index 0e9516240..4596cf3f7 100644 --- a/modules/gke-cluster-standard/README.md +++ b/modules/gke-cluster-standard/README.md @@ -527,7 +527,7 @@ module "cluster-1" { | [issue_client_certificate](variables.tf#L287) | Enable issuing client certificate. | bool | | false | | [labels](variables.tf#L293) | Cluster resource labels. | map(string) | | {} | | [logging_config](variables.tf#L305) | Logging configuration. | object({…}) | | {} | -| [maintenance_config](variables.tf#L326) | Maintenance window configuration. | object({…}) | | {…} | +| [maintenance_config](variables.tf#L326) | Maintenance window configuration. | object({…}) | | {…} | | [max_pods_per_node](variables.tf#L349) | Maximum number of pods per node in this cluster. | number | | 110 | | [min_master_version](variables.tf#L355) | Minimum version of the master, defaults to the version of the most recent official release. | string | | null | | [monitoring_config](variables.tf#L361) | Monitoring configuration. Google Cloud Managed Service for Prometheus is enabled by default. | object({…}) | | {} | diff --git a/modules/gke-cluster-standard/variables.tf b/modules/gke-cluster-standard/variables.tf index 0f80701be..7e6cf4d2d 100644 --- a/modules/gke-cluster-standard/variables.tf +++ b/modules/gke-cluster-standard/variables.tf @@ -342,7 +342,7 @@ variable "maintenance_config" { default = { daily_window_start_time = "03:00" recurring_window = null - maintenance_exclusion = [] + maintenance_exclusions = [] } } From 9d35f19ecb4516544492f1391ff22bce190d8800 Mon Sep 17 00:00:00 2001 From: apichick <19226769+apichick@users.noreply.github.com> Date: Tue, 24 Feb 2026 17:31:57 +0100 Subject: [PATCH 2/3] Fixed psc connection id in net-address module output (#3763) --- modules/net-address/outputs.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/net-address/outputs.tf b/modules/net-address/outputs.tf index abca88674..067378a6f 100644 --- a/modules/net-address/outputs.tf +++ b/modules/net-address/outputs.tf @@ -91,7 +91,7 @@ output "psc" { forwarding_rule = { id = try(google_compute_forwarding_rule.psc_consumer[k].id, null) name = try(google_compute_forwarding_rule.psc_consumer[k].name, null) - psc_connection_id = try(google_compute_global_forwarding_rule.psc_consumer[k].psc_connection_id, null) + psc_connection_id = try(google_compute_forwarding_rule.psc_consumer[k].psc_connection_id, null) } } } From 81b70695acfaeb8ae000791e0625ebb3762bd1f9 Mon Sep 17 00:00:00 2001 From: Simon Roberts Date: Wed, 25 Feb 2026 03:58:43 +1100 Subject: [PATCH 3/3] Add parameter to modules/pubsub to support message_storage_policy.enforce_in_transit (#3761) Co-authored-by: Ludovico Magnocavallo --- modules/pubsub/README.md | 11 ++++++----- modules/pubsub/main.tf | 1 + modules/pubsub/variables.tf | 6 ++++++ 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/modules/pubsub/README.md b/modules/pubsub/README.md index f561210d0..de43c0f60 100644 --- a/modules/pubsub/README.md +++ b/modules/pubsub/README.md @@ -228,8 +228,8 @@ module "pubsub" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [name](variables.tf#L49) | PubSub topic name. | string | ✓ | | -| [project_id](variables.tf#L54) | Project used for resources. | string | ✓ | | +| [name](variables.tf#L55) | PubSub topic name. | string | ✓ | | +| [project_id](variables.tf#L60) | Project used for resources. | string | ✓ | | | [context](variables.tf#L17) | Context-specific interpolations. | object({…}) | | {} | | [iam](variables-iam.tf#L17) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [iam_bindings](variables-iam.tf#L24) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | map(object({…})) | | {} | @@ -238,9 +238,10 @@ module "pubsub" { | [kms_key](variables.tf#L30) | KMS customer managed encryption key. | string | | null | | [labels](variables.tf#L36) | Labels. | map(string) | | {} | | [message_retention_duration](variables.tf#L43) | Minimum duration to retain a message after it is published to the topic. | string | | null | -| [regions](variables.tf#L59) | List of regions used to set persistence policy. | list(string) | | [] | -| [schema](variables.tf#L66) | Topic schema. If set, all messages in this topic should follow this schema. | object({…}) | | null | -| [subscriptions](variables.tf#L76) | Topic subscriptions. Also define push configs for push subscriptions. If options is set to null subscription defaults will be used. Labels default to topic labels if set to null. | map(object({…})) | | {} | +| [message_storage_enforce_in_transit](variables.tf#L49) | If true, var.regions is also used to enforce in-transit guarantees for messages. | bool | | null | +| [regions](variables.tf#L65) | List of regions used to set persistence policy. | list(string) | | [] | +| [schema](variables.tf#L72) | Topic schema. If set, all messages in this topic should follow this schema. | object({…}) | | null | +| [subscriptions](variables.tf#L82) | Topic subscriptions. Also define push configs for push subscriptions. If options is set to null subscription defaults will be used. Labels default to topic labels if set to null. | map(object({…})) | | {} | ## Outputs diff --git a/modules/pubsub/main.tf b/modules/pubsub/main.tf index 7dde62ab1..33cd45092 100644 --- a/modules/pubsub/main.tf +++ b/modules/pubsub/main.tf @@ -49,6 +49,7 @@ resource "google_pubsub_topic" "default" { allowed_persistence_regions = [ for v in var.regions : lookup(local.ctx.locations, v, v) ] + enforce_in_transit = var.message_storage_enforce_in_transit } } dynamic "schema_settings" { diff --git a/modules/pubsub/variables.tf b/modules/pubsub/variables.tf index d868afa23..21c50b975 100644 --- a/modules/pubsub/variables.tf +++ b/modules/pubsub/variables.tf @@ -46,6 +46,12 @@ variable "message_retention_duration" { default = null } +variable "message_storage_enforce_in_transit" { + description = "If true, var.regions is also used to enforce in-transit guarantees for messages." + type = bool + default = null +} + variable "name" { description = "PubSub topic name." type = string