9b9ad76ced
* Update gke-hub to use new Policy Controller API Fixes #3287 * Use same config format for servicemesh * remove useless trys * use ternaries as in the rest of the repo * Update docs and fix tests * Update variables * Bump tofu version * Bump terraform version 1.12
373 lines
13 KiB
HCL
373 lines
13 KiB
HCL
/**
|
|
* Copyright 2025 Google LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
locals {
|
|
# Filter and prepare config management configurations
|
|
cluster_cm_config = {
|
|
for key, cluster in var.clusters :
|
|
key => lookup(var.configmanagement_templates, cluster.configmanagement, null)
|
|
if cluster.configmanagement != null &&
|
|
var.features.configmanagement == true &&
|
|
lookup(var.configmanagement_templates, cluster.configmanagement, null) != null
|
|
}
|
|
|
|
# Filter and prepare policy controller configurations
|
|
cluster_pc_config = {
|
|
for key, cluster in var.clusters :
|
|
key => lookup(var.policycontroller_templates, cluster.policycontroller, null)
|
|
if cluster.policycontroller != null &&
|
|
var.features.policycontroller == true &&
|
|
lookup(var.policycontroller_templates, cluster.policycontroller, null) != null
|
|
}
|
|
|
|
# Filter and prepare service mesh configurations
|
|
cluster_mesh_config = {
|
|
for key, cluster in var.clusters :
|
|
key => lookup(var.servicemesh_templates, cluster.servicemesh, null)
|
|
if cluster.servicemesh != null &&
|
|
var.features.servicemesh == true &&
|
|
lookup(var.servicemesh_templates, cluster.servicemesh, null) != null
|
|
}
|
|
|
|
hub_features = {
|
|
for k, v in var.features :
|
|
k => v
|
|
if v != null && v != false && v != ""
|
|
}
|
|
}
|
|
|
|
resource "google_gke_hub_membership" "default" {
|
|
provider = google-beta
|
|
for_each = var.clusters
|
|
project = var.project_id
|
|
location = var.location
|
|
membership_id = each.key
|
|
endpoint {
|
|
gke_cluster {
|
|
resource_link = "//container.googleapis.com/${each.value.id}"
|
|
}
|
|
}
|
|
dynamic "authority" {
|
|
for_each = each.value.workload_identity ? [1] : []
|
|
content {
|
|
issuer = "https://container.googleapis.com/v1/${each.value.id}"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "google_gke_hub_feature" "default" {
|
|
provider = google-beta
|
|
for_each = local.hub_features
|
|
project = var.project_id
|
|
name = each.key
|
|
location = "global"
|
|
dynamic "spec" {
|
|
for_each = each.key == "multiclusteringress" && each.value != null ? [1] : []
|
|
content {
|
|
multiclusteringress {
|
|
config_membership = google_gke_hub_membership.default[each.value].id
|
|
}
|
|
}
|
|
}
|
|
dynamic "fleet_default_member_config" {
|
|
for_each = var.fleet_default_member_config[*]
|
|
content {
|
|
dynamic "mesh" {
|
|
for_each = var.fleet_default_member_config.mesh[*]
|
|
content {
|
|
management = mesh.value.management
|
|
}
|
|
}
|
|
|
|
dynamic "configmanagement" {
|
|
for_each = var.fleet_default_member_config.configmanagement[*]
|
|
content {
|
|
version = configmanagement.value.version
|
|
|
|
dynamic "config_sync" {
|
|
for_each = configmanagement.value.config_sync[*]
|
|
content {
|
|
prevent_drift = config_sync.value.prevent_drift
|
|
source_format = config_sync.value.source_format
|
|
enabled = config_sync.value.enabled
|
|
|
|
dynamic "git" {
|
|
for_each = config_sync.value.git[*]
|
|
content {
|
|
gcp_service_account_email = git.value.gcp_service_account_email
|
|
https_proxy = git.value.https_proxy
|
|
policy_dir = git.value.policy_dir
|
|
secret_type = git.value.secret_type
|
|
sync_branch = git.value.sync_branch
|
|
sync_repo = git.value.sync_repo
|
|
sync_rev = git.value.sync_rev
|
|
sync_wait_secs = git.value.sync_wait_secs
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
dynamic "policycontroller" {
|
|
for_each = var.fleet_default_member_config.policycontroller[*]
|
|
content {
|
|
version = policycontroller.value.version
|
|
|
|
policy_controller_hub_config {
|
|
audit_interval_seconds = policycontroller.value.policy_controller_hub_config.audit_interval_seconds
|
|
constraint_violation_limit = policycontroller.value.policy_controller_hub_config.constraint_violation_limit
|
|
exemptable_namespaces = policycontroller.value.policy_controller_hub_config.exemptable_namespaces
|
|
install_spec = policycontroller.value.policy_controller_hub_config.install_spec
|
|
log_denies_enabled = policycontroller.value.policy_controller_hub_config.log_denies_enabled
|
|
mutation_enabled = policycontroller.value.policy_controller_hub_config.mutation_enabled
|
|
referential_rules_enabled = policycontroller.value.policy_controller_hub_config.referential_rules_enabled
|
|
|
|
dynamic "deployment_configs" {
|
|
for_each = policycontroller.value.policy_controller_hub_config.deployment_configs[*]
|
|
content {
|
|
component = deployment_configs.key
|
|
|
|
dynamic "container_resources" {
|
|
for_each = deployment_configs.value.container_resources[*]
|
|
content {
|
|
dynamic "limits" {
|
|
for_each = deployment_configs.value.container_resources.limits[*]
|
|
content {
|
|
cpu = limits.value.cpu
|
|
memory = limits.value.memory
|
|
}
|
|
}
|
|
|
|
dynamic "requests" {
|
|
for_each = deployment_configs.value.container_resources.requests[*]
|
|
content {
|
|
cpu = requests.value.cpu
|
|
memory = requests.value.memory
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
pod_affinity = deployment_configs.value.pod_affinity
|
|
|
|
dynamic "pod_toleration" {
|
|
for_each = deployment_configs.value.pod_toleration[*]
|
|
content {
|
|
key = pod_toleration.value.key
|
|
operator = pod_toleration.value.operator
|
|
value = pod_toleration.value.value
|
|
effect = pod_toleration.value.effect
|
|
}
|
|
}
|
|
|
|
replica_count = deployment_configs.value.replica_count
|
|
}
|
|
}
|
|
|
|
dynamic "monitoring" {
|
|
for_each = policycontroller.value.policy_controller_hub_config.monitoring[*]
|
|
content {
|
|
backends = monitoring.value.backends
|
|
}
|
|
}
|
|
|
|
dynamic "policy_content" {
|
|
for_each = policycontroller.value.policy_controller_hub_config.policy_content[*]
|
|
content {
|
|
dynamic "bundles" {
|
|
for_each = policy_content.value.bundles == null ? {} : policy_content.value.bundles
|
|
content {
|
|
bundle = bundles.key
|
|
exempted_namespaces = bundles.value.exempted_namespaces
|
|
}
|
|
}
|
|
|
|
dynamic "template_library" {
|
|
for_each = policycontroller.value.policy_controller_hub_config.policy_content.template_library[*]
|
|
content {
|
|
installation = template_library.value.installation
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "google_gke_hub_feature_membership" "servicemesh" {
|
|
provider = google-beta
|
|
for_each = local.cluster_mesh_config
|
|
project = var.project_id
|
|
location = "global"
|
|
feature = google_gke_hub_feature.default["servicemesh"].name
|
|
membership = google_gke_hub_membership.default[each.key].membership_id
|
|
membership_location = var.location
|
|
|
|
mesh {
|
|
management = each.value.management
|
|
}
|
|
}
|
|
|
|
resource "google_gke_hub_feature_membership" "policycontroller" {
|
|
provider = google-beta
|
|
for_each = local.cluster_pc_config
|
|
project = var.project_id
|
|
location = "global"
|
|
feature = google_gke_hub_feature.default["policycontroller"].name
|
|
membership = google_gke_hub_membership.default[each.key].membership_id
|
|
membership_location = var.location
|
|
|
|
policycontroller {
|
|
version = each.value.version
|
|
|
|
policy_controller_hub_config {
|
|
audit_interval_seconds = each.value.policy_controller_hub_config.audit_interval_seconds
|
|
constraint_violation_limit = each.value.policy_controller_hub_config.constraint_violation_limit
|
|
|
|
dynamic "policy_content" {
|
|
for_each = each.value.policy_controller_hub_config.policy_content[*]
|
|
content {
|
|
dynamic "bundles" {
|
|
for_each = policy_content.value.bundles == null ? {} : policy_content.value.bundles
|
|
content {
|
|
bundle_name = bundles.key
|
|
exempted_namespaces = bundles.value.exempted_namespaces
|
|
}
|
|
}
|
|
|
|
dynamic "template_library" {
|
|
for_each = policy_content.value.template_library[*]
|
|
content {
|
|
installation = template_library.value.installation
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
dynamic "deployment_configs" {
|
|
for_each = each.value.policy_controller_hub_config.deployment_configs == null ? {} : each.value.policy_controller_hub_config.deployment_configs
|
|
content {
|
|
component_name = deployment_configs.key
|
|
|
|
dynamic "container_resources" {
|
|
for_each = deployment_configs.value.container_resources[*]
|
|
content {
|
|
dynamic "limits" {
|
|
for_each = container_resources.value.limits[*]
|
|
content {
|
|
cpu = container_resources.value.limits.cpu
|
|
memory = container_resources.value.limits.memory
|
|
}
|
|
}
|
|
|
|
dynamic "requests" {
|
|
for_each = container_resources.value.requests[*]
|
|
content {
|
|
cpu = requests.value.cpu
|
|
memory = requests.value.memory
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
pod_affinity = deployment_configs.value.pod_affinity
|
|
|
|
dynamic "pod_tolerations" {
|
|
for_each = deployment_configs.value.pod_tolerations[*]
|
|
content {
|
|
key = pod_tolerations.value.key
|
|
operator = pod_tolerations.value.operator
|
|
value = pod_tolerations.value.value
|
|
effect = pod_tolerations.value.effect
|
|
}
|
|
}
|
|
|
|
replica_count = deployment_configs.value.replica_count
|
|
}
|
|
}
|
|
|
|
exemptable_namespaces = each.value.policy_controller_hub_config.exemptable_namespaces
|
|
install_spec = each.value.policy_controller_hub_config.install_spec
|
|
log_denies_enabled = each.value.policy_controller_hub_config.log_denies_enabled
|
|
|
|
dynamic "monitoring" {
|
|
for_each = each.value.policy_controller_hub_config.monitoring[*]
|
|
content {
|
|
backends = monitoring.value.backends
|
|
}
|
|
}
|
|
|
|
mutation_enabled = each.value.policy_controller_hub_config.mutation_enabled
|
|
referential_rules_enabled = each.value.policy_controller_hub_config.referential_rules_enabled
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "google_gke_hub_feature_membership" "default" {
|
|
provider = google-beta
|
|
for_each = local.cluster_cm_config
|
|
project = var.project_id
|
|
location = "global"
|
|
feature = google_gke_hub_feature.default["configmanagement"].name
|
|
membership = google_gke_hub_membership.default[each.key].membership_id
|
|
membership_location = var.location
|
|
|
|
configmanagement {
|
|
version = each.value.version
|
|
|
|
dynamic "config_sync" {
|
|
for_each = each.value.config_sync[*]
|
|
content {
|
|
prevent_drift = config_sync.value.prevent_drift
|
|
source_format = config_sync.value.source_format
|
|
enabled = true
|
|
dynamic "git" {
|
|
for_each = config_sync.value.git[*]
|
|
content {
|
|
gcp_service_account_email = (
|
|
git.value.gcp_service_account_email
|
|
)
|
|
https_proxy = git.value.https_proxy
|
|
policy_dir = git.value.policy_dir
|
|
secret_type = git.value.secret_type
|
|
sync_branch = git.value.sync_branch
|
|
sync_repo = git.value.sync_repo
|
|
sync_rev = git.value.sync_rev
|
|
sync_wait_secs = git.value.sync_wait_secs
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
dynamic "hierarchy_controller" {
|
|
for_each = each.value.hierarchy_controller[*]
|
|
content {
|
|
enable_hierarchical_resource_quota = (
|
|
hierarchy_controller.value.enable_hierarchical_resource_quota
|
|
)
|
|
enable_pod_tree_labels = (
|
|
hierarchy_controller.value.enable_pod_tree_labels
|
|
)
|
|
enabled = true
|
|
}
|
|
}
|
|
}
|
|
}
|