Repository files navigation

This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, IP MASQ, Network Policy, etc.The resources/services/activations/deletions that this module will create/trigger are:

• Create a GKE cluster with the provided addons
• Create GKE Node Pool(s) with provided configuration and attach to cluster
• Replace the default kube-dns configmap ifstub_domains are provided
• Activate network policy ifnetwork_policy is true
• Addip-masq-agent configmap with providednon_masquerade_cidrs ifconfigure_ip_masq is true

Sub modules are provided for creating private clusters, beta private clusters, and beta public clusters as well. Beta sub modules allow for the use of various GKE beta features. See the modules directory for the various sub modules.

This module is meant for use with Terraform 0.12. If you haven'tupgraded and need a Terraform0.11.x-compatible version of this module, the last released versionintended for Terraform 0.11.x is3.0.0.

There are multiple examples included in theexamples folder but simple usage is as follows:

module"gke" {source="terraform-google-modules/kubernetes-engine/google"project_id="<PROJECT ID>"name="gke-test-1"region="us-central1"zones=["us-central1-a","us-central1-b","us-central1-f"]network="vpc-01"subnetwork="us-central1-01"ip_range_pods="us-central1-01-gke-01-pods"ip_range_services="us-central1-01-gke-01-services"http_load_balancing=falsehorizontal_pod_autoscaling=truenetwork_policy=truenode_pools=[    {      name="default-node-pool"      machine_type="e2-medium"      node_locations="us-central1-b,us-central1-c"      min_count=1      max_count=100      local_ssd_count=0      disk_size_gb=100      disk_type="pd-standard"      image_type="COS"      auto_repair=true      auto_upgrade=true      service_account="project-service-account@<PROJECT ID>.iam.gserviceaccount.com"      preemptible=false      initial_node_count=80    },  ]node_pools_oauth_scopes={    all= []    default-node-pool= ["https://www.googleapis.com/auth/cloud-platform",    ]  }node_pools_labels={    all= {}    default-node-pool= {      default-node-pool=true    }  }node_pools_metadata={    all= {}    default-node-pool= {      node-pool-metadata-custom-value="my-node-pool"    }  }node_pools_taints={    all= []    default-node-pool= [      {        key="default-node-pool"        value=true        effect="PREFER_NO_SCHEDULE"      },    ]  }node_pools_tags={    all= []    default-node-pool= ["default-node-pool",    ]  }}

Then perform the following commands on the root folder:

• terraform init to get the plugins
• terraform plan to see the infrastructure plan
• terraform apply to apply the infrastructure build
• terraform destroy to destroy the built infrastructure

object({
    enabled       = bool
    min_cpu_cores = number
    max_cpu_cores = number
    min_memory_gb = number
    max_memory_gb = number
  })

{
  "enabled": false,
  "max_cpu_cores": 0,
  "max_memory_gb": 0,
  "min_cpu_cores": 0,
  "min_memory_gb": 0
}

[
  {
    "key_name": "",
    "state": "DECRYPTED"
  }
]

[
  "8443",
  "9443",
  "15017"
]

[
  {
    "name": "default-node-pool"
  }
]

{
  "all": {},
  "default-node-pool": {}
}

{
  "all": {},
  "default-node-pool": {}
}

{
  "all": [
    "https://www.googleapis.com/auth/cloud-platform"
  ],
  "default-node-pool": []
}

{
  "all": [],
  "default-node-pool": []
}

{
  "all": [],
  "default-node-pool": []
}

[
  "10.0.0.0/8",
  "172.16.0.0/12",
  "192.168.0.0/16"
]

The node_pools variable takes the following parameters:

Before this module can be used on a project, you must ensure that the following pre-requisites are fulfilled:

1. Terraform and kubectl areinstalled on the machine where Terraform is executed.
2. The Service Account you execute the module with has the rightpermissions.
3. The Compute Engine and Kubernetes Engine APIs areactive on the project you will launch the cluster in.
4. If you are using a Shared VPC, the APIs must also be activated on the Shared VPC host project and your service account needs the proper permissions there.

Theproject factory can be used to provision projects with the correct APIs active and the necessary Shared VPC connections.

• kubectl 1.9.x

• Terraform 0.12
• Terraform Provider for GCP v3.41

Some submodules use theterraform-google-gcloud module. By default, this module assumes you already have gcloud installed in your $PATH.See themodule documentation for more information.

In order to execute this module you must have a Service Account with thefollowing project roles:

• roles/compute.viewer
• roles/compute.securityAdmin (only required ifadd_cluster_firewall_rules is set totrue)
• roles/container.clusterAdmin
• roles/container.developer
• roles/iam.serviceAccountAdmin
• roles/iam.serviceAccountUser
• roles/resourcemanager.projectIamAdmin (only required ifservice_account is set tocreate)

Additionally, ifservice_account is set tocreate andgrant_registry_access is requested, the service account requires the following role on theregistry_project_id project:

• roles/resourcemanager.projectIamAdmin

In order to operate with the Service Account you must activate the following APIs on the project where the Service Account was created:

• Compute Engine API - compute.googleapis.com
• Kubernetes Engine API - container.googleapis.com