Repository files navigation

This module handles opinionated Google Cloud Platform Kubernetes Engine cluster creation and configuration with Node Pools, IP MASQ, Network Policy, etc.The resources/services/activations/deletions that this module will create/trigger are:

• Create a GKE cluster with the provided addons
• Create GKE Node Pool(s) with provided configuration and attach to cluster
• Replace the default kube-dns configmap ifstub_domains are provided
• Activate network policy ifnetwork_policy is true
• Addip-masq-agent configmap with providednon_masquerade_cidrs ifconfigure_ip_masq is true

Sub modules are provided from creating private clusters, beta private clusters, and beta public clusters as well. Beta sub modules allow for the use of various GKE beta features. See the modules directory for the various sub modules.

This module is meant for use with Terraform 0.12. If you haven'tupgraded and need a Terraform0.11.x-compatible version of this module, the last released versionintended for Terraform 0.11.x is3.0.0.

There are multiple examples included in theexamples folder but simple usage is as follows:

module"gke" {source="terraform-google-modules/kubernetes-engine/google"project_id="<PROJECT ID>"name="gke-test-1"region="us-central1"zones=["us-central1-a","us-central1-b","us-central1-f"]network="vpc-01"subnetwork="us-central1-01"ip_range_pods="us-central1-01-gke-01-pods"ip_range_services="us-central1-01-gke-01-services"http_load_balancing=falsehorizontal_pod_autoscaling=truekubernetes_dashboard=truenetwork_policy=truenode_pools=[    {      name="default-node-pool"      machine_type="n1-standard-2"      min_count=1      max_count=100      disk_size_gb=100      disk_type="pd-standard"      image_type="COS"      auto_repair=true      auto_upgrade=true      service_account="project-service-account@<PROJECT ID>.iam.gserviceaccount.com"      preemptible=false      initial_node_count=80    },  ]node_pools_oauth_scopes={    all= []    default-node-pool= ["https://www.googleapis.com/auth/cloud-platform",    ]  }node_pools_labels={    all= {}    default-node-pool= {      default-node-pool=true    }  }node_pools_metadata={    all= {}    default-node-pool= {      node-pool-metadata-custom-value="my-node-pool"    }  }node_pools_taints={    all= []    default-node-pool= [      {        key="default-node-pool"        value=true        effect="PREFER_NO_SCHEDULE"      },    ]  }node_pools_tags={    all= []    default-node-pool= ["default-node-pool",    ]  }}

Then perform the following commands on the root folder:

• terraform init to get the plugins
• terraform plan to see the infrastructure plan
• terraform apply to apply the infrastructure build
• terraform destroy to destroy the built infrastructure

v3.0.0 is a breaking release. Refer to theUpgrading to v3.0 guide for details.

v2.0.0 is a breaking release. Refer to theUpgrading to v2.0 guide for details.

Version 1.0.0 of this module introduces a breaking change: adding thedisable-legacy-endpoints metadata field to all node pools. This metadata is required by GKE anddetermines whether the/0.1/ and/v1beta1/ paths are available in the nodes' metadata server. If your applications do not require access to the node's metadata server, you can leave the default value oftrue provided by the module. If your applications require access to the metadata server, be sure to read the linked documentation to see if you need to set the value for this field tofalse to allow your applications access to the above metadata server paths.

In either case, upgrading to module versionv1.0.0 will trigger a recreation of all node pools in the cluster.

Before this module can be used on a project, you must ensure that the following pre-requisites are fulfilled:

1. Terraform and kubectl areinstalled on the machine where Terraform is executed.
2. The Service Account you execute the module with has the rightpermissions.
3. The Compute Engine and Kubernetes Engine APIs areactive on the project you will launch the cluster in.
4. If you are using a Shared VPC, the APIs must also be activated on the Shared VPC host project and your service account needs the proper permissions there.

Theproject factory can be used to provision projects with the correct APIs active and the necessary Shared VPC connections.

• kubectl 1.9.x

• Terraform 0.12
• Terraform Provider for GCP v2.9

In order to execute this module you must have a Service Account with thefollowing project roles:

• roles/compute.viewer
• roles/container.clusterAdmin
• roles/container.developer
• roles/iam.serviceAccountAdmin
• roles/iam.serviceAccountUser
• roles/resourcemanager.projectIamAdmin (only required ifservice_account is set tocreate)

Additionally, ifservice_account is set tocreate andgrant_registry_access is requested, the service account requires the following role on theregistry_project_id project:

• roles/resourcemanager.projectIamAdmin

In order to operate with the Service Account you must activate the following APIs on the project where the Service Account was created:

• Compute Engine API - compute.googleapis.com
• Kubernetes Engine API - container.googleapis.com

The project has the following folders and files:

• /: root folder
• /examples: Examples for using this module and sub module.
• /helpers: Helper scripts.
• /scripts: Scripts for specific tasks on module (see Infrastructure section on this file).
• /test: Folders with files for testing the module (see Testing section on this file).
• /main.tf:main file for the public module, contains all the resources to create.
• /variables.tf: Variables for the public cluster module.
• /output.tf: The outputs for the public cluster module.
• /README.MD: This file.
• /modules: Private and beta sub modules.