Skip to content

Commit 0f37d88

Browse files
wyardleywyardley
committed
container: add support for kubelet read only port
- Add `no_enable_insecure_kubelet_readonly_port` to google_container_cluster - Allow setting `insecure_kubelet_readonly_port_enabled` for `container_node_pool` https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port Fixes hashicorp/terraform-provider-google#15208
1 parent 3c26638 commit 0f37d88

6 files changed

+204
-20
lines changed

‎mmv1/third_party/terraform/services/container/go/node_config.go.tmpl

+8
Original file line numberDiff line numberDiff line change
@@ -601,6 +601,11 @@ func schemaNodeConfig() *schema.Schema {
601601
Optional: true,
602602
Description: `Set the CPU CFS quota period value 'cpu.cfs_period_us'.`,
603603
},
604+
"insecure_kubelet_readonly_port_enabled": {
605+
Type: schema.TypeBool,
606+
Optional: true,
607+
Description: `Enable or disable Kubelet read only port.`,
608+
},
604609
"pod_pids_limit": {
605610
Type: schema.TypeInt,
606611
Optional: true,
@@ -1154,6 +1159,9 @@ func expandKubeletConfig(v interface{}) *container.NodeKubeletConfig {
11541159
if cpuCfsQuotaPeriod, ok := cfg["cpu_cfs_quota_period"]; ok {
11551160
kConfig.CpuCfsQuotaPeriod = cpuCfsQuotaPeriod.(string)
11561161
}
1162+
if insecureKubeletReadonlyPortEnabled, ok := cfg["insecure_kubelet_readonly_port_enabled"]; ok {
1163+
kConfig.insecureKubeletReadonlyPortEnabled = insecureKubeletReadonlyPortEnabled.(bool)
1164+
}
11571165
if podPidsLimit, ok := cfg["pod_pids_limit"]; ok {
11581166
kConfig.PodPidsLimit = int64(podPidsLimit.(int))
11591167
}

‎mmv1/third_party/terraform/services/container/go/resource_container_node_pool_test.go.tmpl

+15-10
Original file line numberDiff line numberDiff line change
@@ -526,10 +526,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
526526
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
527527
Steps: []resource.TestStep{
528528
{
529-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, 2048),
529+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, true, 2048),
530530
Check: resource.ComposeTestCheckFunc(
531531
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
532532
"node_config.0.kubelet_config.0.cpu_cfs_quota", "true"),
533+
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
534+
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "true"),
533535
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
534536
"node_config.0.kubelet_config.0.pod_pids_limit", "2048"),
535537
),
@@ -540,10 +542,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
540542
ImportStateVerify: true,
541543
},
542544
{
543-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, 1024),
545+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, false, 1024),
544546
Check: resource.ComposeTestCheckFunc(
545547
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
546548
"node_config.0.kubelet_config.0.cpu_cfs_quota", "false"),
549+
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
550+
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "false"),
547551
),
548552
},
549553
{
@@ -571,7 +575,7 @@ func TestAccContainerNodePool_withInvalidKubeletCpuManagerPolicy(t *testing.T) {
571575
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
572576
Steps: []resource.TestStep{
573577
{
574-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "dontexist", "100us", networkName, subnetworkName, true, 1024),
578+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "dontexist", "100us", networkName, subnetworkName, true, false, 1024),
575579
ExpectError: regexp.MustCompile(`.*to be one of \["?static"? "?none"? "?"?\].*`),
576580
},
577581
},
@@ -3136,7 +3140,7 @@ resource "google_container_node_pool" "with_sandbox_config" {
31363140
}
31373141
{{- end }}
31383142

3139-
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota bool, podPidsLimit int) string {
3143+
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota, insecureKubeletReadonlyPortEnabled bool, podPidsLimit int) string {
31403144
return fmt.Sprintf(`
31413145
data "google_container_engine_versions" "central1a" {
31423146
location = "us-central1-a"
@@ -3162,10 +3166,11 @@ resource "google_container_node_pool" "with_kubelet_config" {
31623166
node_config {
31633167
image_type = "COS_CONTAINERD"
31643168
kubelet_config {
3165-
cpu_manager_policy = %q
3166-
cpu_cfs_quota = %v
3167-
cpu_cfs_quota_period = %q
3168-
pod_pids_limit = %d
3169+
cpu_manager_policy = %q
3170+
cpu_cfs_quota = %v
3171+
cpu_cfs_quota_period = %q
3172+
insecure_kubelet_readonly_port_enabled = %v
3173+
pod_pids_limit = %d
31693174
}
31703175
oauth_scopes = [
31713176
"https://www.googleapis.com/auth/logging.write",
@@ -3174,7 +3179,7 @@ resource "google_container_node_pool" "with_kubelet_config" {
31743179
logging_variant = "DEFAULT"
31753180
}
31763181
}
3177-
`, cluster, networkName, subnetworkName, np, policy, quota, period, podPidsLimit)
3182+
`, cluster, networkName, subnetworkName, np, policy, quota, insecureKubeletReadonlyPortEnabled, period, podPidsLimit)
31783183
}
31793184

31803185
func testAccContainerNodePool_withLinuxNodeConfig(cluster, np, tcpMem, networkName, subnetworkName string) string {
@@ -4931,4 +4936,4 @@ resource "google_container_node_pool" "np" {
49314936
}
49324937
}
49334938
`, cluster, np)
4934-
}
4939+
}

‎mmv1/third_party/terraform/services/container/node_config.go.erb

+5
Original file line numberDiff line numberDiff line change
@@ -602,6 +602,11 @@ func schemaNodeConfig() *schema.Schema {
602602
Optional: true,
603603
Description: `Set the CPU CFS quota period value 'cpu.cfs_period_us'.`,
604604
},
605+
"insecure_kubelet_readonly_port_enabled": {
606+
Type: schema.TypeBool,
607+
Optional: true,
608+
Description: `Enable or disable Kubelet read only port.`,
609+
},
605610
"pod_pids_limit": {
606611
Type: schema.TypeInt,
607612
Optional: true,

‎mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.erb

+153
Original file line numberDiff line numberDiff line change
@@ -1519,6 +1519,98 @@ func TestAccContainerCluster_withNodeConfig(t *testing.T) {
15191519
})
15201520
}
15211521

1522+
func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfigBool(t *testing.T) {
1523+
t.Parallel()
1524+
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
1525+
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
1526+
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
1527+
1528+
acctest.VcrTest(t, resource.TestCase{
1529+
PreCheck: func() { acctest.AccTestPreCheck(t) },
1530+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
1531+
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
1532+
Steps: []resource.TestStep{
1533+
{
1534+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfigBool(clusterName, networkName, subnetworkName, false),
1535+
},
1536+
{
1537+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_in_node_config",
1538+
ImportState: true,
1539+
ImportStateVerify: true,
1540+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1541+
},
1542+
},
1543+
})
1544+
}
1545+
1546+
func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(t *testing.T) {
1547+
t.Parallel()
1548+
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
1549+
nodePoolName := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
1550+
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
1551+
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
1552+
1553+
acctest.VcrTest(t, resource.TestCase{
1554+
PreCheck: func() { acctest.AccTestPreCheck(t) },
1555+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
1556+
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
1557+
Steps: []resource.TestStep{
1558+
{
1559+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(clusterName, nodePoolName, networkName, subnetworkName, false),
1560+
},
1561+
{
1562+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_in_node_pool",
1563+
ImportState: true,
1564+
ImportStateVerify: true,
1565+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1566+
},
1567+
},
1568+
})
1569+
}
1570+
1571+
func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledUpdatesBool(t *testing.T) {
1572+
t.Parallel()
1573+
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
1574+
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
1575+
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
1576+
1577+
acctest.VcrTest(t, resource.TestCase{
1578+
PreCheck: func() { acctest.AccTestPreCheck(t) },
1579+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
1580+
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
1581+
Steps: []resource.TestStep{
1582+
{
1583+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, networkName, subnetworkName, true),
1584+
},
1585+
{
1586+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
1587+
ImportState: true,
1588+
ImportStateVerify: true,
1589+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1590+
},
1591+
{
1592+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, networkName, subnetworkName, false),
1593+
},
1594+
{
1595+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
1596+
ImportState: true,
1597+
ImportStateVerify: true,
1598+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1599+
},
1600+
{
1601+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, networkName, subnetworkName, true),
1602+
},
1603+
{
1604+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
1605+
ImportState: true,
1606+
ImportStateVerify: true,
1607+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1608+
},
1609+
},
1610+
})
1611+
}
1612+
1613+
15221614
func TestAccContainerCluster_withLoggingVariantInNodeConfig(t *testing.T) {
15231615
t.Parallel()
15241616
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
@@ -6476,6 +6568,67 @@ resource "google_container_cluster" "with_node_config" {
64766568
`, clusterName, networkName, subnetworkName)
64776569
}
64786570

6571+
func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfigBool(clusterName, networkName, subnetworkName string, insecureKubeletReadonlyPortEnabled bool) string {
6572+
return fmt.Sprintf(`
6573+
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_in_node_config" {
6574+
name = "%s"
6575+
location = "us-central1-f"
6576+
initial_node_count = 1
6577+
6578+
node_config {
6579+
kubelet_config {
6580+
insecure_kubelet_readonly_port_enabled = %v
6581+
}
6582+
}
6583+
deletion_protection = false
6584+
network = "%s"
6585+
subnetwork = "%s"
6586+
}
6587+
`, clusterName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
6588+
}
6589+
6590+
func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(clusterName, nodePoolName, networkName, subnetworkName string, insecureKubeletReadonlyPortEnabled bool) string {
6591+
return fmt.Sprintf(`
6592+
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_in_node_pool" {
6593+
name = "%s"
6594+
location = "us-central1-f"
6595+
6596+
node_pool {
6597+
name = "%s"
6598+
initial_node_count = 1
6599+
node_config {
6600+
kubelet_config {
6601+
insecure_kubelet_readonly_port_enabled = %v
6602+
}
6603+
}
6604+
}
6605+
deletion_protection = false
6606+
network = "%s"
6607+
subnetwork = "%s"
6608+
}
6609+
`, clusterName, nodePoolName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
6610+
}
6611+
6612+
func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, networkName, subnetworkName string, insecureKubeletReadonlyPortEnabled bool) string {
6613+
return fmt.Sprintf(`
6614+
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_node_pool_default" {
6615+
name = "%s"
6616+
location = "us-central1-f"
6617+
initial_node_count = 1
6618+
6619+
node_pool_defaults {
6620+
node_config_defaults {
6621+
insecure_kubelet_readonly_port_enabled = %v
6622+
}
6623+
}
6624+
deletion_protection = false
6625+
network = "%s"
6626+
subnetwork = "%s"
6627+
}
6628+
`, clusterName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
6629+
}
6630+
6631+
64796632
func testAccContainerCluster_withLoggingVariantInNodeConfig(clusterName, loggingVariant, networkName, subnetworkName string) string {
64806633
return fmt.Sprintf(`
64816634
resource "google_container_cluster" "with_logging_variant_in_node_config" {

‎mmv1/third_party/terraform/services/container/resource_container_node_pool_test.go.erb

+15-10
Original file line numberDiff line numberDiff line change
@@ -527,10 +527,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
527527
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
528528
Steps: []resource.TestStep{
529529
{
530-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, 2048),
530+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, false, 2048),
531531
Check: resource.ComposeTestCheckFunc(
532532
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
533533
"node_config.0.kubelet_config.0.cpu_cfs_quota", "true"),
534+
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
535+
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "false"),
534536
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
535537
"node_config.0.kubelet_config.0.pod_pids_limit", "2048"),
536538
),
@@ -541,10 +543,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
541543
ImportStateVerify: true,
542544
},
543545
{
544-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, 1024),
546+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, true, 1024),
545547
Check: resource.ComposeTestCheckFunc(
546548
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
547549
"node_config.0.kubelet_config.0.cpu_cfs_quota", "false"),
550+
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
551+
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "true"),
548552
),
549553
},
550554
{
@@ -572,7 +576,7 @@ func TestAccContainerNodePool_withInvalidKubeletCpuManagerPolicy(t *testing.T) {
572576
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
573577
Steps: []resource.TestStep{
574578
{
575-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "dontexist", "100us", networkName, subnetworkName, true, 1024),
579+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "dontexist", "100us", networkName, subnetworkName, true, false, 1024),
576580
ExpectError: regexp.MustCompile(`.*to be one of \["?static"? "?none"? "?"?\].*`),
577581
},
578582
},
@@ -3137,7 +3141,7 @@ resource "google_container_node_pool" "with_sandbox_config" {
31373141
}
31383142
<% end -%>
31393143

3140-
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota bool, podPidsLimit int) string {
3144+
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota, insecureKubeletReadonlyPortEnabled bool, podPidsLimit int) string {
31413145
return fmt.Sprintf(`
31423146
data "google_container_engine_versions" "central1a" {
31433147
location = "us-central1-a"
@@ -3163,10 +3167,11 @@ resource "google_container_node_pool" "with_kubelet_config" {
31633167
node_config {
31643168
image_type = "COS_CONTAINERD"
31653169
kubelet_config {
3166-
cpu_manager_policy = %q
3167-
cpu_cfs_quota = %v
3168-
cpu_cfs_quota_period = %q
3169-
pod_pids_limit = %d
3170+
cpu_manager_policy = %q
3171+
cpu_cfs_quota = %v
3172+
cpu_cfs_quota_period = %q
3173+
insecure_kubelet_readonly_port_enabled = %v
3174+
pod_pids_limit = %d
31703175
}
31713176
oauth_scopes = [
31723177
"https://www.googleapis.com/auth/logging.write",
@@ -3175,7 +3180,7 @@ resource "google_container_node_pool" "with_kubelet_config" {
31753180
logging_variant = "DEFAULT"
31763181
}
31773182
}
3178-
`, cluster, networkName, subnetworkName, np, policy, quota, period, podPidsLimit)
3183+
`, cluster, networkName, subnetworkName, np, policy, quota, period, insecureKubeletReadonlyPortEnabled, podPidsLimit)
31793184
}
31803185

31813186
func testAccContainerNodePool_withLinuxNodeConfig(cluster, np, tcpMem, networkName, subnetworkName string) string {
@@ -4932,4 +4937,4 @@ resource "google_container_node_pool" "np" {
49324937
}
49334938
}
49344939
`, cluster, np)
4935-
}
4940+
}

‎mmv1/third_party/terraform/website/docs/r/container_cluster.html.markdown

+8
Original file line numberDiff line numberDiff line change
@@ -1097,6 +1097,10 @@ node_pool_auto_config {
10971097

10981098
The `node_config_defaults` block supports:
10991099

1100+
* `insecure_kubelet_readonly_port_enabled` (Optional) Controls whether the
1101+
kubelet read-only port is enabled for newly created node pools in the
1102+
cluster. It is strongly recommended to set this to `false`.
1103+
11001104
* `logging_variant` (Optional) The type of logging agent that is deployed by default for newly created node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. See [Increasing logging agent throughput](https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs#throughput) for more information.
11011105

11021106
* `gcfs_config` (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) The default Google Container Filesystem (GCFS) configuration at the cluster level. e.g. enable [image streaming](https://cloud.google.com/kubernetes-engine/docs/how-to/image-streaming) across all the node pools within the cluster. Structure is [documented below](#nested_gcfs_config).
@@ -1287,6 +1291,10 @@ value and accepts an invalid `default` value instead. While this remains true,
12871291
not specifying the `kubelet_config` block should be the equivalent of specifying
12881292
`none`.
12891293

1294+
* `insecure_kubelet_readonly_port_enabled` - (Optional) Controls whether the
1295+
kubelet read-only port is enabled. It is strongly recommended to set this to
1296+
`false`.
1297+
12901298
* `pod_pids_limit` - (Optional) Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304.
12911299

12921300
<a name="nested_linux_node_config"></a>The `linux_node_config` block supports:

0 commit comments

Comments
 (0)