Skip to content

Commit bae9e06

Browse files
wyardleywyardley
committed
container: add support for kubelet read only port
- Add `no_enable_insecure_kubelet_readonly_port` to google_container_cluster - Allow setting `insecure_kubelet_readonly_port_enabled` for `container_node_pool` https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port Fixes hashicorp/terraform-provider-google#15208
1 parent 7a8d684 commit bae9e06

6 files changed

+197
-15
lines changed

‎mmv1/third_party/terraform/services/container/go/node_config.go.tmpl

+8
Original file line numberDiff line numberDiff line change
@@ -601,6 +601,11 @@ func schemaNodeConfig() *schema.Schema {
601601
Optional: true,
602602
Description: `Set the CPU CFS quota period value 'cpu.cfs_period_us'.`,
603603
},
604+
"insecure_kubelet_readonly_port_enabled": {
605+
Type: schema.TypeBool,
606+
Optional: true,
607+
Description: `Enable or disable Kubelet read only port.`,
608+
},
604609
"pod_pids_limit": {
605610
Type: schema.TypeInt,
606611
Optional: true,
@@ -1154,6 +1159,9 @@ func expandKubeletConfig(v interface{}) *container.NodeKubeletConfig {
11541159
if cpuCfsQuotaPeriod, ok := cfg["cpu_cfs_quota_period"]; ok {
11551160
kConfig.CpuCfsQuotaPeriod = cpuCfsQuotaPeriod.(string)
11561161
}
1162+
if insecureKubeletReadonlyPortEnabled, ok := cfg["insecure_kubelet_readonly_port_enabled"]; ok {
1163+
kConfig.insecureKubeletReadonlyPortEnabled = insecureKubeletReadonlyPortEnabled.(bool)
1164+
}
11571165
if podPidsLimit, ok := cfg["pod_pids_limit"]; ok {
11581166
kConfig.PodPidsLimit = int64(podPidsLimit.(int))
11591167
}

‎mmv1/third_party/terraform/services/container/go/resource_container_node_pool_test.go.tmpl

+12-7
Original file line numberDiff line numberDiff line change
@@ -526,10 +526,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
526526
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
527527
Steps: []resource.TestStep{
528528
{
529-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, 2048),
529+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, true, 2048),
530530
Check: resource.ComposeTestCheckFunc(
531531
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
532532
"node_config.0.kubelet_config.0.cpu_cfs_quota", "true"),
533+
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
534+
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "true"),
533535
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
534536
"node_config.0.kubelet_config.0.pod_pids_limit", "2048"),
535537
),
@@ -540,10 +542,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
540542
ImportStateVerify: true,
541543
},
542544
{
543-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, 1024),
545+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, false, 1024),
544546
Check: resource.ComposeTestCheckFunc(
545547
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
546548
"node_config.0.kubelet_config.0.cpu_cfs_quota", "false"),
549+
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
550+
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "false"),
547551
),
548552
},
549553
{
@@ -3136,7 +3140,7 @@ resource "google_container_node_pool" "with_sandbox_config" {
31363140
}
31373141
{{- end }}
31383142

3139-
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota bool, podPidsLimit int) string {
3143+
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota bool, insecureKubeletReadonlyPortEnabled bool, podPidsLimit int) string {
31403144
return fmt.Sprintf(`
31413145
data "google_container_engine_versions" "central1a" {
31423146
location = "us-central1-a"
@@ -3162,10 +3166,11 @@ resource "google_container_node_pool" "with_kubelet_config" {
31623166
node_config {
31633167
image_type = "COS_CONTAINERD"
31643168
kubelet_config {
3165-
cpu_manager_policy = %q
3166-
cpu_cfs_quota = %v
3167-
cpu_cfs_quota_period = %q
3168-
pod_pids_limit = %d
3169+
cpu_manager_policy = %q
3170+
cpu_cfs_quota = %v
3171+
cpu_cfs_quota_period = %q
3172+
insecure_kubelet_readonly_port_enabled = %v
3173+
pod_pids_limit = %d
31693174
}
31703175
oauth_scopes = [
31713176
"https://www.googleapis.com/auth/logging.write",

‎mmv1/third_party/terraform/services/container/node_config.go.erb

+5
Original file line numberDiff line numberDiff line change
@@ -602,6 +602,11 @@ func schemaNodeConfig() *schema.Schema {
602602
Optional: true,
603603
Description: `Set the CPU CFS quota period value 'cpu.cfs_period_us'.`,
604604
},
605+
"insecure_kubelet_readonly_port_enabled": {
606+
Type: schema.TypeBool,
607+
Optional: true,
608+
Description: `Enable or disable Kubelet read only port.`,
609+
},
605610
"pod_pids_limit": {
606611
Type: schema.TypeInt,
607612
Optional: true,

‎mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.erb

+151
Original file line numberDiff line numberDiff line change
@@ -1519,6 +1519,98 @@ func TestAccContainerCluster_withNodeConfig(t *testing.T) {
15191519
})
15201520
}
15211521

1522+
func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfigBool(t *testing.T) {
1523+
t.Parallel()
1524+
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
1525+
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
1526+
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
1527+
1528+
acctest.VcrTest(t, resource.TestCase{
1529+
PreCheck: func() { acctest.AccTestPreCheck(t) },
1530+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
1531+
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
1532+
Steps: []resource.TestStep{
1533+
{
1534+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfig(clusterName, false, networkName, subnetworkName),
1535+
},
1536+
{
1537+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_in_node_config",
1538+
ImportState: true,
1539+
ImportStateVerify: true,
1540+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1541+
},
1542+
},
1543+
})
1544+
}
1545+
1546+
func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(t *testing.T) {
1547+
t.Parallel()
1548+
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
1549+
nodePoolName := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
1550+
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
1551+
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
1552+
1553+
acctest.VcrTest(t, resource.TestCase{
1554+
PreCheck: func() { acctest.AccTestPreCheck(t) },
1555+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
1556+
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
1557+
Steps: []resource.TestStep{
1558+
{
1559+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(clusterName, nodePoolName, false, networkName, subnetworkName),
1560+
},
1561+
{
1562+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_in_node_pool",
1563+
ImportState: true,
1564+
ImportStateVerify: true,
1565+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1566+
},
1567+
},
1568+
})
1569+
}
1570+
1571+
func TestAccContainerCluster_withInsecureKubeletReadonlyPortEnabledUpdatesBool(t *testing.T) {
1572+
t.Parallel()
1573+
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
1574+
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
1575+
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
1576+
1577+
acctest.VcrTest(t, resource.TestCase{
1578+
PreCheck: func() { acctest.AccTestPreCheck(t) },
1579+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
1580+
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
1581+
Steps: []resource.TestStep{
1582+
{
1583+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, true, networkName, subnetworkName),
1584+
},
1585+
{
1586+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
1587+
ImportState: true,
1588+
ImportStateVerify: true,
1589+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1590+
},
1591+
{
1592+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefault(clusterName, false, networkName, subnetworkName),
1593+
},
1594+
{
1595+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
1596+
ImportState: true,
1597+
ImportStateVerify: true,
1598+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1599+
},
1600+
{
1601+
Config: testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefault(clusterName, true, networkName, subnetworkName),
1602+
},
1603+
{
1604+
ResourceName: "google_container_cluster.with_insecure_kubelet_readonly_port_enabled_node_pool_default",
1605+
ImportState: true,
1606+
ImportStateVerify: true,
1607+
ImportStateVerifyIgnore: []string{"deletion_protection"},
1608+
},
1609+
},
1610+
})
1611+
}
1612+
1613+
15221614
func TestAccContainerCluster_withLoggingVariantInNodeConfig(t *testing.T) {
15231615
t.Parallel()
15241616
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
@@ -6422,6 +6514,65 @@ resource "google_container_cluster" "with_node_config" {
64226514
`, clusterName, networkName, subnetworkName)
64236515
}
64246516

6517+
func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodeConfigBool(clusterName, insecureKubeletReadonlyPortEnabled bool, networkName, subnetworkName string) string {
6518+
return fmt.Sprintf(`
6519+
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_in_node_config" {
6520+
name = "%s"
6521+
location = "us-central1-f"
6522+
initial_node_count = 1
6523+
6524+
node_config {
6525+
insecure_kubelet_readonly_port_enabled = %v
6526+
}
6527+
deletion_protection = false
6528+
network = "%s"
6529+
subnetwork = "%s"
6530+
}
6531+
`, clusterName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
6532+
}
6533+
6534+
func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledInNodePoolBool(clusterName, nodePoolName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName string) string {
6535+
return fmt.Sprintf(`
6536+
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_in_node_pool" {
6537+
name = "%s"
6538+
location = "us-central1-f"
6539+
6540+
node_pool {
6541+
name = "%s"
6542+
initial_node_count = 1
6543+
node_config {
6544+
kubelet_config {
6545+
insecure_kubelet_readonly_port_enabled = %v
6546+
}
6547+
}
6548+
}
6549+
deletion_protection = false
6550+
network = "%s"
6551+
subnetwork = "%s"
6552+
}
6553+
`, clusterName, nodePoolName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
6554+
}
6555+
6556+
func testAccContainerCluster_withInsecureKubeletReadonlyPortEnabledNodePoolDefaultBool(clusterName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName string) string {
6557+
return fmt.Sprintf(`
6558+
resource "google_container_cluster" "with_insecure_kubelet_readonly_port_enabled_node_pool_default" {
6559+
name = "%s"
6560+
location = "us-central1-f"
6561+
initial_node_count = 1
6562+
6563+
node_pool_defaults {
6564+
node_config_defaults {
6565+
insecure_kubelet_readonly_port_enabled = %v
6566+
}
6567+
}
6568+
deletion_protection = false
6569+
network = "%s"
6570+
subnetwork = "%s"
6571+
}
6572+
`, clusterName, insecureKubeletReadonlyPortEnabled, networkName, subnetworkName)
6573+
}
6574+
6575+
64256576
func testAccContainerCluster_withLoggingVariantInNodeConfig(clusterName, loggingVariant, networkName, subnetworkName string) string {
64266577
return fmt.Sprintf(`
64276578
resource "google_container_cluster" "with_logging_variant_in_node_config" {

‎mmv1/third_party/terraform/services/container/resource_container_node_pool_test.go.erb

+13-8
Original file line numberDiff line numberDiff line change
@@ -527,10 +527,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
527527
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
528528
Steps: []resource.TestStep{
529529
{
530-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, 2048),
530+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "static", "100ms", networkName, subnetworkName, true, false, 2048),
531531
Check: resource.ComposeTestCheckFunc(
532532
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
533533
"node_config.0.kubelet_config.0.cpu_cfs_quota", "true"),
534+
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
535+
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "false"),
534536
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
535537
"node_config.0.kubelet_config.0.pod_pids_limit", "2048"),
536538
),
@@ -541,10 +543,12 @@ func TestAccContainerNodePool_withKubeletConfig(t *testing.T) {
541543
ImportStateVerify: true,
542544
},
543545
{
544-
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, 1024),
546+
Config: testAccContainerNodePool_withKubeletConfig(cluster, np, "", "", networkName, subnetworkName, false, true, 1024),
545547
Check: resource.ComposeTestCheckFunc(
546548
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
547549
"node_config.0.kubelet_config.0.cpu_cfs_quota", "false"),
550+
resource.TestCheckResourceAttr("google_container_node_pool.with_kubelet_config",
551+
"node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled", "true"),
548552
),
549553
},
550554
{
@@ -3137,7 +3141,7 @@ resource "google_container_node_pool" "with_sandbox_config" {
31373141
}
31383142
<% end -%>
31393143

3140-
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota bool, podPidsLimit int) string {
3144+
func testAccContainerNodePool_withKubeletConfig(cluster, np, policy, period, networkName, subnetworkName string, quota bool, insecureKubeletReadonlyPortEnabled bool, podPidsLimit int) string {
31413145
return fmt.Sprintf(`
31423146
data "google_container_engine_versions" "central1a" {
31433147
location = "us-central1-a"
@@ -3163,10 +3167,11 @@ resource "google_container_node_pool" "with_kubelet_config" {
31633167
node_config {
31643168
image_type = "COS_CONTAINERD"
31653169
kubelet_config {
3166-
cpu_manager_policy = %q
3167-
cpu_cfs_quota = %v
3168-
cpu_cfs_quota_period = %q
3169-
pod_pids_limit = %d
3170+
cpu_manager_policy = %q
3171+
cpu_cfs_quota = %v
3172+
cpu_cfs_quota_period = %q
3173+
insecure_kubelet_readonly_port_enabled = %v
3174+
pod_pids_limit = %d
31703175
}
31713176
oauth_scopes = [
31723177
"https://www.googleapis.com/auth/logging.write",
@@ -4929,4 +4934,4 @@ resource "google_container_node_pool" "np" {
49294934
}
49304935
}
49314936
`, cluster, np)
4932-
}
4937+
}

‎mmv1/third_party/terraform/website/docs/r/container_cluster.html.markdown

+8
Original file line numberDiff line numberDiff line change
@@ -1085,6 +1085,10 @@ node_pool_auto_config {
10851085

10861086
The `node_config_defaults` block supports:
10871087

1088+
* `insecure_kubelet_readonly_port_enabled` (Optional) Controls whether the
1089+
kubelet read-only port is enabled for newly created node pools in the
1090+
cluster. It is strongly recommended to set this to `false`.
1091+
10881092
* `logging_variant` (Optional) The type of logging agent that is deployed by default for newly created node pools in the cluster. Valid values include DEFAULT and MAX_THROUGHPUT. See [Increasing logging agent throughput](https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs#throughput) for more information.
10891093

10901094
* `gcfs_config` (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) The default Google Container Filesystem (GCFS) configuration at the cluster level. e.g. enable [image streaming](https://cloud.google.com/kubernetes-engine/docs/how-to/image-streaming) across all the node pools within the cluster. Structure is [documented below](#nested_gcfs_config).
@@ -1275,6 +1279,10 @@ value and accepts an invalid `default` value instead. While this remains true,
12751279
not specifying the `kubelet_config` block should be the equivalent of specifying
12761280
`none`.
12771281

1282+
* `insecure_kubelet_readonly_port_enabled` - (Optional) Controls whether the
1283+
kubelet read-only port is enabled. It is strongly recommended to set this to
1284+
`false`.
1285+
12781286
* `pod_pids_limit` - (Optional) Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304.
12791287

12801288
<a name="nested_linux_node_config"></a>The `linux_node_config` block supports:

0 commit comments

Comments
 (0)