Skip to content

Commit fcc529c

Browse files
wyardleymelinath
wyardley
and
melinath
authored
container: add support for kubelet read only port (#11272)
Co-authored-by: Stephen Lewis (Burrows) <[email protected]>
1 parent b25f26a commit fcc529c

File tree

5 files changed

+375
-18
lines changed

5 files changed

+375
-18
lines changed

‎mmv1/third_party/terraform/services/container/node_config.go.erb

+49-8
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,18 @@ func schemaContainerdConfig() *schema.Schema {
7878
}
7979
}
8080

81+
// Note: this is a bool internally, but implementing as an enum internally to
82+
// make it easier to accept API level defaults.
83+
func schemaInsecureKubeletReadonlyPortEnabled() *schema.Schema {
84+
return &schema.Schema{
85+
Type: schema.TypeString,
86+
Optional: true,
87+
Computed: true,
88+
Description: "Controls whether the kubelet read-only port is enabled. It is strongly recommended to set this to `FALSE`. Possible values: `TRUE`, `FALSE`.",
89+
ValidateFunc: validation.StringInSlice([]string{"FALSE","TRUE"}, false),
90+
}
91+
}
92+
8193
func schemaLoggingVariant() *schema.Schema {
8294
return &schema.Schema{
8395
Type: schema.TypeString,
@@ -597,6 +609,7 @@ func schemaNodeConfig() *schema.Schema {
597609
Optional: true,
598610
Description: `Set the CPU CFS quota period value 'cpu.cfs_period_us'.`,
599611
},
612+
"insecure_kubelet_readonly_port_enabled": schemaInsecureKubeletReadonlyPortEnabled(),
600613
"pod_pids_limit": {
601614
Type: schema.TypeInt,
602615
Optional: true,
@@ -769,14 +782,20 @@ func schemaNodeConfig() *schema.Schema {
769782
}
770783

771784
func expandNodeConfigDefaults(configured interface{}) *container.NodeConfigDefaults {
772-
configs := configured.([]interface{})
785+
configs := configured.([]interface{})
773786
if len(configs) == 0 || configs[0] == nil {
774787
return nil
775788
}
776789
config := configs[0].(map[string]interface{})
777790

778791
nodeConfigDefaults := &container.NodeConfigDefaults{}
779792
nodeConfigDefaults.ContainerdConfig = expandContainerdConfig(config["containerd_config"])
793+
if v, ok := config["insecure_kubelet_readonly_port_enabled"]; ok {
794+
nodeConfigDefaults.NodeKubeletConfig = &container.NodeKubeletConfig{
795+
InsecureKubeletReadonlyPortEnabled: expandInsecureKubeletReadonlyPortEnabled(v),
796+
ForceSendFields: []string{"InsecureKubeletReadonlyPortEnabled"},
797+
}
798+
}
780799
if variant, ok := config["logging_variant"]; ok {
781800
nodeConfigDefaults.LoggingConfig = &container.NodePoolLoggingConfig{
782801
VariantConfig: &container.LoggingVariantConfig{
@@ -785,14 +804,14 @@ func expandNodeConfigDefaults(configured interface{}) *container.NodeConfigDefau
785804
}
786805
}
787806
<% unless version == "ga" -%>
788-
if v, ok := config["gcfs_config"]; ok && len(v.([]interface{})) > 0 {
789-
gcfsConfig := v.([]interface{})[0].(map[string]interface{})
807+
if v, ok := config["gcfs_config"]; ok && len(v.([]interface{})) > 0 {
808+
gcfsConfig := v.([]interface{})[0].(map[string]interface{})
790809
nodeConfigDefaults.GcfsConfig = &container.GcfsConfig{
791810
Enabled: gcfsConfig["enabled"].(bool),
792811
}
793812
}
794813
<% end -%>
795-
return nodeConfigDefaults
814+
return nodeConfigDefaults
796815
}
797816

798817
func expandNodeConfig(v interface{}) *container.NodeConfig {
@@ -1134,6 +1153,13 @@ func expandWorkloadMetadataConfig(v interface{}) *container.WorkloadMetadataConf
11341153
return wmc
11351154
}
11361155

1156+
func expandInsecureKubeletReadonlyPortEnabled(v interface{}) bool {
1157+
if v == "TRUE" {
1158+
return true
1159+
}
1160+
return false
1161+
}
1162+
11371163
func expandKubeletConfig(v interface{}) *container.NodeKubeletConfig {
11381164
if v == nil {
11391165
return nil
@@ -1154,6 +1180,10 @@ func expandKubeletConfig(v interface{}) *container.NodeKubeletConfig {
11541180
if cpuCfsQuotaPeriod, ok := cfg["cpu_cfs_quota_period"]; ok {
11551181
kConfig.CpuCfsQuotaPeriod = cpuCfsQuotaPeriod.(string)
11561182
}
1183+
if insecureKubeletReadonlyPortEnabled, ok := cfg["insecure_kubelet_readonly_port_enabled"]; ok {
1184+
kConfig.InsecureKubeletReadonlyPortEnabled = expandInsecureKubeletReadonlyPortEnabled(insecureKubeletReadonlyPortEnabled)
1185+
kConfig.ForceSendFields = append(kConfig.ForceSendFields, "InsecureKubeletReadonlyPortEnabled")
1186+
}
11571187
if podPidsLimit, ok := cfg["pod_pids_limit"]; ok {
11581188
kConfig.PodPidsLimit = int64(podPidsLimit.(int))
11591189
}
@@ -1362,6 +1392,8 @@ func flattenNodeConfigDefaults(c *container.NodeConfigDefaults) []map[string]int
13621392

13631393
result[0]["containerd_config"] = flattenContainerdConfig(c.ContainerdConfig)
13641394

1395+
result[0]["insecure_kubelet_readonly_port_enabled"] = flattenInsecureKubeletReadonlyPortEnabled(c.NodeKubeletConfig)
1396+
13651397
result[0]["logging_variant"] = flattenLoggingVariant(c.LoggingConfig)
13661398

13671399
<% unless version == 'ga' -%>
@@ -1553,6 +1585,14 @@ func flattenSecondaryBootDisks(c []*container.SecondaryBootDisk) []map[string]in
15531585
return result
15541586
}
15551587

1588+
func flattenInsecureKubeletReadonlyPortEnabled(c *container.NodeKubeletConfig) string {
1589+
// Convert bool from the API to the enum values used internally
1590+
if c != nil && c.InsecureKubeletReadonlyPortEnabled {
1591+
return "TRUE"
1592+
}
1593+
return "FALSE"
1594+
}
1595+
15561596
func flattenLoggingVariant(c *container.NodePoolLoggingConfig) string {
15571597
variant := "DEFAULT"
15581598
if c != nil && c.VariantConfig != nil && c.VariantConfig.Variant != "" {
@@ -1702,10 +1742,11 @@ func flattenKubeletConfig(c *container.NodeKubeletConfig) []map[string]interface
17021742
result := []map[string]interface{}{}
17031743
if c != nil {
17041744
result = append(result, map[string]interface{}{
1705-
"cpu_cfs_quota": c.CpuCfsQuota,
1706-
"cpu_cfs_quota_period": c.CpuCfsQuotaPeriod,
1707-
"cpu_manager_policy": c.CpuManagerPolicy,
1708-
"pod_pids_limit": c.PodPidsLimit,
1745+
"cpu_cfs_quota": c.CpuCfsQuota,
1746+
"cpu_cfs_quota_period": c.CpuCfsQuotaPeriod,
1747+
"cpu_manager_policy": c.CpuManagerPolicy,
1748+
"insecure_kubelet_readonly_port_enabled": flattenInsecureKubeletReadonlyPortEnabled(c),
1749+
"pod_pids_limit": c.PodPidsLimit,
17091750
})
17101751
}
17111752
return result

‎mmv1/third_party/terraform/services/container/resource_container_cluster.go.erb

+77
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ func clusterSchemaNodePoolDefaults() *schema.Schema {
162162
<% unless version == 'ga' -%>
163163
"gcfs_config": schemaGcfsConfig(false),
164164
<% end -%>
165+
"insecure_kubelet_readonly_port_enabled": schemaInsecureKubeletReadonlyPortEnabled(),
165166
"logging_variant": schemaLoggingVariant(),
166167
},
167168
},
@@ -3829,6 +3830,60 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
38293830

38303831
log.Printf("[INFO] GKE cluster %s: image type has been updated to %s", d.Id(), it)
38313832
}
3833+
3834+
if d.HasChange("node_config.0.kubelet_config") {
3835+
3836+
defaultPool := "default-pool"
3837+
3838+
timeout := d.Timeout(schema.TimeoutCreate)
3839+
3840+
nodePoolInfo, err := extractNodePoolInformationFromCluster(d, config, clusterName)
3841+
if err != nil {
3842+
return err
3843+
}
3844+
3845+
// Acquire write-lock on nodepool.
3846+
npLockKey := nodePoolInfo.nodePoolLockKey(defaultPool)
3847+
3848+
// Note: probably long term this should be handled broadly for all the
3849+
// items in kubelet_config in a simpler / DRYer way.
3850+
// See b/361634104
3851+
if d.HasChange("node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled") {
3852+
it := d.Get("node_config.0.kubelet_config.0.insecure_kubelet_readonly_port_enabled").(string)
3853+
3854+
// While we're getting the value from the drepcated field in
3855+
// node_config.kubelet_config, the actual setting that needs to be updated
3856+
// is on the default nodepool.
3857+
req := &container.UpdateNodePoolRequest{
3858+
Name: defaultPool,
3859+
KubeletConfig: &container.NodeKubeletConfig{
3860+
InsecureKubeletReadonlyPortEnabled: expandInsecureKubeletReadonlyPortEnabled(it),
3861+
ForceSendFields: []string{"InsecureKubeletReadonlyPortEnabled"},
3862+
},
3863+
}
3864+
3865+
updateF := func() error {
3866+
clusterNodePoolsUpdateCall := config.NewContainerClient(userAgent).Projects.Locations.Clusters.NodePools.Update(nodePoolInfo.fullyQualifiedName(defaultPool), req)
3867+
if config.UserProjectOverride {
3868+
clusterNodePoolsUpdateCall.Header().Add("X-Goog-User-Project", nodePoolInfo.project)
3869+
}
3870+
op, err := clusterNodePoolsUpdateCall.Do()
3871+
if err != nil {
3872+
return err
3873+
}
3874+
3875+
// Wait until it's updated
3876+
return ContainerOperationWait(config, op, nodePoolInfo.project, nodePoolInfo.location,
3877+
"updating GKE node pool insecure_kubelet_readonly_port_enabled", userAgent, timeout)
3878+
}
3879+
3880+
if err := retryWhileIncompatibleOperation(timeout, npLockKey, updateF); err != nil {
3881+
return err
3882+
}
3883+
3884+
log.Printf("[INFO] GKE cluster %s: default-pool setting for insecure_kubelet_readonly_port_enabled updated to %s", d.Id(), it)
3885+
}
3886+
}
38323887
}
38333888

38343889
if d.HasChange("notification_config") {
@@ -4253,6 +4308,28 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
42534308
}
42544309
}
42554310

4311+
if d.HasChange("node_pool_defaults") && d.HasChange("node_pool_defaults.0.node_config_defaults.0.insecure_kubelet_readonly_port_enabled") {
4312+
if v, ok := d.GetOk("node_pool_defaults.0.node_config_defaults.0.insecure_kubelet_readonly_port_enabled"); ok {
4313+
insecureKubeletReadonlyPortEnabled := v.(string)
4314+
req := &container.UpdateClusterRequest{
4315+
Update: &container.ClusterUpdate{
4316+
DesiredNodeKubeletConfig: &container.NodeKubeletConfig{
4317+
InsecureKubeletReadonlyPortEnabled: expandInsecureKubeletReadonlyPortEnabled(insecureKubeletReadonlyPortEnabled),
4318+
ForceSendFields: []string{"InsecureKubeletReadonlyPortEnabled"},
4319+
},
4320+
},
4321+
}
4322+
4323+
updateF := updateFunc(req, "updating GKE cluster desired node pool insecure kubelet readonly port configuration defaults.")
4324+
// Call update serially.
4325+
if err := transport_tpg.LockedCall(lockKey, updateF); err != nil {
4326+
return err
4327+
}
4328+
4329+
log.Printf("[INFO] GKE cluster %s node pool insecure_kubelet_readonly_port_enabled default has been updated", d.Id())
4330+
}
4331+
}
4332+
42564333
if d.HasChange("node_pool_defaults") && d.HasChange("node_pool_defaults.0.node_config_defaults.0.logging_variant") {
42574334
if v, ok := d.GetOk("node_pool_defaults.0.node_config_defaults.0.logging_variant"); ok {
42584335
loggingVariant := v.(string)

0 commit comments

Comments
 (0)