Skip to content

Commit 704962b

Browse files
bharathkkbbharathkkb
authored
feat: Enable WI and shielded nodes by default in beta clusters (#441)
BREAKING CHANGE: Beta clusters now have Workload Identity enabled by default. To disable Workload Identity, set `identity_namespace = null` BREAKING CHANGE: Beta clusters now have shielded nodes enabled by default. To disable, set `enable_shielded_nodes = false`.
1 parent 36ddbbb commit 704962b

File tree

12 files changed

+26
-27
lines changed

12 files changed

+26
-27
lines changed

‎autogen/main/main.tf.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -164,8 +164,8 @@ locals {
164164
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
165165
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
166166

167-
cluster_workload_identity_config = var.identity_namespace == "" ? [] : [{
168-
identity_namespace = var.identity_namespace
167+
cluster_workload_identity_config = var.identity_namespace == null ? [] : var.identity_namespace == "enabled" ? [{
168+
identity_namespace = "${var.project_id}.svc.id.goog"}] : [{identity_namespace = var.identity_namespace
169169
}]
170170
# /BETA features
171171
{% endif %}

‎autogen/main/variables.tf.tmpl

+3-3
Original file line numberDiff line numberDiff line change
@@ -451,9 +451,9 @@ variable "enable_vertical_pod_autoscaling" {
451451
}
452452

453453
variable "identity_namespace" {
454-
description = "Workload Identity namespace"
454+
description = "Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `project_id..svc.id.goog`)"
455455
type = string
456-
default = ""
456+
default = "enabled"
457457
}
458458

459459
variable "authenticator_security_group" {
@@ -471,6 +471,6 @@ variable "release_channel" {
471471
variable "enable_shielded_nodes" {
472472
type = bool
473473
description = "Enable Shielded Nodes features on all nodes in this cluster"
474-
default = false
474+
default = true
475475
}
476476
{% endif %}

‎examples/workload_identity/main.tf

-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ module "gke" {
4141
ip_range_services = var.ip_range_services
4242
remove_default_node_pool = true
4343
service_account = "create"
44-
identity_namespace = "${var.project_id}.svc.id.goog"
4544
node_metadata = "GKE_METADATA_SERVER"
4645
node_pools = [
4746
{

‎modules/beta-private-cluster-update-variant/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -174,12 +174,12 @@ Then perform the following commands on the root folder:
174174
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | bool | `"false"` | no |
175175
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | bool | `"false"` | no |
176176
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | bool | `"false"` | no |
177-
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"false"` | no |
177+
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"true"` | no |
178178
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
179179
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"false"` | no |
180180
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
181181
| http\_load\_balancing | Enable httpload balancer addon | bool | `"true"` | no |
182-
| identity\_namespace | Workload Identity namespace | string | `""` | no |
182+
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `project_id..svc.id.goog`) | string | `"enabled"` | no |
183183
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | number | `"0"` | no |
184184
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | bool | `"false"` | no |
185185
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | string | `"60s"` | no |

‎modules/beta-private-cluster-update-variant/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,8 @@ locals {
149149
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
150150
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
151151

152-
cluster_workload_identity_config = var.identity_namespace == "" ? [] : [{
153-
identity_namespace = var.identity_namespace
152+
cluster_workload_identity_config = var.identity_namespace == null ? [] : var.identity_namespace == "enabled" ? [{
153+
identity_namespace = "${var.project_id}.svc.id.goog" }] : [{ identity_namespace = var.identity_namespace
154154
}]
155155
# /BETA features
156156

‎modules/beta-private-cluster-update-variant/variables.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -444,9 +444,9 @@ variable "enable_vertical_pod_autoscaling" {
444444
}
445445

446446
variable "identity_namespace" {
447-
description = "Workload Identity namespace"
447+
description = "Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `project_id..svc.id.goog`)"
448448
type = string
449-
default = ""
449+
default = "enabled"
450450
}
451451

452452
variable "authenticator_security_group" {
@@ -464,5 +464,5 @@ variable "release_channel" {
464464
variable "enable_shielded_nodes" {
465465
type = bool
466466
description = "Enable Shielded Nodes features on all nodes in this cluster"
467-
default = false
467+
default = true
468468
}

‎modules/beta-private-cluster/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -152,12 +152,12 @@ Then perform the following commands on the root folder:
152152
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | bool | `"false"` | no |
153153
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | bool | `"false"` | no |
154154
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | bool | `"false"` | no |
155-
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"false"` | no |
155+
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"true"` | no |
156156
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
157157
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"false"` | no |
158158
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
159159
| http\_load\_balancing | Enable httpload balancer addon | bool | `"true"` | no |
160-
| identity\_namespace | Workload Identity namespace | string | `""` | no |
160+
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `project_id..svc.id.goog`) | string | `"enabled"` | no |
161161
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | number | `"0"` | no |
162162
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | bool | `"false"` | no |
163163
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | string | `"60s"` | no |

‎modules/beta-private-cluster/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,8 @@ locals {
149149
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
150150
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
151151

152-
cluster_workload_identity_config = var.identity_namespace == "" ? [] : [{
153-
identity_namespace = var.identity_namespace
152+
cluster_workload_identity_config = var.identity_namespace == null ? [] : var.identity_namespace == "enabled" ? [{
153+
identity_namespace = "${var.project_id}.svc.id.goog" }] : [{ identity_namespace = var.identity_namespace
154154
}]
155155
# /BETA features
156156

‎modules/beta-private-cluster/variables.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -444,9 +444,9 @@ variable "enable_vertical_pod_autoscaling" {
444444
}
445445

446446
variable "identity_namespace" {
447-
description = "Workload Identity namespace"
447+
description = "Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `project_id..svc.id.goog`)"
448448
type = string
449-
default = ""
449+
default = "enabled"
450450
}
451451

452452
variable "authenticator_security_group" {
@@ -464,5 +464,5 @@ variable "release_channel" {
464464
variable "enable_shielded_nodes" {
465465
type = bool
466466
description = "Enable Shielded Nodes features on all nodes in this cluster"
467-
default = false
467+
default = true
468468
}

‎modules/beta-public-cluster/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -131,12 +131,12 @@ Then perform the following commands on the root folder:
131131
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
132132
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | bool | `"false"` | no |
133133
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | bool | `"false"` | no |
134-
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"false"` | no |
134+
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"true"` | no |
135135
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
136136
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"false"` | no |
137137
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |
138138
| http\_load\_balancing | Enable httpload balancer addon | bool | `"true"` | no |
139-
| identity\_namespace | Workload Identity namespace | string | `""` | no |
139+
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `project_id..svc.id.goog`) | string | `"enabled"` | no |
140140
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | number | `"0"` | no |
141141
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | bool | `"false"` | no |
142142
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | string | `"60s"` | no |

‎modules/beta-public-cluster/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,8 @@ locals {
149149
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
150150
cluster_vertical_pod_autoscaling_enabled = local.cluster_output_vertical_pod_autoscaling_enabled
151151

152-
cluster_workload_identity_config = var.identity_namespace == "" ? [] : [{
153-
identity_namespace = var.identity_namespace
152+
cluster_workload_identity_config = var.identity_namespace == null ? [] : var.identity_namespace == "enabled" ? [{
153+
identity_namespace = "${var.project_id}.svc.id.goog" }] : [{ identity_namespace = var.identity_namespace
154154
}]
155155
# /BETA features
156156

‎modules/beta-public-cluster/variables.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -420,9 +420,9 @@ variable "enable_vertical_pod_autoscaling" {
420420
}
421421

422422
variable "identity_namespace" {
423-
description = "Workload Identity namespace"
423+
description = "Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `project_id..svc.id.goog`)"
424424
type = string
425-
default = ""
425+
default = "enabled"
426426
}
427427

428428
variable "authenticator_security_group" {
@@ -440,5 +440,5 @@ variable "release_channel" {
440440
variable "enable_shielded_nodes" {
441441
type = bool
442442
description = "Enable Shielded Nodes features on all nodes in this cluster"
443-
default = false
443+
default = true
444444
}

0 commit comments

Comments
 (0)