gcp-gke/cluster.tf at main · nullstone-modules/gcp-gke · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
locals {
  // Select the zones to place the node pool
  // We choose from the list available zones in this region
  // We limit the zones chosen by var.num_node_zones (but this cannot be larger than the total available zones)
  zones = slice(local.available_zones, 0, min(var.num_node_zones, length(local.available_zones)))
}

resource "google_container_cluster" "primary" {
  name                     = local.resource_name
  resource_labels          = local.resource_labels
  location                 = data.google_compute_zones.available.region
  initial_node_count       = 1
  remove_default_node_pool = true
  networking_mode          = "VPC_NATIVE"
  network                  = local.vpc_name
  subnetwork               = local.private_subnet_names[0]

  deletion_protection = false

  datapath_provider = var.enable_dataplane_v2 ? "ADVANCED_DATAPATH" : null

  ip_allocation_policy {}

  workload_identity_config {
    workload_pool = "${local.project_id}.svc.id.goog"
  }

  private_cluster_config {
    enable_private_nodes = true
  }

  dynamic "network_policy" {
    // network_policy stanza cannot be specified when using Dataplane v2
    // It's implied to be enabled and Google will error
    for_each = var.enable_dataplane_v2 ? [] : [1]

    content {
      enabled  = true
      provider = "CALICO"
    }
  }

  addons_config {
    gcs_fuse_csi_driver_config {
      enabled = true
    }
    gce_persistent_disk_csi_driver_config {
      enabled = true
    }
    gcp_filestore_csi_driver_config {
      enabled = true
    }
    config_connector_config {
      enabled = true
    }
    network_policy_config {
      disabled = var.enable_dataplane_v2 ? true : false
    }
  }

  # NOTE: This doesn't exist in the Terraform provider yet
  # observability_config {
  #   managed_otel = true
  # }

  gateway_api_config {
    channel = "CHANNEL_STANDARD"
  }

  depends_on = [google_project_service.container]
}

# Managed Node Pool
resource "google_container_node_pool" "primary_nodes" {
  name_prefix        = "${random_string.resource_suffix.result}-"
  location           = data.google_compute_zones.available.region
  cluster            = google_container_cluster.primary.name
  initial_node_count = 1

  node_locations = local.zones

  autoscaling {
    min_node_count = var.min_node_count
    max_node_count = var.max_node_count
  }

  # To avoid empty node pool while auto-scaling https://github.com/hashicorp/terraform-provider-google/issues/6901#issuecomment-667369691
  lifecycle {
    create_before_destroy = true

    ignore_changes = [initial_node_count]
  }

  node_config {
    machine_type    = var.node_machine_type
    service_account = google_service_account.cluster.email
    oauth_scopes    = ["https://www.googleapis.com/auth/cloud-platform"]
    labels          = local.tags
    resource_labels = local.resource_labels
    tags            = ["gke-node", "${local.resource_name}-gke"]

    disk_size_gb = var.node_disk_size
    disk_type    = "pd-standard"

    metadata = {
      disable-legacy-endpoints = "true"
    }
  }

  network_config {
    enable_private_nodes = true
  }
}