This repository has been archived by the owner on Aug 25, 2023. It is now read-only.
generated from basisai/terraform-module-template
-
Notifications
You must be signed in to change notification settings - Fork 3
/
gke.tf
102 lines (81 loc) · 2.5 KB
/
gke.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
locals {
gke_pool_create = var.gke_pool_create
gke_service_account_roles = [
"roles/logging.logWriter", # Write logs
"roles/monitoring.metricWriter", # Write metrics
]
api_services = toset([
"cloudkms.googleapis.com",
"storage-api.googleapis.com",
])
}
resource "google_container_node_pool" "vault" {
provider = google-beta
count = local.gke_pool_create ? 1 : 0
depends_on = [
google_project_iam_member.vault_nodes,
google_project_service.services,
]
name = var.gke_pool_name
location = var.gke_pool_location
cluster = var.gke_cluster
project = var.project_id
autoscaling {
min_node_count = 0
max_node_count = var.gke_node_count
}
management {
auto_repair = true
auto_upgrade = true
}
node_config {
machine_type = var.gke_machine_type
disk_size_gb = var.gke_node_size_gb
disk_type = var.gke_disk_type
boot_disk_kms_key = var.gke_boot_disk_kms_key
image_type = var.gke_image_type
labels = var.gke_labels
metadata = var.gke_metadata
tags = var.gke_tags
dynamic "taint" {
for_each = var.gke_taints
content {
effect = taint.value.effect
key = taint.value.key
value = taint.value.value
}
}
service_account = local.node_service_account
oauth_scopes = [
"https://www.googleapis.com/auth/cloud-platform",
"https://www.googleapis.com/auth/devstorage.read_write",
"https://www.googleapis.com/auth/cloud-platform",
]
# See https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#concealment
workload_metadata_config {
mode = var.workload_identity_enable ? "GKE_METADATA" : "GCE_METADATA"
}
shielded_instance_config {
enable_secure_boot = var.gke_enable_secure_boot
enable_integrity_monitoring = var.gke_enable_integrity_monitoring
}
}
dynamic "upgrade_settings" {
for_each = var.gke_node_upgrade_settings_enabled ? [var.gke_node_upgrade_settings] : []
content {
max_surge = upgrade_settings.value.max_surge
max_unavailable = upgrade_settings.value.max_unavailable
}
}
lifecycle {
create_before_destroy = true
}
}
# We need to enable the KMS and GCS APIs on the GKE cluster project
resource "google_project_service" "services" {
provider = google-beta
for_each = local.gke_pool_create ? local.api_services : []
project = var.project_id
service = each.key
disable_on_destroy = false
}