terraform-google-cloud

An example configuration is found in examples/root_example/main.tf.

Assuming you have the GCloud CLI installed and configured, to the example, run

tf apply --target module.sn_cluster
tf apply

Requirements

Name	Version
terraform	>=1.3.0
google	>= 5.40.0, < 7
kubernetes	~> 2.10
random	>= 2.1

Providers

Name	Version
google	5.45.0
kubernetes	2.35.1

Modules

Name	Source	Version
gke	terraform-google-modules/kubernetes-engine/google	35.0.1
gke_private	terraform-google-modules/kubernetes-engine/google//modules/private-cluster	35.0.1

Resources

Name	Type
google_kms_crypto_key.gke_encryption_key	resource
google_kms_key_ring.keyring	resource
google_project_iam_member.kms_iam_binding	resource
kubernetes_namespace.sn_system	resource
kubernetes_storage_class.sn_default	resource
kubernetes_storage_class.sn_ssd	resource
google_compute_zones.available	data source
google_project.project	data source

Inputs

Name	Description	Type	Default	Required
add_cluster_firewall_rules	Creates additional firewall rules on the cluster.	bool	false	no
add_master_webhook_firewall_rules	Create master_webhook firewall rules for ports defined in firewall_inbound_ports.	bool	false	no
add_shadow_firewall_rules	Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled).	bool	false	no
additive_vpc_scope_dns_domain	This will enable Cloud DNS additive VPC scope. Must provide a domain name that is unique within the VPC. For this to work cluster_dns = CLOUD_DNS and cluster_dns_scope = CLUSTER_SCOPE must both be set as well.	string	""	no
authenticator_security_group	The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]	string	null	no
cluster_autoscaling_config	Cluster autoscaling configuration for node auto-provisioning. This is disabled for our configuration, since we typically want to scale existing node pools rather than add new ones to the cluster	object({ enabled = bool min_cpu_cores = number max_cpu_cores = number min_memory_gb = number max_memory_gb = number gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number })) auto_repair = bool auto_upgrade = bool autoscaling_profile = string })	{ "auto_repair": true, "auto_upgrade": false, "autoscaling_profile": "BALANCED", "enabled": false, "gpu_resources": [], "max_cpu_cores": null, "max_memory_gb": null, "min_cpu_cores": null, "min_memory_gb": null }	no
cluster_dns_domain	The suffix used for all cluster service records.	string	""	no
cluster_dns_provider	Which in-cluster DNS provider should be used. PROVIDER_UNSPECIFIED (default) or PLATFORM_DEFAULT or CLOUD_DNS.	string	"PROVIDER_UNSPECIFIED"	no
cluster_dns_scope	The scope of access to cluster DNS records. DNS_SCOPE_UNSPECIFIED (default) or CLUSTER_SCOPE or VPC_SCOPE.	string	"DNS_SCOPE_UNSPECIFIED"	no
cluster_http_load_balancing	Enable the HTTP load balancing addon for the cluster. Defaults to "true"	bool	true	no
cluster_name	The name of your GKE cluster.	string	n/a	yes
cluster_network_policy	Enable the network policy addon for the cluster. Defaults to "true", and uses CALICO as the provider	bool	true	no
create_service_account	Creates a service account for the cluster. Defaults to "true".	bool	true	no
database_encryption_key_name	Name of the KMS key to encrypt Kubernetes secrets at rest in etcd	string	""	no
datapath_provider	the datapath provider to use, in the future, the default of this should be ADVANCED_DATAPATH	string	"DATAPATH_PROVIDER_UNSPECIFIED"	no
default_max_pods_per_node	the number of pods per node, defaults to GKE default of 110, but in smaller CIDRs we want to tune this	number	110	no
deletion_protection	Whether or not to allow Terraform to destroy the cluster.	bool	true	no
enable_database_encryption	Enables etcd encryption via Google KMS.	bool	false	no
enable_func_pool	Enable an additional dedicated pool for Pulsar Functions. Enabled by default.	bool	true	no
enable_l4_ilb_subsetting	Enable L4 ILB Subsetting on the cluster, this cannot be disabled once it has been enabled.	bool	false	no
enable_private_endpoint	Enables private endpoint for GKE master. Defaults to "false".	bool	false	no
enable_private_gke	Enables private GKE cluster, where nodes are not publicly accessible. Defaults to "false".	bool	false	no
enable_private_nodes	Whether nodes have internal IP addresses only.	bool	false	no
enable_resource_creation	When enabled, all dependencies, like service accounts, buckets, etc will be created. When disabled, they will note. Use in combination with enable_<app> to manage these outside this module	bool	true	no
firewall_inbound_ports	List of TCP ports for admission/webhook controllers. Either flag add_master_webhook_firewall_rules or add_cluster_firewall_rules (also adds egress rules) must be set to true for inbound-ports firewall rules to be applied.	list(string)	[ "5443", "8443", "9443", "15017" ]	no
fleet_project	The Fleet project to register the GKE cluster to. If not set, the GKE cluster's project will be used.	string	null	no
func_pool_auto_repair	Enable auto-repair for the Pulsar Functions pool.	bool	true	no
func_pool_auto_upgrade	Enable auto-upgrade for the Pulsar Functions pool.	bool	true	no
func_pool_autoscaling	Enable autoscaling of the Pulsar Functions pool. Defaults to "true".	bool	true	no
func_pool_autoscaling_initial_count	The initial number of nodes in the Pulsar Functions pool, per zone, when autoscaling is enabled. Defaults to 0.	number	0	no
func_pool_autoscaling_max_size	The maximum size of the Pulsar Functions pool Autoscaling group. Defaults to 3.	number	3	no
func_pool_autoscaling_min_size	The minimum size of the Pulsar Functions pool AutoScaling group. Defaults to 0.	number	0	no
func_pool_count	The number of worker nodes in the Pulsar Functions pool. This is only used if func_pool_autoscaling is set to false. Defaults to 1.	number	1	no
func_pool_disk_size	Disk size in GB for worker nodes in the Pulsar Functions pool. Defaults to 100.	number	100	no
func_pool_disk_type	The type disk attached to worker nodes in the Pulsar Functions pool. Defaults to "pd-standard".	string	"pd-standard"	no
func_pool_image_type	The image type to use for worker nodes in the Pulsar Functions pool. Defaults to "COS" (cointainer-optimized OS with docker).	string	"COS_CONTAINERD"	no
func_pool_locations	A string of comma seperated values (upstream requirement) of zones for the Pulsar Functions pool, e.g. "us-central1-b,us-central1-c" etc. Nodes must be in the same region as the cluster. Defaults to three random zones in the region specified for the cluster via the "cluster_location" input, or the zones provided through the "node_pool_locations" input (if it is defined).	string	""	no
func_pool_machine_type	The machine type to use for worker nodes in the Pulsar Functions pool. Defaults to "n2-standard-4".	string	"n2-standard-4"	no
func_pool_max_pods_per_node	the number of pods per node	number	110	no
func_pool_name	The name of the Pulsar Functions pool. Defaults to "default-node-pool".	string	"func-pool"	no
func_pool_service_account	The service account email address to use for the Pulsar Functions pool. If create_service_account is set to true, it will use the the output from the module.	string	""	no
func_pool_ssd_count	The number of SSDs to attach to each node in the Pulsar Functions pool. Defaults to 0.	number	0	no
func_pool_version	The version of Kubernetes to use for the Pulsar Functions pool. If the input "release_channel" is not defined, defaults to "kubernetes_version" used for the cluster. Should only be defined while "func_pool_auto_upgrade" is also set to "false".	string	""	no
gcp_public_cidrs_access_enabled	Enable access from GCP public CIDRs. Defaults to false.	bool	false	no
google_service_account	when set, don't create GSAs and instead use the this service account for all apps	string	""	no
kubernetes_version	The version of Kubernetes to use for the cluster. Defaults to "latest", which uses the latest available version for GKE in the region specified.	string	"latest"	no
logging_enabled_components	List of services to monitor: SYSTEM_COMPONENTS, APISERVER, CONTROLLER_MANAGER, SCHEDULER, WORKLOADS. Empty list is default GKE configuration.	list(string)	[]	no
logging_service	The logging service to use for the cluster. Defaults to "logging.googleapis.com/kubernetes".	string	"logging.googleapis.com/kubernetes"	no
maintenance_exclusions	A list of objects used to define exceptions to the maintenance window, when non-emergency maintenance should not occur. Can have up to three exclusions. Refer to the offical Terraform docs on the "google_container_cluster" resource for object schema.	list(object({ name = string, start_time = string, end_time = string, exclusion_scope = string }))	[]	no
maintenance_window	The start time (in RFC3339 format) for the GKE to perform maintenance operations. Defaults to "05:00".	string	"05:00"	no
master_authorized_networks	A list of objects used to define authorized networks. If none are provided, the default is to disallow external access. See the parent module for more details. https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest	list(object({ cidr_block = string, display_name = string }))	[]	no
master_global_access_enabled	Whether the cluster master is accessible globally (from any region) or only within the same region as the private endpoint.	bool	false	no
master_ipv4_cidr_block	The IP range in CIDR notation to use for the hosted master network. Only used for private clusters	string	"10.0.0.0/28"	no
monitoring_enabled_components	List of services to monitor: SYSTEM_COMPONENTS, APISERVER, CONTROLLER_MANAGER, SCHEDULER. Empty list is default GKE configuration.	list(string)	[]	no
network_project_id	If using a different project, the id of the project	string	""	no
node_pool_auto_repair	Enable auto-repair for the default node pool.	bool	true	no
node_pool_auto_upgrade	Enable auto-upgrade for the default node pool.	bool	true	no
node_pool_autoscaling	Enable autoscaling of the default node pool. Defaults to "true".	bool	true	no
node_pool_autoscaling_initial_count	The initial number of nodes per zone in the default node pool, PER ZONE, when autoscaling is enabled. Defaults to 1.	number	1	no
node_pool_autoscaling_max_size	The maximum size of the default node pool Autoscaling group. Defaults to 5.	number	5	no
node_pool_autoscaling_min_size	The minimum size of the default node pool AutoScaling group. Defaults to 1.	number	1	no
node_pool_count	The number of worker nodes in the default node pool. This is only used if node_pool_autoscaling is set to false. Defaults to 3.	number	3	no
node_pool_disk_size	Disk size in GB for worker nodes in the default node pool. Defaults to 100.	number	100	no
node_pool_disk_type	The type disk attached to worker nodes in the default node pool. Defaults to "pd-standard".	string	"pd-standard"	no
node_pool_image_type	The image type to use for worker nodes in the default node pool. Defaults to "COS" (cointainer-optimized OS with docker).	string	"COS_CONTAINERD"	no
node_pool_locations	A string of comma seperated values (upstream requirement) of zones for the location of the default node pool, e.g. "us-central1-b,us-central1-c" etc. Nodes must be in the region as the cluster. Defaults to three random zones in the region chosen for the cluster	string	""	no
node_pool_machine_type	The machine type to use for worker nodes in the default node pool. Defaults to "n2-standard-8".	string	"n2-standard-8"	no
node_pool_max_pods_per_node	the number of pods per node	number	110	no
node_pool_name	The name of the default node pool. Defaults to "sn-node-pool".	string	"default-node-pool"	no
node_pool_secure_boot	enable the node pool secure boot setting	bool	false	no
node_pool_service_account	The service account email address to use for the default node pool. If create_service_account is set to true, it will use the the output from the module.	string	""	no
node_pool_ssd_count	The number of SSDs to attach to each node in the default node pool	number	0	no
node_pool_version	The version of Kubernetes to use for the default node pool. If the input "release_channel" is not defined, defaults to "kubernetes_version" used for the cluster. Should only be defined while "node_pool_auto_upgrade" is also set to "false".	string	""	no
private_endpoint_subnetwork	The subnetwork to use for the hosted master network.	string	null	no
project_id	The project ID to use for the cluster. Defaults to the current GCP project.	string	n/a	yes
region	The GCP region where the GKE cluster will be deployed. This module only supports creation of a regional cluster	string	n/a	yes
release_channel	The Kubernetes release channel to use for the cluster. Accepted values are "UNSPECIFIED", "RAPID", "REGULAR" and "STABLE". Defaults to "UNSPECIFIED".	string	"STABLE"	no
secondary_ip_range_pods	The name of the secondary range to use for the pods in the cluster. If no secondary range for the pod network is provided, GKE will create a /14 CIDR within the subnetwork provided by the "vpc_subnet" input	string	null	no
secondary_ip_range_pods_cidr	The cidr of the secondary range, required when using cillium	string	null	no
secondary_ip_range_services	The name of the secondary range to use for services in the cluster. If no secondary range for the services network is provided, GKE will create a /20 CIDR within the subnetwork provided by the "vpc_subnet" input	string	null	no
storage_class_default_ssd	determines if the default storage class should be with ssd	bool	false	no
suffix	A unique string that is used to distinguish cluster resources, where name length constraints are imposed by GKE. Defaults to an empty string.	string	""	no
vpc_network	The name of the VPC network to use for the cluster. Can be set to "default" if the default VPC is enabled in the project	string	n/a	yes
vpc_subnet	The name of the VPC subnetwork to use by the cluster nodes. Can be set to "default" if the default VPC is enabled in the project, and GKE will choose the subnetwork based on the "region" input	string	n/a	yes

Outputs

Name	Description
ca_certificate	n/a
endpoint	n/a
id	n/a
master_version	n/a
name	n/a
node_pool_azs	n/a
service_account	n/a