Skip to content

Commit 0143f50

Browse files
apeabodyapeabody
authored
feat(anthos-attached-clusters): add attached-install-mesh module (#710)
1 parent b48fa5f commit 0143f50

File tree

22 files changed

+785
-18
lines changed

22 files changed

+785
-18
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ credentials_file.json
2626
.kitchen
2727
**ci-abm*.json
2828
out.json
29+
.tmp
30+
.cache
2931

3032
files.log
3133
legacy_headder_check.log

‎anthos-attached-clusters/kind/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,10 @@ The other examples and module limit dependancies to terraform core providers, bu
5959
|------|-------------|------|---------|:--------:|
6060
| gcp\_location | GCP location to create the attached resource in | `string` | `"us-west1"` | no |
6161
| gcp\_project\_id | The GCP project id where the cluster will be registered | `string` | n/a | yes |
62+
| kind\_api\_server\_address | Kind cluster API server address | `string` | `null` | no |
63+
| kind\_api\_server\_port | Kind cluster API server port | `number` | `null` | no |
6264
| kind\_node\_image | The image used for the kind cluster | `string` | `"kindest/node:v1.28.0"` | no |
65+
| kubeconfig\_path | The kubeconfig path. | `string` | `null` | no |
6366
| name\_prefix | Common prefix to use for generating names | `string` | n/a | yes |
6467
| platform\_version | Platform version of the attached cluster resource | `string` | `"1.28.0-gke.3"` | no |
6568

‎anthos-attached-clusters/kind/main.tf

+14-5
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ resource "kind_cluster" "cluster" {
2626
name = local.cluster_name
2727
node_image = var.kind_node_image
2828

29-
kubeconfig_path = "${path.root}/.tmp/kube/${local.cluster_name}"
29+
kubeconfig_path = var.kubeconfig_path != null ? var.kubeconfig_path : "${path.root}/.tmp/kube/${local.cluster_name}"
3030

3131
wait_for_ready = true
3232

@@ -36,6 +36,10 @@ resource "kind_cluster" "cluster" {
3636
feature_gates = {
3737
KubeletInUserNamespace : "true"
3838
}
39+
networking {
40+
api_server_address = var.kind_api_server_address
41+
api_server_port = var.kind_api_server_port
42+
}
3943
}
4044
}
4145

@@ -67,8 +71,6 @@ data "google_project" "project" {
6771
project_id = var.gcp_project_id
6872
}
6973

70-
71-
7274
module "oidc" {
7375
source = "./oidc"
7476

@@ -78,7 +80,6 @@ module "oidc" {
7880
client_key = kind_cluster.cluster.client_key
7981
}
8082

81-
8283
resource "google_container_attached_cluster" "primary" {
8384
name = local.cluster_name
8485
project = data.google_project.project.project_id
@@ -119,6 +120,14 @@ resource "google_container_attached_cluster" "primary" {
119120
]
120121
}
121122

123+
module "install-mesh" {
124+
source = "../modules/attached-install-mesh"
122125

126+
kubeconfig = kind_cluster.cluster.kubeconfig_path
127+
context = local.cluster_context
128+
fleet_id = data.google_project.project.project_id
123129

124-
130+
depends_on = [
131+
google_container_attached_cluster.primary
132+
]
133+
}

‎anthos-attached-clusters/kind/oidc/main.tf

+1-5
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,11 @@ data "http" "issuer" {
3030
client_key = var.client_key
3131
}
3232

33-
locals {
34-
issuer_json = jsondecode(data.http.issuer.response_body)
35-
}
36-
3733
data "http" "jwks" {
3834

3935
provider = http-full
4036

41-
url = local.issuer_json.jwks_uri
37+
url = "${var.endpoint}/openid/v1/jwks"
4238
request_headers = {
4339
content-type = "application/json"
4440
}

‎anthos-attached-clusters/kind/oidc/outputs.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
*/
1616

1717
output "issuer" {
18-
value = local.issuer_json.issuer
18+
value = jsondecode(data.http.issuer.response_body).issuer
1919
}
2020

2121
output "jwks" {

‎anthos-attached-clusters/kind/oidc/providers.tf

-1
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,3 @@ terraform {
2323
}
2424
required_version = ">= 0.13"
2525
}
26-

‎anthos-attached-clusters/kind/oidc/variables.tf

-3
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ variable "endpoint" {
1818
type = string
1919
}
2020

21-
2221
variable "cluster_ca_certificate" {
2322
type = string
2423
}
@@ -30,5 +29,3 @@ variable "client_certificate" {
3029
variable "client_key" {
3130
type = string
3231
}
33-
34-

‎anthos-attached-clusters/kind/variables.tf

+15-1
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,26 @@ variable "platform_version" {
3636
default = "1.28.0-gke.3"
3737
}
3838

39-
4039
variable "kind_node_image" {
4140
description = "The image used for the kind cluster"
4241
type = string
4342
default = "kindest/node:v1.28.0"
4443
}
4544

45+
variable "kind_api_server_address" {
46+
description = "Kind cluster API server address"
47+
type = string
48+
default = null
49+
}
4650

51+
variable "kind_api_server_port" {
52+
description = "Kind cluster API server port"
53+
type = number
54+
default = null
55+
}
4756

57+
variable "kubeconfig_path" {
58+
description = "The kubeconfig path."
59+
type = string
60+
default = null
61+
}

‎anthos-attached-clusters/modules/attached-install-mesh/main.tf

+246
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
/**
2+
* Copyright 2018-2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
tmp_credentials_path = "${path.module}/terraform-google-credentials.json"
19+
cache_path = "${path.module}/.cache/${random_id.cache.hex}"
20+
gcloud_tar_path = "${local.cache_path}/google-cloud-sdk.tar.gz"
21+
gcloud_bin_path = "${local.cache_path}/google-cloud-sdk/bin"
22+
gcloud_bin_abs_path = abspath(local.gcloud_bin_path)
23+
24+
gcloud = "${local.gcloud_bin_path}/gcloud"
25+
gcloud_download_url = var.gcloud_download_url != null ? var.gcloud_download_url : "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-${var.gcloud_sdk_version}-${var.platform}-x86_64.tar.gz"
26+
jq_platform = var.platform == "darwin" ? "osx-amd" : var.platform
27+
jq_download_url = var.jq_download_url != null ? var.jq_download_url : "https://github.com/stedolan/jq/releases/download/jq-${var.jq_version}/jq-${local.jq_platform}64"
28+
asmcli_download_url = var.asmcli_download_url != null ? var.asmcli_download_url : "https://storage.googleapis.com/csm-artifacts/asm/asmcli_${var.asmcli_version}"
29+
30+
cmd_entrypoint = "${local.gcloud_bin_path}/asmcli"
31+
create_cmd_body = "install --kubeconfig ${var.kubeconfig} --context ${var.context} --fleet_id ${var.fleet_id} --platform multicloud --enable_cluster_labels --enable_namespace_creation --enable_gcp_components --enable_cluster_roles --ca mesh_ca --option attached-cluster"
32+
33+
wait = length(null_resource.additional_components[*].triggers) + length(
34+
null_resource.gcloud_auth_service_account_key_file[*].triggers,
35+
) + length(null_resource.gcloud_auth_google_credentials[*].triggers,
36+
) + length(null_resource.run_command[*].triggers)
37+
38+
prepare_cache_command = "mkdir -p ${local.cache_path}"
39+
download_gcloud_command = "curl -sL -o ${local.cache_path}/google-cloud-sdk.tar.gz ${local.gcloud_download_url}"
40+
download_jq_command = "curl -sL -o ${local.cache_path}/jq ${local.jq_download_url} && chmod +x ${local.cache_path}/jq"
41+
download_asmcli_command = "curl -sL -o ${local.cache_path}/asmcli ${local.asmcli_download_url} && chmod +x ${local.cache_path}/asmcli"
42+
decompress_command = "tar -xzf ${local.gcloud_tar_path} -C ${local.cache_path} && cp ${local.cache_path}/jq ${local.cache_path}/google-cloud-sdk/bin/ && cp ${local.cache_path}/asmcli ${local.cache_path}/google-cloud-sdk/bin/"
43+
additional_components_command = "${path.module}/scripts/check_components.sh ${local.gcloud} kubectl"
44+
gcloud_auth_service_account_key_file_command = "${local.gcloud} auth activate-service-account --key-file ${var.service_account_key_file}"
45+
activate_service_account = var.activate_service_account ? "${local.gcloud} auth activate-service-account --key-file ${local.tmp_credentials_path}" : "true"
46+
gcloud_auth_google_credentials_command = <<-EOT
47+
printf "%s" "$GOOGLE_CREDENTIALS" > ${local.tmp_credentials_path} && \
48+
${local.activate_service_account}
49+
EOT
50+
51+
}
52+
53+
resource "random_id" "cache" {
54+
byte_length = 4
55+
}
56+
57+
resource "null_resource" "prepare_cache" {
58+
triggers = {
59+
arguments = md5(local.create_cmd_body)
60+
prepare_cache_command = local.prepare_cache_command
61+
}
62+
63+
provisioner "local-exec" {
64+
when = create
65+
command = self.triggers.prepare_cache_command
66+
}
67+
}
68+
69+
resource "null_resource" "download_gcloud" {
70+
triggers = {
71+
arguments = md5(local.create_cmd_body)
72+
download_gcloud_command = local.download_gcloud_command
73+
version = var.gcloud_sdk_version
74+
}
75+
76+
provisioner "local-exec" {
77+
when = create
78+
command = self.triggers.download_gcloud_command
79+
}
80+
81+
depends_on = [null_resource.prepare_cache]
82+
}
83+
84+
resource "null_resource" "download_jq" {
85+
triggers = {
86+
arguments = md5(local.create_cmd_body)
87+
download_jq_command = local.download_jq_command
88+
version = var.jq_version
89+
}
90+
91+
provisioner "local-exec" {
92+
when = create
93+
command = self.triggers.download_jq_command
94+
}
95+
96+
depends_on = [null_resource.prepare_cache]
97+
}
98+
99+
resource "null_resource" "download_asmcli" {
100+
triggers = {
101+
arguments = md5(local.create_cmd_body)
102+
download_asmcli_command = local.download_asmcli_command
103+
version = var.asmcli_version
104+
}
105+
106+
provisioner "local-exec" {
107+
when = create
108+
command = self.triggers.download_asmcli_command
109+
}
110+
111+
depends_on = [null_resource.prepare_cache]
112+
}
113+
114+
resource "null_resource" "decompress" {
115+
triggers = {
116+
arguments = md5(local.create_cmd_body)
117+
decompress_command = local.decompress_command
118+
download_gcloud_command = local.download_gcloud_command
119+
download_jq_command = local.download_jq_command
120+
download_asmcli_command = local.download_asmcli_command
121+
}
122+
123+
provisioner "local-exec" {
124+
when = create
125+
command = self.triggers.decompress_command
126+
}
127+
128+
depends_on = [null_resource.download_gcloud, null_resource.download_jq, null_resource.download_asmcli]
129+
}
130+
131+
resource "null_resource" "additional_components" {
132+
depends_on = [null_resource.decompress]
133+
134+
triggers = {
135+
arguments = md5(local.create_cmd_body)
136+
additional_components_command = local.additional_components_command
137+
}
138+
139+
provisioner "local-exec" {
140+
when = create
141+
command = self.triggers.additional_components_command
142+
}
143+
}
144+
145+
resource "null_resource" "gcloud_auth_service_account_key_file" {
146+
count = length(var.service_account_key_file) > 0 ? 1 : 0
147+
depends_on = [null_resource.decompress]
148+
149+
triggers = {
150+
arguments = md5(local.create_cmd_body)
151+
gcloud_auth_service_account_key_file_command = local.gcloud_auth_service_account_key_file_command
152+
}
153+
154+
provisioner "local-exec" {
155+
when = create
156+
command = self.triggers.gcloud_auth_service_account_key_file_command
157+
}
158+
}
159+
160+
resource "null_resource" "gcloud_auth_google_credentials" {
161+
count = var.use_tf_google_credentials_env_var ? 1 : 0
162+
depends_on = [null_resource.decompress]
163+
164+
triggers = {
165+
arguments = md5(local.create_cmd_body)
166+
gcloud_auth_google_credentials_command = local.gcloud_auth_google_credentials_command
167+
}
168+
169+
provisioner "local-exec" {
170+
when = create
171+
command = self.triggers.gcloud_auth_google_credentials_command
172+
}
173+
}
174+
175+
resource "null_resource" "run_command" {
176+
depends_on = [
177+
null_resource.decompress,
178+
null_resource.additional_components,
179+
null_resource.gcloud_auth_google_credentials,
180+
null_resource.gcloud_auth_service_account_key_file
181+
]
182+
183+
triggers = {
184+
arguments = md5(local.create_cmd_body)
185+
cmd_entrypoint = local.cmd_entrypoint
186+
create_cmd_body = local.create_cmd_body
187+
gcloud_bin_abs_path = local.gcloud_bin_abs_path
188+
}
189+
190+
provisioner "local-exec" {
191+
when = create
192+
command = <<-EOT
193+
PATH=${self.triggers.gcloud_bin_abs_path}:$PATH
194+
${self.triggers.cmd_entrypoint} ${self.triggers.create_cmd_body}
195+
EOT
196+
environment = {
197+
PROJECT_ID = ""
198+
}
199+
}
200+
201+
}
202+
203+
resource "null_resource" "gcloud_auth_google_credentials_destroy" {
204+
count = var.use_tf_google_credentials_env_var ? 1 : 0
205+
triggers = {
206+
gcloud_auth_google_credentials_command = local.gcloud_auth_google_credentials_command
207+
}
208+
provisioner "local-exec" {
209+
when = destroy
210+
command = self.triggers.gcloud_auth_google_credentials_command
211+
}
212+
}
213+
214+
resource "null_resource" "gcloud_auth_service_account_key_file_destroy" {
215+
count = length(var.service_account_key_file) > 0 ? 1 : 0
216+
triggers = {
217+
gcloud_auth_service_account_key_file_command = local.gcloud_auth_service_account_key_file_command
218+
}
219+
220+
provisioner "local-exec" {
221+
when = destroy
222+
command = self.triggers.gcloud_auth_service_account_key_file_command
223+
}
224+
}
225+
226+
resource "null_resource" "additional_components_destroy" {
227+
triggers = {
228+
additional_components_command = local.additional_components_command
229+
}
230+
231+
provisioner "local-exec" {
232+
when = destroy
233+
command = self.triggers.additional_components_command
234+
}
235+
}
236+
237+
resource "null_resource" "decompress_destroy" {
238+
triggers = {
239+
decompress_command = local.decompress_command
240+
}
241+
242+
provisioner "local-exec" {
243+
when = destroy
244+
command = self.triggers.decompress_command
245+
}
246+
}

0 commit comments

Comments
 (0)