feat: Promote authenticator_security_group to GA modules (terraform-google-modules#989)

Author: kir4h

README.md

@@ -127,6 +127,7 @@ Then perform the following commands on the root folder:
 | add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no |
 | add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no |
 | add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
+| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
 | basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no |
 | basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | `string` | `""` | no |
 | cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> })</pre> | <pre>{<br> "enabled": false,<br> "gpu_resources": [],<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |

autogen/main/cluster.tf.tmpl

@@ -323,14 +323,14 @@ resource "google_container_cluster" "primary" {
  }
  }
 
-{% if beta_cluster %}
  dynamic "authenticator_groups_config" {
  for_each = local.cluster_authenticator_security_group
  content {
  security_group = authenticator_groups_config.value.security_group
  }
  }
 
+{% if beta_cluster %}
  notification_config {
  pubsub {
  enabled = var.notification_config_topic != "" ? true : false
@@ -480,7 +480,7 @@ resource "google_container_node_pool" "pools" {
  }
  }
  {% endif %}
- 
+
  management {
  auto_repair = lookup(each.value, "auto_repair", true)
  auto_upgrade = lookup(each.value, "auto_upgrade", local.default_auto_upgrade)
@@ -539,7 +539,7 @@ resource "google_container_node_pool" "pools" {
 
  {% if beta_cluster %}
  dynamic "ephemeral_storage_config" {
- for_each = lookup(each.value, "local_ssd_ephemeral_count",0) > 0 ? [each.value.local_ssd_ephemeral_count] : [] 
+ for_each = lookup(each.value, "local_ssd_ephemeral_count",0) > 0 ? [each.value.local_ssd_ephemeral_count] : []
  content {
  local_ssd_count = ephemeral_storage_config.value
  }

autogen/main/main.tf.tmpl

@@ -105,13 +105,14 @@ locals {
 
  cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
 
+ cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
+
+{% endif %}
+
  cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
  security_group = var.authenticator_security_group
  }]
 
- cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
-
-{% endif %}
  cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
  node_metadata = var.node_metadata
  }]

autogen/main/variables.tf.tmpl

@@ -524,13 +524,13 @@ variable "enable_intranode_visibility" {
  description = "Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network"
  default = false
 }
+{% endif %}
 
 variable "authenticator_security_group" {
  type = string
  description = "The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com"
  default = null
 }
-{% endif %}
 
 variable "node_metadata" {
  description = "Specifies how node metadata is exposed to the workload running on the node"

cluster.tf

@@ -186,6 +186,13 @@ resource "google_container_cluster" "primary" {
  }
  }
 
+ dynamic "authenticator_groups_config" {
+ for_each = local.cluster_authenticator_security_group
+ content {
+ security_group = authenticator_groups_config.value.security_group
+ }
+ }
+
 }
 
 /******************************************

main.tf

@@ -81,6 +81,11 @@ locals {
  provider = null
  }]
 
+
+ cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
+ security_group = var.authenticator_security_group
+ }]
+
  cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
  node_metadata = var.node_metadata
  }]

modules/beta-private-cluster-update-variant/main.tf

@@ -96,12 +96,13 @@ locals {
 
  cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
 
+ cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
+
+
  cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
  security_group = var.authenticator_security_group
  }]
 
- cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
-
  cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
  node_metadata = var.node_metadata
  }]

modules/beta-private-cluster/main.tf

@@ -96,12 +96,13 @@ locals {
 
  cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
 
+ cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
+
+
  cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
  security_group = var.authenticator_security_group
  }]
 
- cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
-
  cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
  node_metadata = var.node_metadata
  }]

modules/beta-public-cluster-update-variant/main.tf

@@ -96,12 +96,13 @@ locals {
 
  cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
 
+ cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
+
+
  cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
  security_group = var.authenticator_security_group
  }]
 
- cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
-
  cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
  node_metadata = var.node_metadata
  }]

modules/beta-public-cluster/main.tf

@@ -96,12 +96,13 @@ locals {
 
  cluster_gce_pd_csi_config = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
 
+ cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
+
+
  cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{
  security_group = var.authenticator_security_group
  }]
 
- cluster_sandbox_enabled = var.sandbox_enabled ? ["gvisor"] : []
-
  cluster_node_metadata_config = var.node_metadata == "UNSPECIFIED" ? [] : [{
  node_metadata = var.node_metadata
  }]