Skip to content

Commit a5ace36

Browse files
rileykarsonrileykarson
authored
feat: Add an auth submodule outputting a kubeconfig (terraform-google-modules#469)
* Add GKE auth submodule * Add example of auth submodule * Fix copyright dates * Linting * Register test * Add test fixtures
1 parent 121bf71 commit a5ace36

File tree

18 files changed

+712
-0
lines changed

18 files changed

+712
-0
lines changed

‎.kitchen.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,13 @@ suites:
9999
systems:
100100
- name: simple_regional_private
101101
backend: local
102+
- name: "simple_regional_with_kubeconfig"
103+
driver:
104+
root_module_directory: test/fixtures/simple_regional_with_kubeconfig
105+
verifier:
106+
systems:
107+
- name: simple_regional_with_kubeconfig
108+
backend: local
102109
- name: "simple_zonal"
103110
driver:
104111
root_module_directory: test/fixtures/simple_zonal

‎build/int.cloudbuild.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,26 @@ steps:
124124
- verify simple-regional-private-local
125125
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
126126
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-regional-private-local']
127+
- id: create simple-regional-with-kubeconfig-local
128+
waitFor:
129+
- prepare
130+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
131+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create simple-regional-with-kubeconfig-local']
132+
- id: converge simple-regional-with-kubeconfig-local
133+
waitFor:
134+
- create simple-regional-with-kubeconfig-local
135+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
136+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge simple-regional-with-kubeconfig-local']
137+
- id: verify simple-regional-with-kubeconfig-local
138+
waitFor:
139+
- converge simple-regional-with-kubeconfig-local
140+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
141+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify simple-regional-with-kubeconfig-local']
142+
- id: destroy simple-regional-with-kubeconfig-local
143+
waitFor:
144+
- verify simple-regional-with-kubeconfig-local
145+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
146+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy simple-regional-with-kubeconfig-local']
127147
- id: create simple-regional-with-networking-local
128148
waitFor:
129149
- prepare

‎examples/simple_regional_with_kubeconfig/README.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Simple Regional Cluster
2+
3+
This example illustrates how to create a simple cluster and output a `kubeconfig`
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|:----:|:-----:|:-----:|
10+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
11+
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
12+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
13+
| ip\_range\_services | The secondary ip range to use for services | string | n/a | yes |
14+
| network | The VPC network to host the cluster in | string | n/a | yes |
15+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
16+
| region | The region to host the cluster in | string | n/a | yes |
17+
| skip\_provisioners | Flag to skip local-exec provisioners | bool | `"false"` | no |
18+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
19+
20+
## Outputs
21+
22+
| Name | Description |
23+
|------|-------------|
24+
| ca\_certificate | |
25+
| client\_token | |
26+
| cluster\_name | Cluster name |
27+
| ip\_range\_pods | The secondary IP range used for pods |
28+
| ip\_range\_services | The secondary IP range used for services |
29+
| kubeconfig\_raw | |
30+
| kubernetes\_endpoint | |
31+
| location | |
32+
| master\_kubernetes\_version | The master Kubernetes version |
33+
| network | |
34+
| project\_id | |
35+
| region | |
36+
| service\_account | The default service account used for running nodes. |
37+
| subnetwork | |
38+
| zones | List of zones in which the cluster resides |
39+
40+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
41+
42+
To provision this example, run the following from within this directory:
43+
- `terraform init` to get the plugins
44+
- `terraform plan` to see the infrastructure plan
45+
- `terraform apply` to apply the infrastructure build
46+
- `terraform destroy` to destroy the built infrastructure

‎examples/simple_regional_with_kubeconfig/main.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
/**
2+
* Copyright 2020 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "simple-regional"
19+
}
20+
21+
provider "google" {
22+
version = "~> 3.3.0"
23+
region = var.region
24+
}
25+
26+
module "gke" {
27+
source = "../../"
28+
project_id = var.project_id
29+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30+
regional = true
31+
region = var.region
32+
network = var.network
33+
subnetwork = var.subnetwork
34+
ip_range_pods = var.ip_range_pods
35+
ip_range_services = var.ip_range_services
36+
create_service_account = false
37+
service_account = var.compute_engine_service_account
38+
skip_provisioners = var.skip_provisioners
39+
}
40+
41+
module "gke_auth" {
42+
source = "../../modules/auth"
43+
44+
project_id = var.project_id
45+
location = module.gke.location
46+
cluster_name = module.gke.name
47+
}
48+

‎examples/simple_regional_with_kubeconfig/outputs.tf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/**
2+
* Copyright 2020 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = module.gke_auth.host
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = module.gke_auth.token
25+
}
26+
27+
output "ca_certificate" {
28+
value = module.gke_auth.cluster_ca_certificate
29+
}
30+
31+
output "kubeconfig_raw" {
32+
value = module.gke_auth.kubeconfig_raw
33+
}
34+
35+
output "service_account" {
36+
description = "The default service account used for running nodes."
37+
value = module.gke.service_account
38+
}
39+

‎examples/simple_regional_with_kubeconfig/test_outputs.tf‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/**
2+
* Copyright 2020 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
// These outputs are used to test the module with kitchen-terraform
18+
// They do not need to be included in real-world uses of this module
19+
20+
output "project_id" {
21+
value = var.project_id
22+
}
23+
24+
output "region" {
25+
value = module.gke.region
26+
}
27+
28+
output "cluster_name" {
29+
description = "Cluster name"
30+
value = module.gke.name
31+
}
32+
33+
output "network" {
34+
value = var.network
35+
}
36+
37+
output "subnetwork" {
38+
value = var.subnetwork
39+
}
40+
41+
output "location" {
42+
value = module.gke.location
43+
}
44+
45+
output "ip_range_pods" {
46+
description = "The secondary IP range used for pods"
47+
value = var.ip_range_pods
48+
}
49+
50+
output "ip_range_services" {
51+
description = "The secondary IP range used for services"
52+
value = var.ip_range_services
53+
}
54+
55+
output "zones" {
56+
description = "List of zones in which the cluster resides"
57+
value = module.gke.zones
58+
}
59+
60+
output "master_kubernetes_version" {
61+
description = "The master Kubernetes version"
62+
value = module.gke.master_version
63+
}

‎examples/simple_regional_with_kubeconfig/variables.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/**
2+
* Copyright 2020 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "cluster_name_suffix" {
22+
description = "A suffix to append to the default cluster name"
23+
default = ""
24+
}
25+
26+
variable "region" {
27+
description = "The region to host the cluster in"
28+
}
29+
30+
variable "network" {
31+
description = "The VPC network to host the cluster in"
32+
}
33+
34+
variable "subnetwork" {
35+
description = "The subnetwork to host the cluster in"
36+
}
37+
38+
variable "ip_range_pods" {
39+
description = "The secondary ip range to use for pods"
40+
}
41+
42+
variable "ip_range_services" {
43+
description = "The secondary ip range to use for services"
44+
}
45+
46+
variable "compute_engine_service_account" {
47+
description = "Service account to associate to the nodes in the cluster"
48+
}
49+
50+
variable "skip_provisioners" {
51+
type = bool
52+
description = "Flag to skip local-exec provisioners"
53+
default = false
54+
}

‎modules/auth/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Terraform Kubernetes Engine Auth Module
2+
3+
This module allows configuring authentication to a GKE cluster
4+
using an [OpenID Connect token](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens)
5+
retrieved from GCP as a `kubeconfig` file or as outputs intended for use with
6+
the `kubernetes` / `helm` providers.
7+
8+
This module retrieves a token for the account configured with the `google`
9+
provider as the Terraform runner using the provider's `credentials`,
10+
`access_token`, or other means of authentication.
11+
12+
## Usage
13+
14+
```tf
15+
module "gke_auth" {
16+
source = "terraform-google-modules/kubernetes-engine/google//modules/auth"
17+
18+
project_id = "my-project-id"
19+
cluster_name = "my-cluster-name"
20+
location = module.gke.location
21+
}
22+
```
23+
24+
25+
### `kubeconfig` output
26+
27+
```hcl
28+
resource "local_file" "kubeconfig" {
29+
content = module.gke_auth.kubeconfig_raw
30+
filename = "${path.module}/kubeconfig"
31+
}
32+
```
33+
34+
### `kubernetes`/`helm` provider output
35+
36+
```hcl
37+
provider "kubernetes" {
38+
load_config_file = false
39+
40+
cluster_ca_certificate = module.gke_auth.cluster_ca_certificate
41+
host = module.gke_auth.host
42+
token = module.gke_auth.token
43+
}
44+
```

‎modules/auth/main.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Copyright 2020 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
data "google_container_cluster" "gke_cluster" {
18+
name = var.cluster_name
19+
location = var.location
20+
project = var.project_id
21+
}
22+
23+
data "google_client_config" "provider" {}
24+
25+
data "template_file" "kubeconfig" {
26+
template = file("${path.module}/templates/kubeconfig-template.yaml.tpl")
27+
28+
vars = {
29+
context = data.google_container_cluster.gke_cluster.name
30+
cluster_ca_certificate = data.google_container_cluster.gke_cluster.master_auth[0].cluster_ca_certificate
31+
endpoint = data.google_container_cluster.gke_cluster.endpoint
32+
token = data.google_client_config.provider.access_token
33+
}
34+
}

0 commit comments

Comments
 (0)