Skip to content

Commit bbc47f8

Browse files
apeabodyapeabody
authored
chore: split poco into example (#2146)
1 parent feaf342 commit bbc47f8

File tree

10 files changed

+321
-11
lines changed

10 files changed

+321
-11
lines changed

‎examples/simple_zonal_with_acm/README.md

+1-7
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Simple Zonal Cluster
22

3-
This example illustrates how to create a simple cluster and install [Anthos Config Management](https://cloud.google.com/anthos-config-management/docs/)'s [Config Sync](https://cloud.google.com/anthos-config-management/docs/config-sync-overview) and [Policy Controller](https://cloud.google.com/anthos-config-management/docs/concepts/policy-controller) with the [Policy Essentials v2022 policy bundle](https://cloud.google.com/anthos-config-management/docs/how-to/using-policy-essentials-v2022).
3+
This example illustrates how to create a simple cluster and install [Anthos Config Management](https://cloud.google.com/anthos-config-management/docs/)'s [Config Sync](https://cloud.google.com/anthos-config-management/docs/config-sync-overview).
44

55
It incorporates the standard cluster module and the [ACM install module](../../modules/acm).
66

@@ -27,12 +27,6 @@ After applying the Terraform configuration, you can run the following commands t
2727
kubectl describe ns shipping-dev
2828
```
2929
30-
4. You can also use `kubectl` to view any policy violations on the cluster:
31-
32-
```
33-
kubectl get constraint -l policycontroller.gke.io/bundleName=policy-essentials-v2022 -o json | jq -cC '.items[]| [.metadata.name,.status.totalViolations]'
34-
```
35-
3630
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
3731
## Inputs
3832

‎examples/simple_zonal_with_acm/acm.tf

+2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ module "acm" {
2626
sync_branch = "1.0.0"
2727
policy_dir = "foo-corp"
2828

29+
enable_policy_controller = false
30+
2931
enable_fleet_feature = var.enable_fleet_feature
3032

3133
secret_type = "ssh"

‎examples/simple_zonal_with_poco/README.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Simple Zonal Cluster
2+
3+
This example illustrates how to create a simple cluster and install [Policy Controller](https://cloud.google.com/anthos-config-management/docs/concepts/policy-controller) with the [Pod Security Standards Baseline policy bundle](https://cloud.google.com/kubernetes-engine/enterprise/policy-controller/docs/how-to/using-pss-baseline).
4+
5+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6+
## Inputs
7+
8+
| Name | Description | Type | Default | Required |
9+
|------|-------------|------|---------|:--------:|
10+
| cluster\_name\_suffix | A suffix to append to the default cluster name | `string` | `""` | no |
11+
| enable\_fleet\_feature | Whether to enable the Policy Controller feature on the fleet. | `bool` | `true` | no |
12+
| project\_id | The project ID to host the cluster in | `string` | n/a | yes |
13+
| region | The region to host the cluster in | `string` | `"us-central1"` | no |
14+
| zone | The zone to host the cluster in | `string` | `"us-central1-a"` | no |
15+
16+
## Outputs
17+
18+
| Name | Description |
19+
|------|-------------|
20+
| cluster\_name | Cluster name |
21+
| ip\_range\_pods | The secondary IP range used for pods |
22+
| ip\_range\_services | The secondary IP range used for services |
23+
| location | n/a |
24+
| network | n/a |
25+
| project\_id | Standard test outputs |
26+
| region | n/a |
27+
| service\_account | The default service account used for running nodes. |
28+
| subnetwork | n/a |
29+
| zones | List of zones in which the cluster resides |
30+
31+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
32+
33+
To provision this example, run the following from within this directory:
34+
- `terraform init` to get the plugins
35+
- `terraform plan` to see the infrastructure plan
36+
- `terraform apply` to apply the infrastructure build
37+
- `terraform destroy` to destroy the built infrastructure

‎examples/simple_zonal_with_poco/main.tf

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/**
2+
* Copyright 2018-2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "simple-zonal-poco"
19+
}
20+
21+
provider "google" {
22+
region = var.region
23+
}
24+
25+
module "gke" {
26+
source = "terraform-google-modules/kubernetes-engine/google"
27+
version = "~> 33.0"
28+
29+
project_id = var.project_id
30+
fleet_project = var.project_id
31+
regional = false
32+
region = var.region
33+
zones = [var.zone]
34+
35+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
36+
37+
network = google_compute_network.main.name
38+
subnetwork = google_compute_subnetwork.main.name
39+
ip_range_pods = google_compute_subnetwork.main.secondary_ip_range[0].range_name
40+
ip_range_services = google_compute_subnetwork.main.secondary_ip_range[1].range_name
41+
42+
service_account = "create"
43+
deletion_protection = false
44+
node_pools = [
45+
{
46+
name = "poco-node-pool"
47+
autoscaling = false
48+
auto_upgrade = true
49+
node_count = 4
50+
machine_type = "e2-standard-4"
51+
},
52+
]
53+
}

‎examples/simple_zonal_with_poco/network.tf

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/**
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "random_string" "suffix" {
18+
length = 4
19+
special = false
20+
upper = false
21+
}
22+
23+
resource "google_compute_network" "main" {
24+
project = var.project_id
25+
name = "cft-gke-test-${random_string.suffix.result}"
26+
auto_create_subnetworks = false
27+
}
28+
29+
resource "google_compute_subnetwork" "main" {
30+
project = var.project_id
31+
name = "cft-gke-test-${random_string.suffix.result}"
32+
ip_cidr_range = "10.0.0.0/17"
33+
region = var.region
34+
network = google_compute_network.main.self_link
35+
36+
secondary_ip_range {
37+
range_name = "cft-gke-test-pods-${random_string.suffix.result}"
38+
ip_cidr_range = "192.168.0.0/18"
39+
}
40+
41+
secondary_ip_range {
42+
range_name = "cft-gke-test-services-${random_string.suffix.result}"
43+
ip_cidr_range = "192.168.64.0/18"
44+
}
45+
}

‎examples/simple_zonal_with_poco/outputs.tf

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/**
2+
* Copyright 2018-2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "service_account" {
18+
description = "The default service account used for running nodes."
19+
value = module.gke.service_account
20+
}
21+
22+
# Standard test outputs
23+
output "project_id" {
24+
value = var.project_id
25+
}
26+
27+
output "region" {
28+
value = module.gke.region
29+
}
30+
31+
output "cluster_name" {
32+
description = "Cluster name"
33+
value = module.gke.name
34+
}
35+
36+
output "network" {
37+
value = google_compute_network.main.name
38+
}
39+
40+
output "subnetwork" {
41+
value = google_compute_subnetwork.main.name
42+
}
43+
44+
output "location" {
45+
value = module.gke.location
46+
}
47+
48+
output "ip_range_pods" {
49+
description = "The secondary IP range used for pods"
50+
value = google_compute_subnetwork.main.secondary_ip_range[0].range_name
51+
}
52+
53+
output "ip_range_services" {
54+
description = "The secondary IP range used for services"
55+
value = google_compute_subnetwork.main.secondary_ip_range[1].range_name
56+
}
57+
58+
output "zones" {
59+
description = "List of zones in which the cluster resides"
60+
value = module.gke.zones
61+
}

‎examples/simple_zonal_with_poco/policy.tf

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/**
2+
* Copyright 2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
resource "google_gke_hub_feature" "poco_feature" {
18+
name = "policycontroller"
19+
project = var.project_id
20+
location = "global"
21+
22+
count = var.enable_fleet_feature ? 1 : 0
23+
}
24+
25+
resource "google_gke_hub_feature_membership" "poco_feature_member" {
26+
project = var.project_id
27+
location = "global"
28+
29+
feature = "policycontroller"
30+
membership = module.gke.fleet_membership
31+
membership_location = module.gke.region
32+
33+
policycontroller {
34+
policy_controller_hub_config {
35+
install_spec = "INSTALL_SPEC_ENABLED"
36+
policy_content {
37+
template_library {
38+
installation = "ALL"
39+
}
40+
bundles {
41+
bundle_name = "pss-baseline-v2022"
42+
}
43+
}
44+
referential_rules_enabled = true
45+
}
46+
}
47+
48+
depends_on = [
49+
google_gke_hub_feature.poco_feature
50+
]
51+
}

‎examples/simple_zonal_with_poco/variables.tf

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/**
2+
* Copyright 2018-2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
type = string
20+
}
21+
22+
variable "cluster_name_suffix" {
23+
description = "A suffix to append to the default cluster name"
24+
type = string
25+
default = ""
26+
}
27+
28+
variable "region" {
29+
description = "The region to host the cluster in"
30+
type = string
31+
default = "us-central1"
32+
}
33+
34+
variable "zone" {
35+
type = string
36+
description = "The zone to host the cluster in"
37+
default = "us-central1-a"
38+
}
39+
40+
variable "enable_fleet_feature" {
41+
description = "Whether to enable the Policy Controller feature on the fleet."
42+
type = bool
43+
default = true
44+
}

‎examples/simple_zonal_with_poco/versions.tf

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* Copyright 2021-2024 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_providers {
19+
google = {
20+
source = "hashicorp/google"
21+
}
22+
random = {
23+
source = "hashicorp/random"
24+
}
25+
}
26+
required_version = ">= 1.3"
27+
}

‎test/integration/simple_zonal/simple_zonal_test.go

-4
Original file line numberDiff line numberDiff line change
@@ -79,10 +79,6 @@ func TestSimpleZonal(t *testing.T) {
7979
assert.NoError(err)
8080
configkubeNS := testutils.ParseKubectlJSONResult(t, configNameSpace)
8181
assert.Contains(configkubeNS.Get("metadata.name").String(), "config-management-system", "Namespace is Functional")
82-
gateKeeperNameSpace, err := k8s.RunKubectlAndGetOutputE(t, &k8sOpts, "get", "ns", "gatekeeper-system", "-o", "json")
83-
assert.NoError(err)
84-
gateKeeperkubeNS := testutils.ParseKubectlJSONResult(t, gateKeeperNameSpace)
85-
assert.Contains(gateKeeperkubeNS.Get("metadata.name").String(), "gatekeeper-system", "Namespace is Functional")
8682
})
8783

8884
bpt.Test()

0 commit comments

Comments
 (0)