Enabling Dynamic Port Allocation (#65)

* Updating modules. * Disabling kubeconfig. * Disabling kubeconfig * Disabling deletion_protection * Removing extra output. * Removing provider version declaration. * Adding tfenv file. * key_algorithm is not require. * Replacing list function. * Applying fmt * Updating pre-commit * Updating CI pipeline. * Using pre-commit executor. * Removing version config. * Updating cluster version * Adding db_deletion_protection variable. * Updating test case * Removing fix deployment_id. * Adding env TFENV_AUTO_INSTALL for auto install. * Fixing http provider. * Update .circleci/config.yml Co-authored-by: Daniel Hoherd <[email protected]> * Update .circleci/config.yml Co-authored-by: Daniel Hoherd <[email protected]> * Removing kubeconfig configurations. * Enabling dynamic port allocation. * Making shield node feature configurable. * Making dynamic port allocation dynamic. * Making enable_endpoint_independent_mapping dynamic. Co-authored-by: Daniel Hoherd <[email protected]>
astronomer · Aug 12, 2022 · dd6596a · dd6596a
1 parent 826f200
commit dd6596a
Show file tree

Hide file tree

Showing 3 changed files with 50 additions and 10 deletions.
diff --git a/main.tf b/main.tf
@@ -17,7 +17,8 @@ resource "google_container_cluster" "primary" {
   provider = google-beta
   name     = "${var.deployment_id}-cluster"
 
-  project = data.google_project.project.project_id
+  project               = data.google_project.project.project_id
+  enable_shielded_nodes = var.gke_enable_shielded_nodes
 
   # "
   # We can't create a cluster with no node pool defined, but we want to only use

diff --git a/network.tf b/network.tf
@@ -34,7 +34,8 @@ resource "google_compute_router" "router" {
   network = google_compute_network.core.self_link
 
   bgp {
-    asn = 64514
+    keepalive_interval = 0
+    asn                = 64514
   }
 
 }
@@ -49,14 +50,22 @@ resource "google_compute_address" "address" {
 # Cloud NAT
 resource "google_compute_router_nat" "nat" {
 
-  name                               = "${var.deployment_id}-gke-${formatdate("MM-DD-hh-mm", timestamp())}"
-  region                             = local.region
-  min_ports_per_vm                   = 128
-  router                             = google_compute_router.router.name
-  nat_ip_allocate_option             = "MANUAL_ONLY"
-  nat_ips                            = length(var.natgateway_external_ip_list) == 0 ? google_compute_address.address.*.self_link : var.natgateway_external_ip_list
-  source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
-  tcp_established_idle_timeout_sec   = 7200
+  name                                = "${var.deployment_id}-gke-${formatdate("MM-DD-hh-mm", timestamp())}"
+  region                              = local.region
+  max_ports_per_vm                    = var.router_nat_max_port_vm
+  min_ports_per_vm                    = var.router_nat_min_port_vm
+  enable_dynamic_port_allocation      = var.router_nat_enable_dynamic_port_allocation
+  router                              = google_compute_router.router.name
+  nat_ip_allocate_option              = "MANUAL_ONLY"
+  nat_ips                             = length(var.natgateway_external_ip_list) == 0 ? google_compute_address.address.*.self_link : var.natgateway_external_ip_list
+  source_subnetwork_ip_ranges_to_nat  = "LIST_OF_SUBNETWORKS"
+  tcp_established_idle_timeout_sec    = 7200
+  enable_endpoint_independent_mapping = var.router_nat_enable_endpoint_independent_mapping
+
+  log_config {
+    enable = false
+    filter = "ALL"
+  }
 
   lifecycle {
     ignore_changes = [name]

diff --git a/variables.tf b/variables.tf
@@ -19,6 +19,12 @@ variable "gke_release_channel" {
   description = "The GKE Release channel to use. Blank for none"
 }
 
+variable "gke_enable_shielded_nodes" {
+  type        = bool
+  default     = false
+  description = "Enable shield nodes for GKE cluster."
+}
+
 variable "machine_type_bastion" {
   default     = "g1-small"
   description = "The GCP machine type for the bastion"
@@ -441,6 +447,30 @@ variable "enable_gvisor_dynamic_green" {
   description = "Should gvisor be enabled for the green dynamic node pool?"
 }
 
+variable "router_nat_max_port_vm" {
+  type        = number
+  default     = 65536
+  description = "Maximum number of ports allocated to a VM from this NAT."
+}
+
+variable "router_nat_min_port_vm" {
+  type        = number
+  default     = 1024
+  description = "Minimum number of ports allocated to a VM from this NAT."
+}
+
+variable "router_nat_enable_dynamic_port_allocation" {
+  type        = bool
+  default     = true
+  description = "Enable Dynamic Port Allocation."
+}
+
+variable "router_nat_enable_endpoint_independent_mapping" {
+  type        = bool
+  default     = false
+  description = "Enable endpoint independent mapping."
+}
+
 ## Extra stuff
 
 variable "kube_api_whitelist_cidr" {