Skip to content

Commit 69896ee

Browse files
modular-magicianmodular-magician
authored
Add writable cgroups to containerd config (#15511) (#25140)
[upstream:c59fe19f66d5d57d31220dd7d248c791096885a5] Signed-off-by: Modular Magician <magic-modules@google.com>
1 parent a2aa88b commit 69896ee

File tree

6 files changed

+373
-0
lines changed

6 files changed

+373
-0
lines changed

‎.changelog/15511.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
container: added `writable_cgroups` field to node `containerd_config`
3+
```

‎google/services/container/node_config.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,21 @@ func schemaContainerdConfig() *schema.Schema {
9191
},
9292
}},
9393
},
94+
"writable_cgroups": {
95+
Type: schema.TypeList,
96+
Description: `Parameters for writable cgroups configuration.`,
97+
Optional: true,
98+
MaxItems: 1,
99+
Elem: &schema.Resource{
100+
Schema: map[string]*schema.Schema{
101+
"enabled": {
102+
Type: schema.TypeBool,
103+
Required: true,
104+
Description: `Whether writable cgroups are enabled.`,
105+
},
106+
},
107+
},
108+
},
94109
}},
95110
}
96111
}
@@ -1908,6 +1923,7 @@ func expandContainerdConfig(v interface{}) *container.ContainerdConfig {
19081923

19091924
cc := &container.ContainerdConfig{}
19101925
cc.PrivateRegistryAccessConfig = expandPrivateRegistryAccessConfig(cfg["private_registry_access_config"])
1926+
cc.WritableCgroups = expandWritableCgroups(cfg["writable_cgroups"])
19111927
return cc
19121928
}
19131929

@@ -1979,6 +1995,26 @@ func expandGCPSecretManagerCertificateConfig(v interface{}) *container.GCPSecret
19791995
return gcpSMConfig
19801996
}
19811997

1998+
func expandWritableCgroups(v interface{}) *container.WritableCgroups {
1999+
if v == nil {
2000+
return nil
2001+
}
2002+
ls := v.([]interface{})
2003+
if len(ls) == 0 {
2004+
return nil
2005+
}
2006+
if ls[0] == nil {
2007+
return &container.WritableCgroups{}
2008+
}
2009+
cfg := ls[0].(map[string]interface{})
2010+
2011+
wcg := &container.WritableCgroups{}
2012+
if enabled, ok := cfg["enabled"]; ok {
2013+
wcg.Enabled = enabled.(bool)
2014+
}
2015+
return wcg
2016+
}
2017+
19822018
func expandSoleTenantConfig(v interface{}) *container.SoleTenantConfig {
19832019
if v == nil {
19842020
return nil
@@ -2485,6 +2521,9 @@ func flattenContainerdConfig(c *container.ContainerdConfig) []map[string]interfa
24852521
if c.PrivateRegistryAccessConfig != nil {
24862522
r["private_registry_access_config"] = flattenPrivateRegistryAccessConfig(c.PrivateRegistryAccessConfig)
24872523
}
2524+
if c.WritableCgroups != nil {
2525+
r["writable_cgroups"] = flattenWritableCgroups(c.WritableCgroups)
2526+
}
24882527
return append(result, r)
24892528
}
24902529

@@ -2544,6 +2583,17 @@ func flattenGCPSecretManagerCertificateConfig(c *container.GCPSecretManagerCerti
25442583
return append(result, r)
25452584
}
25462585

2586+
func flattenWritableCgroups(c *container.WritableCgroups) []map[string]interface{} {
2587+
result := []map[string]interface{}{}
2588+
if c == nil {
2589+
return result
2590+
}
2591+
r := map[string]interface{}{
2592+
"enabled": c.Enabled,
2593+
}
2594+
return append(result, r)
2595+
}
2596+
25472597
func flattenConfidentialNodes(c *container.ConfidentialNodes) []map[string]interface{} {
25482598
result := []map[string]interface{}{}
25492599
if c != nil {

‎google/services/container/resource_container_cluster_meta.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,7 @@ fields:
233233
- api_field: 'nodeConfig.containerdConfig.privateRegistryAccessConfig.certificateAuthorityDomainConfig.fqdns'
234234
- api_field: 'nodeConfig.containerdConfig.privateRegistryAccessConfig.certificateAuthorityDomainConfig.gcpSecretManagerCertificateConfig.secretUri'
235235
- api_field: 'nodeConfig.containerdConfig.privateRegistryAccessConfig.enabled'
236+
- api_field: 'nodeConfig.containerdConfig.writableCgroups.enabled'
236237
- api_field: 'nodeConfig.diskSizeGb'
237238
- api_field: 'nodeConfig.diskType'
238239
- field: 'node_config.effective_taints.effect'
@@ -655,6 +656,7 @@ fields:
655656
- api_field: 'nodePoolDefaults.nodeConfigDefaults.containerdConfig.privateRegistryAccessConfig.certificateAuthorityDomainConfig.fqdns'
656657
- api_field: 'nodePoolDefaults.nodeConfigDefaults.containerdConfig.privateRegistryAccessConfig.certificateAuthorityDomainConfig.gcpSecretManagerCertificateConfig.secretUri'
657658
- api_field: 'nodePoolDefaults.nodeConfigDefaults.containerdConfig.privateRegistryAccessConfig.enabled'
659+
- api_field: 'nodePoolDefaults.nodeConfigDefaults.containerdConfig.writableCgroups.enabled'
658660
- api_field: 'nodePoolDefaults.nodeConfigDefaults.gcfsConfig.enabled'
659661
- field: 'node_pool_defaults.node_config_defaults.insecure_kubelet_readonly_port_enabled'
660662
api_field: 'nodePoolDefaults.nodeConfigDefaults.nodeKubeletConfig.insecureKubeletReadonlyPortEnabled'

‎google/services/container/resource_container_cluster_test.go‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12932,6 +12932,208 @@ resource "google_container_cluster" "primary" {
1293212932
`, secretID, clusterName, customDomain, networkName, subnetworkName)
1293312933
}
1293412934

12935+
func TestAccContainerCluster_writableCgroups(t *testing.T) {
12936+
t.Parallel()
12937+
12938+
clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
12939+
nodePoolName := fmt.Sprintf("tf-test-nodepool-%s", acctest.RandString(t, 10))
12940+
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
12941+
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)
12942+
12943+
acctest.VcrTest(t, resource.TestCase{
12944+
PreCheck: func() { acctest.AccTestPreCheck(t) },
12945+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
12946+
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
12947+
Steps: []resource.TestStep{
12948+
// Test enabling writable_cgroups for new node pools via node_pool_defaults.
12949+
{
12950+
Config: testAccContainerCluster_writableCgroupsEnabled(clusterName, networkName, subnetworkName),
12951+
Check: resource.ComposeAggregateTestCheckFunc(
12952+
resource.TestCheckResourceAttr(
12953+
"google_container_cluster.primary",
12954+
"node_pool_defaults.0.node_config_defaults.0.containerd_config.0.writable_cgroups.0.enabled",
12955+
"true",
12956+
),
12957+
),
12958+
},
12959+
{
12960+
ResourceName: "google_container_cluster.primary",
12961+
ImportState: true,
12962+
ImportStateVerify: true,
12963+
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
12964+
},
12965+
// Test disabling writable_cgroups for new node pools via node_pool_defaults.
12966+
{
12967+
Config: testAccContainerCluster_writableCgroupsDisabled(clusterName, networkName, subnetworkName),
12968+
ConfigPlanChecks: resource.ConfigPlanChecks{
12969+
PreApply: []plancheck.PlanCheck{
12970+
acctest.ExpectNoDelete(),
12971+
},
12972+
},
12973+
Check: resource.ComposeAggregateTestCheckFunc(
12974+
resource.TestCheckResourceAttr(
12975+
"google_container_cluster.primary",
12976+
"node_pool_defaults.0.node_config_defaults.0.containerd_config.0.writable_cgroups.0.enabled",
12977+
"false",
12978+
),
12979+
),
12980+
},
12981+
{
12982+
ResourceName: "google_container_cluster.primary",
12983+
ImportState: true,
12984+
ImportStateVerify: true,
12985+
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
12986+
},
12987+
// Test configuring writable_cgroups on the cluster's default node pool directly via node_config.
12988+
{
12989+
Config: testAccContainerCluster_withNodeConfigWritableCgroups(clusterName, networkName, subnetworkName),
12990+
ConfigPlanChecks: resource.ConfigPlanChecks{
12991+
PreApply: []plancheck.PlanCheck{
12992+
acctest.ExpectNoDelete(),
12993+
},
12994+
},
12995+
Check: resource.ComposeAggregateTestCheckFunc(
12996+
resource.TestCheckResourceAttr(
12997+
"google_container_cluster.primary",
12998+
"node_config.0.containerd_config.0.writable_cgroups.0.enabled",
12999+
"true",
13000+
),
13001+
),
13002+
},
13003+
{
13004+
ResourceName: "google_container_cluster.primary",
13005+
ImportState: true,
13006+
ImportStateVerify: true,
13007+
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
13008+
},
13009+
// Test configuring writable_cgroups on a named node pool defined within the cluster.
13010+
// This change from a default to a named node pool is expected to force recreation.
13011+
{
13012+
Config: testAccContainerCluster_withNodePoolWritableCgroups(clusterName, nodePoolName, networkName, subnetworkName),
13013+
},
13014+
{
13015+
ResourceName: "google_container_cluster.primary",
13016+
ImportState: true,
13017+
ImportStateVerify: true,
13018+
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
13019+
},
13020+
},
13021+
})
13022+
}
13023+
13024+
func testAccContainerCluster_writableCgroupsEnabled(clusterName, networkName, subnetworkName string) string {
13025+
return fmt.Sprintf(`
13026+
data "google_container_engine_versions" "central1a" {
13027+
location = "us-central1-a"
13028+
}
13029+
13030+
resource "google_container_cluster" "primary" {
13031+
name = "%s"
13032+
location = "us-central1-a"
13033+
initial_node_count = 1
13034+
min_master_version = data.google_container_engine_versions.central1a.release_channel_latest_version["RAPID"]
13035+
network = "%s"
13036+
subnetwork = "%s"
13037+
deletion_protection = false
13038+
13039+
node_pool_defaults {
13040+
node_config_defaults {
13041+
containerd_config {
13042+
writable_cgroups {
13043+
enabled = true
13044+
}
13045+
}
13046+
}
13047+
}
13048+
}
13049+
`, clusterName, networkName, subnetworkName)
13050+
}
13051+
13052+
func testAccContainerCluster_writableCgroupsDisabled(clusterName, networkName, subnetworkName string) string {
13053+
return fmt.Sprintf(`
13054+
data "google_container_engine_versions" "central1a" {
13055+
location = "us-central1-a"
13056+
}
13057+
13058+
resource "google_container_cluster" "primary" {
13059+
name = "%s"
13060+
location = "us-central1-a"
13061+
initial_node_count = 1
13062+
min_master_version = data.google_container_engine_versions.central1a.release_channel_latest_version["RAPID"]
13063+
network = "%s"
13064+
subnetwork = "%s"
13065+
deletion_protection = false
13066+
13067+
node_pool_defaults {
13068+
node_config_defaults {
13069+
containerd_config {
13070+
writable_cgroups {
13071+
enabled = false
13072+
}
13073+
}
13074+
}
13075+
}
13076+
}
13077+
`, clusterName, networkName, subnetworkName)
13078+
}
13079+
13080+
func testAccContainerCluster_withNodePoolWritableCgroups(clusterName, nodePoolName, networkName, subnetworkName string) string {
13081+
return fmt.Sprintf(`
13082+
data "google_container_engine_versions" "central1a" {
13083+
location = "us-central1-a"
13084+
}
13085+
13086+
resource "google_container_cluster" "primary" {
13087+
name = "%s"
13088+
location = "us-central1-a"
13089+
min_master_version = data.google_container_engine_versions.central1a.release_channel_latest_version["RAPID"]
13090+
network = "%s"
13091+
subnetwork = "%s"
13092+
deletion_protection = false
13093+
13094+
node_pool {
13095+
name = "%s"
13096+
initial_node_count = 1
13097+
node_config {
13098+
containerd_config {
13099+
writable_cgroups {
13100+
enabled = true
13101+
}
13102+
}
13103+
}
13104+
}
13105+
13106+
}
13107+
`, clusterName, networkName, subnetworkName, nodePoolName)
13108+
}
13109+
13110+
func testAccContainerCluster_withNodeConfigWritableCgroups(clusterName, networkName, subnetworkName string) string {
13111+
return fmt.Sprintf(`
13112+
data "google_container_engine_versions" "central1a" {
13113+
location = "us-central1-a"
13114+
}
13115+
13116+
resource "google_container_cluster" "primary" {
13117+
name = "%s"
13118+
location = "us-central1-a"
13119+
initial_node_count = 1
13120+
min_master_version = data.google_container_engine_versions.central1a.release_channel_latest_version["RAPID"]
13121+
network = "%s"
13122+
subnetwork = "%s"
13123+
deletion_protection = false
13124+
13125+
node_config {
13126+
containerd_config {
13127+
writable_cgroups {
13128+
enabled = true
13129+
}
13130+
}
13131+
}
13132+
13133+
}
13134+
`, clusterName, networkName, subnetworkName)
13135+
}
13136+
1293513137
func TestAccContainerCluster_withProviderDefaultLabels(t *testing.T) {
1293613138
// The test failed if VCR testing is enabled, because the cached provider config is used.
1293713139
// With the cached provider config, any changes in the provider default labels will not be applied.

0 commit comments

Comments
 (0)