Skip to content

Commit 5d6eac1

Browse files
anoxapebharathkkb
anoxape
and
bharathkkb
authored
feat: support gVNIC (#1296)
Co-authored-by: Bharath KKB <bharathkrishnakb@gmail.com>
1 parent 274da2f commit 5d6eac1

File tree

16 files changed

+124
-0
lines changed

16 files changed

+124
-0
lines changed

‎README.md

+2
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ module "gke" {
6060
disk_type = "pd-standard"
6161
image_type = "COS_CONTAINERD"
6262
enable_gcfs = false
63+
enable_gvnic = false
6364
auto_repair = true
6465
auto_upgrade = true
6566
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
@@ -239,6 +240,7 @@ The node_pools variable takes the following parameters:
239240
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
240241
| effect | Effect for the taint | | Required |
241242
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
243+
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
242244
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
243245
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
244246
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |

‎autogen/main/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,7 @@ module "gke" {
109109
disk_type = "pd-standard"
110110
image_type = "COS_CONTAINERD"
111111
enable_gcfs = false
112+
enable_gvnic = false
112113
auto_repair = true
113114
auto_upgrade = true
114115
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
@@ -196,6 +197,7 @@ The node_pools variable takes the following parameters:
196197
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
197198
| effect | Effect for the taint | | Required |
198199
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
200+
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
199201
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
200202
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
201203
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |

‎autogen/main/cluster.tf.tmpl

+14
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,13 @@ resource "google_container_cluster" "primary" {
311311
}
312312
}
313313

314+
dynamic "gvnic" {
315+
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
316+
content {
317+
enabled = gvnic.value
318+
}
319+
}
320+
314321
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
315322

316323
tags = concat(
@@ -447,6 +454,7 @@ locals {
447454
"spot",
448455
"service_account",
449456
"enable_gcfs",
457+
"enable_gvnic",
450458
"enable_secure_boot",
451459
]
452460
}
@@ -598,6 +606,12 @@ resource "google_container_node_pool" "pools" {
598606
enabled = gcfs_config.value
599607
}
600608
}
609+
dynamic "gvnic" {
610+
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
611+
content {
612+
enabled = gvnic.value
613+
}
614+
}
601615
labels = merge(
602616
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
603617
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},

‎cluster.tf

+13
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,13 @@ resource "google_container_cluster" "primary" {
181181
}
182182
}
183183

184+
dynamic "gvnic" {
185+
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
186+
content {
187+
enabled = gvnic.value
188+
}
189+
}
190+
184191
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
185192

186193
tags = concat(
@@ -307,6 +314,12 @@ resource "google_container_node_pool" "pools" {
307314
enabled = gcfs_config.value
308315
}
309316
}
317+
dynamic "gvnic" {
318+
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
319+
content {
320+
enabled = gvnic.value
321+
}
322+
}
310323
labels = merge(
311324
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
312325
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},

‎modules/beta-private-cluster-update-variant/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ module "gke" {
9292
disk_type = "pd-standard"
9393
image_type = "COS_CONTAINERD"
9494
enable_gcfs = false
95+
enable_gvnic = false
9596
auto_repair = true
9697
auto_upgrade = true
9798
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
@@ -313,6 +314,7 @@ The node_pools variable takes the following parameters:
313314
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
314315
| effect | Effect for the taint | | Required |
315316
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
317+
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
316318
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
317319
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
318320
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |

‎modules/beta-private-cluster-update-variant/cluster.tf

+14
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,13 @@ resource "google_container_cluster" "primary" {
274274
}
275275
}
276276

277+
dynamic "gvnic" {
278+
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
279+
content {
280+
enabled = gvnic.value
281+
}
282+
}
283+
277284
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
278285

279286
tags = concat(
@@ -394,6 +401,7 @@ locals {
394401
"spot",
395402
"service_account",
396403
"enable_gcfs",
404+
"enable_gvnic",
397405
"enable_secure_boot",
398406
]
399407
}
@@ -531,6 +539,12 @@ resource "google_container_node_pool" "pools" {
531539
enabled = gcfs_config.value
532540
}
533541
}
542+
dynamic "gvnic" {
543+
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
544+
content {
545+
enabled = gvnic.value
546+
}
547+
}
534548
labels = merge(
535549
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
536550
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},

‎modules/beta-private-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ module "gke" {
7070
disk_type = "pd-standard"
7171
image_type = "COS_CONTAINERD"
7272
enable_gcfs = false
73+
enable_gvnic = false
7374
auto_repair = true
7475
auto_upgrade = true
7576
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
@@ -291,6 +292,7 @@ The node_pools variable takes the following parameters:
291292
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
292293
| effect | Effect for the taint | | Required |
293294
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
295+
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
294296
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
295297
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
296298
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |

‎modules/beta-private-cluster/cluster.tf

+13
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,13 @@ resource "google_container_cluster" "primary" {
274274
}
275275
}
276276

277+
dynamic "gvnic" {
278+
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
279+
content {
280+
enabled = gvnic.value
281+
}
282+
}
283+
277284
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
278285

279286
tags = concat(
@@ -443,6 +450,12 @@ resource "google_container_node_pool" "pools" {
443450
enabled = gcfs_config.value
444451
}
445452
}
453+
dynamic "gvnic" {
454+
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
455+
content {
456+
enabled = gvnic.value
457+
}
458+
}
446459
labels = merge(
447460
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
448461
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},

‎modules/beta-public-cluster-update-variant/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ module "gke" {
8686
disk_type = "pd-standard"
8787
image_type = "COS_CONTAINERD"
8888
enable_gcfs = false
89+
enable_gvnic = false
8990
auto_repair = true
9091
auto_upgrade = true
9192
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
@@ -300,6 +301,7 @@ The node_pools variable takes the following parameters:
300301
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
301302
| effect | Effect for the taint | | Required |
302303
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
304+
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
303305
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
304306
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
305307
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |

‎modules/beta-public-cluster-update-variant/cluster.tf

+14
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,13 @@ resource "google_container_cluster" "primary" {
274274
}
275275
}
276276

277+
dynamic "gvnic" {
278+
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
279+
content {
280+
enabled = gvnic.value
281+
}
282+
}
283+
277284
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
278285

279286
tags = concat(
@@ -375,6 +382,7 @@ locals {
375382
"spot",
376383
"service_account",
377384
"enable_gcfs",
385+
"enable_gvnic",
378386
"enable_secure_boot",
379387
]
380388
}
@@ -512,6 +520,12 @@ resource "google_container_node_pool" "pools" {
512520
enabled = gcfs_config.value
513521
}
514522
}
523+
dynamic "gvnic" {
524+
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
525+
content {
526+
enabled = gvnic.value
527+
}
528+
}
515529
labels = merge(
516530
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
517531
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},

‎modules/beta-public-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ module "gke" {
6464
disk_type = "pd-standard"
6565
image_type = "COS_CONTAINERD"
6666
enable_gcfs = false
67+
enable_gvnic = false
6768
auto_repair = true
6869
auto_upgrade = true
6970
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
@@ -278,6 +279,7 @@ The node_pools variable takes the following parameters:
278279
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
279280
| effect | Effect for the taint | | Required |
280281
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
282+
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
281283
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
282284
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
283285
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |

‎modules/beta-public-cluster/cluster.tf

+13
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,13 @@ resource "google_container_cluster" "primary" {
274274
}
275275
}
276276

277+
dynamic "gvnic" {
278+
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
279+
content {
280+
enabled = gvnic.value
281+
}
282+
}
283+
277284
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
278285

279286
tags = concat(
@@ -424,6 +431,12 @@ resource "google_container_node_pool" "pools" {
424431
enabled = gcfs_config.value
425432
}
426433
}
434+
dynamic "gvnic" {
435+
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
436+
content {
437+
enabled = gvnic.value
438+
}
439+
}
427440
labels = merge(
428441
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
429442
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},

‎modules/private-cluster-update-variant/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ module "gke" {
8888
disk_type = "pd-standard"
8989
image_type = "COS_CONTAINERD"
9090
enable_gcfs = false
91+
enable_gvnic = false
9192
auto_repair = true
9293
auto_upgrade = true
9394
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
@@ -273,6 +274,7 @@ The node_pools variable takes the following parameters:
273274
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
274275
| effect | Effect for the taint | | Required |
275276
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
277+
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
276278
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
277279
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
278280
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |

‎modules/private-cluster-update-variant/cluster.tf

+14
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,13 @@ resource "google_container_cluster" "primary" {
181181
}
182182
}
183183

184+
dynamic "gvnic" {
185+
for_each = lookup(var.node_pools[0], "enable_gvnic", false) ? [true] : []
186+
content {
187+
enabled = gvnic.value
188+
}
189+
}
190+
184191
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
185192

186193
tags = concat(
@@ -281,6 +288,7 @@ locals {
281288
"spot",
282289
"service_account",
283290
"enable_gcfs",
291+
"enable_gvnic",
284292
"enable_secure_boot",
285293
]
286294
}
@@ -408,6 +416,12 @@ resource "google_container_node_pool" "pools" {
408416
enabled = gcfs_config.value
409417
}
410418
}
419+
dynamic "gvnic" {
420+
for_each = lookup(each.value, "enable_gvnic", false) ? [true] : []
421+
content {
422+
enabled = gvnic.value
423+
}
424+
}
411425
labels = merge(
412426
lookup(lookup(local.node_pools_labels, "default_values", {}), "cluster_name", true) ? { "cluster_name" = var.name } : {},
413427
lookup(lookup(local.node_pools_labels, "default_values", {}), "node_pool", true) ? { "node_pool" = each.value["name"] } : {},

‎modules/private-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ module "gke" {
6666
disk_type = "pd-standard"
6767
image_type = "COS_CONTAINERD"
6868
enable_gcfs = false
69+
enable_gvnic = false
6970
auto_repair = true
7071
auto_upgrade = true
7172
service_account = "project-service-account@<PROJECT ID>.iam.gserviceaccount.com"
@@ -251,6 +252,7 @@ The node_pools variable takes the following parameters:
251252
| disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional |
252253
| effect | Effect for the taint | | Required |
253254
| enable_gcfs | Google Container File System (gcfs) has to be enabled for image streaming to be active. Needs image_type to be set to COS_CONTAINERD. | false | Optional |
255+
| enable_gvnic | gVNIC (GVE) is an alternative to the virtIO-based ethernet driver. Needs a Container-Optimized OS node image. | false | Optional |
254256
| enable_integrity_monitoring | Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. | true | Optional |
255257
| enable_secure_boot | Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. | false | Optional |
256258
| gpu_partition_size | Size of partitions to create on the GPU | null | Optional |

0 commit comments

Comments
 (0)