Skip to content

Commit 5f77b52

Browse files
KagashinoKagashino
authored
deprecate: tke - security_policies; fix: endpoint modify limits (#1179)
1 parent da1102f commit 5f77b52

7 files changed

+114
-334
lines changed

‎tencentcloud/resource_tc_kubernetes_cluster.go‎

Lines changed: 19 additions & 161 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ resource "tencentcloud_kubernetes_cluster" "managed_cluster" {
4141
cluster_desc = "test cluster desc"
4242
cluster_max_service_num = 32
4343
cluster_internet = true
44-
managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
44+
# managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
4545
cluster_deploy_type = "MANAGED_CLUSTER"
4646
4747
worker_config {
@@ -134,7 +134,7 @@ resource "tencentcloud_kubernetes_cluster" "managed_cluster" {
134134
cluster_desc = "test cluster desc"
135135
cluster_max_service_num = 32
136136
cluster_internet = true
137-
managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
137+
# managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
138138
cluster_deploy_type = "MANAGED_CLUSTER"
139139
140140
worker_config {
@@ -221,7 +221,7 @@ resource "tencentcloud_kubernetes_cluster" "cluster_with_addon" {
221221
cluster_desc = "test cluster desc"
222222
cluster_max_service_num = 32
223223
cluster_internet = true
224-
managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
224+
# managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
225225
cluster_deploy_type = "MANAGED_CLUSTER"
226226
227227
worker_config {
@@ -295,7 +295,7 @@ resource "tencentcloud_kubernetes_cluster" "test_node_pool_global_config" {
295295
cluster_desc = "test cluster desc"
296296
cluster_max_service_num = 32
297297
cluster_internet = true
298-
managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
298+
# managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
299299
cluster_deploy_type = "MANAGED_CLUSTER"
300300
301301
worker_config {
@@ -360,7 +360,7 @@ resource "tencentcloud_kubernetes_cluster" "managed_cluster" {
360360
cluster_desc = "test cluster desc"
361361
cluster_max_service_num = 256
362362
cluster_internet = true
363-
managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
363+
# managed_cluster_internet_security_policies = ["3.3.3.3", "1.1.1.1"]
364364
cluster_deploy_type = "MANAGED_CLUSTER"
365365
network_type = "VPC-CNI"
366366
eni_subnet_ids = ["subnet-bk1etlyu"]
@@ -1064,9 +1064,10 @@ func resourceTencentCloudTkeCluster() *schema.Resource {
10641064
Description: "Specify security group, NOTE: This argument must not be empty if cluster internet enabled.",
10651065
},
10661066
"managed_cluster_internet_security_policies": {
1067-
Type: schema.TypeList,
1068-
Optional: true,
1069-
Elem: &schema.Schema{Type: schema.TypeString},
1067+
Type: schema.TypeList,
1068+
Optional: true,
1069+
Elem: &schema.Schema{Type: schema.TypeString},
1070+
Deprecated: "this argument was deprecated, use `cluster_internet_security_group` instead.",
10701071
Description: "Security policies for managed cluster internet, like:'192.168.1.0/24' or '113.116.51.27', '0.0.0.0/0' means all." +
10711072
" This field can only set when field `cluster_deploy_type` is 'MANAGED_CLUSTER' and `cluster_internet` is true." +
10721073
" `managed_cluster_internet_security_policies` can not delete or empty once be set.",
@@ -1856,17 +1857,13 @@ func resourceTencentCloudTkeClusterCreate(d *schema.ResourceData, meta interface
18561857
iAdvanced InstanceAdvancedSettings
18571858
iDiskMountSettings []*tke.InstanceDataDiskMountSetting
18581859
cidrSet ClusterCidrSettings
1859-
securityPolicies []string
18601860
extensionAddons []*tke.ExtensionAddon
18611861
clusterInternet = d.Get("cluster_internet").(bool)
18621862
clusterIntranet = d.Get("cluster_intranet").(bool)
18631863
intranetSubnetId = d.Get("cluster_intranet_subnet_id").(string)
18641864
clusterInternetSecurityGroup = d.Get("cluster_internet_security_group").(string)
18651865
)
18661866

1867-
if temp, ok := d.GetOkExists("managed_cluster_internet_security_policies"); ok {
1868-
securityPolicies = helper.InterfacesStrings(temp.([]interface{}))
1869-
}
18701867
clusterDeployType := d.Get("cluster_deploy_type").(string)
18711868

18721869
if clusterIntranet && intranetSubnetId == "" {
@@ -1876,18 +1873,6 @@ func resourceTencentCloudTkeClusterCreate(d *schema.ResourceData, meta interface
18761873
return fmt.Errorf("`cluster_intranet_subnet_id` can only set when `cluster_intranet` is true")
18771874
}
18781875

1879-
if clusterDeployType == TKE_DEPLOY_TYPE_INDEPENDENT {
1880-
if len(securityPolicies) != 0 {
1881-
return fmt.Errorf("`managed_cluster_internet_security_policies` can only set when field `cluster_deploy_type` is 'MANAGED_CLUSTER' and `cluster_internet` is true.")
1882-
}
1883-
}
1884-
1885-
if clusterDeployType == TKE_DEPLOY_TYPE_MANAGED {
1886-
if !clusterInternet && len(securityPolicies) != 0 {
1887-
return fmt.Errorf("`managed_cluster_internet_security_policies` can only set when field `cluster_deploy_type` is 'MANAGED_CLUSTER' and `cluster_internet` is true.")
1888-
}
1889-
}
1890-
18911876
vpcId := d.Get("vpc_id").(string)
18921877
if vpcId != "" {
18931878
basic.VpcId = vpcId
@@ -2036,11 +2021,8 @@ func resourceTencentCloudTkeClusterCreate(d *schema.ResourceData, meta interface
20362021
if masterCount < 3 {
20372022
return fmt.Errorf("if `cluster_deploy_type` is `TKE_DEPLOY_TYPE_INDEPENDENT` len(master_config) should >=3")
20382023
}
2039-
} else {
2040-
if clusterDeployType == TKE_DEPLOY_TYPE_INDEPENDENT {
2041-
return fmt.Errorf("if `cluster_deploy_type` is `TKE_DEPLOY_TYPE_INDEPENDENT` , You need define the master yourself")
2042-
}
2043-
2024+
} else if clusterDeployType == TKE_DEPLOY_TYPE_INDEPENDENT {
2025+
return fmt.Errorf("if `cluster_deploy_type` is `TKE_DEPLOY_TYPE_INDEPENDENT` , You need define the master yourself")
20442026
}
20452027

20462028
if workers, ok := d.GetOk("worker_config"); ok {
@@ -2224,40 +2206,7 @@ func resourceTencentCloudTkeClusterCreate(d *schema.ResourceData, meta interface
22242206
}
22252207
}
22262208

2227-
//TKE_DEPLOY_TYPE_MANAGED Open the internet
2228-
if clusterDeployType == TKE_DEPLOY_TYPE_MANAGED && clusterInternet {
2229-
err = resource.Retry(writeRetryTimeout, func() *resource.RetryError {
2230-
inErr := service.CreateClusterEndpointVip(ctx, id, clusterInternetSecurityGroup)
2231-
if inErr != nil {
2232-
return retryError(inErr)
2233-
}
2234-
return nil
2235-
})
2236-
if err != nil {
2237-
return err
2238-
}
2239-
err = resource.Retry(2*readRetryTimeout, func() *resource.RetryError {
2240-
status, message, inErr := service.DescribeClusterEndpointVipStatus(ctx, id, true)
2241-
if inErr != nil {
2242-
return retryError(inErr)
2243-
}
2244-
if status == TkeInternetStatusCreating {
2245-
return resource.RetryableError(
2246-
fmt.Errorf("%s create cluster endpoint vip status still is %s", id, status))
2247-
}
2248-
if status == TkeInternetStatusNotfound || status == TkeInternetStatusCreated {
2249-
return nil
2250-
}
2251-
return resource.NonRetryableError(
2252-
fmt.Errorf("%s create cluster endpoint vip error ,status is %s,message is %s", id, status, message))
2253-
})
2254-
if err != nil {
2255-
return err
2256-
}
2257-
}
2258-
2259-
//TKE_DEPLOY_TYPE_INDEPENDENT Open the internet
2260-
if clusterDeployType == TKE_DEPLOY_TYPE_INDEPENDENT && clusterInternet {
2209+
if clusterInternet {
22612210
err = resource.Retry(writeRetryTimeout, func() *resource.RetryError {
22622211
inErr := service.CreateClusterEndpoint(ctx, id, "", clusterInternetSecurityGroup, true)
22632212
if inErr != nil {
@@ -2583,32 +2532,21 @@ func resourceTencentCloudTkeClusterUpdate(d *schema.ResourceData, meta interface
25832532
}
25842533

25852534
var (
2586-
securityPolicies []string
25872535
clusterInternet = d.Get("cluster_internet").(bool)
25882536
clusterIntranet = d.Get("cluster_intranet").(bool)
25892537
intranetSubnetId = d.Get("cluster_intranet_subnet_id").(string)
25902538
clusterInternetSecurityGroup = d.Get("cluster_internet_security_group").(string)
25912539
)
25922540

2593-
if temp, ok := d.GetOkExists("managed_cluster_internet_security_policies"); ok {
2594-
securityPolicies = helper.InterfacesStrings(temp.([]interface{}))
2595-
}
2596-
clusterDeployType := d.Get("cluster_deploy_type").(string)
2597-
2598-
if d.HasChange("cluster_intranet_subnet_id") {
2599-
oldKey, newKey := d.GetChange("cluster_intranet_subnet_id")
2600-
if (oldKey.(string) != "" && newKey.(string) == "") || (oldKey.(string) != "" && newKey.(string) != "") {
2601-
return fmt.Errorf("`cluster_intranet_subnet_id` can not modify once be set")
2602-
}
2603-
}
26042541
if clusterIntranet && intranetSubnetId == "" {
26052542
return fmt.Errorf("`cluster_intranet_subnet_id` must set when `cluster_intranet` is true")
26062543
}
26072544

2608-
if clusterDeployType == TKE_DEPLOY_TYPE_INDEPENDENT {
2609-
if len(securityPolicies) != 0 {
2610-
return fmt.Errorf("`managed_cluster_internet_security_policies` can only set when field `cluster_deploy_type` is 'MANAGED_CLUSTER' ")
2611-
}
2545+
if d.HasChange("cluster_intranet_subnet_id") && !d.HasChange("cluster_intranet") {
2546+
return fmt.Errorf("`cluster_intranet_subnet_id` must modified with `cluster_intranet`")
2547+
}
2548+
if d.HasChange("cluster_internet_security_group") && !d.HasChange("cluster_internet") {
2549+
return fmt.Errorf("`cluster_internet_security_group` must modified with `cluster_internet`")
26122550
}
26132551

26142552
if d.HasChange("cluster_intranet") {
@@ -2679,8 +2617,7 @@ func resourceTencentCloudTkeClusterUpdate(d *schema.ResourceData, meta interface
26792617

26802618
if d.HasChange("cluster_internet") {
26812619

2682-
//TKE_DEPLOY_TYPE_INDEPENDENT open internet
2683-
if clusterDeployType == TKE_DEPLOY_TYPE_INDEPENDENT && clusterInternet {
2620+
if clusterInternet {
26842621
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
26852622
inErr := tkeService.CreateClusterEndpoint(ctx, id, "", clusterInternetSecurityGroup, true)
26862623
if inErr != nil {
@@ -2709,10 +2646,7 @@ func resourceTencentCloudTkeClusterUpdate(d *schema.ResourceData, meta interface
27092646
if err != nil {
27102647
return err
27112648
}
2712-
}
2713-
2714-
//TKE_DEPLOY_TYPE_INDEPENDENT close internet
2715-
if clusterDeployType == TKE_DEPLOY_TYPE_INDEPENDENT && !clusterInternet {
2649+
} else {
27162650
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
27172651
inErr := tkeService.DeleteClusterEndpoint(ctx, id, true)
27182652
if inErr != nil {
@@ -2742,82 +2676,6 @@ func resourceTencentCloudTkeClusterUpdate(d *schema.ResourceData, meta interface
27422676
return err
27432677
}
27442678
}
2745-
2746-
//TKE_DEPLOY_TYPE_MANAGED open internet
2747-
if clusterDeployType == TKE_DEPLOY_TYPE_MANAGED && clusterInternet {
2748-
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
2749-
inErr := tkeService.CreateClusterEndpointVip(ctx, id, clusterInternetSecurityGroup)
2750-
if inErr != nil {
2751-
return retryError(inErr)
2752-
}
2753-
return nil
2754-
})
2755-
if err != nil {
2756-
return err
2757-
}
2758-
err = resource.Retry(2*readRetryTimeout, func() *resource.RetryError {
2759-
status, message, inErr := tkeService.DescribeClusterEndpointVipStatus(ctx, id, true)
2760-
if inErr != nil {
2761-
return retryError(inErr)
2762-
}
2763-
if status == TkeInternetStatusCreating {
2764-
return resource.RetryableError(
2765-
fmt.Errorf("%s create cluster endpoint vip status still is %s", id, status))
2766-
}
2767-
if status == TkeInternetStatusNotfound || status == TkeInternetStatusCreated {
2768-
return nil
2769-
}
2770-
return resource.NonRetryableError(
2771-
fmt.Errorf("%s create cluster endpoint vip error ,status is %s,message is %s", id, status, message))
2772-
})
2773-
if err != nil {
2774-
return err
2775-
}
2776-
}
2777-
2778-
//TKE_DEPLOY_TYPE_MANAGED close internet
2779-
if clusterDeployType == TKE_DEPLOY_TYPE_MANAGED && !clusterInternet {
2780-
err := resource.Retry(writeRetryTimeout, func() *resource.RetryError {
2781-
inErr := tkeService.DeleteClusterEndpointVip(ctx, id)
2782-
if inErr != nil {
2783-
return retryError(inErr)
2784-
}
2785-
return nil
2786-
})
2787-
if err != nil {
2788-
return err
2789-
}
2790-
err = resource.Retry(2*readRetryTimeout, func() *resource.RetryError {
2791-
status, message, inErr := tkeService.DescribeClusterEndpointVipStatus(ctx, id, true)
2792-
if inErr != nil {
2793-
return retryError(inErr)
2794-
}
2795-
if status == TkeInternetStatusDeleting {
2796-
return resource.RetryableError(
2797-
fmt.Errorf("%s close cluster internet endpoint status still is %s", id, status))
2798-
}
2799-
if status == TkeInternetStatusNotfound || status == TkeInternetStatusDeleted || status == TkeInternetStatusCreated {
2800-
return nil
2801-
}
2802-
return resource.NonRetryableError(
2803-
fmt.Errorf("%s close cluster internet endpoint error ,status is %s,message is %s", id, status, message))
2804-
})
2805-
if err != nil {
2806-
return err
2807-
}
2808-
}
2809-
}
2810-
2811-
if clusterInternet {
2812-
if !d.HasChange("cluster_internet") && d.HasChange("managed_cluster_internet_security_policies") {
2813-
if len(securityPolicies) == 0 {
2814-
return fmt.Errorf("`managed_cluster_internet_security_policies` can not delete or empty once be setted")
2815-
}
2816-
if err := tkeService.ModifyClusterEndpointSP(ctx, id, securityPolicies); err != nil {
2817-
return err
2818-
}
2819-
d.SetPartial("managed_cluster_internet_security_policies")
2820-
}
28212679
}
28222680

28232681
if d.HasChange("project_id") || d.HasChange("cluster_name") || d.HasChange("cluster_desc") || d.HasChange("cluster_level") || d.HasChange("auto_upgrade_cluster_level") {

0 commit comments

Comments
 (0)