Skip to content

Commit 0c8e37a

Browse files
AmeausooneAmeausoone
committed
feat(backup): add GKE backup configuration variables
Introduce new variables for GKE backup configuration, including `backup_cron_schedule`, `backup_rpo_target_in_minutes`, `backup_config`, and `backup_retain_days`. These new settings enable backup schedule definition, RPO configuration, volume data and secrets backup options, and backup retention period definition.
1 parent df4b5a7 commit 0c8e37a

File tree

29 files changed

+785
-0
lines changed

29 files changed

+785
-0
lines changed

‎README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,10 @@ Then perform the following commands on the root folder:
144144
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
145145
| additive\_vpc\_scope\_dns\_domain | This will enable Cloud DNS additive VPC scope. Must provide a domain name that is unique within the VPC. For this to work cluster\_dns = `CLOUD_DNS` and cluster\_dns\_scope = `CLUSTER_SCOPE` must both be set as well. | `string` | `""` | no |
146146
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
147+
| backup\_config | Defines the backup configuration settings, including volume data and secrets backup options. | <pre>object({<br> include_volume_data = optional(bool)<br> include_secrets = optional(bool)<br> })</pre> | <pre>{<br> "include_secrets": true,<br> "include_volume_data": true<br>}</pre> | no |
148+
| backup\_cron\_schedule | Defines the GKE backup schedule. Mutually exclusive with backup\_rpo\_target\_in\_minutes; backup\_cron\_schedule takes precedence if both are set. Configure at least one to enable backup. | `string` | `null` | no |
149+
| backup\_retain\_days | The number of days to retain backups. Must be between 1 and 35. Defaults to 7. | `number` | `7` | no |
150+
| backup\_rpo\_target\_in\_minutes | Configuration for Recovery Point Objective (RPO), specifying the target RPO in minutes. Must be between 60 and 86400. Mutually exclusive with backup\_cron\_schedule; backup\_cron\_schedule takes precedence if both are set. Configure at least one to enable backup. | `number` | `null` | no |
147151
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
148152
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
149153
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |

‎autogen/main/backup.tf.tmpl

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
resource "google_gke_backup_backup_plan" "backup" {
2+
count = (var.backup_cron_schedule != null || var.backup_rpo_target_in_minutes != null) && var.gke_backup_agent_config ? 1 : 0
3+
4+
name = "${google_container_cluster.primary.name}-backup-plan"
5+
cluster = google_container_cluster.primary.id
6+
7+
# Location (fallback to region or derived from zones)
8+
location = try(var.region, substr(var.zones[0], 0, length(var.zones[0]) - 2))
9+
10+
backup_config {
11+
include_volume_data = try(var.backup_config.include_volume_data, true)
12+
include_secrets = try(var.backup_config.include_secrets, true)
13+
all_namespaces = true
14+
}
15+
16+
dynamic "backup_schedule" {
17+
for_each = var.backup_cron_schedule != null ? [var.backup_cron_schedule] : []
18+
content {
19+
cron_schedule = backup_schedule.value
20+
}
21+
}
22+
23+
dynamic "backup_schedule" {
24+
# If both backup_schedule and rpo_config are specified, backup_schedule have the precedence
25+
for_each = var.backup_rpo_target_in_minutes != null && var.backup_cron_schedule ==null ? [var.backup_rpo_target_in_minutes] : []
26+
content {
27+
rpo_config {
28+
target_rpo_minutes = backup_schedule.value
29+
}
30+
}
31+
}
32+
33+
retention_policy {
34+
backup_retain_days = var.backup_retain_days
35+
}
36+
}

‎autogen/main/variables.tf.tmpl

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -822,6 +822,44 @@ variable "gke_backup_agent_config" {
822822
default = false
823823
}
824824

825+
variable "backup_cron_schedule" {
826+
description = "Defines the GKE backup schedule. Mutually exclusive with backup_rpo_target_in_minutes; backup_cron_schedule takes precedence if both are set. Configure at least one to enable backup."
827+
type = string
828+
default = null
829+
}
830+
831+
variable "backup_rpo_target_in_minutes" {
832+
description = "Configuration for Recovery Point Objective (RPO), specifying the target RPO in minutes. Must be between 60 and 86400. Mutually exclusive with backup_cron_schedule; backup_cron_schedule takes precedence if both are set. Configure at least one to enable backup."
833+
type = number
834+
default = null
835+
validation {
836+
condition = var.backup_rpo_target_in_minutes == null || try(var.backup_rpo_target_in_minutes >= 60 && var.backup_rpo_target_in_minutes <= 86400, false)
837+
error_message = "backup_rpo_target_in_minutes must be between 60 and 86400."
838+
}
839+
}
840+
841+
variable "backup_config" {
842+
description = "Defines the backup configuration settings, including volume data and secrets backup options."
843+
type = object({
844+
include_volume_data = optional(bool)
845+
include_secrets = optional(bool)
846+
})
847+
default = {
848+
include_volume_data = true
849+
include_secrets = true
850+
}
851+
}
852+
853+
variable "backup_retain_days" {
854+
description = "The number of days to retain backups. Must be between 1 and 35. Defaults to 7."
855+
type = number
856+
default = 7
857+
validation {
858+
condition = var.backup_retain_days >= 1 && var.backup_retain_days <= 35
859+
error_message = "backup_retain_days must be between 1 and 35."
860+
}
861+
}
862+
825863
variable "stateful_ha" {
826864
type = bool
827865
description = "Whether the Stateful HA Addon is enabled for this cluster."

‎backup.tf

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
resource "google_gke_backup_backup_plan" "backup" {
2+
count = (var.backup_cron_schedule != null || var.backup_rpo_target_in_minutes != null) && var.gke_backup_agent_config ? 1 : 0
3+
4+
# Plan name and cluster identification
5+
name = "${google_container_cluster.primary.name}-backup-plan"
6+
cluster = google_container_cluster.primary.id
7+
8+
# Location (fallback to region or derived from zones)
9+
location = try(var.region, substr(var.zones[0], 0, length(var.zones[0]) - 2))
10+
11+
backup_config {
12+
include_volume_data = try(var.backup_config.include_volume_data, true)
13+
include_secrets = try(var.backup_config.include_secrets, true)
14+
all_namespaces = true
15+
}
16+
17+
dynamic "backup_schedule" {
18+
for_each = var.backup_cron_schedule != null ? [var.backup_cron_schedule] : []
19+
content {
20+
cron_schedule = backup_schedule.value
21+
}
22+
}
23+
24+
dynamic "backup_schedule" {
25+
# If both backup_schedule and rpo_config are specified, backup_schedule have the precedence
26+
for_each = var.backup_rpo_target_in_minutes != null && var.backup_cron_schedule == null ? [var.backup_rpo_target_in_minutes] : []
27+
content {
28+
rpo_config {
29+
target_rpo_minutes = backup_schedule.value
30+
}
31+
}
32+
}
33+
34+
retention_policy {
35+
backup_retain_days = var.backup_retain_days
36+
}
37+
}

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,10 @@ Then perform the following commands on the root folder:
7777
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
7878
| allow\_net\_admin | (Optional) Enable NET\_ADMIN for the cluster. | `bool` | `null` | no |
7979
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
80+
| backup\_config | Defines the backup configuration settings, including volume data and secrets backup options. | <pre>object({<br> include_volume_data = optional(bool)<br> include_secrets = optional(bool)<br> })</pre> | <pre>{<br> "include_secrets": true,<br> "include_volume_data": true<br>}</pre> | no |
81+
| backup\_cron\_schedule | Defines the GKE backup schedule. Mutually exclusive with backup\_rpo\_target\_in\_minutes; backup\_cron\_schedule takes precedence if both are set. Configure at least one to enable backup. | `string` | `null` | no |
82+
| backup\_retain\_days | The number of days to retain backups. Must be between 1 and 35. Defaults to 7. | `number` | `7` | no |
83+
| backup\_rpo\_target\_in\_minutes | Configuration for Recovery Point Objective (RPO), specifying the target RPO in minutes. Must be between 60 and 86400. Mutually exclusive with backup\_cron\_schedule; backup\_cron\_schedule takes precedence if both are set. Configure at least one to enable backup. | `number` | `null` | no |
8084
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
8185
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | `string` | `null` | no |
8286
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | `map(string)` | `{}` | no |

‎modules/beta-autopilot-private-cluster/backup.tf

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
resource "google_gke_backup_backup_plan" "backup" {
2+
count = (var.backup_cron_schedule != null || var.backup_rpo_target_in_minutes != null) && var.gke_backup_agent_config ? 1 : 0
3+
4+
# Plan name and cluster identification
5+
name = "${google_container_cluster.primary.name}-backup-plan"
6+
cluster = google_container_cluster.primary.id
7+
8+
# Location (fallback to region or derived from zones)
9+
location = try(var.region, substr(var.zones[0], 0, length(var.zones[0]) - 2))
10+
11+
backup_config {
12+
include_volume_data = try(var.backup_config.include_volume_data, true)
13+
include_secrets = try(var.backup_config.include_secrets, true)
14+
all_namespaces = true
15+
}
16+
17+
dynamic "backup_schedule" {
18+
for_each = var.backup_cron_schedule != null ? [var.backup_cron_schedule] : []
19+
content {
20+
cron_schedule = backup_schedule.value
21+
}
22+
}
23+
24+
dynamic "backup_schedule" {
25+
# If both backup_schedule and rpo_config are specified, backup_schedule have the precedence
26+
for_each = var.backup_rpo_target_in_minutes != null && var.backup_cron_schedule == null ? [var.backup_rpo_target_in_minutes] : []
27+
content {
28+
rpo_config {
29+
target_rpo_minutes = backup_schedule.value
30+
}
31+
}
32+
}
33+
34+
retention_policy {
35+
backup_retain_days = var.backup_retain_days
36+
}
37+
}

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -495,6 +495,44 @@ variable "gke_backup_agent_config" {
495495
default = false
496496
}
497497

498+
variable "backup_cron_schedule" {
499+
description = "Defines the GKE backup schedule. Mutually exclusive with backup_rpo_target_in_minutes; backup_cron_schedule takes precedence if both are set. Configure at least one to enable backup."
500+
type = string
501+
default = null
502+
}
503+
504+
variable "backup_rpo_target_in_minutes" {
505+
description = "Configuration for Recovery Point Objective (RPO), specifying the target RPO in minutes. Must be between 60 and 86400. Mutually exclusive with backup_cron_schedule; backup_cron_schedule takes precedence if both are set. Configure at least one to enable backup."
506+
type = number
507+
default = null
508+
validation {
509+
condition = var.backup_rpo_target_in_minutes == null || try(var.backup_rpo_target_in_minutes >= 60 && var.backup_rpo_target_in_minutes <= 86400, false)
510+
error_message = "backup_rpo_target_in_minutes must be between 60 and 86400."
511+
}
512+
}
513+
514+
variable "backup_config" {
515+
description = "Defines the backup configuration settings, including volume data and secrets backup options."
516+
type = object({
517+
include_volume_data = optional(bool)
518+
include_secrets = optional(bool)
519+
})
520+
default = {
521+
include_volume_data = true
522+
include_secrets = true
523+
}
524+
}
525+
526+
variable "backup_retain_days" {
527+
description = "The number of days to retain backups. Must be between 1 and 35. Defaults to 7."
528+
type = number
529+
default = 7
530+
validation {
531+
condition = var.backup_retain_days >= 1 && var.backup_retain_days <= 35
532+
error_message = "backup_retain_days must be between 1 and 35."
533+
}
534+
}
535+
498536
variable "stateful_ha" {
499537
type = bool
500538
description = "Whether the Stateful HA Addon is enabled for this cluster."

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,10 @@ Then perform the following commands on the root folder:
7272
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
7373
| allow\_net\_admin | (Optional) Enable NET\_ADMIN for the cluster. | `bool` | `null` | no |
7474
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
75+
| backup\_config | Defines the backup configuration settings, including volume data and secrets backup options. | <pre>object({<br> include_volume_data = optional(bool)<br> include_secrets = optional(bool)<br> })</pre> | <pre>{<br> "include_secrets": true,<br> "include_volume_data": true<br>}</pre> | no |
76+
| backup\_cron\_schedule | Defines the GKE backup schedule. Mutually exclusive with backup\_rpo\_target\_in\_minutes; backup\_cron\_schedule takes precedence if both are set. Configure at least one to enable backup. | `string` | `null` | no |
77+
| backup\_retain\_days | The number of days to retain backups. Must be between 1 and 35. Defaults to 7. | `number` | `7` | no |
78+
| backup\_rpo\_target\_in\_minutes | Configuration for Recovery Point Objective (RPO), specifying the target RPO in minutes. Must be between 60 and 86400. Mutually exclusive with backup\_cron\_schedule; backup\_cron\_schedule takes precedence if both are set. Configure at least one to enable backup. | `number` | `null` | no |
7579
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
7680
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | `string` | `null` | no |
7781
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | `map(string)` | `{}` | no |

‎modules/beta-autopilot-public-cluster/backup.tf

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
resource "google_gke_backup_backup_plan" "backup" {
2+
count = (var.backup_cron_schedule != null || var.backup_rpo_target_in_minutes != null) && var.gke_backup_agent_config ? 1 : 0
3+
4+
# Plan name and cluster identification
5+
name = "${google_container_cluster.primary.name}-backup-plan"
6+
cluster = google_container_cluster.primary.id
7+
8+
# Location (fallback to region or derived from zones)
9+
location = try(var.region, substr(var.zones[0], 0, length(var.zones[0]) - 2))
10+
11+
backup_config {
12+
include_volume_data = try(var.backup_config.include_volume_data, true)
13+
include_secrets = try(var.backup_config.include_secrets, true)
14+
all_namespaces = true
15+
}
16+
17+
dynamic "backup_schedule" {
18+
for_each = var.backup_cron_schedule != null ? [var.backup_cron_schedule] : []
19+
content {
20+
cron_schedule = backup_schedule.value
21+
}
22+
}
23+
24+
dynamic "backup_schedule" {
25+
# If both backup_schedule and rpo_config are specified, backup_schedule have the precedence
26+
for_each = var.backup_rpo_target_in_minutes != null && var.backup_cron_schedule == null ? [var.backup_rpo_target_in_minutes] : []
27+
content {
28+
rpo_config {
29+
target_rpo_minutes = backup_schedule.value
30+
}
31+
}
32+
}
33+
34+
retention_policy {
35+
backup_retain_days = var.backup_retain_days
36+
}
37+
}

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -459,6 +459,44 @@ variable "gke_backup_agent_config" {
459459
default = false
460460
}
461461

462+
variable "backup_cron_schedule" {
463+
description = "Defines the GKE backup schedule. Mutually exclusive with backup_rpo_target_in_minutes; backup_cron_schedule takes precedence if both are set. Configure at least one to enable backup."
464+
type = string
465+
default = null
466+
}
467+
468+
variable "backup_rpo_target_in_minutes" {
469+
description = "Configuration for Recovery Point Objective (RPO), specifying the target RPO in minutes. Must be between 60 and 86400. Mutually exclusive with backup_cron_schedule; backup_cron_schedule takes precedence if both are set. Configure at least one to enable backup."
470+
type = number
471+
default = null
472+
validation {
473+
condition = var.backup_rpo_target_in_minutes == null || try(var.backup_rpo_target_in_minutes >= 60 && var.backup_rpo_target_in_minutes <= 86400, false)
474+
error_message = "backup_rpo_target_in_minutes must be between 60 and 86400."
475+
}
476+
}
477+
478+
variable "backup_config" {
479+
description = "Defines the backup configuration settings, including volume data and secrets backup options."
480+
type = object({
481+
include_volume_data = optional(bool)
482+
include_secrets = optional(bool)
483+
})
484+
default = {
485+
include_volume_data = true
486+
include_secrets = true
487+
}
488+
}
489+
490+
variable "backup_retain_days" {
491+
description = "The number of days to retain backups. Must be between 1 and 35. Defaults to 7."
492+
type = number
493+
default = 7
494+
validation {
495+
condition = var.backup_retain_days >= 1 && var.backup_retain_days <= 35
496+
error_message = "backup_retain_days must be between 1 and 35."
497+
}
498+
}
499+
462500
variable "stateful_ha" {
463501
type = bool
464502
description = "Whether the Stateful HA Addon is enabled for this cluster."

0 commit comments

Comments
 (0)