如何通过 terraform 为 GKE 集群启用 Anthos Service Mesh

Question

我在 GKE 中有 2 个 k8s 集群，都通过 terraform 进行配置，但其中一个处于自动驾驶模式。

但是我在网上找不到任何关于如何通过 terraform 在其中启用 anthos 服务网格的资源。

当我单击任何集群详细信息页面时，我会看到：

两个集群均已注册到我的 Anthos 队列，示例：

resource "google_gke_hub_membership" "anthos_registration" {
  provider      = google-beta
  project = var.project_id
  membership_id = google_container_cluster.cluster.name
  endpoint {
    gke_cluster {
      resource_link = "//container.googleapis.com/${google_container_cluster.foobar.id}"
    }
  }
}

Answer 1

有一个专用模块https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest/submodules/asm

Answer 2

通过 terraform 获得了一个 GKE 集群与 anthos 服务网格配合使用的简单示例，将其发布在此处，以防将来有人需要它：

data "google_client_config" "default" {}

provider "kubernetes" {
  host                   = "https://${module.gke.endpoint}"
  token                  = data.google_client_config.default.access_token
  cluster_ca_certificate = base64decode(module.gke.ca_certificate)
}

data "google_project" "project" {
  project_id = var.project_id
}

module "gke" {
  source            = "terraform-google-modules/kubernetes-engine/google//"
  project_id              = var.project_id
  name                    = "test-prefix-cluster"
  regional                = false
  region                  = var.region
  zones                   = var.zones
  release_channel         = "REGULAR"
  network                 = "default"
  subnetwork              = "default"
  ip_range_pods           = ""
  ip_range_services       = ""
  network_policy          = false
  cluster_resource_labels = { "mesh_id" : "proj-${data.google_project.project.number}" }
  identity_namespace      = "${var.project_id}.svc.id.goog"
  deletion_protection     = false
  node_pools = [
    {
        service_account = google_service_account.iam_sa.email
      name         = "asm-node-pool"
      autoscaling  = false
      auto_upgrade = true
      node_count   = 2
      machine_type = "e2-standard-4"
    },
  ]
}

module "asm" {
  source            = "terraform-google-modules/kubernetes-engine/google//modules/asm"
  project_id                = var.project_id
  cluster_name              = module.gke.name
  cluster_location          = module.gke.location
  multicluster_mode         = "connected"
  enable_cni                = true
  enable_fleet_registration = true
  enable_mesh_feature       = true
}