feat: expose secret manager rotation config

README.md

@@ -185,7 +185,6 @@ Then perform the following commands on the root folder:
 | enable\_multi\_networking | Whether multi-networking is enabled for this cluster | `bool` | `null` | no |
 | enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
 | enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
-| enable\_secret\_manager\_addon | Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
 | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no |
 | enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
 | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no |
@@ -267,6 +266,7 @@ Then perform the following commands on the root folder:
 | remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
 | resource\_manager\_tags | (Optional) - List of resource manager tags applied to autopilot and auto-provisioned node pools. A maximum of 5 tags can be specified. Tags must be in one of these formats: "tagKeys/{tag\_key\_id}"="tagValues/{tag\_value\_id}", "{org\_id}/{tag\_key\_name}"="{tag\_value\_name}", "{project\_id}/{tag\_key\_name}"="{tag\_value\_name}". | `map(string)` | `{}` | no |
 | resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
+| secret\_manager\_addon | Configure the Secret Manager add-on for this cluster | <pre>object({<br>    enabled = bool,<br>    rotation_config = optional(object({<br>      enabled           = bool,<br>      rotation_interval = optional(string)<br>    }))<br>  })</pre> | <pre>{<br>  "enabled": false<br>}</pre> | no |
 | security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
 | security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED`, `VULNERABILITY_BASIC`, and `VULNERABILITY_ENTERPRISE`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
 | service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |

autogen/main/cluster.tf.tmpl

@@ -305,9 +305,16 @@ resource "google_container_cluster" "primary" {
   }
 
   dynamic "secret_manager_config" {
-    for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
+    for_each = var.secret_manager_addon.enabled ? [var.secret_manager_addon] : []
     content {
-      enabled = secret_manager_config.value
+      enabled = secret_manager_config.value.enabled
+      dynamic "rotation_config" {
+        for_each = secret_manager_config.value.rotation_config != null ? [secret_manager_config.value.rotation_config] : []
+        content {
+          enabled           = rotation_config.value.enabled
+          rotation_interval = rotation_config.value.rotation_interval != "" ? rotation_config.value.rotation_interval : null
+        }
+      }
     }
   }
 

autogen/main/variables.tf.tmpl

@@ -708,10 +708,16 @@ variable "enable_gcfs" {
 }
 {% endif %}
 
-variable "enable_secret_manager_addon" {
-  description = "Enable the Secret Manager add-on for this cluster"
-  type        = bool
-  default     = false
+variable "secret_manager_addon" {
+  description = "Configure the Secret Manager add-on for this cluster"
+  type        = object({ 
+    enabled         = bool,
+    rotation_config = optional(object({
+      enabled           = bool,
+      rotation_interval = optional(string)
+    }))
+  })
+  default     = { enabled = false  }
 }
 {% if beta_cluster %}
 

cluster.tf

@@ -243,9 +243,16 @@ resource "google_container_cluster" "primary" {
   }
 
   dynamic "secret_manager_config" {
-    for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
+    for_each = var.secret_manager_addon.enabled ? [var.secret_manager_addon] : []
     content {
-      enabled = secret_manager_config.value
+      enabled = secret_manager_config.value.enabled
+      dynamic "rotation_config" {
+        for_each = secret_manager_config.value.rotation_config != null ? [secret_manager_config.value.rotation_config] : []
+        content {
+          enabled           = rotation_config.value.enabled
+          rotation_interval = rotation_config.value.rotation_interval != "" ? rotation_config.value.rotation_interval : null
+        }
+      }
     }
   }
 

examples/simple_regional_private/main.tf

@@ -36,22 +36,22 @@ module "gke" {
   source  = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster"
   version = "~> 43.0"
 
-  project_id                  = var.project_id
-  name                        = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
-  regional                    = true
-  region                      = var.region
-  network                     = var.network
-  subnetwork                  = var.subnetwork
-  ip_range_pods               = var.ip_range_pods
-  create_service_account      = false
-  service_account             = var.compute_engine_service_account
-  enable_private_endpoint     = true
-  enable_private_nodes        = true
-  enable_secret_manager_addon = true
-  default_max_pods_per_node   = 20
-  remove_default_node_pool    = true
-  deletion_protection         = false
-  enable_k8s_beta_apis        = var.enable_k8s_beta_apis
+  project_id                = var.project_id
+  name                      = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
+  regional                  = true
+  region                    = var.region
+  network                   = var.network
+  subnetwork                = var.subnetwork
+  ip_range_pods             = var.ip_range_pods
+  create_service_account    = false
+  service_account           = var.compute_engine_service_account
+  enable_private_endpoint   = true
+  enable_private_nodes      = true
+  secret_manager_addon      = { enabled = true }
+  default_max_pods_per_node = 20
+  remove_default_node_pool  = true
+  deletion_protection       = false
+  enable_k8s_beta_apis      = var.enable_k8s_beta_apis
 
   node_pools = [
     {

examples/simple_regional_private_no_pool/main.tf

@@ -36,22 +36,22 @@ module "gke" {
   source  = "terraform-google-modules/kubernetes-engine/google//modules/private-cluster"
   version = "~> 43.0"
 
-  project_id                  = var.project_id
-  name                        = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
-  regional                    = true
-  region                      = var.region
-  network                     = var.network
-  subnetwork                  = var.subnetwork
-  ip_range_pods               = var.ip_range_pods
-  create_service_account      = false
-  service_account             = var.compute_engine_service_account
-  enable_private_endpoint     = true
-  enable_private_nodes        = true
-  enable_secret_manager_addon = true
-  default_max_pods_per_node   = 20
-  remove_default_node_pool    = true
-  deletion_protection         = false
-  enable_k8s_beta_apis        = var.enable_k8s_beta_apis
+  project_id                = var.project_id
+  name                      = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
+  regional                  = true
+  region                    = var.region
+  network                   = var.network
+  subnetwork                = var.subnetwork
+  ip_range_pods             = var.ip_range_pods
+  create_service_account    = false
+  service_account           = var.compute_engine_service_account
+  enable_private_endpoint   = true
+  enable_private_nodes      = true
+  secret_manager_addon      = { enabled = true }
+  default_max_pods_per_node = 20
+  remove_default_node_pool  = true
+  deletion_protection       = false
+  enable_k8s_beta_apis      = var.enable_k8s_beta_apis
 
   cluster_autoscaling = {
     enabled                      = true

metadata.display.yaml

@@ -168,9 +168,6 @@ spec:
         enable_resource_consumption_export:
           name: enable_resource_consumption_export
           title: Enable Resource Consumption Export
-        enable_secret_manager_addon:
-          name: enable_secret_manager_addon
-          title: Enable Secret Manager Addon
         enable_shielded_nodes:
           name: enable_shielded_nodes
           title: Enable Shielded Nodes
@@ -414,6 +411,9 @@ spec:
         resource_usage_export_dataset_id:
           name: resource_usage_export_dataset_id
           title: Resource Usage Export Dataset Id
+        secret_manager_addon:
+          name: secret_manager_addon
+          title: Secret Manager Addon
         security_posture_mode:
           name: security_posture_mode
           title: Security Posture Mode

metadata.yaml

@@ -571,10 +571,18 @@ spec:
         description: Enable image streaming on cluster level.
         varType: bool
         defaultValue: false
-      - name: enable_secret_manager_addon
-        description: Enable the Secret Manager add-on for this cluster
-        varType: bool
-        defaultValue: false
+      - name: secret_manager_addon
+        description: Configure the Secret Manager add-on for this cluster
+        varType: |-
+          object({
+              enabled = bool,
+              rotation_config = optional(object({
+                enabled           = bool,
+                rotation_interval = optional(string)
+              }))
+            })
+        defaultValue:
+          enabled: false
       - name: enable_fqdn_network_policy
         description: Enable FQDN Network Policies on the cluster
         varType: bool

modules/beta-autopilot-private-cluster/README.md

@@ -107,7 +107,6 @@ Then perform the following commands on the root folder:
 | enable\_private\_endpoint | Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
 | enable\_private\_nodes | Whether nodes have internal IP addresses only | `bool` | `true` | no |
 | enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
-| enable\_secret\_manager\_addon | Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
 | enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
 | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `true` | no |
 | enterprise\_config | (Optional) Enable or disable GKE enterprise. Valid values are STANDARD and ENTERPRISE. | `string` | `null` | no |
@@ -161,6 +160,7 @@ Then perform the following commands on the root folder:
 | release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
 | resource\_manager\_tags | (Optional) - List of resource manager tags applied to autopilot and auto-provisioned node pools. A maximum of 5 tags can be specified. Tags must be in one of these formats: "tagKeys/{tag\_key\_id}"="tagValues/{tag\_value\_id}", "{org\_id}/{tag\_key\_name}"="{tag\_value\_name}", "{project\_id}/{tag\_key\_name}"="{tag\_value\_name}". | `map(string)` | `{}` | no |
 | resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
+| secret\_manager\_addon | Configure the Secret Manager add-on for this cluster | <pre>object({<br>    enabled = bool,<br>    rotation_config = optional(object({<br>      enabled           = bool,<br>      rotation_interval = optional(string)<br>    }))<br>  })</pre> | <pre>{<br>  "enabled": false<br>}</pre> | no |
 | security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
 | security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED`, `VULNERABILITY_BASIC`, and `VULNERABILITY_ENTERPRISE`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
 | service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |

modules/beta-autopilot-private-cluster/cluster.tf

@@ -157,9 +157,16 @@ resource "google_container_cluster" "primary" {
   }
 
   dynamic "secret_manager_config" {
-    for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
+    for_each = var.secret_manager_addon.enabled ? [var.secret_manager_addon] : []
     content {
-      enabled = secret_manager_config.value
+      enabled = secret_manager_config.value.enabled
+      dynamic "rotation_config" {
+        for_each = secret_manager_config.value.rotation_config != null ? [secret_manager_config.value.rotation_config] : []
+        content {
+          enabled           = rotation_config.value.enabled
+          rotation_interval = rotation_config.value.rotation_interval != "" ? rotation_config.value.rotation_interval : null
+        }
+      }
     }
   }
 

modules/beta-autopilot-private-cluster/metadata.display.yaml

@@ -136,9 +136,6 @@ spec:
         enable_resource_consumption_export:
           name: enable_resource_consumption_export
           title: Enable Resource Consumption Export
-        enable_secret_manager_addon:
-          name: enable_secret_manager_addon
-          title: Enable Secret Manager Addon
         enable_tpu:
           name: enable_tpu
           title: Enable Tpu
@@ -307,6 +304,9 @@ spec:
         resource_usage_export_dataset_id:
           name: resource_usage_export_dataset_id
           title: Resource Usage Export Dataset Id
+        secret_manager_addon:
+          name: secret_manager_addon
+          title: Secret Manager Addon
         security_posture_mode:
           name: security_posture_mode
           title: Security Posture Mode

modules/beta-autopilot-private-cluster/metadata.yaml

@@ -378,10 +378,18 @@ spec:
         description: Enable the Horizontal Pod Autoscaling profile for this cluster. Values are "NONE" and "PERFORMANCE".
         varType: string
         defaultValue: ""
-      - name: enable_secret_manager_addon
-        description: Enable the Secret Manager add-on for this cluster
-        varType: bool
-        defaultValue: false
+      - name: secret_manager_addon
+        description: Configure the Secret Manager add-on for this cluster
+        varType: |-
+          object({
+              enabled = bool,
+              rotation_config = optional(object({
+                enabled           = bool,
+                rotation_interval = optional(string)
+              }))
+            })
+        defaultValue:
+          enabled: false
       - name: workload_vulnerability_mode
         description: (beta) Sets which mode to use for Protect workload vulnerability scanning feature. Accepted values are DISABLED, BASIC.
         varType: string

modules/beta-autopilot-private-cluster/variables.tf

@@ -412,10 +412,16 @@ variable "hpa_profile" {
   default     = ""
 }
 
-variable "enable_secret_manager_addon" {
-  description = "Enable the Secret Manager add-on for this cluster"
-  type        = bool
-  default     = false
+variable "secret_manager_addon" {
+  description = "Configure the Secret Manager add-on for this cluster"
+  type = object({
+    enabled = bool,
+    rotation_config = optional(object({
+      enabled           = bool,
+      rotation_interval = optional(string)
+    }))
+  })
+  default = { enabled = false }
 }
 
 variable "workload_vulnerability_mode" {

modules/beta-autopilot-public-cluster/README.md

@@ -98,7 +98,6 @@ Then perform the following commands on the root folder:
 | enable\_multi\_networking | Whether multi-networking is enabled for this cluster | `bool` | `null` | no |
 | enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
 | enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
-| enable\_secret\_manager\_addon | Enable the Secret Manager add-on for this cluster | `bool` | `false` | no |
 | enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
 | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `true` | no |
 | enterprise\_config | (Optional) Enable or disable GKE enterprise. Valid values are STANDARD and ENTERPRISE. | `string` | `null` | no |
@@ -149,6 +148,7 @@ Then perform the following commands on the root folder:
 | release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
 | resource\_manager\_tags | (Optional) - List of resource manager tags applied to autopilot and auto-provisioned node pools. A maximum of 5 tags can be specified. Tags must be in one of these formats: "tagKeys/{tag\_key\_id}"="tagValues/{tag\_value\_id}", "{org\_id}/{tag\_key\_name}"="{tag\_value\_name}", "{project\_id}/{tag\_key\_name}"="{tag\_value\_name}". | `map(string)` | `{}` | no |
 | resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
+| secret\_manager\_addon | Configure the Secret Manager add-on for this cluster | <pre>object({<br>    enabled = bool,<br>    rotation_config = optional(object({<br>      enabled           = bool,<br>      rotation_interval = optional(string)<br>    }))<br>  })</pre> | <pre>{<br>  "enabled": false<br>}</pre> | no |
 | security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
 | security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED`, `VULNERABILITY_BASIC`, and `VULNERABILITY_ENTERPRISE`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
 | service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |