diff --git a/autogen/main/README.md b/autogen/main/README.md index f47c6171d7..4206111f2f 100644 --- a/autogen/main/README.md +++ b/autogen/main/README.md @@ -201,6 +201,7 @@ The node_pools variable takes the following parameters: | cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional | | cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional | | cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional | +| pod_pids_limit | Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304. | null | Optional | | enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no | {% endif %} | disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional | diff --git a/autogen/main/cluster.tf.tmpl b/autogen/main/cluster.tf.tmpl index 97337c5fb2..426ba4c301 100644 --- a/autogen/main/cluster.tf.tmpl +++ b/autogen/main/cluster.tf.tmpl @@ -987,13 +987,14 @@ resource "google_container_node_pool" "windows_pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } } {% endif %} diff --git a/examples/node_pool/main.tf b/examples/node_pool/main.tf index 634a3b2965..8da1827934 100644 --- a/examples/node_pool/main.tf +++ b/examples/node_pool/main.tf @@ -79,6 +79,7 @@ module "gke" { cpu_manager_policy = "static" cpu_cfs_quota = true local_ssd_ephemeral_count = 2 + pod_pids_limit = 4096 }, { name = "pool-04" diff --git a/modules/beta-private-cluster-update-variant/README.md b/modules/beta-private-cluster-update-variant/README.md index a64513a799..ba2948a962 100644 --- a/modules/beta-private-cluster-update-variant/README.md +++ b/modules/beta-private-cluster-update-variant/README.md @@ -353,6 +353,7 @@ The node_pools variable takes the following parameters: | cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional | | cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional | | cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional | +| pod_pids_limit | Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304. | null | Optional | | enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no | | disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional | | disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional | diff --git a/modules/beta-private-cluster-update-variant/cluster.tf b/modules/beta-private-cluster-update-variant/cluster.tf index d8ba69dff4..f3f6c1d216 100644 --- a/modules/beta-private-cluster-update-variant/cluster.tf +++ b/modules/beta-private-cluster-update-variant/cluster.tf @@ -870,13 +870,14 @@ resource "google_container_node_pool" "pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } } @@ -1155,13 +1156,14 @@ resource "google_container_node_pool" "windows_pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } } diff --git a/modules/beta-private-cluster/README.md b/modules/beta-private-cluster/README.md index 1e25d4b4e8..863d39522f 100644 --- a/modules/beta-private-cluster/README.md +++ b/modules/beta-private-cluster/README.md @@ -331,6 +331,7 @@ The node_pools variable takes the following parameters: | cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional | | cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional | | cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional | +| pod_pids_limit | Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304. | null | Optional | | enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no | | disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional | | disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional | diff --git a/modules/beta-private-cluster/cluster.tf b/modules/beta-private-cluster/cluster.tf index 64d04e4b4f..dfcd012def 100644 --- a/modules/beta-private-cluster/cluster.tf +++ b/modules/beta-private-cluster/cluster.tf @@ -791,13 +791,14 @@ resource "google_container_node_pool" "pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } } @@ -1075,13 +1076,14 @@ resource "google_container_node_pool" "windows_pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } } diff --git a/modules/beta-public-cluster-update-variant/README.md b/modules/beta-public-cluster-update-variant/README.md index 07279278f5..5976e0a7c8 100644 --- a/modules/beta-public-cluster-update-variant/README.md +++ b/modules/beta-public-cluster-update-variant/README.md @@ -340,6 +340,7 @@ The node_pools variable takes the following parameters: | cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional | | cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional | | cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional | +| pod_pids_limit | Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304. | null | Optional | | enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no | | disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional | | disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional | diff --git a/modules/beta-public-cluster-update-variant/cluster.tf b/modules/beta-public-cluster-update-variant/cluster.tf index 15dbbe5c2f..60a9f80687 100644 --- a/modules/beta-public-cluster-update-variant/cluster.tf +++ b/modules/beta-public-cluster-update-variant/cluster.tf @@ -851,13 +851,14 @@ resource "google_container_node_pool" "pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } } @@ -1136,13 +1137,14 @@ resource "google_container_node_pool" "windows_pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } } diff --git a/modules/beta-public-cluster/README.md b/modules/beta-public-cluster/README.md index e57dbe6ec5..fb40bfb57d 100644 --- a/modules/beta-public-cluster/README.md +++ b/modules/beta-public-cluster/README.md @@ -318,6 +318,7 @@ The node_pools variable takes the following parameters: | cpu_manager_policy | The CPU manager policy on the node. One of "none" or "static". | "static" | Optional | | cpu_cfs_quota | Enforces the Pod's CPU limit. Setting this value to false means that the CPU limits for Pods are ignored | null | Optional | | cpu_cfs_quota_period | The CPU CFS quota period value, which specifies the period of how often a cgroup's access to CPU resources should be reallocated | null | Optional | +| pod_pids_limit | Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304. | null | Optional | | enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no | | disk_size_gb | Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB | 100 | Optional | | disk_type | Type of the disk attached to each node (e.g. 'pd-standard' or 'pd-ssd') | pd-standard | Optional | diff --git a/modules/beta-public-cluster/cluster.tf b/modules/beta-public-cluster/cluster.tf index 9b81443a80..6be429c0b6 100644 --- a/modules/beta-public-cluster/cluster.tf +++ b/modules/beta-public-cluster/cluster.tf @@ -772,13 +772,14 @@ resource "google_container_node_pool" "pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } } @@ -1056,13 +1057,14 @@ resource "google_container_node_pool" "windows_pools" { dynamic "kubelet_config" { for_each = length(setintersection( keys(each.value), - ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period"] + ["cpu_manager_policy", "cpu_cfs_quota", "cpu_cfs_quota_period", "pod_pids_limit"] )) != 0 ? [1] : [] content { cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static") cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null) cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null) + pod_pids_limit = lookup(each.value, "pod_pids_limit", null) } }