Remove automatic subnetwork creation in GKE

[rileykarson]

resource "google_compute_network" "container_network" {
  name                    = "container-network"
  auto_create_subnetworks = false
}

+resource "google_compute_subnetwork" "container_subnetwork" {
+  name          = "container-subnetwork"
+  ip_cidr_range = "10.2.0.0/16"
+  region        = "us-central1"
+  network       = "${google_compute_network.container_network.self_link}"
+}

resource "google_container_cluster" "primary" {
  name       = "my-cluster"
  location   = "us-central1"
  network    = "${google_compute_network.container_network.name}"
+ subnetwork = "${google_compute_subnetwork.container_subnetwork.name}"
  
   ip_allocation_policy {
-    use_ip_aliases           = true
-    create_subnetwork        = true
     cluster_ipv4_cidr_block  = "10.0.0.0/16"
     services_ipv4_cidr_block = "10.1.0.0/16"
-    node_ipv4_cidr_block     = "10.2.0.0/16"
   }
}

Changes:

• ip_allocation_policy.node_ipv4_cidr_block removed
  (This controls the primary range of the created subnetwork)
• ip_allocation_policy.create_subnetwork, ip_allocation_policy.subnetwork_name removed.
• ip_allocation_policy.use_ip_aliases removed
  • Enablement is now based on ip_allocation_policy being defined
• Conflict added between node_ipv4_cidr, ip_allocation_policy

Motivation:

Mixing control planes isn't a great idea, and using create_subnetwork means that GKE is the control plane for subnetworks; it's a lot more Terraform-friendly for the all GKE subnetworks to be Terraform-managed.

With this change, configuration of subnetworks using the google_compute_subnetwork resource mirrors the Console, where GKE-created subnetworks don’t exist. node_ipv4_cidr vs node_ipv4_cidr_block is no longer confusing as node_ipv4_cidr_block is removed. Additionally, usage with Shared VPC will be more clear, as create_subnetwork does not work in those circumstances.

This change will require manual intervention on the part of users to import subnetworks that were previously manually created.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!