ansible-collections / ansible-collections/google.cloud

GKE Documentation is wrong/out of date

Open
#473 1 comment 0 reactions 0 assignees View on GitHub
stale
Dominant language
Python
Stars
105
Forks
144
Avg merge
5d 10h
Merged PRs (30d)
4

Description

##### SUMMARY
GKE Documentation is wrong

##### ISSUE TYPE
- Documentation Report

##### COMPONENT NAME
https://docs.ansible.com/ansible/latest/collections/google/cloud/gcp_container_cluster_module.html

##### ANSIBLE VERSION

```paste below
ansible [core 2.11.6]
config file = /etc/ansible/ansible.cfg
configured module search path = ['/home/johnny/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python3.10/site-packages/ansible
ansible collection location = /home/johnny/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/bin/ansible
python version = 3.10.1 (main, Dec 9 2021, 00:00:00) [GCC 11.2.1 20211203 (Red Hat 11.2.1-7)]
jinja version = 3.0.1
libyaml = True
```

In the documentation, it provides this example:

```
- name: create a cluster
google.cloud.gcp_container_cluster:
name: my-cluster
initial_node_count: 2
master_auth:
username: cluster_admin
password: my-secret-password
node_config:
machine_type: n1-standard-4
disk_size_gb: 500
location: us-central1-a
project: test_project
auth_kind: serviceaccount
service_account_file: "/tmp/auth.pem"
state: present
```

However, this will fail, as the user/pass auth was removed in 1.19+

```
TASK [gke : create a cluster] ****************************************************************************************************************************************
fatal: [localhost]: FAILED! => {"changed": false, "msg": "GCP returned error: {'error': {'code': 400, 'message': 'Basic authentication was removed for GKE cluster versions >= 1.19. The cluster cannot be created with basic authentication enabled. Instructions for choosing an alternative authentication method can be found at: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication.', 'status': 'INVALID_ARGUMENT'}}"}
```

Also, there are options on GKE that are not supported in this collection yet, such as VerticalPodAutoscaling, Workload Identity and even _not_ deleting the default node pool.

I'm having to create the cluster in one task, then tweak it in a second task, which is not ideal and causes the control plane to restart.

In Terraform, I can enable VPA and Workload Identity at the same time as the cluster creation.

Second, if you tweak the example to use

```
master_auth:
client_certificate_config:
issue_client_certificate: yes
```

Instead, it will create, but then it will delete the default node pool. This is fine, as it makes you have to use a separate node_pool resource, but nowhere in the example or documentation does it say that. The example essentially leaves you with a zero-node GKE, which is useless.

Contributor guide

Open the contributing guide

Research direction

Start with the gcp_container_cluster module documentation at the linked URL and review the shown cluster-creation example against the reported GKE 1.19+ authentication behavior. Verify the client-certificate variant and its default-node-pool result, then update the example and document the unsupported or separately required options, including VerticalPodAutoscaling and Workload Identity.

Written by the indexing model from the issue text.

Assessment

Tech stack
google-cloud, kubernetes, python
Domain
cloud, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.