GCP: add nodepool for trusted cluster

[ameukam]

Signed-off-by: Arnaud Meukam ameukam@gmail.com

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ameukam

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/terraform/k8s-infra-prow-build-trusted/OWNERS [ameukam]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-infra-ci-robot]

Ran Plan for dir: infra/gcp/terraform/k8s-infra-prow-build-trusted workspace: default

Show Output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create

Terraform will perform the following actions:

  # module.prow_build_nodepool_n4_highmem_8.google_container_node_pool.node_pool will be created
+ resource "google_container_node_pool" "node_pool" {
      + cluster                     = (sensitive value)
      + id                          = (known after apply)
      + initial_node_count          = 1
      + instance_group_urls         = (known after apply)
      + location                    = (sensitive value)
      + managed_instance_group_urls = (known after apply)
      + max_pods_per_node           = (known after apply)
      + name                        = (known after apply)
      + name_prefix                 = "trusted-pool2-"
      + node_count                  = (known after apply)
      + node_locations              = [
          + "us-central1-a",
          + "us-central1-b",
          + "us-central1-f",
        ]
      + operation                   = (known after apply)
      + project                     = "k8s-infra-prow-build-trusted"
      + version                     = (known after apply)

      + autoscaling {
          + location_policy = (known after apply)
          + max_node_count  = 6
          + min_node_count  = 1
        }

      + management {
          + auto_repair  = true
          + auto_upgrade = true
        }

      + network_config (known after apply)

      + node_config {
          + disk_size_gb      = 200
          + disk_type         = "hyperdisk-balanced"
          + effective_taints  = (known after apply)
          + guest_accelerator = (known after apply)
          + image_type        = "COS_CONTAINERD"
          + labels            = (known after apply)
          + local_ssd_count   = (known after apply)
          + logging_variant   = (known after apply)
          + machine_type      = "n4-highmem-8"
          + metadata          = {
              + "disable-legacy-endpoints" = "true"
            }
          + min_cpu_platform  = (known after apply)
          + oauth_scopes      = [
              + "https://www.googleapis.com/auth/cloud-platform",
            ]
          + preemptible       = false
          + service_account   = "gke-nodes-prow-build-trusted@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
          + spot              = false

          + confidential_nodes (known after apply)

          + gcfs_config (known after apply)

          + kubelet_config (known after apply)

          + shielded_instance_config (known after apply)

          + workload_metadata_config {
              + mode = "GKE_METADATA"
            }
        }

      + upgrade_settings (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

• ▶️ To apply this plan, comment:

  atlantis apply -d infra/gcp/terraform/k8s-infra-prow-build-trusted

• 🚮 To delete this plan and lock, click here
• 🔁 To plan this project again, comment:

  atlantis plan -d infra/gcp/terraform/k8s-infra-prow-build-trusted

Plan: 1 to add, 0 to change, 0 to destroy.

---

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock

[ameukam]

/hold
cc @BenTheElder @upodroid @xmudrii

[BenTheElder]

should we get results from the other cluster first?

[ameukam]

should we get results from the other cluster first?

Not necessarily. Throughput, IOPS and node density are not comparable. The trusted cluster has really low occupation compared to the untrusted one.