Add exclusion_end_time_behavior and update release channel maintenance window (GoogleCloudPlatform#4990)

SwarnaBharathiMantena · web-flow · commit 1003df0e8ee2 · 2025-12-12T21:49:57.000+05:30
diff --git a/community/examples/xpk-n2-filestore/xpk-n2-filestore.yaml b/community/examples/xpk-n2-filestore/xpk-n2-filestore.yaml
@@ -64,12 +64,12 @@ deployment_groups:
       - display_name: deployment-machine
         cidr_block: $(vars.authorized_cidr)
       version_prefix: "1.31."
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2024-12-01T00:00:00Z"
-        end_time: "2025-12-22T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
       enable_filestore_csi: true
     outputs: [instructions]
 
diff --git a/examples/gke-a3-ultragpu/gke-a3-ultragpu.yaml b/examples/gke-a3-ultragpu/gke-a3-ultragpu.yaml
@@ -197,12 +197,12 @@ deployment_groups:
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: $(vars.version_prefix)
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2024-12-01T00:00:00Z"
-        end_time: "2025-12-22T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   # # --- MANAGED LUSTRE ADDITIONS ---
diff --git a/examples/gke-a4/gke-a4.yaml b/examples/gke-a4/gke-a4.yaml
@@ -212,12 +212,12 @@ deployment_groups:
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: $(vars.version_prefix)
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2024-12-01T00:00:00Z"
-        end_time: "2025-12-22T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   # # --- MANAGED LUSTRE ADDITIONS ---
diff --git a/examples/gke-a4x/gke-a4x.yaml b/examples/gke-a4x/gke-a4x.yaml
@@ -218,12 +218,12 @@ deployment_groups:
       - cidr_block: $(vars.authorized_cidr)  # Allows your machine to run the kubectl command. Required for multi network setup.
         display_name: "kubectl-access-network"
       version_prefix: $(vars.version_prefix)
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2025-04-01T00:00:00Z"
-        end_time: "2026-04-10T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
       additional_networks:
         $(concat(
           [{
diff --git a/examples/gke-g4/gke-g4.yaml b/examples/gke-g4/gke-g4.yaml
@@ -144,12 +144,12 @@ deployment_groups:
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: "1.32."
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2025-08-01T00:00:00Z"
-        end_time: "2026-04-10T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   - id: g4-pool
diff --git a/examples/gke-h4d/gke-h4d.yaml b/examples/gke-h4d/gke-h4d.yaml
@@ -144,12 +144,12 @@ deployment_groups:
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: "1.32."
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2024-12-01T00:00:00Z"
-        end_time: "2025-12-22T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   - id: h4d-pool
diff --git a/examples/gke-managed-hyperdisk.yaml b/examples/gke-managed-hyperdisk.yaml
@@ -65,18 +65,18 @@ deployment_groups:
     source: modules/scheduler/gke-cluster
     use: [network, workload_service_account]
     settings:
-      release_channel: RAPID
       enable_persistent_disk_csi: true # enable Hyperdisk for the cluster
       configure_workload_identity_sa: true
       enable_private_endpoint: false  # Allows for access from authorized public IPs
       master_authorized_networks:
       - display_name: deployment-machine
         cidr_block: $(vars.authorized_cidr)
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2024-12-01T00:00:00Z"
-        end_time: "2025-12-22T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   ### Set up storage class and persistent volume claim for Hyperdisk ###
diff --git a/examples/gke-managed-lustre.yaml b/examples/gke-managed-lustre.yaml
@@ -116,18 +116,18 @@ deployment_groups:
     use: [network, workload_service_account]
     settings:
       version_prefix: $(vars.version_prefix)
-      release_channel: RAPID
       enable_managed_lustre_csi: true # Enable Managed Lustre for the cluster
       configure_workload_identity_sa: true
       enable_private_endpoint: false  # Allows for access from authorized public IPs
       master_authorized_networks:
       - display_name: kubectl-access-network
         cidr_block: $(vars.authorized_cidr)
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2025-08-01T00:00:00Z"
-        end_time: "2026-08-01T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   - id: lustre-pv
diff --git a/examples/gke-tpu-7x/gke-tpu-7x-advanced.yaml b/examples/gke-tpu-7x/gke-tpu-7x-advanced.yaml
@@ -186,12 +186,12 @@ deployment_groups:
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: "1.34.1"
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2024-12-01T00:00:00Z"
-        end_time: "2025-12-22T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   - id: workload_policy
diff --git a/examples/gke-tpu-7x/gke-tpu-7x.yaml b/examples/gke-tpu-7x/gke-tpu-7x.yaml
@@ -116,7 +116,12 @@ deployment_groups:
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: "1.34."
-      release_channel: RAPID
+      release_channel: REGULAR
+      maintenance_exclusions:
+      - name: no-minor-or-node-upgrades-indefinite
+        start_time: "2025-12-01T00:00:00Z"
+        exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   - id: workload_policy
diff --git a/examples/gke-tpu-v6/gke-tpu-v6-advanced.yaml b/examples/gke-tpu-v6/gke-tpu-v6-advanced.yaml
@@ -192,12 +192,12 @@ deployment_groups:
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: $(vars.version_prefix)
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2024-12-01T00:00:00Z"
-        end_time: "2025-12-22T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   - id: gke-tpu-v6-pool
diff --git a/examples/gke-tpu-v6/gke-tpu-v6.yaml b/examples/gke-tpu-v6/gke-tpu-v6.yaml
@@ -154,12 +154,12 @@ deployment_groups:
       # Cluster versions cannot be updated through the toolkit after creation
       # Please manage cluster version from the Google Cloud Console directly
       version_prefix: "1.32."
-      release_channel: RAPID
+      release_channel: REGULAR
       maintenance_exclusions:
       - name: no-minor-or-node-upgrades-indefinite
-        start_time: "2024-12-01T00:00:00Z"
-        end_time: "2025-12-22T00:00:00Z"
+        start_time: "2025-12-01T00:00:00Z"
         exclusion_scope: NO_MINOR_OR_NODE_UPGRADES
+        exclusion_end_time_behavior: UNTIL_END_OF_SUPPORT
     outputs: [instructions]
 
   - id: gke-tpu-v6-pool
diff --git a/modules/scheduler/gke-cluster/README.md b/modules/scheduler/gke-cluster/README.md
@@ -173,7 +173,7 @@ limitations under the License.
 | <a name="input_k8s_network_names"></a> [k8s\_network\_names](#input\_k8s\_network\_names) | Kubernetes network names details for GKE. If starting index is not specified for gvnic or rdma, it would be set to the default values. | <pre>object({<br/>    gvnic_prefix      = optional(string, "")<br/>    gvnic_start_index = optional(number, 1)<br/>    gvnic_postfix     = optional(string, "")<br/>    rdma_prefix       = optional(string, "")<br/>    rdma_start_index  = optional(number, 0)<br/>    rdma_postfix      = optional(string, "")<br/>  })</pre> | <pre>{<br/>  "gvnic_postfix": "",<br/>  "gvnic_prefix": "gvnic-",<br/>  "gvnic_start_index": 1,<br/>  "rdma_postfix": "",<br/>  "rdma_prefix": "rdma-",<br/>  "rdma_start_index": 0<br/>}</pre> | no |
 | <a name="input_k8s_service_account_name"></a> [k8s\_service\_account\_name](#input\_k8s\_service\_account\_name) | Kubernetes service account name to use with the gke cluster | `string` | `"workload-identity-k8s-sa"` | no |
 | <a name="input_labels"></a> [labels](#input\_labels) | GCE resource labels to be applied to resources. Key-value pairs. | `map(string)` | n/a | yes |
-| <a name="input_maintenance_exclusions"></a> [maintenance\_exclusions](#input\_maintenance\_exclusions) | List of maintenance exclusions. A cluster can have up to three. | <pre>list(object({<br/>    name            = string<br/>    start_time      = string<br/>    end_time        = string<br/>    exclusion_scope = string<br/>  }))</pre> | `[]` | no |
+| <a name="input_maintenance_exclusions"></a> [maintenance\_exclusions](#input\_maintenance\_exclusions) | List of maintenance exclusions. A cluster can have up to three. For each exclusion, exactly one of `end_time` or `exclusion_end_time_behavior` must be specified. If `exclusion_end_time_behavior` is used, its value must be `UNTIL_END_OF_SUPPORT`. | <pre>list(object({<br/>    name                        = string<br/>    start_time                  = string<br/>    end_time                    = optional(string)<br/>    exclusion_scope             = string<br/>    exclusion_end_time_behavior = optional(string)<br/>  }))</pre> | `[]` | no |
 | <a name="input_maintenance_start_time"></a> [maintenance\_start\_time](#input\_maintenance\_start\_time) | Start time for daily maintenance operations. Specified in GMT with `HH:MM` format. | `string` | `"09:00"` | no |
 | <a name="input_master_authorized_networks"></a> [master\_authorized\_networks](#input\_master\_authorized\_networks) | External network that can access Kubernetes master through HTTPS. Must be specified in CIDR notation. | <pre>list(object({<br/>    cidr_block   = string<br/>    display_name = string<br/>  }))</pre> | `[]` | no |
 | <a name="input_master_ipv4_cidr_block"></a> [master\_ipv4\_cidr\_block](#input\_master\_ipv4\_cidr\_block) | (Beta) The IP range in CIDR notation to use for the hosted master network. | `string` | `"172.16.0.32/28"` | no |
diff --git a/modules/scheduler/gke-cluster/main.tf b/modules/scheduler/gke-cluster/main.tf
@@ -198,7 +198,8 @@ resource "google_container_cluster" "gke_cluster" {
         start_time     = maintenance_exclusion.value.start_time
         end_time       = maintenance_exclusion.value.end_time
         exclusion_options {
-          scope = maintenance_exclusion.value.exclusion_scope
+          scope             = maintenance_exclusion.value.exclusion_scope
+          end_time_behavior = maintenance_exclusion.value.exclusion_end_time_behavior
         }
       }
     }
diff --git a/modules/scheduler/gke-cluster/variables.tf b/modules/scheduler/gke-cluster/variables.tf
@@ -104,14 +104,31 @@ variable "maintenance_start_time" {
 }
 
 variable "maintenance_exclusions" {
-  description = "List of maintenance exclusions. A cluster can have up to three."
+  description = "List of maintenance exclusions. A cluster can have up to three. For each exclusion, exactly one of `end_time` or `exclusion_end_time_behavior` must be specified. If `exclusion_end_time_behavior` is used, its value must be `UNTIL_END_OF_SUPPORT`."
   type = list(object({
-    name            = string
-    start_time      = string
-    end_time        = string
-    exclusion_scope = string
+    name                        = string
+    start_time                  = string
+    end_time                    = optional(string)
+    exclusion_scope             = string
+    exclusion_end_time_behavior = optional(string)
   }))
   default = []
+  validation {
+    condition = alltrue([
+      for x in var.maintenance_exclusions : (
+        ((x.end_time != null) != (x.exclusion_end_time_behavior != null)) &&
+        (x.end_time == null || length(trimspace(x.end_time)) > 0)
+      )
+    ])
+    error_message = "For each maintenance exclusion, exactly one of 'end_time' or 'exclusion_end_time_behavior' must be specified. If 'end_time' is provided, it cannot be an empty string."
+  }
+  validation {
+    condition = alltrue([
+      for x in var.maintenance_exclusions :
+      x.exclusion_end_time_behavior == null || x.exclusion_end_time_behavior == "UNTIL_END_OF_SUPPORT"
+    ])
+    error_message = "If specified, 'exclusion_end_time_behavior' must be 'UNTIL_END_OF_SUPPORT'."
+  }
   validation {
     condition = alltrue([
       for x in var.maintenance_exclusions :
