refactor: Introduce internal semver compare module (#5411)

Author: jamOne-

modules/internal/semver_compare/README.md

@@ -0,0 +1,80 @@
+<!--
+Copyright 2026 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Semver Compare Module
+
+This internal module securely performs a semantic version comparison (major.minor.patch) between a target version and a required minimum version.
+
+It safely parses inputs using native Terraform `regex()`. It evaluates up to four hierarchical components: `major`, `minor`, `patch`, and an optional GKE build number (`-gke.X`). It explicitly ignores any other suffixes (e.g., `-beta`, `+build123`) that follow the parsed components.
+
+Critically, this module implements **fail-open validation**: if the provided `current_version` cannot be resolved to a standard 3-integer format (for example, if a user specifies a Github branch name like `my-custom-feature` or a commit SHA `sha256-4c4892`), the output `is_greater_than_or_equal` evaluates to `true`. This protects the Cluster Toolkit from inadvertently blocking advanced users running fully custom artifacts.
+
+**Note on GKE Versions:** This module evaluates the `-gke.X` suffix as a post-release build number (where `1.35.0-gke.100` is strictly *greater* than `1.35.0`). This correctly maps to GKE's versioning scheme, but diverges from strict SemVer which treats hyphenated suffixes as pre-releases.
+
+## Usage
+
+You must invoke this inside a module, and usually consume it via a `lifecycle { precondition {} }` block since `module` outputs cannot be natively read from `variable { validation {} }` blocks.
+
+```hcl
+module "version_check" {
+  source          = "../../internal/semver_compare"
+  current_version = "1.35.2-gke.1269001"
+  minimum_version = "1.35.0"
+}
+
+resource "terraform_data" "feature_guard" {
+  lifecycle {
+    precondition {
+      condition     = module.version_check.is_greater_than_or_equal
+      error_message = "Your environment requires version >= 1.35.0."
+    }
+  }
+}
+```
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
+
+## Providers
+
+No providers.
+
+## Modules
+
+No modules.
+
+## Resources
+
+No resources.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_current_version"></a> [current\_version](#input\_current\_version) | The version string to evaluate (e.g. 1.35.2-gke, v0.15.2, sha256-123). | `string` | n/a | yes |
+| <a name="input_minimum_version"></a> [minimum\_version](#input\_minimum\_version) | The minimum required version (e.g. 1.35.0). | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_is_greater_than_or_equal"></a> [is\_greater\_than\_or\_equal](#output\_is\_greater\_than\_or\_equal) | True if the version meets the minimum requirement, or if the version is a non-standard custom string (fail-open). |
+| <a name="output_is_valid_semver"></a> [is\_valid\_semver](#output\_is\_valid\_semver) | True if both versions could be parsed into major.minor semantic logic. |
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

modules/internal/semver_compare/main.tf

@@ -0,0 +1,51 @@
+# Copyright 2026 "Google LLC"
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+locals {
+  # Strip leading 'v' if present
+  clean_version     = var.current_version != null ? trimprefix(var.current_version, "v") : ""
+  clean_min_version = var.minimum_version != null ? trimprefix(var.minimum_version, "v") : ""
+
+  # Regex to capture strictly major.minor.patch integers, and optionally a -gke.123 build suffix
+  version_regex = "^([0-9]+)(?:\\.([0-9]+))?(?:\\.([0-9]+))?(?:-gke\\.([0-9]+))?(?:[-+].*)?$"
+
+  # Try to parse. If it fails (e.g., 'sha256-12345'), it returns null.
+  parsed_ver = try(regex(local.version_regex, local.clean_version), null)
+  parsed_min = try(regex(local.version_regex, local.clean_min_version), null)
+
+  is_valid_current = local.parsed_ver != null
+  is_valid_min     = local.parsed_min != null
+
+  is_valid_semver = local.is_valid_current && local.is_valid_min
+
+  # Map to integers, defaulting to 0 for missing patch versions or gke build numbers
+  ver_major = local.is_valid_current ? tonumber(local.parsed_ver[0]) : 0
+  ver_minor = local.is_valid_current ? tonumber(coalesce(local.parsed_ver[1], "0")) : 0
+  ver_patch = local.is_valid_current ? tonumber(coalesce(local.parsed_ver[2], "0")) : 0
+  ver_gke   = local.is_valid_current ? tonumber(coalesce(local.parsed_ver[3], "0")) : 0
+
+  min_major = local.is_valid_min ? tonumber(local.parsed_min[0]) : 0
+  min_minor = local.is_valid_min ? tonumber(coalesce(local.parsed_min[1], "0")) : 0
+  min_patch = local.is_valid_min ? tonumber(coalesce(local.parsed_min[2], "0")) : 0
+  min_gke   = local.is_valid_min ? tonumber(coalesce(local.parsed_min[3], "0")) : 0
+
+  # Fail-open logic for custom tags
+  is_greater_than_or_equal = local.is_valid_min ? (
+    !local.is_valid_current ||
+    local.ver_major > local.min_major ||
+    (local.ver_major == local.min_major && local.ver_minor > local.min_minor) ||
+    (local.ver_major == local.min_major && local.ver_minor == local.min_minor && local.ver_patch > local.min_patch) ||
+    (local.ver_major == local.min_major && local.ver_minor == local.min_minor && local.ver_patch == local.min_patch && local.ver_gke >= local.min_gke)
+  ) : false
+}

modules/internal/semver_compare/outputs.tf

@@ -0,0 +1,23 @@
+# Copyright 2026 "Google LLC"
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+output "is_valid_semver" {
+  value       = local.is_valid_semver
+  description = "True if both versions could be parsed into major.minor semantic logic."
+}
+
+output "is_greater_than_or_equal" {
+  value       = local.is_greater_than_or_equal
+  description = "True if the version meets the minimum requirement, or if the version is a non-standard custom string (fail-open)."
+}

modules/internal/semver_compare/variables.tf

@@ -0,0 +1,28 @@
+# Copyright 2026 "Google LLC"
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+variable "current_version" {
+  type        = string
+  description = "The version string to evaluate (e.g. 1.35.2-gke, v0.15.2, sha256-123)."
+}
+
+variable "minimum_version" {
+  type        = string
+  description = "The minimum required version (e.g. 1.35.0)."
+
+  validation {
+    condition     = can(regex("^[vV]?([0-9]+)(?:\\.([0-9]+))?(?:\\.([0-9]+))?(?:-gke\\.([0-9]+))?(?:[-+].*)?$", var.minimum_version))
+    error_message = "The minimum_version must be a valid major.minor.patch[-gke.X] string."
+  }
+}

modules/internal/semver_compare/versions.tf

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_version = ">= 1.3"
+}

modules/scheduler/gke-cluster/README.md

@@ -126,6 +126,7 @@ limitations under the License.
 | Name | Source | Version |
 |------|--------|---------|
 | <a name="module_kubectl_apply"></a> [kubectl\_apply](#module\_kubectl\_apply) | ../../management/kubectl-apply | n/a |
+| <a name="module_slice_controller_version_check"></a> [slice\_controller\_version\_check](#module\_slice\_controller\_version\_check) | ../../internal/semver_compare | n/a |
 | <a name="module_workload_identity"></a> [workload\_identity](#module\_workload\_identity) | terraform-google-modules/kubernetes-engine/google//modules/workload-identity | >= 40.0 |
 
 ## Resources

modules/scheduler/gke-cluster/main.tf

@@ -79,6 +79,13 @@ locals {
   master_version = var.min_master_version != null ? var.min_master_version : data.google_container_engine_versions.version_prefix_filter.latest_master_version
 }
 
+
+module "slice_controller_version_check" {
+  source          = "../../internal/semver_compare"
+  current_version = local.master_version
+  minimum_version = "1.35.0-gke.274500"
+}
+
 resource "google_container_cluster" "gke_cluster" {
   provider = google-beta
 
@@ -299,9 +306,9 @@ resource "google_container_cluster" "gke_cluster" {
     precondition {
       condition = (
         !var.enable_slice_controller ||
-        try(tonumber(split(".", local.master_version)[0]) > 1 || (tonumber(split(".", local.master_version)[0]) == 1 && tonumber(split(".", local.master_version)[1]) >= 35), true)
+        module.slice_controller_version_check.is_greater_than_or_equal
       )
-      error_message = "The GKE Slice Controller requires a GKE version of 1.35 or higher. Please update 'version_prefix' or 'min_master_version'."
+      error_message = "The GKE Slice Controller requires a GKE version of 1.35.0-gke.274500 or higher. Please update 'version_prefix' or 'min_master_version'."
     }
   }