Skip to content

Commit 0c37cdc

Browse files
TheKangarooTheKangaroo
committed
feat: add fqdn policies
1 parent 6b927e5 commit 0c37cdc

File tree

23 files changed

+63
-20
lines changed

23 files changed

+63
-20
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,9 @@ resource "google_container_cluster" "primary" {
210210
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
211211
{% endif %}
212212
{% endif %}
213+
{% if beta_cluster %}
214+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
215+
{% endif %}
213216
{% if autopilot_cluster %}
214217
enable_autopilot = true
215218
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -777,6 +777,12 @@ variable "enable_l4_ilb_subsetting" {
777777
default = false
778778
}
779779

780+
variable "enable_fqdn_network_policy" {
781+
type = bool
782+
description = "Enable FQDN Network Policies on the cluster"
783+
default = false
784+
}
785+
780786
variable "sandbox_enabled" {
781787
type = bool
782788
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it)."

‎autogen/main/versions.tf.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ terraform {
2424
required_providers {
2525
google = {
2626
source = "hashicorp/google"
27-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
27+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2828
}
2929
google-beta = {
3030
source = "hashicorp/google-beta"
31-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
31+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
3232
}
3333
kubernetes = {
3434
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
8181
vertical_pod_autoscaling {
8282
enabled = var.enable_vertical_pod_autoscaling
8383
}
84-
enable_autopilot = true
84+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
85+
enable_autopilot = true
8586
dynamic "master_authorized_networks_config" {
8687
for_each = local.master_authorized_networks_config
8788
content {

‎modules/beta-autopilot-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
8181
vertical_pod_autoscaling {
8282
enabled = var.enable_vertical_pod_autoscaling
8383
}
84-
enable_autopilot = true
84+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
85+
enable_autopilot = true
8586
dynamic "master_authorized_networks_config" {
8687
for_each = local.master_authorized_networks_config
8788
content {

‎modules/beta-autopilot-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,7 @@ Then perform the following commands on the root folder:
191191
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
192192
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
193193
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
194+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
194195
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
195196
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
196197
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ resource "google_container_cluster" "primary" {
170170
}
171171
}
172172

173-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
173+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
174+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
174175
dynamic "master_authorized_networks_config" {
175176
for_each = local.master_authorized_networks_config
176177
content {

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -734,6 +734,12 @@ variable "enable_l4_ilb_subsetting" {
734734
default = false
735735
}
736736

737+
variable "enable_fqdn_network_policy" {
738+
type = bool
739+
description = "Enable FQDN Network Policies on the cluster"
740+
default = false
741+
}
742+
737743
variable "sandbox_enabled" {
738744
type = bool
739745
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it)."

‎modules/beta-private-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ Then perform the following commands on the root folder:
169169
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
170170
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
171171
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
172+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
172173
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
173174
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
174175
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ resource "google_container_cluster" "primary" {
170170
}
171171
}
172172

173-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
173+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
174+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
174175
dynamic "master_authorized_networks_config" {
175176
for_each = local.master_authorized_networks_config
176177
content {

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -734,6 +734,12 @@ variable "enable_l4_ilb_subsetting" {
734734
default = false
735735
}
736736

737+
variable "enable_fqdn_network_policy" {
738+
type = bool
739+
description = "Enable FQDN Network Policies on the cluster"
740+
default = false
741+
}
742+
737743
variable "sandbox_enabled" {
738744
type = bool
739745
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it)."

‎modules/beta-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,7 @@ Then perform the following commands on the root folder:
184184
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
185185
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
186186
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
187+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
187188
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
188189
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
189190
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ resource "google_container_cluster" "primary" {
170170
}
171171
}
172172

173-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
173+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
174+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
174175
dynamic "master_authorized_networks_config" {
175176
for_each = local.master_authorized_networks_config
176177
content {

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -704,6 +704,12 @@ variable "enable_l4_ilb_subsetting" {
704704
default = false
705705
}
706706

707+
variable "enable_fqdn_network_policy" {
708+
type = bool
709+
description = "Enable FQDN Network Policies on the cluster"
710+
default = false
711+
}
712+
707713
variable "sandbox_enabled" {
708714
type = bool
709715
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it)."

‎modules/beta-public-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ Then perform the following commands on the root folder:
162162
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
163163
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
164164
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
165+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
165166
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
166167
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
167168
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ resource "google_container_cluster" "primary" {
170170
}
171171
}
172172

173-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
173+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
174+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
174175
dynamic "master_authorized_networks_config" {
175176
for_each = local.master_authorized_networks_config
176177
content {

‎modules/beta-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -704,6 +704,12 @@ variable "enable_l4_ilb_subsetting" {
704704
default = false
705705
}
706706

707+
variable "enable_fqdn_network_policy" {
708+
type = bool
709+
description = "Enable FQDN Network Policies on the cluster"
710+
default = false
711+
}
712+
707713
variable "sandbox_enabled" {
708714
type = bool
709715
description = "(Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it)."

‎modules/beta-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

0 commit comments

Comments
 (0)