Skip to content

Commit 16db390

Browse files
author
chrislovecnm
committed
Enabling two features in beta clusters
This allow pod security policies and binary authorization to be used by both beta private and beta public clusters. Previously these two features where limited to only private clusters, and this commit also removes that functionality from private clusters.
1 parent 075e9c2 commit 16db390

19 files changed

+76
-33
lines changed

‎autogen/cluster_regional.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,10 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
{% if private_cluster %}
45+
{% if beta_cluster %}
4646
enable_binary_authorization = "${var.enable_binary_authorization}"
4747
pod_security_policy_config = "${var.pod_security_policy_config}"
48-
{% endif %}
48+
{% endif %}
4949
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
5050

5151
master_auth {

‎autogen/cluster_zonal.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,11 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
{% if private_cluster %}
45+
{% if beta_cluster %}
4646
enable_binary_authorization = "${var.enable_binary_authorization}"
4747
pod_security_policy_config = "${var.pod_security_policy_config}"
48-
{% endif %}
48+
{% endif %}
49+
4950
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
5051

5152
master_auth {

‎autogen/outputs.tf

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -123,11 +123,20 @@ output "cloudrun_enabled" {
123123
description = "Whether CloudRun enabled"
124124
value = "${local.cluster_cloudrun_enabled}"
125125
}
126-
{% endif %}
127-
{% if private_cluster %}
128126

129127
output "pod_security_policy_enabled" {
130128
description = "Whether pod security policy is enabled"
131129
value = "${local.cluster_pod_security_policy_enabled}"
132130
}
131+
132+
output "pod_security_policy_enabled" {
133+
description = "Whether pod security policy is enabled"
134+
value = "${local.cluster_pod_security_policy_enabled}"
135+
}
136+
137+
output "enable_binary_authorization" {
138+
description = "Enable BinAuthZ Admission controller"
139+
value = "${local.cluster_binary_authorization_enabled}"
140+
}
141+
133142
{% endif %}

‎autogen/variables.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89-
{% if private_cluster %}
89+
{% if beta_cluster %}
9090
variable "enable_binary_authorization" {
9191
description = "Enable BinAuthZ Admission controller"
9292
default = false
@@ -99,8 +99,9 @@ variable "pod_security_policy_config" {
9999
"enabled" = false
100100
}]
101101
}
102-
103102
{% endif %}
103+
104+
104105
variable "horizontal_pod_autoscaling" {
105106
description = "Enable horizontal pod autoscaling addon"
106107
default = true

‎cluster_zonal.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45+
4546
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4647

4748
master_auth {

‎modules/beta-private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
177177
|------|-------------|
178178
| ca\_certificate | Cluster ca certificate (base64 encoded) |
179179
| cloudrun\_enabled | Whether CloudRun enabled |
180+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller |
180181
| endpoint | Cluster endpoint |
181182
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
182183
| http\_load\_balancing\_enabled | Whether http load balancing enabled |
@@ -193,6 +194,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
193194
| node\_pools\_names | List of node pools names |
194195
| node\_pools\_versions | List of node pools versions |
195196
| pod\_security\_policy\_enabled | Whether pod security policy is enabled |
197+
| pod\_security\_policy\_enabled | Whether pod security policy is enabled |
196198
| region | Cluster region |
197199
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
198200
| type | Cluster type (regional / zonal) |

‎modules/beta-private-cluster/cluster_zonal.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ resource "google_container_cluster" "zonal_primary" {
4444

4545
enable_binary_authorization = "${var.enable_binary_authorization}"
4646
pod_security_policy_config = "${var.pod_security_policy_config}"
47+
4748
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4849

4950
master_auth {

‎modules/beta-private-cluster/outputs.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,3 +127,14 @@ output "pod_security_policy_enabled" {
127127
description = "Whether pod security policy is enabled"
128128
value = "${local.cluster_pod_security_policy_enabled}"
129129
}
130+
131+
output "pod_security_policy_enabled" {
132+
description = "Whether pod security policy is enabled"
133+
value = "${local.cluster_pod_security_policy_enabled}"
134+
}
135+
136+
output "enable_binary_authorization" {
137+
description = "Enable BinAuthZ Admission controller"
138+
value = "${local.cluster_binary_authorization_enabled}"
139+
}
140+

‎modules/beta-public-cluster/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
123123
| database\_encryption | Application-layer Secrets Encryption settings. Example: database_encryption = [{ state = "ENCRYPTED", key_name = "projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key" }] | list | `<list>` | no |
124124
| description | The description of the cluster | string | `""` | no |
125125
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
126+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
126127
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |
127128
| http\_load\_balancing | Enable httpload balancer addon | string | `"true"` | no |
128129
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | string | `"0"` | no |
@@ -151,6 +152,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
151152
| node\_pools\_taints | Map of lists containing node taints by node-pool name | map | `<map>` | no |
152153
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
153154
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list | `<list>` | no |
155+
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
154156
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
155157
| region | The region to host the cluster in (required) | string | n/a | yes |
156158
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | string | `"true"` | no |
@@ -166,6 +168,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
166168
|------|-------------|
167169
| ca\_certificate | Cluster ca certificate (base64 encoded) |
168170
| cloudrun\_enabled | Whether CloudRun enabled |
171+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller |
169172
| endpoint | Cluster endpoint |
170173
| horizontal\_pod\_autoscaling\_enabled | Whether horizontal pod autoscaling enabled |
171174
| http\_load\_balancing\_enabled | Whether http load balancing enabled |
@@ -181,6 +184,8 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
181184
| network\_policy\_enabled | Whether network policy enabled |
182185
| node\_pools\_names | List of node pools names |
183186
| node\_pools\_versions | List of node pools versions |
187+
| pod\_security\_policy\_enabled | Whether pod security policy is enabled |
188+
| pod\_security\_policy\_enabled | Whether pod security policy is enabled |
184189
| region | Cluster region |
185190
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
186191
| type | Cluster type (regional / zonal) |

‎modules/beta-public-cluster/cluster_regional.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45+
enable_binary_authorization = "${var.enable_binary_authorization}"
46+
pod_security_policy_config = "${var.pod_security_policy_config}"
4547
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4648

4749
master_auth {

‎modules/beta-public-cluster/cluster_zonal.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45+
enable_binary_authorization = "${var.enable_binary_authorization}"
46+
pod_security_policy_config = "${var.pod_security_policy_config}"
47+
4548
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4649

4750
master_auth {

‎modules/beta-public-cluster/outputs.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,3 +122,19 @@ output "cloudrun_enabled" {
122122
description = "Whether CloudRun enabled"
123123
value = "${local.cluster_cloudrun_enabled}"
124124
}
125+
126+
output "pod_security_policy_enabled" {
127+
description = "Whether pod security policy is enabled"
128+
value = "${local.cluster_pod_security_policy_enabled}"
129+
}
130+
131+
output "pod_security_policy_enabled" {
132+
description = "Whether pod security policy is enabled"
133+
value = "${local.cluster_pod_security_policy_enabled}"
134+
}
135+
136+
output "enable_binary_authorization" {
137+
description = "Enable BinAuthZ Admission controller"
138+
value = "${local.cluster_binary_authorization_enabled}"
139+
}
140+

‎modules/beta-public-cluster/variables.tf

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,19 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89+
variable "enable_binary_authorization" {
90+
description = "Enable BinAuthZ Admission controller"
91+
default = false
92+
}
93+
94+
variable "pod_security_policy_config" {
95+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
96+
97+
default = [{
98+
"enabled" = false
99+
}]
100+
}
101+
89102
variable "horizontal_pod_autoscaling" {
90103
description = "Enable horizontal pod autoscaling addon"
91104
default = true

‎modules/private-cluster/README.md

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,6 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
125125
| deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | string | `"false"` | no |
126126
| description | The description of the cluster | string | `""` | no |
127127
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
128-
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
129128
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | string | `"false"` | no |
130129
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | string | `"false"` | no |
131130
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |
@@ -156,7 +155,6 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
156155
| node\_pools\_taints | Map of lists containing node taints by node-pool name | map | `<map>` | no |
157156
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
158157
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list | `<list>` | no |
159-
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
160158
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
161159
| region | The region to host the cluster in (required) | string | n/a | yes |
162160
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | string | `"true"` | no |
@@ -185,7 +183,6 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
185183
| network\_policy\_enabled | Whether network policy enabled |
186184
| node\_pools\_names | List of node pools names |
187185
| node\_pools\_versions | List of node pools versions |
188-
| pod\_security\_policy\_enabled | Whether pod security policy is enabled |
189186
| region | Cluster region |
190187
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
191188
| type | Cluster type (regional / zonal) |

‎modules/private-cluster/cluster_regional.tf

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,6 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
enable_binary_authorization = "${var.enable_binary_authorization}"
46-
pod_security_policy_config = "${var.pod_security_policy_config}"
4745
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4846

4947
master_auth {

‎modules/private-cluster/cluster_zonal.tf

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,7 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
enable_binary_authorization = "${var.enable_binary_authorization}"
46-
pod_security_policy_config = "${var.pod_security_policy_config}"
45+
4746
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4847

4948
master_auth {

‎modules/private-cluster/outputs.tf

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,3 @@ output "service_account" {
112112
description = "The service account to default running nodes as if not overridden in `node_pools`."
113113
value = "${local.service_account}"
114114
}
115-
116-
output "pod_security_policy_enabled" {
117-
description = "Whether pod security policy is enabled"
118-
value = "${local.cluster_pod_security_policy_enabled}"
119-
}

‎modules/private-cluster/variables.tf

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -86,19 +86,6 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89-
variable "enable_binary_authorization" {
90-
description = "Enable BinAuthZ Admission controller"
91-
default = false
92-
}
93-
94-
variable "pod_security_policy_config" {
95-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
96-
97-
default = [{
98-
"enabled" = false
99-
}]
100-
}
101-
10289
variable "horizontal_pod_autoscaling" {
10390
description = "Enable horizontal pod autoscaling addon"
10491
default = true

‎variables.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,8 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89+
90+
8991
variable "horizontal_pod_autoscaling" {
9092
description = "Enable horizontal pod autoscaling addon"
9193
default = true

0 commit comments

Comments
 (0)