add shadow_firewall_rules_log_config and shadow_firewall_rules_priority validation

Author: splichy

autogen/main/firewall.tf.tmpl

@@ -155,8 +155,11 @@ resource "google_compute_firewall" "shadow_allow_pods" {
   allow { protocol = "esp" }
   allow { protocol = "ah" }
 
-  log_config {
-    metadata = "INCLUDE_ALL_METADATA"
+  dynamic "log_config" {
+    for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
+    content {
+      metadata = log_config.value.metadata
+    }
   }
 }
 
@@ -178,8 +181,11 @@ resource "google_compute_firewall" "shadow_allow_master" {
     ports    = ["10250", "443"]
   }
 
-  log_config {
-    metadata = "INCLUDE_ALL_METADATA"
+  dynamic "log_config" {
+    for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
+    content {
+      metadata = log_config.value.metadata
+    }
   }
 }
 
@@ -210,8 +216,11 @@ resource "google_compute_firewall" "shadow_allow_nodes" {
     ports    = ["1-65535"]
   }
 
-  log_config {
-    metadata = "INCLUDE_ALL_METADATA"
+  dynamic "log_config" {
+    for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
+    content {
+      metadata = log_config.value.metadata
+    }
   }
 }
 
@@ -222,7 +231,7 @@ resource "google_compute_firewall" "shadow_allow_inkubelet" {
   description = "Managed by terraform GKE module: A shadow firewall rule to match the default rule allowing worker nodes & pods communication to kubelet."
   project     = local.network_project_id
   network     = var.network
-  priority    = min(998, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 999
+  priority    = var.shadow_firewall_rules_priority - 1 # rule created by GKE robot have prio 999
   direction   = "INGRESS"
 
   source_ranges = local.pod_all_ip_ranges
@@ -234,8 +243,11 @@ resource "google_compute_firewall" "shadow_allow_inkubelet" {
     ports    = ["10255"]
   }
 
-  log_config {
-    metadata = "INCLUDE_ALL_METADATA"
+  dynamic "log_config" {
+    for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
+    content {
+      metadata = log_config.value.metadata
+    }
   }
 }
 
@@ -246,7 +258,7 @@ resource "google_compute_firewall" "shadow_deny_exkubelet" {
   description = "Managed by terraform GKE module: A shadow firewall rule to match the default deny rule to kubelet."
   project     = local.network_project_id
   network     = var.network
-  priority    = min(999, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 1000
+  priority    = var.shadow_firewall_rules_priority # rule created by GKE robot have prio 1000
   direction   = "INGRESS"
 
   source_ranges = ["0.0.0.0/0"]
@@ -257,7 +269,10 @@ resource "google_compute_firewall" "shadow_deny_exkubelet" {
     ports    = ["10255"]
   }
 
-  log_config {
-    metadata = "INCLUDE_ALL_METADATA"
+  dynamic "log_config" {
+    for_each = var.shadow_firewall_rules_log_config == null ? [] : [var.shadow_firewall_rules_log_config]
+    content {
+      metadata = log_config.value.metadata
+    }
   }
 }

autogen/main/variables.tf.tmpl

@@ -475,9 +475,23 @@ variable "add_shadow_firewall_rules" {
 }
 
 variable "shadow_firewall_rules_priority" {
-  type = number
+  type        = number
   description = "The firewall priority of GKE shadow firewall rules. The priority should be less than default firewall, which is 1000."
-  default = 999
+  default     = 999
+  validation {
+    condition     = var.shadow_firewall_rules_priority < 1000
+    error_message = "The shadow firewall rule priority must be lower than auto-created one(1000)."
+  }
+}
+
+variable "shadow_firewall_rules_log_config" {
+  type = object({
+      metadata = string
+    })
+  description = "The log_config for shadow firewall rules. You can set this variable to `null` to disable logging."
+  default = {
+    metadata = "INCLUDE_ALL_METADATA"
+  }
 }
 
 {% if beta_cluster %}