Skip to content

Commit 2beb720

Browse files
TheKangarooTheKangaroo
authored
feat(TPG>=4.81.0)!: add fqdn policies (#1729)
1 parent 47477d6 commit 2beb720

File tree

27 files changed

+77
-20
lines changed

27 files changed

+77
-20
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,9 @@ resource "google_container_cluster" "primary" {
208208
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
209209
{% endif %}
210210
{% endif %}
211+
{% if beta_cluster %}
212+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
213+
{% endif %}
211214
{% if autopilot_cluster %}
212215
enable_autopilot = true
213216
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -560,6 +560,12 @@ variable "workload_config_audit_mode" {
560560
type = string
561561
default = "DISABLED"
562562
}
563+
564+
variable "enable_fqdn_network_policy" {
565+
type = bool
566+
description = "Enable FQDN Network Policies on the cluster"
567+
default = null
568+
}
563569
{% endif %}
564570

565571
variable "disable_default_snat" {

‎autogen/main/versions.tf.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ terraform {
2424
required_providers {
2525
google = {
2626
source = "hashicorp/google"
27-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
27+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2828
}
2929
google-beta = {
3030
source = "hashicorp/google-beta"
31-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
31+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
3232
}
3333
kubernetes = {
3434
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ Then perform the following commands on the root folder:
8787
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
8888
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
8989
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
90+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
9091
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
9192
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
9293
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
8181
vertical_pod_autoscaling {
8282
enabled = var.enable_vertical_pod_autoscaling
8383
}
84-
enable_autopilot = true
84+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
85+
enable_autopilot = true
8586
dynamic "master_authorized_networks_config" {
8687
for_each = local.master_authorized_networks_config
8788
content {

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -386,6 +386,12 @@ variable "workload_config_audit_mode" {
386386
default = "DISABLED"
387387
}
388388

389+
variable "enable_fqdn_network_policy" {
390+
type = bool
391+
description = "Enable FQDN Network Policies on the cluster"
392+
default = null
393+
}
394+
389395
variable "disable_default_snat" {
390396
type = bool
391397
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ Then perform the following commands on the root folder:
8080
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
8181
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
8282
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
83+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
8384
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
8485
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
8586
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
8181
vertical_pod_autoscaling {
8282
enabled = var.enable_vertical_pod_autoscaling
8383
}
84-
enable_autopilot = true
84+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
85+
enable_autopilot = true
8586
dynamic "master_authorized_networks_config" {
8687
for_each = local.master_authorized_networks_config
8788
content {

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,12 @@ variable "workload_config_audit_mode" {
356356
default = "DISABLED"
357357
}
358358

359+
variable "enable_fqdn_network_policy" {
360+
type = bool
361+
description = "Enable FQDN Network Policies on the cluster"
362+
default = null
363+
}
364+
359365
variable "disable_default_snat" {
360366
type = bool
361367
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Then perform the following commands on the root folder:
192192
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
193193
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
194194
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
195+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
195196
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
196197
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
197198
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
164164
}
165165
}
166166

167-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
167+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
168+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
168169
dynamic "master_authorized_networks_config" {
169170
for_each = local.master_authorized_networks_config
170171
content {

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -531,6 +531,12 @@ variable "workload_config_audit_mode" {
531531
default = "DISABLED"
532532
}
533533

534+
variable "enable_fqdn_network_policy" {
535+
type = bool
536+
description = "Enable FQDN Network Policies on the cluster"
537+
default = null
538+
}
539+
534540
variable "disable_default_snat" {
535541
type = bool
536542
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ Then perform the following commands on the root folder:
170170
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
171171
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
172172
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
173+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
173174
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
174175
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
175176
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
164164
}
165165
}
166166

167-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
167+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
168+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
168169
dynamic "master_authorized_networks_config" {
169170
for_each = local.master_authorized_networks_config
170171
content {

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -531,6 +531,12 @@ variable "workload_config_audit_mode" {
531531
default = "DISABLED"
532532
}
533533

534+
variable "enable_fqdn_network_policy" {
535+
type = bool
536+
description = "Enable FQDN Network Policies on the cluster"
537+
default = null
538+
}
539+
534540
variable "disable_default_snat" {
535541
type = bool
536542
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@ Then perform the following commands on the root folder:
185185
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
186186
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
187187
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
188+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
188189
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
189190
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
190191
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
164164
}
165165
}
166166

167-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
167+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
168+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
168169
dynamic "master_authorized_networks_config" {
169170
for_each = local.master_authorized_networks_config
170171
content {

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,12 @@ variable "workload_config_audit_mode" {
501501
default = "DISABLED"
502502
}
503503

504+
variable "enable_fqdn_network_policy" {
505+
type = bool
506+
description = "Enable FQDN Network Policies on the cluster"
507+
default = null
508+
}
509+
504510
variable "disable_default_snat" {
505511
type = bool
506512
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@ Then perform the following commands on the root folder:
163163
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
164164
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
165165
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
166+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
166167
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
167168
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
168169
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
164164
}
165165
}
166166

167-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
167+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
168+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
168169
dynamic "master_authorized_networks_config" {
169170
for_each = local.master_authorized_networks_config
170171
content {

‎modules/beta-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,12 @@ variable "workload_config_audit_mode" {
501501
default = "DISABLED"
502502
}
503503

504+
variable "enable_fqdn_network_policy" {
505+
type = bool
506+
description = "Enable FQDN Network Policies on the cluster"
507+
default = null
508+
}
509+
504510
variable "disable_default_snat" {
505511
type = bool
506512
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

0 commit comments

Comments
 (0)