Skip to content

Commit 322a5ee

Browse files
DrFaust92DrFaust92
authored
feat: Make confidential_nodes GA (#1815)
Signed-off-by: drfaust92 <[email protected]>
1 parent 495623e commit 322a5ee

File tree

27 files changed

+57
-10
lines changed

27 files changed

+57
-10
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ Then perform the following commands on the root folder:
155155
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
156156
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
157157
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
158+
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
158159
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
159160
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
160161
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,14 +70,13 @@ resource "google_container_cluster" "primary" {
7070
enabled = var.enable_cost_allocation
7171
}
7272
}
73-
{% if beta_cluster %}
73+
7474
dynamic "confidential_nodes" {
7575
for_each = local.confidential_node_config
7676
content {
7777
enabled = confidential_nodes.value.enabled
7878
}
7979
}
80-
{% endif %}
8180

8281
subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"
8382

‎autogen/main/main.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,7 @@ locals {
219219
cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
220220
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
221221
}]
222+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
222223
{% if autopilot_cluster != true %}
223224
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
224225
enable_certificates = var.enable_mesh_certificates
@@ -234,7 +235,6 @@ locals {
234235
{% endif %}
235236
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
236237
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
237-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
238238

239239
# /BETA features
240240
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -544,12 +544,12 @@ variable "shadow_firewall_rules_log_config" {
544544
}
545545
}
546546

547-
{% if beta_cluster %}
548547
variable "enable_confidential_nodes" {
549548
type = bool
550549
description = "An optional flag to enable confidential node config."
551550
default = false
552551
}
552+
{% if beta_cluster %}
553553

554554
variable "workload_vulnerability_mode" {
555555
description = "(beta) Vulnerability mode."

‎cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,13 @@ resource "google_container_cluster" "primary" {
6565
}
6666
}
6767

68+
dynamic "confidential_nodes" {
69+
for_each = local.confidential_node_config
70+
content {
71+
enabled = confidential_nodes.value.enabled
72+
}
73+
}
74+
6875
subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"
6976

7077
default_snat_status {

‎main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ locals {
162162
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
163163
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
164164
}]
165+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
165166
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
166167
enable_certificates = var.enable_mesh_certificates
167168
}] : []

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ resource "google_container_cluster" "primary" {
5656
enabled = var.enable_cost_allocation
5757
}
5858
}
59+
5960
dynamic "confidential_nodes" {
6061
for_each = local.confidential_node_config
6162
content {

‎modules/beta-autopilot-private-cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,13 +121,13 @@ locals {
121121
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
122122
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
123123
}]
124+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
124125

125126
# BETA features
126127
cluster_istio_enabled = !local.cluster_output_istio_disabled
127128
cluster_dns_cache_enabled = var.dns_cache
128129
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
129130
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
130-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
131131

132132
# /BETA features
133133

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ resource "google_container_cluster" "primary" {
5656
enabled = var.enable_cost_allocation
5757
}
5858
}
59+
5960
dynamic "confidential_nodes" {
6061
for_each = local.confidential_node_config
6162
content {

‎modules/beta-autopilot-public-cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,13 +120,13 @@ locals {
120120
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
121121
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
122122
}]
123+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
123124

124125
# BETA features
125126
cluster_istio_enabled = !local.cluster_output_istio_disabled
126127
cluster_dns_cache_enabled = var.dns_cache
127128
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
128129
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
129-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
130130

131131
# /BETA features
132132

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ resource "google_container_cluster" "primary" {
6464
enabled = var.enable_cost_allocation
6565
}
6666
}
67+
6768
dynamic "confidential_nodes" {
6869
for_each = local.confidential_node_config
6970
content {

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,7 @@ locals {
181181
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
182182
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
183183
}]
184+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
184185
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
185186
enable_certificates = var.enable_mesh_certificates
186187
}] : []
@@ -191,7 +192,6 @@ locals {
191192
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
192193
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
193194
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
194-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
195195

196196
# /BETA features
197197

‎modules/beta-private-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ resource "google_container_cluster" "primary" {
6464
enabled = var.enable_cost_allocation
6565
}
6666
}
67+
6768
dynamic "confidential_nodes" {
6869
for_each = local.confidential_node_config
6970
content {

‎modules/beta-private-cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,7 @@ locals {
181181
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
182182
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
183183
}]
184+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
184185
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
185186
enable_certificates = var.enable_mesh_certificates
186187
}] : []
@@ -191,7 +192,6 @@ locals {
191192
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
192193
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
193194
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
194-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
195195

196196
# /BETA features
197197

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ resource "google_container_cluster" "primary" {
6464
enabled = var.enable_cost_allocation
6565
}
6666
}
67+
6768
dynamic "confidential_nodes" {
6869
for_each = local.confidential_node_config
6970
content {

‎modules/beta-public-cluster-update-variant/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,7 @@ locals {
180180
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
181181
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
182182
}]
183+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
183184
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
184185
enable_certificates = var.enable_mesh_certificates
185186
}] : []
@@ -190,7 +191,6 @@ locals {
190191
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
191192
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
192193
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
193-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
194194

195195
# /BETA features
196196

‎modules/beta-public-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ resource "google_container_cluster" "primary" {
6464
enabled = var.enable_cost_allocation
6565
}
6666
}
67+
6768
dynamic "confidential_nodes" {
6869
for_each = local.confidential_node_config
6970
content {

‎modules/beta-public-cluster/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,7 @@ locals {
180180
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
181181
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
182182
}]
183+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
183184
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
184185
enable_certificates = var.enable_mesh_certificates
185186
}] : []
@@ -190,7 +191,6 @@ locals {
190191
cluster_telemetry_type_is_set = var.cluster_telemetry_type != null
191192
cluster_pod_security_policy_enabled = local.cluster_output_pod_security_policy_enabled
192193
cluster_intranode_visibility_enabled = local.cluster_output_intranode_visbility_enabled
193-
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
194194

195195
# /BETA features
196196

‎modules/private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,7 @@ Then perform the following commands on the root folder:
184184
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
185185
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
186186
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
187+
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
187188
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
188189
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
189190
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |

‎modules/private-cluster-update-variant/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,13 @@ resource "google_container_cluster" "primary" {
6565
}
6666
}
6767

68+
dynamic "confidential_nodes" {
69+
for_each = local.confidential_node_config
70+
content {
71+
enabled = confidential_nodes.value.enabled
72+
}
73+
}
74+
6875
subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"
6976

7077
default_snat_status {

‎modules/private-cluster-update-variant/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@ locals {
163163
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
164164
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
165165
}]
166+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
166167
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
167168
enable_certificates = var.enable_mesh_certificates
168169
}] : []

‎modules/private-cluster-update-variant/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -513,6 +513,11 @@ variable "shadow_firewall_rules_log_config" {
513513
}
514514
}
515515

516+
variable "enable_confidential_nodes" {
517+
type = bool
518+
description = "An optional flag to enable confidential node config."
519+
default = false
520+
}
516521

517522
variable "security_posture_mode" {
518523
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."

‎modules/private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ Then perform the following commands on the root folder:
162162
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
163163
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
164164
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
165+
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
165166
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
166167
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
167168
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |

‎modules/private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,13 @@ resource "google_container_cluster" "primary" {
6565
}
6666
}
6767

68+
dynamic "confidential_nodes" {
69+
for_each = local.confidential_node_config
70+
content {
71+
enabled = confidential_nodes.value.enabled
72+
}
73+
}
74+
6875
subnetwork = "projects/${local.network_project_id}/regions/${local.region}/subnetworks/${var.subnetwork}"
6976

7077
default_snat_status {

‎modules/private-cluster/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@ locals {
163163
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
164164
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
165165
}]
166+
confidential_node_config = var.enable_confidential_nodes == true ? [{ enabled = true }] : []
166167
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
167168
enable_certificates = var.enable_mesh_certificates
168169
}] : []

‎modules/private-cluster/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -513,6 +513,11 @@ variable "shadow_firewall_rules_log_config" {
513513
}
514514
}
515515

516+
variable "enable_confidential_nodes" {
517+
type = bool
518+
description = "An optional flag to enable confidential node config."
519+
default = false
520+
}
516521

517522
variable "security_posture_mode" {
518523
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."

‎variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -483,6 +483,11 @@ variable "shadow_firewall_rules_log_config" {
483483
}
484484
}
485485

486+
variable "enable_confidential_nodes" {
487+
type = bool
488+
description = "An optional flag to enable confidential node config."
489+
default = false
490+
}
486491

487492
variable "security_posture_mode" {
488493
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."

0 commit comments

Comments
 (0)