Skip to content

Commit 38430c4

Browse files
TheKangarooTheKangaroo
committed
feat: add fqdn policies
1 parent 6b927e5 commit 38430c4

File tree

27 files changed

+77
-20
lines changed

27 files changed

+77
-20
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,9 @@ resource "google_container_cluster" "primary" {
210210
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
211211
{% endif %}
212212
{% endif %}
213+
{% if beta_cluster %}
214+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
215+
{% endif %}
213216
{% if autopilot_cluster %}
214217
enable_autopilot = true
215218
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -553,6 +553,12 @@ variable "workload_config_audit_mode" {
553553
type = string
554554
default = "DISABLED"
555555
}
556+
557+
variable "enable_fqdn_network_policy" {
558+
type = bool
559+
description = "Enable FQDN Network Policies on the cluster"
560+
default = false
561+
}
556562
{% endif %}
557563

558564
variable "disable_default_snat" {

‎autogen/main/versions.tf.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ terraform {
2424
required_providers {
2525
google = {
2626
source = "hashicorp/google"
27-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
27+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2828
}
2929
google-beta = {
3030
source = "hashicorp/google-beta"
31-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
31+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
3232
}
3333
kubernetes = {
3434
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ Then perform the following commands on the root folder:
8686
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
8787
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
8888
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
89+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
8990
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
9091
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
9192
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
8181
vertical_pod_autoscaling {
8282
enabled = var.enable_vertical_pod_autoscaling
8383
}
84-
enable_autopilot = true
84+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
85+
enable_autopilot = true
8586
dynamic "master_authorized_networks_config" {
8687
for_each = local.master_authorized_networks_config
8788
content {

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -379,6 +379,12 @@ variable "workload_config_audit_mode" {
379379
default = "DISABLED"
380380
}
381381

382+
variable "enable_fqdn_network_policy" {
383+
type = bool
384+
description = "Enable FQDN Network Policies on the cluster"
385+
default = false
386+
}
387+
382388
variable "disable_default_snat" {
383389
type = bool
384390
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ Then perform the following commands on the root folder:
7979
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
8080
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
8181
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
82+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
8283
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
8384
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
8485
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
8181
vertical_pod_autoscaling {
8282
enabled = var.enable_vertical_pod_autoscaling
8383
}
84-
enable_autopilot = true
84+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
85+
enable_autopilot = true
8586
dynamic "master_authorized_networks_config" {
8687
for_each = local.master_authorized_networks_config
8788
content {

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -349,6 +349,12 @@ variable "workload_config_audit_mode" {
349349
default = "DISABLED"
350350
}
351351

352+
variable "enable_fqdn_network_policy" {
353+
type = bool
354+
description = "Enable FQDN Network Policies on the cluster"
355+
default = false
356+
}
357+
352358
variable "disable_default_snat" {
353359
type = bool
354360
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,7 @@ Then perform the following commands on the root folder:
191191
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
192192
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
193193
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
194+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
194195
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
195196
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
196197
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ resource "google_container_cluster" "primary" {
170170
}
171171
}
172172

173-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
173+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
174+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
174175
dynamic "master_authorized_networks_config" {
175176
for_each = local.master_authorized_networks_config
176177
content {

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -524,6 +524,12 @@ variable "workload_config_audit_mode" {
524524
default = "DISABLED"
525525
}
526526

527+
variable "enable_fqdn_network_policy" {
528+
type = bool
529+
description = "Enable FQDN Network Policies on the cluster"
530+
default = false
531+
}
532+
527533
variable "disable_default_snat" {
528534
type = bool
529535
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ Then perform the following commands on the root folder:
169169
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
170170
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
171171
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
172+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
172173
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
173174
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
174175
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ resource "google_container_cluster" "primary" {
170170
}
171171
}
172172

173-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
173+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
174+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
174175
dynamic "master_authorized_networks_config" {
175176
for_each = local.master_authorized_networks_config
176177
content {

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -524,6 +524,12 @@ variable "workload_config_audit_mode" {
524524
default = "DISABLED"
525525
}
526526

527+
variable "enable_fqdn_network_policy" {
528+
type = bool
529+
description = "Enable FQDN Network Policies on the cluster"
530+
default = false
531+
}
532+
527533
variable "disable_default_snat" {
528534
type = bool
529535
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,7 @@ Then perform the following commands on the root folder:
184184
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
185185
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
186186
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
187+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
187188
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
188189
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
189190
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ resource "google_container_cluster" "primary" {
170170
}
171171
}
172172

173-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
173+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
174+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
174175
dynamic "master_authorized_networks_config" {
175176
for_each = local.master_authorized_networks_config
176177
content {

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -494,6 +494,12 @@ variable "workload_config_audit_mode" {
494494
default = "DISABLED"
495495
}
496496

497+
variable "enable_fqdn_network_policy" {
498+
type = bool
499+
description = "Enable FQDN Network Policies on the cluster"
500+
default = false
501+
}
502+
497503
variable "disable_default_snat" {
498504
type = bool
499505
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ Then perform the following commands on the root folder:
162162
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
163163
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
164164
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
165+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
165166
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
166167
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
167168
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,8 @@ resource "google_container_cluster" "primary" {
170170
}
171171
}
172172

173-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
173+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
174+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
174175
dynamic "master_authorized_networks_config" {
175176
for_each = local.master_authorized_networks_config
176177
content {

‎modules/beta-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -494,6 +494,12 @@ variable "workload_config_audit_mode" {
494494
default = "DISABLED"
495495
}
496496

497+
variable "enable_fqdn_network_policy" {
498+
type = bool
499+
description = "Enable FQDN Network Policies on the cluster"
500+
default = false
501+
}
502+
497503
variable "disable_default_snat" {
498504
type = bool
499505
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.76.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

0 commit comments

Comments
 (0)