Skip to content

Commit 5d959a6

Browse files
mmorejonmmorejon
authored
feat: add security posture (#1750)
Signed-off-by: Manuel Morejon <[email protected]>
1 parent f43a241 commit 5d959a6

File tree

37 files changed

+250
-0
lines changed

37 files changed

+250
-0
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,8 @@ Then perform the following commands on the root folder:
212212
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
213213
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
214214
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
215+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
216+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
215217
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
216218
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
217219
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,12 @@ resource "google_container_cluster" "primary" {
335335
workload_vulnerability_mode = var.workload_vulnerability_mode
336336
}
337337
{% endif %}
338+
339+
security_posture_config {
340+
mode = var.security_posture_mode
341+
vulnerability_mode = var.security_posture_vulnerability_mode
342+
}
343+
338344
ip_allocation_policy {
339345
cluster_secondary_range_name = var.ip_range_pods
340346
services_secondary_range_name = var.ip_range_services

‎autogen/main/variables.tf.tmpl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -568,6 +568,18 @@ variable "enable_fqdn_network_policy" {
568568
}
569569
{% endif %}
570570

571+
variable "security_posture_mode" {
572+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
573+
type = string
574+
default = "DISABLED"
575+
}
576+
577+
variable "security_posture_vulnerability_mode" {
578+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
579+
type = string
580+
default = "VULNERABILITY_DISABLED"
581+
}
582+
571583
variable "disable_default_snat" {
572584
type = bool
573585
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎autogen/safer-cluster/main.tf.tmpl

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,4 +204,8 @@ module "gke" {
204204
// Enabling vulnerability and audit for workloads
205205
workload_vulnerability_mode = var.workload_vulnerability_mode
206206
workload_config_audit_mode = var.workload_config_audit_mode
207+
208+
// Enabling security posture
209+
security_posture_mode = var.security_posture_mode
210+
security_posture_vulnerability_mode = var.security_posture_vulnerability_mode
207211
}

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,18 @@ variable "gke_backup_agent_config" {
463463
default = false
464464
}
465465

466+
variable "security_posture_mode" {
467+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
468+
type = string
469+
default = "DISABLED"
470+
}
471+
472+
variable "security_posture_vulnerability_mode" {
473+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`."
474+
type = string
475+
default = null
476+
}
477+
466478
variable "disable_default_snat" {
467479
type = bool
468480
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎cluster.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,12 @@ resource "google_container_cluster" "primary" {
211211

212212
datapath_provider = var.datapath_provider
213213

214+
215+
security_posture_config {
216+
mode = var.security_posture_mode
217+
vulnerability_mode = var.security_posture_vulnerability_mode
218+
}
219+
214220
ip_allocation_policy {
215221
cluster_secondary_range_name = var.ip_range_pods
216222
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ Then perform the following commands on the root folder:
126126
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
127127
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
128128
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
129+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
130+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
129131
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
130132
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
131133
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,12 @@ resource "google_container_cluster" "primary" {
136136
}
137137
workload_vulnerability_mode = var.workload_vulnerability_mode
138138
}
139+
140+
security_posture_config {
141+
mode = var.security_posture_mode
142+
vulnerability_mode = var.security_posture_vulnerability_mode
143+
}
144+
139145
ip_allocation_policy {
140146
cluster_secondary_range_name = var.ip_range_pods
141147
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -392,6 +392,18 @@ variable "enable_fqdn_network_policy" {
392392
default = null
393393
}
394394

395+
variable "security_posture_mode" {
396+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
397+
type = string
398+
default = "DISABLED"
399+
}
400+
401+
variable "security_posture_vulnerability_mode" {
402+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
403+
type = string
404+
default = "VULNERABILITY_DISABLED"
405+
}
406+
395407
variable "disable_default_snat" {
396408
type = bool
397409
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,8 @@ Then perform the following commands on the root folder:
115115
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
116116
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
117117
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
118+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
119+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
118120
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
119121
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
120122
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,12 @@ resource "google_container_cluster" "primary" {
136136
}
137137
workload_vulnerability_mode = var.workload_vulnerability_mode
138138
}
139+
140+
security_posture_config {
141+
mode = var.security_posture_mode
142+
vulnerability_mode = var.security_posture_vulnerability_mode
143+
}
144+
139145
ip_allocation_policy {
140146
cluster_secondary_range_name = var.ip_range_pods
141147
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -362,6 +362,18 @@ variable "enable_fqdn_network_policy" {
362362
default = null
363363
}
364364

365+
variable "security_posture_mode" {
366+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
367+
type = string
368+
default = "DISABLED"
369+
}
370+
371+
variable "security_posture_vulnerability_mode" {
372+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
373+
type = string
374+
default = "VULNERABILITY_DISABLED"
375+
}
376+
365377
variable "disable_default_snat" {
366378
type = bool
367379
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,8 @@ Then perform the following commands on the root folder:
264264
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
265265
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
266266
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
267+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
268+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
267269
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
268270
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
269271
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,12 @@ resource "google_container_cluster" "primary" {
269269
}
270270
workload_vulnerability_mode = var.workload_vulnerability_mode
271271
}
272+
273+
security_posture_config {
274+
mode = var.security_posture_mode
275+
vulnerability_mode = var.security_posture_vulnerability_mode
276+
}
277+
272278
ip_allocation_policy {
273279
cluster_secondary_range_name = var.ip_range_pods
274280
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,18 @@ variable "enable_fqdn_network_policy" {
537537
default = null
538538
}
539539

540+
variable "security_posture_mode" {
541+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
542+
type = string
543+
default = "DISABLED"
544+
}
545+
546+
variable "security_posture_vulnerability_mode" {
547+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
548+
type = string
549+
default = "VULNERABILITY_DISABLED"
550+
}
551+
540552
variable "disable_default_snat" {
541553
type = bool
542554
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,8 @@ Then perform the following commands on the root folder:
242242
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
243243
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
244244
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
245+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
246+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
245247
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
246248
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
247249
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,12 @@ resource "google_container_cluster" "primary" {
269269
}
270270
workload_vulnerability_mode = var.workload_vulnerability_mode
271271
}
272+
273+
security_posture_config {
274+
mode = var.security_posture_mode
275+
vulnerability_mode = var.security_posture_vulnerability_mode
276+
}
277+
272278
ip_allocation_policy {
273279
cluster_secondary_range_name = var.ip_range_pods
274280
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -537,6 +537,18 @@ variable "enable_fqdn_network_policy" {
537537
default = null
538538
}
539539

540+
variable "security_posture_mode" {
541+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
542+
type = string
543+
default = "DISABLED"
544+
}
545+
546+
variable "security_posture_vulnerability_mode" {
547+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
548+
type = string
549+
default = "VULNERABILITY_DISABLED"
550+
}
551+
540552
variable "disable_default_snat" {
541553
type = bool
542554
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,8 @@ Then perform the following commands on the root folder:
253253
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
254254
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
255255
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
256+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
257+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
256258
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
257259
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
258260
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,12 @@ resource "google_container_cluster" "primary" {
269269
}
270270
workload_vulnerability_mode = var.workload_vulnerability_mode
271271
}
272+
273+
security_posture_config {
274+
mode = var.security_posture_mode
275+
vulnerability_mode = var.security_posture_vulnerability_mode
276+
}
277+
272278
ip_allocation_policy {
273279
cluster_secondary_range_name = var.ip_range_pods
274280
services_secondary_range_name = var.ip_range_services

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -507,6 +507,18 @@ variable "enable_fqdn_network_policy" {
507507
default = null
508508
}
509509

510+
variable "security_posture_mode" {
511+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
512+
type = string
513+
default = "DISABLED"
514+
}
515+
516+
variable "security_posture_vulnerability_mode" {
517+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
518+
type = string
519+
default = "VULNERABILITY_DISABLED"
520+
}
521+
510522
variable "disable_default_snat" {
511523
type = bool
512524
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

0 commit comments

Comments
 (0)