Skip to content

Commit 6069ece

Browse files
msgongoramorgante
msgongora
authored and
morgante
committed
fix: Simplified pod security policy interface.
BREAKING CHANGE: Pod security policy enablement has been changed to use a simple boolean flag (`var. enable_pod_security_policy`)
1 parent e3e5458 commit 6069ece

File tree

26 files changed

+55
-82
lines changed

26 files changed

+55
-82
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,9 +94,9 @@ resource "google_container_cluster" "primary" {
9494
}
9595

9696
dynamic "pod_security_policy_config" {
97-
for_each = var.pod_security_policy_config
97+
for_each = var.enable_pod_security_policy ? [var.enable_pod_security_policy] : []
9898
content {
99-
enabled = pod_security_policy_config.value.enabled
99+
enabled = pod_security_policy_config.value
100100
}
101101
}
102102
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -455,13 +455,10 @@ variable "enable_binary_authorization" {
455455
default = false
456456
}
457457

458-
variable "pod_security_policy_config" {
459-
type = list(object({ enabled = bool }))
458+
variable "enable_pod_security_policy" {
459+
type = bool
460460
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
461-
462-
default = [{
463-
"enabled" = false
464-
}]
461+
default = false
465462
}
466463

467464
variable "node_metadata" {

‎autogen/safer-cluster/main.tf.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -137,9 +137,9 @@ module "gke" {
137137
// We suggest to define policies about which images can run on a cluster.
138138
enable_binary_authorization = true
139139

140-
// Define PodSecurityPolicies for differnet applications.
141-
// Example: https://kubernetes.io/docs/concepts/policy/pod-security-policy/#example
142-
pod_security_policy_config = var.pod_security_policy_config
140+
// Use of PodSecurityPolicy admission controller
141+
// https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies
142+
enable_pod_security_policy = var.enable_pod_security_policy
143143

144144
resource_usage_export_dataset_id = var.resource_usage_export_dataset_id
145145

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -328,13 +328,10 @@ variable "skip_provisioners" {
328328
default = false
329329
}
330330

331-
variable "pod_security_policy_config" {
332-
type = list(object({ enabled = bool }))
331+
variable "enable_pod_security_policy" {
332+
type = bool
333333
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
334-
335-
default = [{
336-
"enabled" = true
337-
}]
334+
default = false
338335
}
339336

340337
variable "gce_pd_csi_driver" {

‎examples/simple_regional_beta/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ This example illustrates how to create a simple cluster with beta features.
1313
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key_name is the name of a CloudKMS key. | object | `<list>` | no |
1414
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. | bool | `"false"` | no |
1515
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
16+
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | bool | `"false"` | no |
1617
| gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | bool | `"false"` | no |
1718
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
1819
| ip\_range\_services | The secondary ip range to use for services | string | n/a | yes |
1920
| istio | Boolean to enable / disable Istio | string | `"true"` | no |
2021
| network | The VPC network to host the cluster in | string | n/a | yes |
2122
| node\_pools | List of maps containing node pools | list(map(string)) | `<list>` | no |
22-
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
2323
| project\_id | The project ID to host the cluster in | string | n/a | yes |
2424
| region | The region to host the cluster in | string | n/a | yes |
2525
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |

‎examples/simple_regional_beta/main.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ module "gke" {
4545
node_pools = var.node_pools
4646
database_encryption = var.database_encryption
4747
enable_binary_authorization = var.enable_binary_authorization
48-
pod_security_policy_config = var.pod_security_policy_config
48+
enable_pod_security_policy = var.enable_pod_security_policy
4949
release_channel = "REGULAR"
5050

5151
# Disable workload identity

‎examples/simple_regional_beta/variables.tf

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,10 @@ variable "enable_binary_authorization" {
106106
default = false
107107
}
108108

109-
variable "pod_security_policy_config" {
109+
variable "enable_pod_security_policy" {
110+
type = bool
110111
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
111-
default = [{
112-
"enabled" = false
113-
}]
112+
default = false
114113
}
115114

116115
variable "zones" {

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@ Then perform the following commands on the root folder:
165165
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | bool | `"false"` | no |
166166
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | bool | `"false"` | no |
167167
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | bool | `"false"` | no |
168+
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | bool | `"false"` | no |
168169
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | bool | `"false"` | no |
169170
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | bool | `"false"` | no |
170171
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | bool | `"true"` | no |
@@ -209,7 +210,6 @@ Then perform the following commands on the root folder:
209210
| node\_pools\_tags | Map of lists containing node network tags by node-pool name | map(list(string)) | `<map>` | no |
210211
| node\_pools\_taints | Map of lists containing node taints by node-pool name | object | `<map>` | no |
211212
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
212-
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | object | `<list>` | no |
213213
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
214214
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
215215
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,9 @@ resource "google_container_cluster" "primary" {
8181
}
8282

8383
dynamic "pod_security_policy_config" {
84-
for_each = var.pod_security_policy_config
84+
for_each = var.enable_pod_security_policy ? [var.enable_pod_security_policy] : []
8585
content {
86-
enabled = pod_security_policy_config.value.enabled
86+
enabled = pod_security_policy_config.value
8787
}
8888
}
8989
dynamic "master_authorized_networks_config" {

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -448,13 +448,10 @@ variable "enable_binary_authorization" {
448448
default = false
449449
}
450450

451-
variable "pod_security_policy_config" {
452-
type = list(object({ enabled = bool }))
451+
variable "enable_pod_security_policy" {
452+
type = bool
453453
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
454-
455-
default = [{
456-
"enabled" = false
457-
}]
454+
default = false
458455
}
459456

460457
variable "node_metadata" {

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ Then perform the following commands on the root folder:
143143
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | bool | `"false"` | no |
144144
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | bool | `"false"` | no |
145145
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | bool | `"false"` | no |
146+
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | bool | `"false"` | no |
146147
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | bool | `"false"` | no |
147148
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | bool | `"false"` | no |
148149
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | bool | `"true"` | no |
@@ -187,7 +188,6 @@ Then perform the following commands on the root folder:
187188
| node\_pools\_tags | Map of lists containing node network tags by node-pool name | map(list(string)) | `<map>` | no |
188189
| node\_pools\_taints | Map of lists containing node taints by node-pool name | object | `<map>` | no |
189190
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
190-
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | object | `<list>` | no |
191191
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
192192
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
193193
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,9 @@ resource "google_container_cluster" "primary" {
8181
}
8282

8383
dynamic "pod_security_policy_config" {
84-
for_each = var.pod_security_policy_config
84+
for_each = var.enable_pod_security_policy ? [var.enable_pod_security_policy] : []
8585
content {
86-
enabled = pod_security_policy_config.value.enabled
86+
enabled = pod_security_policy_config.value
8787
}
8888
}
8989
dynamic "master_authorized_networks_config" {

‎modules/beta-private-cluster/variables.tf

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -448,13 +448,10 @@ variable "enable_binary_authorization" {
448448
default = false
449449
}
450450

451-
variable "pod_security_policy_config" {
452-
type = list(object({ enabled = bool }))
451+
variable "enable_pod_security_policy" {
452+
type = bool
453453
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
454-
455-
default = [{
456-
"enabled" = false
457-
}]
454+
default = false
458455
}
459456

460457
variable "node_metadata" {

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@ Then perform the following commands on the root folder:
158158
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | bool | `"false"` | no |
159159
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | bool | `"false"` | no |
160160
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | bool | `"false"` | no |
161+
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | bool | `"false"` | no |
161162
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | bool | `"true"` | no |
162163
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"true"` | no |
163164
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
@@ -199,7 +200,6 @@ Then perform the following commands on the root folder:
199200
| node\_pools\_tags | Map of lists containing node network tags by node-pool name | map(list(string)) | `<map>` | no |
200201
| node\_pools\_taints | Map of lists containing node taints by node-pool name | object | `<map>` | no |
201202
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
202-
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | object | `<list>` | no |
203203
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
204204
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
205205
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,9 @@ resource "google_container_cluster" "primary" {
8181
}
8282

8383
dynamic "pod_security_policy_config" {
84-
for_each = var.pod_security_policy_config
84+
for_each = var.enable_pod_security_policy ? [var.enable_pod_security_policy] : []
8585
content {
86-
enabled = pod_security_policy_config.value.enabled
86+
enabled = pod_security_policy_config.value
8787
}
8888
}
8989
dynamic "master_authorized_networks_config" {

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -424,13 +424,10 @@ variable "enable_binary_authorization" {
424424
default = false
425425
}
426426

427-
variable "pod_security_policy_config" {
428-
type = list(object({ enabled = bool }))
427+
variable "enable_pod_security_policy" {
428+
type = bool
429429
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
430-
431-
default = [{
432-
"enabled" = false
433-
}]
430+
default = false
434431
}
435432

436433
variable "node_metadata" {

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ Then perform the following commands on the root folder:
136136
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | bool | `"false"` | no |
137137
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | bool | `"false"` | no |
138138
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | bool | `"false"` | no |
139+
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | bool | `"false"` | no |
139140
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | bool | `"true"` | no |
140141
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"true"` | no |
141142
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
@@ -177,7 +178,6 @@ Then perform the following commands on the root folder:
177178
| node\_pools\_tags | Map of lists containing node network tags by node-pool name | map(list(string)) | `<map>` | no |
178179
| node\_pools\_taints | Map of lists containing node taints by node-pool name | object | `<map>` | no |
179180
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list(string) | `<list>` | no |
180-
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | object | `<list>` | no |
181181
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
182182
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | string | `"null"` | no |
183183
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | bool | `"true"` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,9 @@ resource "google_container_cluster" "primary" {
8181
}
8282

8383
dynamic "pod_security_policy_config" {
84-
for_each = var.pod_security_policy_config
84+
for_each = var.enable_pod_security_policy ? [var.enable_pod_security_policy] : []
8585
content {
86-
enabled = pod_security_policy_config.value.enabled
86+
enabled = pod_security_policy_config.value
8787
}
8888
}
8989
dynamic "master_authorized_networks_config" {

‎modules/beta-public-cluster/variables.tf

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -424,13 +424,10 @@ variable "enable_binary_authorization" {
424424
default = false
425425
}
426426

427-
variable "pod_security_policy_config" {
428-
type = list(object({ enabled = bool }))
427+
variable "enable_pod_security_policy" {
428+
type = bool
429429
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
430-
431-
default = [{
432-
"enabled" = false
433-
}]
430+
default = false
434431
}
435432

436433
variable "node_metadata" {

0 commit comments

Comments
 (0)