Skip to content

Commit 64411e2

Browse files
aaron-laneaaron-lane
authored
Merge pull request #163 from ingwarr/issue140
Add configuration flag for `pod_security_policy_config` #140
2 parents 797ec09 + d7b6d78 commit 64411e2

File tree

14 files changed

+59
-4
lines changed

14 files changed

+59
-4
lines changed

‎.kitchen.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ provisioner:
2323
verifier:
2424
name: terraform
2525
color: false
26+
fail_fast: false
2627

2728
platforms:
2829
- name: local

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Extending the adopted spec, each change should have a link to its corresponding
1111
### Added
1212

1313
* Add configuration flag for enable BinAuthZ Admission controller [#160]
14+
* Add configuration flag for `pod_security_policy_config` [#163]
1415
* Support for a guest accelerator in node pool configuration. [#157]
1516
* Support to scale the default node cluster. [#149]
1617
* Support for configuring the network policy provider. [#159]

‎autogen/cluster_regional.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_container_cluster" "primary" {
4343
monitoring_service = "${var.monitoring_service}"
4444

4545
{% if private_cluster %}
46-
enable_binary_authorization = "${var.enable_binary_authorization}"
46+
enable_binary_authorization = "${var.enable_binary_authorization}"
47+
pod_security_policy_config = "${var.pod_security_policy_config}"
4748
{% endif %}
4849
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4950

‎autogen/cluster_zonal.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,8 @@ resource "google_container_cluster" "zonal_primary" {
4343
monitoring_service = "${var.monitoring_service}"
4444

4545
{% if private_cluster %}
46-
enable_binary_authorization = "${var.enable_binary_authorization}"
46+
enable_binary_authorization = "${var.enable_binary_authorization}"
47+
pod_security_policy_config = "${var.pod_security_policy_config}"
4748
{% endif %}
4849
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4950

‎autogen/main.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,13 @@ locals {
139139
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
140140
}
141141

142+
{% if private_cluster %}
143+
cluster_type_output_pod_security_policy_enabled = {
144+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
145+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
146+
}
147+
148+
{% endif %}
142149
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
143150
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
144151
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -161,6 +168,9 @@ locals {
161168
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
162169
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
163170
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
171+
{% if private_cluster %}
172+
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
173+
{% endif %}
164174
}
165175

166176
/******************************************

‎autogen/outputs.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,3 +112,11 @@ output "service_account" {
112112
description = "The service account to default running nodes as if not overridden in `node_pools`."
113113
value = "${local.service_account}"
114114
}
115+
116+
{% if private_cluster %}
117+
output "pod_security_policy_enabled" {
118+
description = "Whether pod security policy is enabled"
119+
value = "${local.cluster_pod_security_policy_enabled}"
120+
}
121+
122+
{% endif %}

‎autogen/variables.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,14 @@ variable "enable_binary_authorization" {
9292
default = false
9393
}
9494

95+
variable "pod_security_policy_config" {
96+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
97+
98+
default = [{
99+
"enabled" = false
100+
}]
101+
}
102+
95103
{% endif %}
96104
variable "horizontal_pod_autoscaling" {
97105
description = "Enable horizontal pod autoscaling addon"

‎modules/private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
155155
| node\_pools\_taints | Map of lists containing node taints by node-pool name | map | `<map>` | no |
156156
| node\_version | The Kubernetes version of the node pools. Defaults kubernetes_version (master) variable and can be overridden for individual node pools by setting the `version` key on them. Must be empyty or set the same as master at cluster creation. | string | `""` | no |
157157
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | list | `<list>` | no |
158+
| pod\_security\_policy\_config | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. | list | `<list>` | no |
158159
| project\_id | The project ID to host the cluster in (required) | string | n/a | yes |
159160
| region | The region to host the cluster in (required) | string | n/a | yes |
160161
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | string | `"true"` | no |
@@ -183,6 +184,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
183184
| network\_policy\_enabled | Whether network policy enabled |
184185
| node\_pools\_names | List of node pools names |
185186
| node\_pools\_versions | List of node pools versions |
187+
| pod\_security\_policy\_enabled | Whether pod security policy is enabled |
186188
| region | Cluster region |
187189
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
188190
| type | Cluster type (regional / zonal) |

‎modules/private-cluster/cluster_regional.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
enable_binary_authorization = "${var.enable_binary_authorization}"
45+
enable_binary_authorization = "${var.enable_binary_authorization}"
46+
pod_security_policy_config = "${var.pod_security_policy_config}"
4647
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4748

4849
master_auth {

‎modules/private-cluster/cluster_zonal.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
enable_binary_authorization = "${var.enable_binary_authorization}"
45+
enable_binary_authorization = "${var.enable_binary_authorization}"
46+
pod_security_policy_config = "${var.pod_security_policy_config}"
4647
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4748

4849
master_auth {

‎modules/private-cluster/main.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,11 @@ locals {
132132
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
133133
}
134134

135+
cluster_type_output_pod_security_policy_enabled = {
136+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
137+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
138+
}
139+
135140
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
136141
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
137142
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -154,6 +159,7 @@ locals {
154159
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
155160
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
156161
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
162+
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? false : true}"
157163
}
158164

159165
/******************************************

‎modules/private-cluster/outputs.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,3 +112,9 @@ output "service_account" {
112112
description = "The service account to default running nodes as if not overridden in `node_pools`."
113113
value = "${local.service_account}"
114114
}
115+
116+
output "pod_security_policy_enabled" {
117+
description = "Whether pod security policy is enabled"
118+
value = "${local.cluster_pod_security_policy_enabled}"
119+
}
120+

‎modules/private-cluster/variables.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,14 @@ variable "enable_binary_authorization" {
9191
default = false
9292
}
9393

94+
variable "pod_security_policy_config" {
95+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
96+
97+
default = [{
98+
"enabled" = false
99+
}]
100+
}
101+
94102
variable "horizontal_pod_autoscaling" {
95103
description = "Enable horizontal pod autoscaling addon"
96104
default = true

‎outputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,3 +112,4 @@ output "service_account" {
112112
description = "The service account to default running nodes as if not overridden in `node_pools`."
113113
value = "${local.service_account}"
114114
}
115+

0 commit comments

Comments
 (0)