Skip to content

Commit 72cf873

Browse files
SavvasM1SavvasM1
authored
feat: Add enable_cilium_clusterwide_network_policy support (#1972)
1 parent a6210fc commit 72cf873

File tree

29 files changed

+112
-6
lines changed

29 files changed

+112
-6
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ Then perform the following commands on the root folder:
162162
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
163163
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
164164
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
165+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
165166
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
166167
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
167168
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,9 @@ resource "google_container_cluster" "primary" {
238238
{% endif %}
239239

240240
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
241+
242+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
243+
241244
{% if beta_cluster %}
242245
enable_fqdn_network_policy = var.enable_fqdn_network_policy
243246
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -592,8 +592,15 @@ variable "enable_fqdn_network_policy" {
592592
description = "Enable FQDN Network Policies on the cluster"
593593
default = null
594594
}
595+
595596
{% endif %}
596597

598+
variable "enable_cilium_clusterwide_network_policy" {
599+
type = bool
600+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
601+
default = false
602+
}
603+
597604
variable "security_posture_mode" {
598605
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
599606
type = string

‎cluster.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,9 @@ resource "google_container_cluster" "primary" {
177177
enable_tpu = var.enable_tpu
178178

179179
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
180+
181+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
182+
180183
dynamic "master_authorized_networks_config" {
181184
for_each = local.master_authorized_networks_config
182185
content {

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ Then perform the following commands on the root folder:
8888
| description | The description of the cluster | `string` | `""` | no |
8989
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
9090
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
91+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
9192
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
9293
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
9394
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,10 @@ resource "google_container_cluster" "primary" {
8585
enabled = var.enable_vertical_pod_autoscaling
8686
}
8787

88-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
88+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
89+
90+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
91+
8992
enable_fqdn_network_policy = var.enable_fqdn_network_policy
9093
enable_autopilot = true
9194
dynamic "master_authorized_networks_config" {

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,13 @@ variable "enable_fqdn_network_policy" {
399399
default = null
400400
}
401401

402+
403+
variable "enable_cilium_clusterwide_network_policy" {
404+
type = bool
405+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
406+
default = false
407+
}
408+
402409
variable "security_posture_mode" {
403410
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
404411
type = string

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ Then perform the following commands on the root folder:
8181
| description | The description of the cluster | `string` | `""` | no |
8282
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
8383
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
84+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
8485
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
8586
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
8687
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,10 @@ resource "google_container_cluster" "primary" {
8585
enabled = var.enable_vertical_pod_autoscaling
8686
}
8787

88-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
88+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
89+
90+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
91+
8992
enable_fqdn_network_policy = var.enable_fqdn_network_policy
9093
enable_autopilot = true
9194
dynamic "master_authorized_networks_config" {

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -369,6 +369,13 @@ variable "enable_fqdn_network_policy" {
369369
default = null
370370
}
371371

372+
373+
variable "enable_cilium_clusterwide_network_policy" {
374+
type = bool
375+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
376+
default = false
377+
}
378+
372379
variable "security_posture_mode" {
373380
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
374381
type = string

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,7 @@ Then perform the following commands on the root folder:
197197
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
198198
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
199199
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
200+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
200201
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
201202
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
202203
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,10 @@ resource "google_container_cluster" "primary" {
198198
}
199199
}
200200

201-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
201+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
202+
203+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
204+
202205
enable_fqdn_network_policy = var.enable_fqdn_network_policy
203206
dynamic "master_authorized_networks_config" {
204207
for_each = local.master_authorized_networks_config

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -568,6 +568,13 @@ variable "enable_fqdn_network_policy" {
568568
default = null
569569
}
570570

571+
572+
variable "enable_cilium_clusterwide_network_policy" {
573+
type = bool
574+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
575+
default = false
576+
}
577+
571578
variable "security_posture_mode" {
572579
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
573580
type = string

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,7 @@ Then perform the following commands on the root folder:
175175
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
176176
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
177177
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
178+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
178179
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
179180
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
180181
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,10 @@ resource "google_container_cluster" "primary" {
198198
}
199199
}
200200

201-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
201+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
202+
203+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
204+
202205
enable_fqdn_network_policy = var.enable_fqdn_network_policy
203206
dynamic "master_authorized_networks_config" {
204207
for_each = local.master_authorized_networks_config

‎modules/beta-private-cluster/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -568,6 +568,13 @@ variable "enable_fqdn_network_policy" {
568568
default = null
569569
}
570570

571+
572+
variable "enable_cilium_clusterwide_network_policy" {
573+
type = bool
574+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
575+
default = false
576+
}
577+
571578
variable "security_posture_mode" {
572579
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
573580
type = string

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ Then perform the following commands on the root folder:
190190
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
191191
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
192192
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
193+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
193194
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
194195
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
195196
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,10 @@ resource "google_container_cluster" "primary" {
198198
}
199199
}
200200

201-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
201+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
202+
203+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
204+
202205
enable_fqdn_network_policy = var.enable_fqdn_network_policy
203206
dynamic "master_authorized_networks_config" {
204207
for_each = local.master_authorized_networks_config

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -538,6 +538,13 @@ variable "enable_fqdn_network_policy" {
538538
default = null
539539
}
540540

541+
542+
variable "enable_cilium_clusterwide_network_policy" {
543+
type = bool
544+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
545+
default = false
546+
}
547+
541548
variable "security_posture_mode" {
542549
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
543550
type = string

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ Then perform the following commands on the root folder:
168168
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
169169
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
170170
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
171+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
171172
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
172173
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
173174
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,10 @@ resource "google_container_cluster" "primary" {
198198
}
199199
}
200200

201-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
201+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
202+
203+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
204+
202205
enable_fqdn_network_policy = var.enable_fqdn_network_policy
203206
dynamic "master_authorized_networks_config" {
204207
for_each = local.master_authorized_networks_config

‎modules/beta-public-cluster/variables.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -538,6 +538,13 @@ variable "enable_fqdn_network_policy" {
538538
default = null
539539
}
540540

541+
542+
variable "enable_cilium_clusterwide_network_policy" {
543+
type = bool
544+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
545+
default = false
546+
}
547+
541548
variable "security_posture_mode" {
542549
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
543550
type = string

‎modules/private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,7 @@ Then perform the following commands on the root folder:
191191
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
192192
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
193193
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
194+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
194195
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
195196
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
196197
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/private-cluster-update-variant/cluster.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,9 @@ resource "google_container_cluster" "primary" {
177177
enable_tpu = var.enable_tpu
178178

179179
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
180+
181+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
182+
180183
dynamic "master_authorized_networks_config" {
181184
for_each = local.master_authorized_networks_config
182185
content {

‎modules/private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -544,6 +544,12 @@ variable "enable_confidential_nodes" {
544544
default = false
545545
}
546546

547+
variable "enable_cilium_clusterwide_network_policy" {
548+
type = bool
549+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
550+
default = false
551+
}
552+
547553
variable "security_posture_mode" {
548554
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
549555
type = string

‎modules/private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ Then perform the following commands on the root folder:
169169
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
170170
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
171171
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
172+
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
172173
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
173174
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
174175
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |

‎modules/private-cluster/cluster.tf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,9 @@ resource "google_container_cluster" "primary" {
177177
enable_tpu = var.enable_tpu
178178

179179
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
180+
181+
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
182+
180183
dynamic "master_authorized_networks_config" {
181184
for_each = local.master_authorized_networks_config
182185
content {

‎modules/private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -544,6 +544,12 @@ variable "enable_confidential_nodes" {
544544
default = false
545545
}
546546

547+
variable "enable_cilium_clusterwide_network_policy" {
548+
type = bool
549+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
550+
default = false
551+
}
552+
547553
variable "security_posture_mode" {
548554
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
549555
type = string

‎variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,12 @@ variable "enable_confidential_nodes" {
514514
default = false
515515
}
516516

517+
variable "enable_cilium_clusterwide_network_policy" {
518+
type = bool
519+
description = "Enable Cilium Cluster Wide Network Policies on the cluster"
520+
default = false
521+
}
522+
517523
variable "security_posture_mode" {
518524
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
519525
type = string

0 commit comments

Comments
 (0)