Skip to content

Commit 75a8187

Browse files
NissesSenapNissesSenap
committed
feat: Add protect_config to beta clusters
Signed-off-by: Edvin Norling <[email protected]>
1 parent 2fe1715 commit 75a8187

File tree

22 files changed

+191
-0
lines changed

22 files changed

+191
-0
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,13 @@ resource "google_container_cluster" "primary" {
315315

316316
{% if beta_cluster %}
317317
networking_mode = "VPC_NATIVE"
318+
319+
protect_config {
320+
workload_config {
321+
audit_mode = var.protect_config.workload_config.audit_mode
322+
}
323+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
324+
}
318325
{% endif %}
319326
ip_allocation_policy {
320327
cluster_secondary_range_name = var.ip_range_pods

‎autogen/main/variables.tf.tmpl

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -766,5 +766,23 @@ variable "enable_identity_service" {
766766
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
767767
default = false
768768
}
769+
770+
variable "protect_config" {
771+
description = "(beta) Enable/Disable Protect API features for the cluster."
772+
type = object({
773+
workload_vulnerability_mode = string,
774+
workload_config = object({
775+
audit_mode = string
776+
})
777+
}
778+
)
779+
780+
default = {
781+
workload_vulnerability_mode = ""
782+
workload_config = {
783+
audit_mode = "MODE_UNSPECIFIED"
784+
}
785+
}
786+
}
769787
{% endif %}
770788
{% endif %}

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,13 @@ resource "google_container_cluster" "primary" {
128128
}
129129

130130
networking_mode = "VPC_NATIVE"
131+
132+
protect_config {
133+
workload_config {
134+
audit_mode = var.protect_config.workload_config.audit_mode
135+
}
136+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
137+
}
131138
ip_allocation_policy {
132139
cluster_secondary_range_name = var.ip_range_pods
133140
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/versions.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,19 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24+
<<<<<<< HEAD
2425
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
2526
}
2627
google-beta = {
2728
source = "hashicorp/google-beta"
2829
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
30+
=======
31+
version = ">= 4.63.0, < 5.0"
32+
}
33+
google-beta = {
34+
source = "hashicorp/google-beta"
35+
version = ">= 4.63.0, < 5.0"
36+
>>>>>>> c27c19db (feat: Add protect_config to beta clusters)
2937
}
3038
kubernetes = {
3139
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,13 @@ resource "google_container_cluster" "primary" {
128128
}
129129

130130
networking_mode = "VPC_NATIVE"
131+
132+
protect_config {
133+
workload_config {
134+
audit_mode = var.protect_config.workload_config.audit_mode
135+
}
136+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
137+
}
131138
ip_allocation_policy {
132139
cluster_secondary_range_name = var.ip_range_pods
133140
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-public-cluster/versions.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,19 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24+
<<<<<<< HEAD
2425
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
2526
}
2627
google-beta = {
2728
source = "hashicorp/google-beta"
2829
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
30+
=======
31+
version = ">= 4.63.0, < 5.0"
32+
}
33+
google-beta = {
34+
source = "hashicorp/google-beta"
35+
version = ">= 4.63.0, < 5.0"
36+
>>>>>>> c27c19db (feat: Add protect_config to beta clusters)
2937
}
3038
kubernetes = {
3139
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,7 @@ Then perform the following commands on the root folder:
247247
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
248248
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
249249
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
250+
| protect\_config | (beta) Enable/Disable Protect API features for the cluster. | <pre>object({<br> workload_vulnerability_mode = string,<br> workload_config = object({<br> audit_mode = string<br> })<br> }<br> )</pre> | <pre>{<br> "workload_config": {<br> "audit_mode": "MODE_UNSPECIFIED"<br> },<br> "workload_vulnerability_mode": ""<br>}</pre> | no |
250251
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
251252
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
252253
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,13 @@ resource "google_container_cluster" "primary" {
256256
datapath_provider = var.datapath_provider
257257

258258
networking_mode = "VPC_NATIVE"
259+
260+
protect_config {
261+
workload_config {
262+
audit_mode = var.protect_config.workload_config.audit_mode
263+
}
264+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
265+
}
259266
ip_allocation_policy {
260267
cluster_secondary_range_name = var.ip_range_pods
261268
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -725,3 +725,21 @@ variable "enable_identity_service" {
725725
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
726726
default = false
727727
}
728+
729+
variable "protect_config" {
730+
description = "(beta) Enable/Disable Protect API features for the cluster."
731+
type = object({
732+
workload_vulnerability_mode = string,
733+
workload_config = object({
734+
audit_mode = string
735+
})
736+
}
737+
)
738+
739+
default = {
740+
workload_vulnerability_mode = ""
741+
workload_config = {
742+
audit_mode = "MODE_UNSPECIFIED"
743+
}
744+
}
745+
}

‎modules/beta-private-cluster-update-variant/versions.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,19 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24+
<<<<<<< HEAD
2425
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
2526
}
2627
google-beta = {
2728
source = "hashicorp/google-beta"
2829
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
30+
=======
31+
version = ">= 4.63.0, < 5.0"
32+
}
33+
google-beta = {
34+
source = "hashicorp/google-beta"
35+
version = ">= 4.63.0, < 5.0"
36+
>>>>>>> c27c19db (feat: Add protect_config to beta clusters)
2937
}
3038
kubernetes = {
3139
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,7 @@ Then perform the following commands on the root folder:
225225
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
226226
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
227227
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
228+
| protect\_config | (beta) Enable/Disable Protect API features for the cluster. | <pre>object({<br> workload_vulnerability_mode = string,<br> workload_config = object({<br> audit_mode = string<br> })<br> }<br> )</pre> | <pre>{<br> "workload_config": {<br> "audit_mode": "MODE_UNSPECIFIED"<br> },<br> "workload_vulnerability_mode": ""<br>}</pre> | no |
228229
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
229230
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
230231
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,13 @@ resource "google_container_cluster" "primary" {
256256
datapath_provider = var.datapath_provider
257257

258258
networking_mode = "VPC_NATIVE"
259+
260+
protect_config {
261+
workload_config {
262+
audit_mode = var.protect_config.workload_config.audit_mode
263+
}
264+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
265+
}
259266
ip_allocation_policy {
260267
cluster_secondary_range_name = var.ip_range_pods
261268
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -725,3 +725,21 @@ variable "enable_identity_service" {
725725
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
726726
default = false
727727
}
728+
729+
variable "protect_config" {
730+
description = "(beta) Enable/Disable Protect API features for the cluster."
731+
type = object({
732+
workload_vulnerability_mode = string,
733+
workload_config = object({
734+
audit_mode = string
735+
})
736+
}
737+
)
738+
739+
default = {
740+
workload_vulnerability_mode = ""
741+
workload_config = {
742+
audit_mode = "MODE_UNSPECIFIED"
743+
}
744+
}
745+
}

‎modules/beta-private-cluster/versions.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,19 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24+
<<<<<<< HEAD
2425
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
2526
}
2627
google-beta = {
2728
source = "hashicorp/google-beta"
2829
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
30+
=======
31+
version = ">= 4.63.0, < 5.0"
32+
}
33+
google-beta = {
34+
source = "hashicorp/google-beta"
35+
version = ">= 4.63.0, < 5.0"
36+
>>>>>>> c27c19db (feat: Add protect_config to beta clusters)
2937
}
3038
kubernetes = {
3139
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,7 @@ Then perform the following commands on the root folder:
236236
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
237237
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
238238
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
239+
| protect\_config | (beta) Enable/Disable Protect API features for the cluster. | <pre>object({<br> workload_vulnerability_mode = string,<br> workload_config = object({<br> audit_mode = string<br> })<br> }<br> )</pre> | <pre>{<br> "workload_config": {<br> "audit_mode": "MODE_UNSPECIFIED"<br> },<br> "workload_vulnerability_mode": ""<br>}</pre> | no |
239240
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
240241
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
241242
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,13 @@ resource "google_container_cluster" "primary" {
256256
datapath_provider = var.datapath_provider
257257

258258
networking_mode = "VPC_NATIVE"
259+
260+
protect_config {
261+
workload_config {
262+
audit_mode = var.protect_config.workload_config.audit_mode
263+
}
264+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
265+
}
259266
ip_allocation_policy {
260267
cluster_secondary_range_name = var.ip_range_pods
261268
services_secondary_range_name = var.ip_range_services

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -695,3 +695,21 @@ variable "enable_identity_service" {
695695
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
696696
default = false
697697
}
698+
699+
variable "protect_config" {
700+
description = "(beta) Enable/Disable Protect API features for the cluster."
701+
type = object({
702+
workload_vulnerability_mode = string,
703+
workload_config = object({
704+
audit_mode = string
705+
})
706+
}
707+
)
708+
709+
default = {
710+
workload_vulnerability_mode = ""
711+
workload_config = {
712+
audit_mode = "MODE_UNSPECIFIED"
713+
}
714+
}
715+
}

‎modules/beta-public-cluster-update-variant/versions.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,19 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24+
<<<<<<< HEAD
2425
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
2526
}
2627
google-beta = {
2728
source = "hashicorp/google-beta"
2829
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
30+
=======
31+
version = ">= 4.63.0, < 5.0"
32+
}
33+
google-beta = {
34+
source = "hashicorp/google-beta"
35+
version = ">= 4.63.0, < 5.0"
36+
>>>>>>> c27c19db (feat: Add protect_config to beta clusters)
2937
}
3038
kubernetes = {
3139
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,7 @@ Then perform the following commands on the root folder:
214214
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
215215
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
216216
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
217+
| protect\_config | (beta) Enable/Disable Protect API features for the cluster. | <pre>object({<br> workload_vulnerability_mode = string,<br> workload_config = object({<br> audit_mode = string<br> })<br> }<br> )</pre> | <pre>{<br> "workload_config": {<br> "audit_mode": "MODE_UNSPECIFIED"<br> },<br> "workload_vulnerability_mode": ""<br>}</pre> | no |
217218
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
218219
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
219220
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,13 @@ resource "google_container_cluster" "primary" {
256256
datapath_provider = var.datapath_provider
257257

258258
networking_mode = "VPC_NATIVE"
259+
260+
protect_config {
261+
workload_config {
262+
audit_mode = var.protect_config.workload_config.audit_mode
263+
}
264+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
265+
}
259266
ip_allocation_policy {
260267
cluster_secondary_range_name = var.ip_range_pods
261268
services_secondary_range_name = var.ip_range_services

‎modules/beta-public-cluster/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -695,3 +695,21 @@ variable "enable_identity_service" {
695695
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
696696
default = false
697697
}
698+
699+
variable "protect_config" {
700+
description = "(beta) Enable/Disable Protect API features for the cluster."
701+
type = object({
702+
workload_vulnerability_mode = string,
703+
workload_config = object({
704+
audit_mode = string
705+
})
706+
}
707+
)
708+
709+
default = {
710+
workload_vulnerability_mode = ""
711+
workload_config = {
712+
audit_mode = "MODE_UNSPECIFIED"
713+
}
714+
}
715+
}

‎modules/beta-public-cluster/versions.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,19 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24+
<<<<<<< HEAD
2425
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
2526
}
2627
google-beta = {
2728
source = "hashicorp/google-beta"
2829
version = ">= 4.51.0, < 5.0, !=4.65.0, !=4.65.1"
30+
=======
31+
version = ">= 4.63.0, < 5.0"
32+
}
33+
google-beta = {
34+
source = "hashicorp/google-beta"
35+
version = ">= 4.63.0, < 5.0"
36+
>>>>>>> c27c19db (feat: Add protect_config to beta clusters)
2937
}
3038
kubernetes = {
3139
source = "hashicorp/kubernetes"

0 commit comments

Comments
 (0)