Skip to content

Commit 7bfd6fe

Browse files
mmorejonmmorejon
authored
feat!: enabling vulnerability and audit modes for workloads (#1749)
Signed-off-by: Manuel Morejon <[email protected]>
1 parent 2b48458 commit 7bfd6fe

File tree

21 files changed

+72
-13
lines changed

21 files changed

+72
-13
lines changed

‎autogen/main/variables.tf.tmpl

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -548,14 +548,15 @@ variable "enable_confidential_nodes" {
548548
description = "An optional flag to enable confidential node config."
549549
default = false
550550
}
551+
551552
variable "workload_vulnerability_mode" {
552553
description = "(beta) Vulnerability mode."
553554
type = string
554555
default = ""
555556
}
556557

557558
variable "workload_config_audit_mode" {
558-
description = "(beta) Worload config audit mode."
559+
description = "(beta) Workload config audit mode."
559560
type = string
560561
default = "DISABLED"
561562
}

‎autogen/safer-cluster/main.tf.tmpl

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,4 +200,8 @@ module "gke" {
200200
timeouts = var.timeouts
201201

202202
enable_gcfs = var.enable_gcfs
203+
204+
// Enabling vulnerability and audit for workloads
205+
workload_vulnerability_mode = var.workload_vulnerability_mode
206+
workload_config_audit_mode = var.workload_config_audit_mode
203207
}

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -496,3 +496,15 @@ variable "enable_mesh_certificates" {
496496
default = false
497497
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
498498
}
499+
500+
variable "workload_vulnerability_mode" {
501+
description = "(beta) Vulnerability mode."
502+
type = string
503+
default = ""
504+
}
505+
506+
variable "workload_config_audit_mode" {
507+
description = "(beta) Workload config audit mode."
508+
type = string
509+
default = "DISABLED"
510+
}

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ Then perform the following commands on the root folder:
134134
| subnetwork | The subnetwork to host the cluster in (required) | `string` | n/a | yes |
135135
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |
136136
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
137-
| workload\_config\_audit\_mode | (beta) Worload config audit mode. | `string` | `"DISABLED"` | no |
137+
| workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
138138
| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
139139
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | `list(string)` | `[]` | no |
140140

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,14 +373,15 @@ variable "enable_confidential_nodes" {
373373
description = "An optional flag to enable confidential node config."
374374
default = false
375375
}
376+
376377
variable "workload_vulnerability_mode" {
377378
description = "(beta) Vulnerability mode."
378379
type = string
379380
default = ""
380381
}
381382

382383
variable "workload_config_audit_mode" {
383-
description = "(beta) Worload config audit mode."
384+
description = "(beta) Workload config audit mode."
384385
type = string
385386
default = "DISABLED"
386387
}

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ Then perform the following commands on the root folder:
123123
| subnetwork | The subnetwork to host the cluster in (required) | `string` | n/a | yes |
124124
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |
125125
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
126-
| workload\_config\_audit\_mode | (beta) Worload config audit mode. | `string` | `"DISABLED"` | no |
126+
| workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
127127
| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
128128
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | `list(string)` | `[]` | no |
129129

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -343,14 +343,15 @@ variable "enable_confidential_nodes" {
343343
description = "An optional flag to enable confidential node config."
344344
default = false
345345
}
346+
346347
variable "workload_vulnerability_mode" {
347348
description = "(beta) Vulnerability mode."
348349
type = string
349350
default = ""
350351
}
351352

352353
variable "workload_config_audit_mode" {
353-
description = "(beta) Worload config audit mode."
354+
description = "(beta) Workload config audit mode."
354355
type = string
355356
default = "DISABLED"
356357
}

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,7 @@ Then perform the following commands on the root folder:
273273
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |
274274
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
275275
| windows\_node\_pools | List of maps containing Windows node pools | `list(map(string))` | `[]` | no |
276-
| workload\_config\_audit\_mode | (beta) Worload config audit mode. | `string` | `"DISABLED"` | no |
276+
| workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
277277
| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
278278
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | `list(string)` | `[]` | no |
279279

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -518,14 +518,15 @@ variable "enable_confidential_nodes" {
518518
description = "An optional flag to enable confidential node config."
519519
default = false
520520
}
521+
521522
variable "workload_vulnerability_mode" {
522523
description = "(beta) Vulnerability mode."
523524
type = string
524525
default = ""
525526
}
526527

527528
variable "workload_config_audit_mode" {
528-
description = "(beta) Worload config audit mode."
529+
description = "(beta) Workload config audit mode."
529530
type = string
530531
default = "DISABLED"
531532
}

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ Then perform the following commands on the root folder:
251251
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |
252252
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
253253
| windows\_node\_pools | List of maps containing Windows node pools | `list(map(string))` | `[]` | no |
254-
| workload\_config\_audit\_mode | (beta) Worload config audit mode. | `string` | `"DISABLED"` | no |
254+
| workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
255255
| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
256256
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | `list(string)` | `[]` | no |
257257

‎modules/beta-private-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -518,14 +518,15 @@ variable "enable_confidential_nodes" {
518518
description = "An optional flag to enable confidential node config."
519519
default = false
520520
}
521+
521522
variable "workload_vulnerability_mode" {
522523
description = "(beta) Vulnerability mode."
523524
type = string
524525
default = ""
525526
}
526527

527528
variable "workload_config_audit_mode" {
528-
description = "(beta) Worload config audit mode."
529+
description = "(beta) Workload config audit mode."
529530
type = string
530531
default = "DISABLED"
531532
}

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ Then perform the following commands on the root folder:
262262
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |
263263
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
264264
| windows\_node\_pools | List of maps containing Windows node pools | `list(map(string))` | `[]` | no |
265-
| workload\_config\_audit\_mode | (beta) Worload config audit mode. | `string` | `"DISABLED"` | no |
265+
| workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
266266
| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
267267
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | `list(string)` | `[]` | no |
268268

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -488,14 +488,15 @@ variable "enable_confidential_nodes" {
488488
description = "An optional flag to enable confidential node config."
489489
default = false
490490
}
491+
491492
variable "workload_vulnerability_mode" {
492493
description = "(beta) Vulnerability mode."
493494
type = string
494495
default = ""
495496
}
496497

497498
variable "workload_config_audit_mode" {
498-
description = "(beta) Worload config audit mode."
499+
description = "(beta) Workload config audit mode."
499500
type = string
500501
default = "DISABLED"
501502
}

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ Then perform the following commands on the root folder:
240240
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |
241241
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
242242
| windows\_node\_pools | List of maps containing Windows node pools | `list(map(string))` | `[]` | no |
243-
| workload\_config\_audit\_mode | (beta) Worload config audit mode. | `string` | `"DISABLED"` | no |
243+
| workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
244244
| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
245245
| zones | The zones to host the cluster in (optional if regional cluster / required if zonal) | `list(string)` | `[]` | no |
246246

‎modules/beta-public-cluster/variables.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -488,14 +488,15 @@ variable "enable_confidential_nodes" {
488488
description = "An optional flag to enable confidential node config."
489489
default = false
490490
}
491+
491492
variable "workload_vulnerability_mode" {
492493
description = "(beta) Vulnerability mode."
493494
type = string
494495
default = ""
495496
}
496497

497498
variable "workload_config_audit_mode" {
498-
description = "(beta) Worload config audit mode."
499+
description = "(beta) Workload config audit mode."
499500
type = string
500501
default = "DISABLED"
501502
}

‎modules/safer-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,8 @@ For simplicity, we suggest using `roles/container.admin` and
272272
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |
273273
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
274274
| windows\_node\_pools | List of maps containing node pools | `list(map(string))` | `[]` | no |
275+
| workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
276+
| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
275277
| zones | The zones to host the cluster in | `list(string)` | `[]` | no |
276278

277279
## Outputs

‎modules/safer-cluster-update-variant/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,4 +196,8 @@ module "gke" {
196196
timeouts = var.timeouts
197197

198198
enable_gcfs = var.enable_gcfs
199+
200+
// Enabling vulnerability and audit for workloads
201+
workload_vulnerability_mode = var.workload_vulnerability_mode
202+
workload_config_audit_mode = var.workload_config_audit_mode
199203
}

‎modules/safer-cluster-update-variant/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -496,3 +496,15 @@ variable "enable_mesh_certificates" {
496496
default = false
497497
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
498498
}
499+
500+
variable "workload_vulnerability_mode" {
501+
description = "(beta) Vulnerability mode."
502+
type = string
503+
default = ""
504+
}
505+
506+
variable "workload_config_audit_mode" {
507+
description = "(beta) Workload config audit mode."
508+
type = string
509+
default = "DISABLED"
510+
}

‎modules/safer-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,8 @@ For simplicity, we suggest using `roles/container.admin` and
272272
| timeouts | Timeout for cluster operations. | `map(string)` | `{}` | no |
273273
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf | `list(string)` | `[]` | no |
274274
| windows\_node\_pools | List of maps containing node pools | `list(map(string))` | `[]` | no |
275+
| workload\_config\_audit\_mode | (beta) Workload config audit mode. | `string` | `"DISABLED"` | no |
276+
| workload\_vulnerability\_mode | (beta) Vulnerability mode. | `string` | `""` | no |
275277
| zones | The zones to host the cluster in | `list(string)` | `[]` | no |
276278

277279
## Outputs

‎modules/safer-cluster/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,4 +196,8 @@ module "gke" {
196196
timeouts = var.timeouts
197197

198198
enable_gcfs = var.enable_gcfs
199+
200+
// Enabling vulnerability and audit for workloads
201+
workload_vulnerability_mode = var.workload_vulnerability_mode
202+
workload_config_audit_mode = var.workload_config_audit_mode
199203
}

‎modules/safer-cluster/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -496,3 +496,15 @@ variable "enable_mesh_certificates" {
496496
default = false
497497
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
498498
}
499+
500+
variable "workload_vulnerability_mode" {
501+
description = "(beta) Vulnerability mode."
502+
type = string
503+
default = ""
504+
}
505+
506+
variable "workload_config_audit_mode" {
507+
description = "(beta) Workload config audit mode."
508+
type = string
509+
default = "DISABLED"
510+
}

0 commit comments

Comments
 (0)