Skip to content

Commit c27c19d

Browse files
NissesSenapNissesSenap
committed
feat: Add protect_config to beta clusters
Signed-off-by: Edvin Norling <[email protected]>
1 parent db51271 commit c27c19d

File tree

23 files changed

+157
-14
lines changed

23 files changed

+157
-14
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,13 @@ resource "google_container_cluster" "primary" {
315315

316316
{% if beta_cluster %}
317317
networking_mode = "VPC_NATIVE"
318+
319+
protect_config {
320+
workload_config {
321+
audit_mode = var.protect_config.workload_config.audit_mode
322+
}
323+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
324+
}
318325
{% endif %}
319326
ip_allocation_policy {
320327
cluster_secondary_range_name = var.ip_range_pods

‎autogen/main/variables.tf.tmpl

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -760,5 +760,23 @@ variable "enable_identity_service" {
760760
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
761761
default = false
762762
}
763+
764+
variable "protect_config" {
765+
description = "(beta) Enable/Disable Protect API features for the cluster."
766+
type = object({
767+
workload_vulnerability_mode = string,
768+
workload_config = object({
769+
audit_mode = string
770+
})
771+
}
772+
)
773+
774+
default = {
775+
workload_vulnerability_mode = ""
776+
workload_config = {
777+
audit_mode = "MODE_UNSPECIFIED"
778+
}
779+
}
780+
}
763781
{% endif %}
764782
{% endif %}

‎autogen/main/versions.tf.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ terraform {
2424
required_providers {
2525
google = {
2626
source = "hashicorp/google"
27-
version = ">= 4.51.0, < 5.0"
27+
version = ">= 4.63.0, < 5.0"
2828
}
2929
google-beta = {
3030
source = "hashicorp/google-beta"
31-
version = ">= 4.51.0, < 5.0"
31+
version = ">= 4.63.0, < 5.0"
3232
}
3333
kubernetes = {
3434
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,13 @@ resource "google_container_cluster" "primary" {
128128
}
129129

130130
networking_mode = "VPC_NATIVE"
131+
132+
protect_config {
133+
workload_config {
134+
audit_mode = var.protect_config.workload_config.audit_mode
135+
}
136+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
137+
}
131138
ip_allocation_policy {
132139
cluster_secondary_range_name = var.ip_range_pods
133140
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.51.0, < 5.0"
24+
version = ">= 4.63.0, < 5.0"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.51.0, < 5.0"
28+
version = ">= 4.63.0, < 5.0"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,13 @@ resource "google_container_cluster" "primary" {
128128
}
129129

130130
networking_mode = "VPC_NATIVE"
131+
132+
protect_config {
133+
workload_config {
134+
audit_mode = var.protect_config.workload_config.audit_mode
135+
}
136+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
137+
}
131138
ip_allocation_policy {
132139
cluster_secondary_range_name = var.ip_range_pods
133140
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.51.0, < 5.0"
24+
version = ">= 4.63.0, < 5.0"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.51.0, < 5.0"
28+
version = ">= 4.63.0, < 5.0"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,7 @@ Then perform the following commands on the root folder:
247247
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
248248
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
249249
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
250+
| protect\_config | (beta) Enable/Disable Protect API features for the cluster. | <pre>object({<br> workload_vulnerability_mode = string,<br> workload_config = object({<br> audit_mode = string<br> })<br> }<br> )</pre> | <pre>{<br> "workload_config": {<br> "audit_mode": "MODE_UNSPECIFIED"<br> },<br> "workload_vulnerability_mode": ""<br>}</pre> | no |
250251
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
251252
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
252253
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,13 @@ resource "google_container_cluster" "primary" {
256256
datapath_provider = var.datapath_provider
257257

258258
networking_mode = "VPC_NATIVE"
259+
260+
protect_config {
261+
workload_config {
262+
audit_mode = var.protect_config.workload_config.audit_mode
263+
}
264+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
265+
}
259266
ip_allocation_policy {
260267
cluster_secondary_range_name = var.ip_range_pods
261268
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -719,3 +719,21 @@ variable "enable_identity_service" {
719719
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
720720
default = false
721721
}
722+
723+
variable "protect_config" {
724+
description = "(beta) Enable/Disable Protect API features for the cluster."
725+
type = object({
726+
workload_vulnerability_mode = string,
727+
workload_config = object({
728+
audit_mode = string
729+
})
730+
}
731+
)
732+
733+
default = {
734+
workload_vulnerability_mode = ""
735+
workload_config = {
736+
audit_mode = "MODE_UNSPECIFIED"
737+
}
738+
}
739+
}

‎modules/beta-private-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.51.0, < 5.0"
24+
version = ">= 4.63.0, < 5.0"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.51.0, < 5.0"
28+
version = ">= 4.63.0, < 5.0"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,7 @@ Then perform the following commands on the root folder:
225225
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
226226
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
227227
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
228+
| protect\_config | (beta) Enable/Disable Protect API features for the cluster. | <pre>object({<br> workload_vulnerability_mode = string,<br> workload_config = object({<br> audit_mode = string<br> })<br> }<br> )</pre> | <pre>{<br> "workload_config": {<br> "audit_mode": "MODE_UNSPECIFIED"<br> },<br> "workload_vulnerability_mode": ""<br>}</pre> | no |
228229
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
229230
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
230231
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,13 @@ resource "google_container_cluster" "primary" {
256256
datapath_provider = var.datapath_provider
257257

258258
networking_mode = "VPC_NATIVE"
259+
260+
protect_config {
261+
workload_config {
262+
audit_mode = var.protect_config.workload_config.audit_mode
263+
}
264+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
265+
}
259266
ip_allocation_policy {
260267
cluster_secondary_range_name = var.ip_range_pods
261268
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -719,3 +719,21 @@ variable "enable_identity_service" {
719719
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
720720
default = false
721721
}
722+
723+
variable "protect_config" {
724+
description = "(beta) Enable/Disable Protect API features for the cluster."
725+
type = object({
726+
workload_vulnerability_mode = string,
727+
workload_config = object({
728+
audit_mode = string
729+
})
730+
}
731+
)
732+
733+
default = {
734+
workload_vulnerability_mode = ""
735+
workload_config = {
736+
audit_mode = "MODE_UNSPECIFIED"
737+
}
738+
}
739+
}

‎modules/beta-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.51.0, < 5.0"
24+
version = ">= 4.63.0, < 5.0"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.51.0, < 5.0"
28+
version = ">= 4.63.0, < 5.0"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,7 @@ Then perform the following commands on the root folder:
236236
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
237237
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
238238
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
239+
| protect\_config | (beta) Enable/Disable Protect API features for the cluster. | <pre>object({<br> workload_vulnerability_mode = string,<br> workload_config = object({<br> audit_mode = string<br> })<br> }<br> )</pre> | <pre>{<br> "workload_config": {<br> "audit_mode": "MODE_UNSPECIFIED"<br> },<br> "workload_vulnerability_mode": ""<br>}</pre> | no |
239240
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
240241
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
241242
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,13 @@ resource "google_container_cluster" "primary" {
256256
datapath_provider = var.datapath_provider
257257

258258
networking_mode = "VPC_NATIVE"
259+
260+
protect_config {
261+
workload_config {
262+
audit_mode = var.protect_config.workload_config.audit_mode
263+
}
264+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
265+
}
259266
ip_allocation_policy {
260267
cluster_secondary_range_name = var.ip_range_pods
261268
services_secondary_range_name = var.ip_range_services

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -689,3 +689,21 @@ variable "enable_identity_service" {
689689
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
690690
default = false
691691
}
692+
693+
variable "protect_config" {
694+
description = "(beta) Enable/Disable Protect API features for the cluster."
695+
type = object({
696+
workload_vulnerability_mode = string,
697+
workload_config = object({
698+
audit_mode = string
699+
})
700+
}
701+
)
702+
703+
default = {
704+
workload_vulnerability_mode = ""
705+
workload_config = {
706+
audit_mode = "MODE_UNSPECIFIED"
707+
}
708+
}
709+
}

‎modules/beta-public-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.51.0, < 5.0"
24+
version = ">= 4.63.0, < 5.0"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.51.0, < 5.0"
28+
version = ">= 4.63.0, < 5.0"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,7 @@ Then perform the following commands on the root folder:
214214
| non\_masquerade\_cidrs | List of strings in CIDR notation that specify the IP address ranges that do not use IP masquerading. | `list(string)` | <pre>[<br> "10.0.0.0/8",<br> "172.16.0.0/12",<br> "192.168.0.0/16"<br>]</pre> | no |
215215
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. | `string` | `""` | no |
216216
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
217+
| protect\_config | (beta) Enable/Disable Protect API features for the cluster. | <pre>object({<br> workload_vulnerability_mode = string,<br> workload_config = object({<br> audit_mode = string<br> })<br> }<br> )</pre> | <pre>{<br> "workload_config": {<br> "audit_mode": "MODE_UNSPECIFIED"<br> },<br> "workload_vulnerability_mode": ""<br>}</pre> | no |
217218
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
218219
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
219220
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,13 @@ resource "google_container_cluster" "primary" {
256256
datapath_provider = var.datapath_provider
257257

258258
networking_mode = "VPC_NATIVE"
259+
260+
protect_config {
261+
workload_config {
262+
audit_mode = var.protect_config.workload_config.audit_mode
263+
}
264+
workload_vulnerability_mode = var.protect_config.workload_vulnerability_mode
265+
}
259266
ip_allocation_policy {
260267
cluster_secondary_range_name = var.ip_range_pods
261268
services_secondary_range_name = var.ip_range_services

‎modules/beta-public-cluster/variables.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -689,3 +689,21 @@ variable "enable_identity_service" {
689689
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
690690
default = false
691691
}
692+
693+
variable "protect_config" {
694+
description = "(beta) Enable/Disable Protect API features for the cluster."
695+
type = object({
696+
workload_vulnerability_mode = string,
697+
workload_config = object({
698+
audit_mode = string
699+
})
700+
}
701+
)
702+
703+
default = {
704+
workload_vulnerability_mode = ""
705+
workload_config = {
706+
audit_mode = "MODE_UNSPECIFIED"
707+
}
708+
}
709+
}

‎modules/beta-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.51.0, < 5.0"
24+
version = ">= 4.63.0, < 5.0"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.51.0, < 5.0"
28+
version = ">= 4.63.0, < 5.0"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

0 commit comments

Comments
 (0)