Skip to content

Commit d47c2dc

Browse files
splichysplichy
committed
autogen
1 parent a404d99 commit d47c2dc

File tree

18 files changed

+477
-36
lines changed

18 files changed

+477
-36
lines changed

‎firewall.tf

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,12 @@ resource "google_compute_firewall" "intra_egress" {
3434
direction = "EGRESS"
3535

3636
target_tags = [local.cluster_network_tag]
37-
destination_ranges = [
37+
destination_ranges = concat([
3838
local.cluster_endpoint_for_nodes,
3939
local.cluster_subnet_cidr,
40-
local.cluster_alias_ranges_cidr[var.ip_range_pods],
41-
]
40+
],
41+
local.pod_all_ip_ranges
42+
)
4243

4344
# Allow all possible protocols
4445
allow { protocol = "tcp" }
@@ -99,7 +100,7 @@ resource "google_compute_firewall" "shadow_allow_pods" {
99100
priority = var.shadow_firewall_rules_priority
100101
direction = "INGRESS"
101102

102-
source_ranges = [local.cluster_alias_ranges_cidr[var.ip_range_pods]]
103+
source_ranges = local.pod_all_ip_ranges
103104
target_tags = [local.cluster_network_tag]
104105

105106
# Allow all possible protocols
@@ -169,3 +170,50 @@ resource "google_compute_firewall" "shadow_allow_nodes" {
169170
metadata = "INCLUDE_ALL_METADATA"
170171
}
171172
}
173+
174+
resource "google_compute_firewall" "shadow_allow_inkubelet" {
175+
count = var.add_shadow_firewall_rules ? 1 : 0
176+
177+
name = "gke-shadow-${substr(var.name, 0, min(25, length(var.name)))}-inkubelet"
178+
description = "Managed by terraform GKE module: A shadow firewall rule to match the default rule allowing worker nodes & pods communication to kubelet."
179+
project = local.network_project_id
180+
network = var.network
181+
priority = min(998, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 999
182+
direction = "INGRESS"
183+
184+
source_ranges = local.pod_all_ip_ranges
185+
source_tags = [local.cluster_network_tag]
186+
target_tags = [local.cluster_network_tag]
187+
188+
allow {
189+
protocol = "tcp"
190+
ports = ["10255"]
191+
}
192+
193+
log_config {
194+
metadata = "INCLUDE_ALL_METADATA"
195+
}
196+
}
197+
198+
resource "google_compute_firewall" "shadow_deny_exkubelet" {
199+
count = var.add_shadow_firewall_rules ? 1 : 0
200+
201+
name = "gke-shadow-${substr(var.name, 0, min(25, length(var.name)))}-exkubelet"
202+
description = "Managed by terraform GKE module: A shadow firewall rule to match the default deny rule to kubelet."
203+
project = local.network_project_id
204+
network = var.network
205+
priority = min(999, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 1000
206+
direction = "INGRESS"
207+
208+
source_ranges = ["0.0.0.0/0"]
209+
target_tags = [local.cluster_network_tag]
210+
211+
deny {
212+
protocol = "tcp"
213+
ports = ["10255"]
214+
}
215+
216+
log_config {
217+
metadata = "INCLUDE_ALL_METADATA"
218+
}
219+
}

‎main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ locals {
7373

7474
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
7575
cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
76+
pod_all_ip_ranges = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
7677

7778
cluster_network_policy = var.network_policy ? [{
7879
enabled = true

‎modules/beta-autopilot-private-cluster/firewall.tf

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,12 @@ resource "google_compute_firewall" "intra_egress" {
3434
direction = "EGRESS"
3535

3636
target_tags = [local.cluster_network_tag]
37-
destination_ranges = [
37+
destination_ranges = concat([
3838
local.cluster_endpoint_for_nodes,
3939
local.cluster_subnet_cidr,
40-
local.cluster_alias_ranges_cidr[var.ip_range_pods],
41-
]
40+
],
41+
local.pod_all_ip_ranges
42+
)
4243

4344
# Allow all possible protocols
4445
allow { protocol = "tcp" }
@@ -126,7 +127,7 @@ resource "google_compute_firewall" "shadow_allow_pods" {
126127
priority = var.shadow_firewall_rules_priority
127128
direction = "INGRESS"
128129

129-
source_ranges = [local.cluster_alias_ranges_cidr[var.ip_range_pods]]
130+
source_ranges = local.pod_all_ip_ranges
130131
target_tags = [local.cluster_network_tag]
131132

132133
# Allow all possible protocols
@@ -196,3 +197,50 @@ resource "google_compute_firewall" "shadow_allow_nodes" {
196197
metadata = "INCLUDE_ALL_METADATA"
197198
}
198199
}
200+
201+
resource "google_compute_firewall" "shadow_allow_inkubelet" {
202+
count = var.add_shadow_firewall_rules ? 1 : 0
203+
204+
name = "gke-shadow-${substr(var.name, 0, min(25, length(var.name)))}-inkubelet"
205+
description = "Managed by terraform GKE module: A shadow firewall rule to match the default rule allowing worker nodes & pods communication to kubelet."
206+
project = local.network_project_id
207+
network = var.network
208+
priority = min(998, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 999
209+
direction = "INGRESS"
210+
211+
source_ranges = local.pod_all_ip_ranges
212+
source_tags = [local.cluster_network_tag]
213+
target_tags = [local.cluster_network_tag]
214+
215+
allow {
216+
protocol = "tcp"
217+
ports = ["10255"]
218+
}
219+
220+
log_config {
221+
metadata = "INCLUDE_ALL_METADATA"
222+
}
223+
}
224+
225+
resource "google_compute_firewall" "shadow_deny_exkubelet" {
226+
count = var.add_shadow_firewall_rules ? 1 : 0
227+
228+
name = "gke-shadow-${substr(var.name, 0, min(25, length(var.name)))}-exkubelet"
229+
description = "Managed by terraform GKE module: A shadow firewall rule to match the default deny rule to kubelet."
230+
project = local.network_project_id
231+
network = var.network
232+
priority = min(999, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 1000
233+
direction = "INGRESS"
234+
235+
source_ranges = ["0.0.0.0/0"]
236+
target_tags = [local.cluster_network_tag]
237+
238+
deny {
239+
protocol = "tcp"
240+
ports = ["10255"]
241+
}
242+
243+
log_config {
244+
metadata = "INCLUDE_ALL_METADATA"
245+
}
246+
}

‎modules/beta-autopilot-private-cluster/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ locals {
6060

6161
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
6262
cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
63+
pod_all_ip_ranges = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
6364

6465

6566
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{

‎modules/beta-autopilot-public-cluster/firewall.tf

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,12 @@ resource "google_compute_firewall" "intra_egress" {
3434
direction = "EGRESS"
3535

3636
target_tags = [local.cluster_network_tag]
37-
destination_ranges = [
37+
destination_ranges = concat([
3838
local.cluster_endpoint_for_nodes,
3939
local.cluster_subnet_cidr,
40-
local.cluster_alias_ranges_cidr[var.ip_range_pods],
41-
]
40+
],
41+
local.pod_all_ip_ranges
42+
)
4243

4344
# Allow all possible protocols
4445
allow { protocol = "tcp" }
@@ -135,7 +136,7 @@ resource "google_compute_firewall" "shadow_allow_pods" {
135136
priority = var.shadow_firewall_rules_priority
136137
direction = "INGRESS"
137138

138-
source_ranges = [local.cluster_alias_ranges_cidr[var.ip_range_pods]]
139+
source_ranges = local.pod_all_ip_ranges
139140
target_tags = [local.cluster_network_tag]
140141

141142
# Allow all possible protocols
@@ -205,3 +206,50 @@ resource "google_compute_firewall" "shadow_allow_nodes" {
205206
metadata = "INCLUDE_ALL_METADATA"
206207
}
207208
}
209+
210+
resource "google_compute_firewall" "shadow_allow_inkubelet" {
211+
count = var.add_shadow_firewall_rules ? 1 : 0
212+
213+
name = "gke-shadow-${substr(var.name, 0, min(25, length(var.name)))}-inkubelet"
214+
description = "Managed by terraform GKE module: A shadow firewall rule to match the default rule allowing worker nodes & pods communication to kubelet."
215+
project = local.network_project_id
216+
network = var.network
217+
priority = min(998, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 999
218+
direction = "INGRESS"
219+
220+
source_ranges = local.pod_all_ip_ranges
221+
source_tags = [local.cluster_network_tag]
222+
target_tags = [local.cluster_network_tag]
223+
224+
allow {
225+
protocol = "tcp"
226+
ports = ["10255"]
227+
}
228+
229+
log_config {
230+
metadata = "INCLUDE_ALL_METADATA"
231+
}
232+
}
233+
234+
resource "google_compute_firewall" "shadow_deny_exkubelet" {
235+
count = var.add_shadow_firewall_rules ? 1 : 0
236+
237+
name = "gke-shadow-${substr(var.name, 0, min(25, length(var.name)))}-exkubelet"
238+
description = "Managed by terraform GKE module: A shadow firewall rule to match the default deny rule to kubelet."
239+
project = local.network_project_id
240+
network = var.network
241+
priority = min(999, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 1000
242+
direction = "INGRESS"
243+
244+
source_ranges = ["0.0.0.0/0"]
245+
target_tags = [local.cluster_network_tag]
246+
247+
deny {
248+
protocol = "tcp"
249+
ports = ["10255"]
250+
}
251+
252+
log_config {
253+
metadata = "INCLUDE_ALL_METADATA"
254+
}
255+
}

‎modules/beta-autopilot-public-cluster/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ locals {
6060

6161
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
6262
cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
63+
pod_all_ip_ranges = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
6364

6465

6566
cluster_authenticator_security_group = var.authenticator_security_group == null ? [] : [{

‎modules/beta-private-cluster-update-variant/firewall.tf

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,12 @@ resource "google_compute_firewall" "intra_egress" {
3434
direction = "EGRESS"
3535

3636
target_tags = [local.cluster_network_tag]
37-
destination_ranges = [
37+
destination_ranges = concat([
3838
local.cluster_endpoint_for_nodes,
3939
local.cluster_subnet_cidr,
40-
local.cluster_alias_ranges_cidr[var.ip_range_pods],
41-
]
40+
],
41+
local.pod_all_ip_ranges
42+
)
4243

4344
# Allow all possible protocols
4445
allow { protocol = "tcp" }
@@ -126,7 +127,7 @@ resource "google_compute_firewall" "shadow_allow_pods" {
126127
priority = var.shadow_firewall_rules_priority
127128
direction = "INGRESS"
128129

129-
source_ranges = [local.cluster_alias_ranges_cidr[var.ip_range_pods]]
130+
source_ranges = local.pod_all_ip_ranges
130131
target_tags = [local.cluster_network_tag]
131132

132133
# Allow all possible protocols
@@ -196,3 +197,50 @@ resource "google_compute_firewall" "shadow_allow_nodes" {
196197
metadata = "INCLUDE_ALL_METADATA"
197198
}
198199
}
200+
201+
resource "google_compute_firewall" "shadow_allow_inkubelet" {
202+
count = var.add_shadow_firewall_rules ? 1 : 0
203+
204+
name = "gke-shadow-${substr(var.name, 0, min(25, length(var.name)))}-inkubelet"
205+
description = "Managed by terraform GKE module: A shadow firewall rule to match the default rule allowing worker nodes & pods communication to kubelet."
206+
project = local.network_project_id
207+
network = var.network
208+
priority = min(998, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 999
209+
direction = "INGRESS"
210+
211+
source_ranges = local.pod_all_ip_ranges
212+
source_tags = [local.cluster_network_tag]
213+
target_tags = [local.cluster_network_tag]
214+
215+
allow {
216+
protocol = "tcp"
217+
ports = ["10255"]
218+
}
219+
220+
log_config {
221+
metadata = "INCLUDE_ALL_METADATA"
222+
}
223+
}
224+
225+
resource "google_compute_firewall" "shadow_deny_exkubelet" {
226+
count = var.add_shadow_firewall_rules ? 1 : 0
227+
228+
name = "gke-shadow-${substr(var.name, 0, min(25, length(var.name)))}-exkubelet"
229+
description = "Managed by terraform GKE module: A shadow firewall rule to match the default deny rule to kubelet."
230+
project = local.network_project_id
231+
network = var.network
232+
priority = min(999, var.shadow_firewall_rules_priority) # rule created by GKE robot have prio 1000
233+
direction = "INGRESS"
234+
235+
source_ranges = ["0.0.0.0/0"]
236+
target_tags = [local.cluster_network_tag]
237+
238+
deny {
239+
protocol = "tcp"
240+
ports = ["10255"]
241+
}
242+
243+
log_config {
244+
metadata = "INCLUDE_ALL_METADATA"
245+
}
246+
}

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ locals {
7474

7575
cluster_subnet_cidr = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
7676
cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
77+
pod_all_ip_ranges = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
7778

7879
cluster_network_policy = var.network_policy ? [{
7980
enabled = true

0 commit comments

Comments
 (0)