Skip to content

Commit e6ea4cf

Browse files
TheKangarooTheKangaroo
committed
feat: add fqdn policies
1 parent dbb57a2 commit e6ea4cf

File tree

27 files changed

+77
-20
lines changed

27 files changed

+77
-20
lines changed

‎autogen/main/cluster.tf.tmpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,9 @@ resource "google_container_cluster" "primary" {
208208
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
209209
{% endif %}
210210
{% endif %}
211+
{% if beta_cluster %}
212+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
213+
{% endif %}
211214
{% if autopilot_cluster %}
212215
enable_autopilot = true
213216
{% endif %}

‎autogen/main/variables.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -559,6 +559,12 @@ variable "workload_config_audit_mode" {
559559
type = string
560560
default = "DISABLED"
561561
}
562+
563+
variable "enable_fqdn_network_policy" {
564+
type = bool
565+
description = "Enable FQDN Network Policies on the cluster"
566+
default = false
567+
}
562568
{% endif %}
563569

564570
variable "disable_default_snat" {

‎autogen/main/versions.tf.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ terraform {
2424
required_providers {
2525
google = {
2626
source = "hashicorp/google"
27-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
27+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2828
}
2929
google-beta = {
3030
source = "hashicorp/google-beta"
31-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
31+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
3232
}
3333
kubernetes = {
3434
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ Then perform the following commands on the root folder:
8787
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
8888
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
8989
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
90+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
9091
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
9192
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
9293
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
8181
vertical_pod_autoscaling {
8282
enabled = var.enable_vertical_pod_autoscaling
8383
}
84-
enable_autopilot = true
84+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
85+
enable_autopilot = true
8586
dynamic "master_authorized_networks_config" {
8687
for_each = local.master_authorized_networks_config
8788
content {

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,12 @@ variable "workload_config_audit_mode" {
385385
default = "DISABLED"
386386
}
387387

388+
variable "enable_fqdn_network_policy" {
389+
type = bool
390+
description = "Enable FQDN Network Policies on the cluster"
391+
default = false
392+
}
393+
388394
variable "disable_default_snat" {
389395
type = bool
390396
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ Then perform the following commands on the root folder:
8080
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
8181
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
8282
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
83+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
8384
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
8485
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
8586
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
8181
vertical_pod_autoscaling {
8282
enabled = var.enable_vertical_pod_autoscaling
8383
}
84-
enable_autopilot = true
84+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
85+
enable_autopilot = true
8586
dynamic "master_authorized_networks_config" {
8687
for_each = local.master_authorized_networks_config
8788
content {

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,12 @@ variable "workload_config_audit_mode" {
355355
default = "DISABLED"
356356
}
357357

358+
variable "enable_fqdn_network_policy" {
359+
type = bool
360+
description = "Enable FQDN Network Policies on the cluster"
361+
default = false
362+
}
363+
358364
variable "disable_default_snat" {
359365
type = bool
360366
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ Then perform the following commands on the root folder:
192192
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
193193
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
194194
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
195+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
195196
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
196197
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
197198
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
164164
}
165165
}
166166

167-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
167+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
168+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
168169
dynamic "master_authorized_networks_config" {
169170
for_each = local.master_authorized_networks_config
170171
content {

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,12 @@ variable "workload_config_audit_mode" {
530530
default = "DISABLED"
531531
}
532532

533+
variable "enable_fqdn_network_policy" {
534+
type = bool
535+
description = "Enable FQDN Network Policies on the cluster"
536+
default = false
537+
}
538+
533539
variable "disable_default_snat" {
534540
type = bool
535541
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ Then perform the following commands on the root folder:
170170
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
171171
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
172172
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
173+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
173174
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
174175
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
175176
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
164164
}
165165
}
166166

167-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
167+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
168+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
168169
dynamic "master_authorized_networks_config" {
169170
for_each = local.master_authorized_networks_config
170171
content {

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,12 @@ variable "workload_config_audit_mode" {
530530
default = "DISABLED"
531531
}
532532

533+
variable "enable_fqdn_network_policy" {
534+
type = bool
535+
description = "Enable FQDN Network Policies on the cluster"
536+
default = false
537+
}
538+
533539
variable "disable_default_snat" {
534540
type = bool
535541
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@ Then perform the following commands on the root folder:
185185
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
186186
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
187187
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
188+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
188189
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
189190
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
190191
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
164164
}
165165
}
166166

167-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
167+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
168+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
168169
dynamic "master_authorized_networks_config" {
169170
for_each = local.master_authorized_networks_config
170171
content {

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,12 @@ variable "workload_config_audit_mode" {
500500
default = "DISABLED"
501501
}
502502

503+
variable "enable_fqdn_network_policy" {
504+
type = bool
505+
description = "Enable FQDN Network Policies on the cluster"
506+
default = false
507+
}
508+
503509
variable "disable_default_snat" {
504510
type = bool
505511
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster-update-variant/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

‎modules/beta-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@ Then perform the following commands on the root folder:
163163
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
164164
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
165165
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
166+
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `false` | no |
166167
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
167168
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
168169
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |

‎modules/beta-public-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
164164
}
165165
}
166166

167-
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
167+
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
168+
enable_fqdn_network_policy = var.enable_fqdn_network_policy
168169
dynamic "master_authorized_networks_config" {
169170
for_each = local.master_authorized_networks_config
170171
content {

‎modules/beta-public-cluster/variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,12 @@ variable "workload_config_audit_mode" {
500500
default = "DISABLED"
501501
}
502502

503+
variable "enable_fqdn_network_policy" {
504+
type = bool
505+
description = "Enable FQDN Network Policies on the cluster"
506+
default = false
507+
}
508+
503509
variable "disable_default_snat" {
504510
type = bool
505511
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster/versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,11 @@ terraform {
2121
required_providers {
2222
google = {
2323
source = "hashicorp/google"
24-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
24+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2525
}
2626
google-beta = {
2727
source = "hashicorp/google-beta"
28-
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
28+
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
2929
}
3030
kubernetes = {
3131
source = "hashicorp/kubernetes"

0 commit comments

Comments
 (0)