Skip to content

Commit e8688fc

Browse files
mmontanmmontan
committed
Initial definition of a Safer Cluster module.
The PR adds a new "safer" GKE module. The module includes hardening suggestions from multiple sources.
1 parent 81eb717 commit e8688fc

File tree

19 files changed

+1125
-0
lines changed

19 files changed

+1125
-0
lines changed

‎.kitchen.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,13 @@ suites:
6161
systems:
6262
- name: shared_vpc
6363
backend: local
64+
- name: "safer_cluster"
65+
driver:
66+
root_module_directory: test/fixtures/safer_cluster
67+
verifier:
68+
systems:
69+
- name: safer_cluster
70+
backend: local
6471
- name: "simple_regional"
6572
driver:
6673
root_module_directory: test/fixtures/simple_regional

‎examples/safer_cluster/README.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Safer GKE Cluster
2+
3+
This example illustrates how to instantiate the opinionanted Safer Cluster module.
4+
5+
[^]: (autogen_docs_start)
6+
7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|:----:|:-----:|:-----:|
11+
| cloudrun | Boolean to enable / disable CloudRun | string | `"true"` | no |
12+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
13+
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
14+
| credentials\_path | The path to the GCP credentials JSON file | string | n/a | yes |
15+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
16+
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
17+
| istio | Boolean to enable / disable Istio | string | `"true"` | no |
18+
| network | The VPC network to host the cluster in | string | n/a | yes |
19+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
20+
| region | The region to host the cluster in | string | n/a | yes |
21+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
22+
23+
## Outputs
24+
25+
| Name | Description |
26+
|------|-------------|
27+
| ca\_certificate | |
28+
| client\_token | |
29+
| cluster\_name | Cluster name |
30+
| credentials\_path | |
31+
| ip\_range\_pods | The secondary IP range used for pods |
32+
| ip\_range\_services | The secondary IP range used for services |
33+
| kubernetes\_endpoint | |
34+
| location | |
35+
| master\_kubernetes\_version | The master Kubernetes version |
36+
| network | |
37+
| project\_id | |
38+
| region | |
39+
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
40+
| subnetwork | |
41+
| zones | List of zones in which the cluster resides |
42+
43+
[^]: (autogen_docs_end)
44+
45+
To provision this example, run the following from within this directory:
46+
- `terraform init` to get the plugins
47+
- `terraform plan` to see the infrastructure plan
48+
- `terraform apply` to apply the infrastructure build
49+
- `terraform destroy` to destroy the built infrastructure

‎examples/safer_cluster/main.tf

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "safer-cluster"
19+
}
20+
21+
provider "google-beta" {
22+
version = "~> 2.12.0"
23+
region = var.region
24+
}
25+
26+
data "google_compute_subnetwork" "subnetwork" {
27+
name = var.subnetwork
28+
project = var.project_id
29+
region = var.region
30+
}
31+
32+
module "gke" {
33+
source = "../../modules/safer-cluster/"
34+
project_id = var.project_id
35+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
36+
regional = true
37+
region = var.region
38+
network = var.network
39+
subnetwork = var.subnetwork
40+
ip_range_pods = var.ip_range_pods
41+
ip_range_services = var.ip_range_services
42+
master_ipv4_cidr_block = "172.16.0.0/28"
43+
44+
istio = var.istio
45+
cloudrun = var.cloudrun
46+
}
47+
48+
data "google_client_config" "default" {
49+
}
50+

‎examples/safer_cluster/outputs.tf

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = module.gke.endpoint
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = base64encode(data.google_client_config.default.access_token)
25+
}
26+
27+
output "ca_certificate" {
28+
value = module.gke.ca_certificate
29+
}
30+
31+
output "service_account" {
32+
description = "The service account to default running nodes as if not overridden in `node_pools`."
33+
value = module.gke.service_account
34+
}
35+

‎examples/safer_cluster/test_outputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../test/fixtures/all_examples/test_outputs.tf

‎examples/safer_cluster/variables.tf

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "cluster_name_suffix" {
22+
description = "A suffix to append to the default cluster name"
23+
default = ""
24+
}
25+
26+
variable "region" {
27+
description = "The region to host the cluster in"
28+
}
29+
30+
variable "network" {
31+
description = "The VPC network to host the cluster in"
32+
}
33+
34+
variable "subnetwork" {
35+
description = "The subnetwork to host the cluster in"
36+
}
37+
38+
variable "ip_range_pods" {
39+
description = "The secondary ip range to use for pods"
40+
}
41+
42+
variable "ip_range_services" {
43+
description = "The secondary ip range to use for pods"
44+
}
45+
46+
variable "istio" {
47+
description = "Boolean to enable / disable Istio"
48+
default = true
49+
}
50+
51+
variable "cloudrun" {
52+
description = "Boolean to enable / disable CloudRun"
53+
default = true
54+
}
55+

‎examples/safer_cluster/versions.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">= 0.12"
19+
}

‎modules/safer-cluster/README.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Safer Beta Cluster
2+
3+
The module defines a safer configuration for a GKE cluster.
4+
5+
TODO(mmontan): add documentation for the module.
6+
7+
[^]: (autogen_docs_start)
8+
9+
[^]: (autogen_docs_end)
10+
11+
To provision this example, run the following from within this directory:
12+
- `terraform init` to get the plugins
13+
- `terraform plan` to see the infrastructure plan
14+
- `terraform apply` to apply the infrastructure build
15+
- `terraform destroy` to destroy the built infrastructure

0 commit comments

Comments
 (0)