Skip to content

Commit fa480e5

Browse files
marko7460marko7460
committed
Moving binary authorization from beta to GA
1 parent ae17a3f commit fa480e5

File tree

20 files changed

+76
-41
lines changed

20 files changed

+76
-41
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ Then perform the following commands on the root folder:
125125
| default\_max\_pods\_per\_node | The maximum number of pods to schedule per node | string | `"110"` | no |
126126
| description | The description of the cluster | string | `""` | no |
127127
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | bool | `"true"` | no |
128+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
128129
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | bool | `"false"` | no |
129130
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | bool | `"true"` | no |
130131
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | bool | `"true"` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,8 +83,8 @@ resource "google_container_cluster" "primary" {
8383
default_max_pods_per_node = var.default_max_pods_per_node
8484

8585
enable_shielded_nodes = var.enable_shielded_nodes
86-
{% if beta_cluster %}
8786
enable_binary_authorization = var.enable_binary_authorization
87+
{% if beta_cluster %}
8888
enable_intranode_visibility = var.enable_intranode_visibility
8989
enable_kubernetes_alpha = var.enable_kubernetes_alpha
9090

‎autogen/main/variables.tf.tmpl

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -454,11 +454,6 @@ variable "cloudrun" {
454454
default = false
455455
}
456456

457-
variable "enable_binary_authorization" {
458-
description = "Enable BinAuthZ Admission controller"
459-
default = false
460-
}
461-
462457
variable "enable_pod_security_policy" {
463458
type = bool
464459
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
@@ -524,6 +519,11 @@ variable "enable_shielded_nodes" {
524519
default = true
525520
}
526521

522+
variable "enable_binary_authorization" {
523+
description = "Enable BinAuthZ Admission controller"
524+
default = false
525+
}
526+
527527
variable "add_cluster_firewall_rules" {
528528
type = bool
529529
description = "Create additional firewall rules"

‎cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ resource "google_container_cluster" "primary" {
7070

7171
default_max_pods_per_node = var.default_max_pods_per_node
7272

73-
enable_shielded_nodes = var.enable_shielded_nodes
73+
enable_shielded_nodes = var.enable_shielded_nodes
74+
enable_binary_authorization = var.enable_binary_authorization
7475
dynamic "master_authorized_networks_config" {
7576
for_each = local.master_authorized_networks_config
7677
content {

‎examples/simple_regional/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ This example illustrates how to create a simple cluster.
99
|------|-------------|:----:|:-----:|:-----:|
1010
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
1111
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
12+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
1213
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
1314
| ip\_range\_services | The secondary ip range to use for services | string | n/a | yes |
1415
| network | The VPC network to host the cluster in | string | n/a | yes |

‎examples/simple_regional/main.tf

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,19 @@ provider "google" {
2424
}
2525

2626
module "gke" {
27-
source = "../../"
28-
project_id = var.project_id
29-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30-
regional = true
31-
region = var.region
32-
network = var.network
33-
subnetwork = var.subnetwork
34-
ip_range_pods = var.ip_range_pods
35-
ip_range_services = var.ip_range_services
36-
create_service_account = false
37-
service_account = var.compute_engine_service_account
38-
skip_provisioners = var.skip_provisioners
27+
source = "../../"
28+
project_id = var.project_id
29+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30+
regional = true
31+
region = var.region
32+
network = var.network
33+
subnetwork = var.subnetwork
34+
ip_range_pods = var.ip_range_pods
35+
ip_range_services = var.ip_range_services
36+
create_service_account = false
37+
service_account = var.compute_engine_service_account
38+
enable_binary_authorization = var.enable_binary_authorization
39+
skip_provisioners = var.skip_provisioners
3940
}
4041

4142
data "google_client_config" "default" {

‎examples/simple_regional/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,3 +52,8 @@ variable "skip_provisioners" {
5252
description = "Flag to skip local-exec provisioners"
5353
default = false
5454
}
55+
56+
variable "enable_binary_authorization" {
57+
description = "Enable BinAuthZ Admission controller"
58+
default = false
59+
}

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -441,11 +441,6 @@ variable "cloudrun" {
441441
default = false
442442
}
443443

444-
variable "enable_binary_authorization" {
445-
description = "Enable BinAuthZ Admission controller"
446-
default = false
447-
}
448-
449444
variable "enable_pod_security_policy" {
450445
type = bool
451446
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
@@ -510,6 +505,11 @@ variable "enable_shielded_nodes" {
510505
default = true
511506
}
512507

508+
variable "enable_binary_authorization" {
509+
description = "Enable BinAuthZ Admission controller"
510+
default = false
511+
}
512+
513513
variable "add_cluster_firewall_rules" {
514514
type = bool
515515
description = "Create additional firewall rules"

‎modules/beta-private-cluster/variables.tf

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -441,11 +441,6 @@ variable "cloudrun" {
441441
default = false
442442
}
443443

444-
variable "enable_binary_authorization" {
445-
description = "Enable BinAuthZ Admission controller"
446-
default = false
447-
}
448-
449444
variable "enable_pod_security_policy" {
450445
type = bool
451446
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
@@ -510,6 +505,11 @@ variable "enable_shielded_nodes" {
510505
default = true
511506
}
512507

508+
variable "enable_binary_authorization" {
509+
description = "Enable BinAuthZ Admission controller"
510+
default = false
511+
}
512+
513513
variable "add_cluster_firewall_rules" {
514514
type = bool
515515
description = "Create additional firewall rules"

‎modules/beta-public-cluster-update-variant/variables.tf

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -410,11 +410,6 @@ variable "cloudrun" {
410410
default = false
411411
}
412412

413-
variable "enable_binary_authorization" {
414-
description = "Enable BinAuthZ Admission controller"
415-
default = false
416-
}
417-
418413
variable "enable_pod_security_policy" {
419414
type = bool
420415
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
@@ -479,6 +474,11 @@ variable "enable_shielded_nodes" {
479474
default = true
480475
}
481476

477+
variable "enable_binary_authorization" {
478+
description = "Enable BinAuthZ Admission controller"
479+
default = false
480+
}
481+
482482
variable "add_cluster_firewall_rules" {
483483
type = bool
484484
description = "Create additional firewall rules"

‎modules/beta-public-cluster/variables.tf

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -410,11 +410,6 @@ variable "cloudrun" {
410410
default = false
411411
}
412412

413-
variable "enable_binary_authorization" {
414-
description = "Enable BinAuthZ Admission controller"
415-
default = false
416-
}
417-
418413
variable "enable_pod_security_policy" {
419414
type = bool
420415
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
@@ -479,6 +474,11 @@ variable "enable_shielded_nodes" {
479474
default = true
480475
}
481476

477+
variable "enable_binary_authorization" {
478+
description = "Enable BinAuthZ Admission controller"
479+
default = false
480+
}
481+
482482
variable "add_cluster_firewall_rules" {
483483
type = bool
484484
description = "Create additional firewall rules"

‎modules/private-cluster-update-variant/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ Then perform the following commands on the root folder:
154154
| deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | bool | `"false"` | no |
155155
| description | The description of the cluster | string | `""` | no |
156156
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | bool | `"true"` | no |
157+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
157158
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | bool | `"false"` | no |
158159
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | bool | `"false"` | no |
159160
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | bool | `"false"` | no |

‎modules/private-cluster-update-variant/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ resource "google_container_cluster" "primary" {
7070

7171
default_max_pods_per_node = var.default_max_pods_per_node
7272

73-
enable_shielded_nodes = var.enable_shielded_nodes
73+
enable_shielded_nodes = var.enable_shielded_nodes
74+
enable_binary_authorization = var.enable_binary_authorization
7475
dynamic "master_authorized_networks_config" {
7576
for_each = local.master_authorized_networks_config
7677
content {

‎modules/private-cluster-update-variant/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,6 +408,11 @@ variable "enable_shielded_nodes" {
408408
default = true
409409
}
410410

411+
variable "enable_binary_authorization" {
412+
description = "Enable BinAuthZ Admission controller"
413+
default = false
414+
}
415+
411416
variable "add_cluster_firewall_rules" {
412417
type = bool
413418
description = "Create additional firewall rules"

‎modules/private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,7 @@ Then perform the following commands on the root folder:
132132
| deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | bool | `"false"` | no |
133133
| description | The description of the cluster | string | `""` | no |
134134
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | bool | `"true"` | no |
135+
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | string | `"false"` | no |
135136
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | bool | `"false"` | no |
136137
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | bool | `"false"` | no |
137138
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | bool | `"false"` | no |

‎modules/private-cluster/cluster.tf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ resource "google_container_cluster" "primary" {
7070

7171
default_max_pods_per_node = var.default_max_pods_per_node
7272

73-
enable_shielded_nodes = var.enable_shielded_nodes
73+
enable_shielded_nodes = var.enable_shielded_nodes
74+
enable_binary_authorization = var.enable_binary_authorization
7475
dynamic "master_authorized_networks_config" {
7576
for_each = local.master_authorized_networks_config
7677
content {

‎modules/private-cluster/variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,6 +408,11 @@ variable "enable_shielded_nodes" {
408408
default = true
409409
}
410410

411+
variable "enable_binary_authorization" {
412+
description = "Enable BinAuthZ Admission controller"
413+
default = false
414+
}
415+
411416
variable "add_cluster_firewall_rules" {
412417
type = bool
413418
description = "Create additional firewall rules"

‎test/fixtures/simple_regional/example.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,4 +26,5 @@ module "example" {
2626
ip_range_services = google_compute_subnetwork.main.secondary_ip_range[1].range_name
2727
compute_engine_service_account = var.compute_engine_service_accounts[0]
2828
skip_provisioners = true
29+
enable_binary_authorization = true
2930
}

‎test/integration/simple_regional/controls/gcloud.rb

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,12 @@
6565
"enabled" => true,
6666
})
6767
end
68+
69+
it "has the expected binaryAuthorization config" do
70+
expect(data['binaryAuthorization']).to eq({
71+
"enabled" => true,
72+
})
73+
end
6874
end
6975

7076
describe "default node pool" do

‎variables.tf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -384,6 +384,11 @@ variable "enable_shielded_nodes" {
384384
default = true
385385
}
386386

387+
variable "enable_binary_authorization" {
388+
description = "Enable BinAuthZ Admission controller"
389+
default = false
390+
}
391+
387392
variable "add_cluster_firewall_rules" {
388393
type = bool
389394
description = "Create additional firewall rules"

0 commit comments

Comments
 (0)