Skip to content

Commit

Permalink
feat(TPG>=4.81.0)!: add fqdn policies (#1729)
Browse files Browse the repository at this point in the history
  • Loading branch information
TheKangaroo authored Oct 17, 2023
1 parent 47477d6 commit 2beb720
Show file tree
Hide file tree
Showing 27 changed files with 77 additions and 20 deletions.
3 changes: 3 additions & 0 deletions autogen/main/cluster.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,9 @@ resource "google_container_cluster" "primary" {
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
{% endif %}
{% endif %}
{% if beta_cluster %}
enable_fqdn_network_policy = var.enable_fqdn_network_policy
{% endif %}
{% if autopilot_cluster %}
enable_autopilot = true
{% endif %}
Expand Down
6 changes: 6 additions & 0 deletions autogen/main/variables.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -560,6 +560,12 @@ variable "workload_config_audit_mode" {
type = string
default = "DISABLED"
}

variable "enable_fqdn_network_policy" {
type = bool
description = "Enable FQDN Network Policies on the cluster"
default = null
}
{% endif %}

variable "disable_default_snat" {
Expand Down
4 changes: 2 additions & 2 deletions autogen/main/versions.tf.tmpl
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-autopilot-private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,7 @@ Then perform the following commands on the root folder:
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | `bool` | `false` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-autopilot-private-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
vertical_pod_autoscaling {
enabled = var.enable_vertical_pod_autoscaling
}
enable_autopilot = true
enable_fqdn_network_policy = var.enable_fqdn_network_policy
enable_autopilot = true
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
content {
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-autopilot-private-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -386,6 +386,12 @@ variable "workload_config_audit_mode" {
default = "DISABLED"
}

variable "enable_fqdn_network_policy" {
type = bool
description = "Enable FQDN Network Policies on the cluster"
default = null
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-autopilot-private-cluster/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-autopilot-public-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@ Then perform the following commands on the root folder:
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
| enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-autopilot-public-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,8 @@ resource "google_container_cluster" "primary" {
vertical_pod_autoscaling {
enabled = var.enable_vertical_pod_autoscaling
}
enable_autopilot = true
enable_fqdn_network_policy = var.enable_fqdn_network_policy
enable_autopilot = true
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
content {
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-autopilot-public-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -356,6 +356,12 @@ variable "workload_config_audit_mode" {
default = "DISABLED"
}

variable "enable_fqdn_network_policy" {
type = bool
description = "Enable FQDN Network Policies on the cluster"
default = null
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-autopilot-public-cluster/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,7 @@ Then perform the following commands on the root folder:
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-private-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
enable_fqdn_network_policy = var.enable_fqdn_network_policy
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
content {
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster-update-variant/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -531,6 +531,12 @@ variable "workload_config_audit_mode" {
default = "DISABLED"
}

variable "enable_fqdn_network_policy" {
type = bool
description = "Enable FQDN Network Policies on the cluster"
default = null
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-private-cluster-update-variant/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,7 @@ Then perform the following commands on the root folder:
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-private-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
enable_fqdn_network_policy = var.enable_fqdn_network_policy
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
content {
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -531,6 +531,12 @@ variable "workload_config_audit_mode" {
default = "DISABLED"
}

variable "enable_fqdn_network_policy" {
type = bool
description = "Enable FQDN Network Policies on the cluster"
default = null
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-private-cluster/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-public-cluster-update-variant/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,7 @@ Then perform the following commands on the root folder:
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-public-cluster-update-variant/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
enable_fqdn_network_policy = var.enable_fqdn_network_policy
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
content {
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-public-cluster-update-variant/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -501,6 +501,12 @@ variable "workload_config_audit_mode" {
default = "DISABLED"
}

variable "enable_fqdn_network_policy" {
type = bool
description = "Enable FQDN Network Policies on the cluster"
default = null
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-public-cluster-update-variant/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
1 change: 1 addition & 0 deletions modules/beta-public-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -163,6 +163,7 @@ Then perform the following commands on the root folder:
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
| enable\_fqdn\_network\_policy | Enable FQDN Network Policies on the cluster | `bool` | `null` | no |
| enable\_gcfs | Enable image streaming on cluster level. | `bool` | `false` | no |
| enable\_identity\_service | Enable the Identity Service component, which allows customers to use external identity providers with the K8S API. | `bool` | `false` | no |
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-public-cluster/cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,8 @@ resource "google_container_cluster" "primary" {
}
}

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting
enable_fqdn_network_policy = var.enable_fqdn_network_policy
dynamic "master_authorized_networks_config" {
for_each = local.master_authorized_networks_config
content {
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-public-cluster/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -501,6 +501,12 @@ variable "workload_config_audit_mode" {
default = "DISABLED"
}

variable "enable_fqdn_network_policy" {
type = bool
description = "Enable FQDN Network Policies on the cluster"
default = null
}

variable "disable_default_snat" {
type = bool
description = "Whether to disable the default SNAT to support the private use of public IP addresses"
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-public-cluster/versions.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 4.80.0, < 5.0, !=4.65.0, !=4.65.1"
version = ">= 4.81.0, < 5.0, !=4.65.0, !=4.65.1"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down

0 comments on commit 2beb720

Please sign in to comment.