Skip to content

Commit 55be990

Browse files
mmorejonmmorejon
committed
feat: add security posture
Signed-off-by: Manuel Morejon <[email protected]>
1 parent 7c28e82 commit 55be990

File tree

37 files changed

+250
-0
lines changed

37 files changed

+250
-0
lines changed

‎README.md

+2
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,8 @@ Then perform the following commands on the root folder:
212212
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
213213
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
214214
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
215+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
216+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
215217
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
216218
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
217219
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl

+6
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,12 @@ resource "google_container_cluster" "primary" {
332332
workload_vulnerability_mode = var.workload_vulnerability_mode
333333
}
334334
{% endif %}
335+
336+
security_posture_config {
337+
mode = var.security_posture_mode
338+
vulnerability_mode = var.security_posture_vulnerability_mode
339+
}
340+
335341
ip_allocation_policy {
336342
cluster_secondary_range_name = var.ip_range_pods
337343
services_secondary_range_name = var.ip_range_services

‎autogen/main/variables.tf.tmpl

+12
Original file line numberDiff line numberDiff line change
@@ -562,6 +562,18 @@ variable "workload_config_audit_mode" {
562562
}
563563
{% endif %}
564564

565+
variable "security_posture_mode" {
566+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
567+
type = string
568+
default = "DISABLED"
569+
}
570+
571+
variable "security_posture_vulnerability_mode" {
572+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
573+
type = string
574+
default = "VULNERABILITY_DISABLED"
575+
}
576+
565577
variable "disable_default_snat" {
566578
type = bool
567579
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎autogen/safer-cluster/main.tf.tmpl

+4
Original file line numberDiff line numberDiff line change
@@ -204,4 +204,8 @@ module "gke" {
204204
// Enabling vulnerability and audit for workloads
205205
workload_vulnerability_mode = var.workload_vulnerability_mode
206206
workload_config_audit_mode = var.workload_config_audit_mode
207+
208+
// Enabling security posture
209+
security_posture_mode = var.security_posture_mode
210+
security_posture_vulnerability_mode = var.security_posture_vulnerability_mode
207211
}

‎autogen/safer-cluster/variables.tf.tmpl

+12
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,18 @@ variable "gke_backup_agent_config" {
463463
default = false
464464
}
465465

466+
variable "security_posture_mode" {
467+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
468+
type = string
469+
default = "DISABLED"
470+
}
471+
472+
variable "security_posture_vulnerability_mode" {
473+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`."
474+
type = string
475+
default = null
476+
}
477+
466478
variable "disable_default_snat" {
467479
type = bool
468480
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,12 @@ resource "google_container_cluster" "primary" {
211211

212212
datapath_provider = var.datapath_provider
213213

214+
215+
security_posture_config {
216+
mode = var.security_posture_mode
217+
vulnerability_mode = var.security_posture_vulnerability_mode
218+
}
219+
214220
ip_allocation_policy {
215221
cluster_secondary_range_name = var.ip_range_pods
216222
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,8 @@ Then perform the following commands on the root folder:
125125
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
126126
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
127127
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
128+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
129+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
128130
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
129131
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
130132
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,12 @@ resource "google_container_cluster" "primary" {
135135
}
136136
workload_vulnerability_mode = var.workload_vulnerability_mode
137137
}
138+
139+
security_posture_config {
140+
mode = var.security_posture_mode
141+
vulnerability_mode = var.security_posture_vulnerability_mode
142+
}
143+
138144
ip_allocation_policy {
139145
cluster_secondary_range_name = var.ip_range_pods
140146
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -386,6 +386,18 @@ variable "workload_config_audit_mode" {
386386
default = "DISABLED"
387387
}
388388

389+
variable "security_posture_mode" {
390+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
391+
type = string
392+
default = "DISABLED"
393+
}
394+
395+
variable "security_posture_vulnerability_mode" {
396+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
397+
type = string
398+
default = "VULNERABILITY_DISABLED"
399+
}
400+
389401
variable "disable_default_snat" {
390402
type = bool
391403
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-public-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,8 @@ Then perform the following commands on the root folder:
114114
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
115115
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
116116
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
117+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
118+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
117119
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
118120
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
119121
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,12 @@ resource "google_container_cluster" "primary" {
135135
}
136136
workload_vulnerability_mode = var.workload_vulnerability_mode
137137
}
138+
139+
security_posture_config {
140+
mode = var.security_posture_mode
141+
vulnerability_mode = var.security_posture_vulnerability_mode
142+
}
143+
138144
ip_allocation_policy {
139145
cluster_secondary_range_name = var.ip_range_pods
140146
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-public-cluster/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,18 @@ variable "workload_config_audit_mode" {
356356
default = "DISABLED"
357357
}
358358

359+
variable "security_posture_mode" {
360+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
361+
type = string
362+
default = "DISABLED"
363+
}
364+
365+
variable "security_posture_vulnerability_mode" {
366+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
367+
type = string
368+
default = "VULNERABILITY_DISABLED"
369+
}
370+
359371
variable "disable_default_snat" {
360372
type = bool
361373
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster-update-variant/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,8 @@ Then perform the following commands on the root folder:
263263
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
264264
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
265265
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
266+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
267+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
266268
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
267269
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
268270
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,12 @@ resource "google_container_cluster" "primary" {
268268
}
269269
workload_vulnerability_mode = var.workload_vulnerability_mode
270270
}
271+
272+
security_posture_config {
273+
mode = var.security_posture_mode
274+
vulnerability_mode = var.security_posture_vulnerability_mode
275+
}
276+
271277
ip_allocation_policy {
272278
cluster_secondary_range_name = var.ip_range_pods
273279
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster-update-variant/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -531,6 +531,18 @@ variable "workload_config_audit_mode" {
531531
default = "DISABLED"
532532
}
533533

534+
variable "security_posture_mode" {
535+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
536+
type = string
537+
default = "DISABLED"
538+
}
539+
540+
variable "security_posture_vulnerability_mode" {
541+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
542+
type = string
543+
default = "VULNERABILITY_DISABLED"
544+
}
545+
534546
variable "disable_default_snat" {
535547
type = bool
536548
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,8 @@ Then perform the following commands on the root folder:
241241
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
242242
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
243243
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
244+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
245+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
244246
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
245247
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
246248
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,12 @@ resource "google_container_cluster" "primary" {
268268
}
269269
workload_vulnerability_mode = var.workload_vulnerability_mode
270270
}
271+
272+
security_posture_config {
273+
mode = var.security_posture_mode
274+
vulnerability_mode = var.security_posture_vulnerability_mode
275+
}
276+
271277
ip_allocation_policy {
272278
cluster_secondary_range_name = var.ip_range_pods
273279
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -531,6 +531,18 @@ variable "workload_config_audit_mode" {
531531
default = "DISABLED"
532532
}
533533

534+
variable "security_posture_mode" {
535+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
536+
type = string
537+
default = "DISABLED"
538+
}
539+
540+
variable "security_posture_vulnerability_mode" {
541+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
542+
type = string
543+
default = "VULNERABILITY_DISABLED"
544+
}
545+
534546
variable "disable_default_snat" {
535547
type = bool
536548
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster-update-variant/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,8 @@ Then perform the following commands on the root folder:
252252
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
253253
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
254254
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
255+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
256+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
255257
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
256258
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
257259
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,12 @@ resource "google_container_cluster" "primary" {
268268
}
269269
workload_vulnerability_mode = var.workload_vulnerability_mode
270270
}
271+
272+
security_posture_config {
273+
mode = var.security_posture_mode
274+
vulnerability_mode = var.security_posture_vulnerability_mode
275+
}
276+
271277
ip_allocation_policy {
272278
cluster_secondary_range_name = var.ip_range_pods
273279
services_secondary_range_name = var.ip_range_services

‎modules/beta-public-cluster-update-variant/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,18 @@ variable "workload_config_audit_mode" {
501501
default = "DISABLED"
502502
}
503503

504+
variable "security_posture_mode" {
505+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
506+
type = string
507+
default = "DISABLED"
508+
}
509+
510+
variable "security_posture_vulnerability_mode" {
511+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
512+
type = string
513+
default = "VULNERABILITY_DISABLED"
514+
}
515+
504516
variable "disable_default_snat" {
505517
type = bool
506518
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

0 commit comments

Comments
 (0)