Skip to content

Commit 77787f2

Browse files
mmorejonmmorejon
committed
feat: add security posture
Signed-off-by: Manuel Morejon <[email protected]>
1 parent abdba8c commit 77787f2

File tree

37 files changed

+250
-0
lines changed

37 files changed

+250
-0
lines changed

‎README.md

+2
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,8 @@ Then perform the following commands on the root folder:
212212
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
213213
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
214214
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
215+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
216+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
215217
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
216218
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
217219
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl

+6
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,12 @@ resource "google_container_cluster" "primary" {
332332
workload_vulnerability_mode = var.workload_vulnerability_mode
333333
}
334334
{% endif %}
335+
336+
security_posture_config {
337+
mode = var.security_posture_mode
338+
vulnerability_mode = var.security_posture_vulnerability_mode
339+
}
340+
335341
ip_allocation_policy {
336342
cluster_secondary_range_name = var.ip_range_pods
337343
services_secondary_range_name = var.ip_range_services

‎autogen/main/variables.tf.tmpl

+12
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,18 @@ variable "workload_config_audit_mode" {
561561
}
562562
{% endif %}
563563

564+
variable "security_posture_mode" {
565+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
566+
type = string
567+
default = "DISABLED"
568+
}
569+
570+
variable "security_posture_vulnerability_mode" {
571+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
572+
type = string
573+
default = "VULNERABILITY_DISABLED"
574+
}
575+
564576
variable "disable_default_snat" {
565577
type = bool
566578
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎autogen/safer-cluster/main.tf.tmpl

+4
Original file line numberDiff line numberDiff line change
@@ -200,4 +200,8 @@ module "gke" {
200200
timeouts = var.timeouts
201201

202202
enable_gcfs = var.enable_gcfs
203+
204+
// Enabling security posture
205+
security_posture_mode = var.security_posture_mode
206+
security_posture_vulnerability_mode = var.security_posture_vulnerability_mode
203207
}

‎autogen/safer-cluster/variables.tf.tmpl

+12
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,18 @@ variable "gke_backup_agent_config" {
463463
default = false
464464
}
465465

466+
variable "security_posture_mode" {
467+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
468+
type = string
469+
default = "DISABLED"
470+
}
471+
472+
variable "security_posture_vulnerability_mode" {
473+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`."
474+
type = string
475+
default = null
476+
}
477+
466478
variable "disable_default_snat" {
467479
type = bool
468480
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,12 @@ resource "google_container_cluster" "primary" {
211211

212212
datapath_provider = var.datapath_provider
213213

214+
215+
security_posture_config {
216+
mode = var.security_posture_mode
217+
vulnerability_mode = var.security_posture_vulnerability_mode
218+
}
219+
214220
ip_allocation_policy {
215221
cluster_secondary_range_name = var.ip_range_pods
216222
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,8 @@ Then perform the following commands on the root folder:
125125
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
126126
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
127127
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
128+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
129+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
128130
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
129131
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
130132
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,12 @@ resource "google_container_cluster" "primary" {
135135
}
136136
workload_vulnerability_mode = var.workload_vulnerability_mode
137137
}
138+
139+
security_posture_config {
140+
mode = var.security_posture_mode
141+
vulnerability_mode = var.security_posture_vulnerability_mode
142+
}
143+
138144
ip_allocation_policy {
139145
cluster_secondary_range_name = var.ip_range_pods
140146
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,18 @@ variable "workload_config_audit_mode" {
385385
default = "DISABLED"
386386
}
387387

388+
variable "security_posture_mode" {
389+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
390+
type = string
391+
default = "DISABLED"
392+
}
393+
394+
variable "security_posture_vulnerability_mode" {
395+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
396+
type = string
397+
default = "VULNERABILITY_DISABLED"
398+
}
399+
388400
variable "disable_default_snat" {
389401
type = bool
390402
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-public-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,8 @@ Then perform the following commands on the root folder:
114114
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
115115
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
116116
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
117+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
118+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
117119
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
118120
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
119121
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,12 @@ resource "google_container_cluster" "primary" {
135135
}
136136
workload_vulnerability_mode = var.workload_vulnerability_mode
137137
}
138+
139+
security_posture_config {
140+
mode = var.security_posture_mode
141+
vulnerability_mode = var.security_posture_vulnerability_mode
142+
}
143+
138144
ip_allocation_policy {
139145
cluster_secondary_range_name = var.ip_range_pods
140146
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-public-cluster/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,18 @@ variable "workload_config_audit_mode" {
355355
default = "DISABLED"
356356
}
357357

358+
variable "security_posture_mode" {
359+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
360+
type = string
361+
default = "DISABLED"
362+
}
363+
364+
variable "security_posture_vulnerability_mode" {
365+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
366+
type = string
367+
default = "VULNERABILITY_DISABLED"
368+
}
369+
358370
variable "disable_default_snat" {
359371
type = bool
360372
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster-update-variant/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,8 @@ Then perform the following commands on the root folder:
263263
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
264264
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
265265
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
266+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
267+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
266268
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
267269
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
268270
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,12 @@ resource "google_container_cluster" "primary" {
268268
}
269269
workload_vulnerability_mode = var.workload_vulnerability_mode
270270
}
271+
272+
security_posture_config {
273+
mode = var.security_posture_mode
274+
vulnerability_mode = var.security_posture_vulnerability_mode
275+
}
276+
271277
ip_allocation_policy {
272278
cluster_secondary_range_name = var.ip_range_pods
273279
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster-update-variant/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,18 @@ variable "workload_config_audit_mode" {
530530
default = "DISABLED"
531531
}
532532

533+
variable "security_posture_mode" {
534+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
535+
type = string
536+
default = "DISABLED"
537+
}
538+
539+
variable "security_posture_vulnerability_mode" {
540+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
541+
type = string
542+
default = "VULNERABILITY_DISABLED"
543+
}
544+
533545
variable "disable_default_snat" {
534546
type = bool
535547
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-private-cluster/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,8 @@ Then perform the following commands on the root folder:
241241
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
242242
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
243243
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
244+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
245+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
244246
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
245247
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
246248
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,12 @@ resource "google_container_cluster" "primary" {
268268
}
269269
workload_vulnerability_mode = var.workload_vulnerability_mode
270270
}
271+
272+
security_posture_config {
273+
mode = var.security_posture_mode
274+
vulnerability_mode = var.security_posture_vulnerability_mode
275+
}
276+
271277
ip_allocation_policy {
272278
cluster_secondary_range_name = var.ip_range_pods
273279
services_secondary_range_name = var.ip_range_services

‎modules/beta-private-cluster/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -530,6 +530,18 @@ variable "workload_config_audit_mode" {
530530
default = "DISABLED"
531531
}
532532

533+
variable "security_posture_mode" {
534+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
535+
type = string
536+
default = "DISABLED"
537+
}
538+
539+
variable "security_posture_vulnerability_mode" {
540+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
541+
type = string
542+
default = "VULNERABILITY_DISABLED"
543+
}
544+
533545
variable "disable_default_snat" {
534546
type = bool
535547
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-public-cluster-update-variant/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,8 @@ Then perform the following commands on the root folder:
252252
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
253253
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
254254
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). | `bool` | `false` | no |
255+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
256+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
255257
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
256258
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
257259
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

+6
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,12 @@ resource "google_container_cluster" "primary" {
268268
}
269269
workload_vulnerability_mode = var.workload_vulnerability_mode
270270
}
271+
272+
security_posture_config {
273+
mode = var.security_posture_mode
274+
vulnerability_mode = var.security_posture_vulnerability_mode
275+
}
276+
271277
ip_allocation_policy {
272278
cluster_secondary_range_name = var.ip_range_pods
273279
services_secondary_range_name = var.ip_range_services

‎modules/beta-public-cluster-update-variant/variables.tf

+12
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,18 @@ variable "workload_config_audit_mode" {
500500
default = "DISABLED"
501501
}
502502

503+
variable "security_posture_mode" {
504+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
505+
type = string
506+
default = "DISABLED"
507+
}
508+
509+
variable "security_posture_vulnerability_mode" {
510+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
511+
type = string
512+
default = "VULNERABILITY_DISABLED"
513+
}
514+
503515
variable "disable_default_snat" {
504516
type = bool
505517
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

0 commit comments

Comments
 (0)