Skip to content

Commit 2ef4bb5

Browse files
hankfreundhankfreund
authored
Implement node kernel module signature enforcement field. (#15679)
1 parent 54e244e commit 2ef4bb5

File tree

4 files changed

+291
-48
lines changed

4 files changed

+291
-48
lines changed

‎mmv1/third_party/terraform/services/container/node_config.go.tmpl‎

Lines changed: 73 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -889,6 +889,23 @@ func schemaNodeConfig() *schema.Schema {
889889
Description: `cgroupMode specifies the cgroup mode to be used on the node.`,
890890
DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("CGROUP_MODE_UNSPECIFIED"),
891891
},
892+
"node_kernel_module_loading": {
893+
Type: schema.TypeList,
894+
Optional: true,
895+
MaxItems: 1,
896+
Description: `The settings for kernel module loading.`,
897+
Elem: &schema.Resource{
898+
Schema: map[string]*schema.Schema{
899+
"policy": {
900+
Type: schema.TypeString,
901+
Optional: true,
902+
ValidateFunc: validation.StringInSlice([]string{"POLICY_UNSPECIFIED", "ENFORCE_SIGNED_MODULES", "DO_NOT_ENFORCE_SIGNED_MODULES"}, false),
903+
Description: `The policy for kernel module loading.`,
904+
DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("POLICY_UNSPECIFIED"),
905+
},
906+
},
907+
},
908+
},
892909
"transparent_hugepage_enabled": {
893910
Type: schema.TypeString,
894911
Optional: true,
@@ -1176,8 +1193,8 @@ func schemaNodePoolAutoConfigNodeKubeletConfig() *schema.Schema {
11761193
}
11771194
}
11781195

1179-
// Separate since this currently only supports a single value -- a subset of
1180-
// the overall LinuxNodeConfig
1196+
// Separate since this currently only supports a subset of the overall
1197+
// LinuxNodeConfig
11811198
func schemaNodePoolAutoConfigLinuxNodeConfig() *schema.Schema {
11821199
return &schema.Schema{
11831200
Type: schema.TypeList,
@@ -1194,6 +1211,23 @@ func schemaNodePoolAutoConfigLinuxNodeConfig() *schema.Schema {
11941211
Description: `cgroupMode specifies the cgroup mode to be used on the node.`,
11951212
DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("CGROUP_MODE_UNSPECIFIED"),
11961213
},
1214+
"node_kernel_module_loading": {
1215+
Type: schema.TypeList,
1216+
Optional: true,
1217+
MaxItems: 1,
1218+
Description: `The settings for kernel module loading.`,
1219+
Elem: &schema.Resource{
1220+
Schema: map[string]*schema.Schema{
1221+
"policy": {
1222+
Type: schema.TypeString,
1223+
Optional: true,
1224+
ValidateFunc: validation.StringInSlice([]string{"POLICY_UNSPECIFIED", "ENFORCE_SIGNED_MODULES", "DO_NOT_ENFORCE_SIGNED_MODULES"}, false),
1225+
Description: `The policy for kernel module loading.`,
1226+
DiffSuppressFunc: tpgresource.EmptyOrDefaultStringSuppress("POLICY_UNSPECIFIED"),
1227+
},
1228+
},
1229+
},
1230+
},
11971231
},
11981232
},
11991233
}
@@ -1893,6 +1927,10 @@ func expandLinuxNodeConfig(v interface{}) *container.LinuxNodeConfig {
18931927
if v, ok := cfg["hugepages_config"]; ok {
18941928
linuxNodeConfig.Hugepages = expandHugepagesConfig(v)
18951929
}
1930+
1931+
if v, ok := cfg["node_kernel_module_loading"]; ok {
1932+
linuxNodeConfig.NodeKernelModuleLoading = expandNodeKernelModuleLoading(v)
1933+
}
18961934

18971935
return linuxNodeConfig
18981936
}
@@ -1962,6 +2000,28 @@ func expandHugepagesConfig(v interface{}) *container.HugepagesConfig {
19622000
return hugepagesConfig
19632001
}
19642002

2003+
func expandNodeKernelModuleLoading(v interface{}) *container.NodeKernelModuleLoading {
2004+
if v == nil {
2005+
return nil
2006+
}
2007+
ls := v.([]interface{})
2008+
if len(ls) == 0 {
2009+
return nil
2010+
}
2011+
if ls[0] == nil {
2012+
return &container.NodeKernelModuleLoading{}
2013+
}
2014+
cfg := ls[0].(map[string]interface{})
2015+
2016+
NodeKernelModuleLoading := &container.NodeKernelModuleLoading{}
2017+
2018+
if v, ok := cfg["policy"]; ok {
2019+
NodeKernelModuleLoading.Policy = v.(string)
2020+
}
2021+
2022+
return NodeKernelModuleLoading
2023+
}
2024+
19652025
func expandContainerdConfig(v interface{}) *container.ContainerdConfig {
19662026
if v == nil {
19672027
return nil
@@ -2637,6 +2697,7 @@ func flattenLinuxNodeConfig(c *container.LinuxNodeConfig) []map[string]interface
26372697
"hugepages_config": flattenHugepagesConfig(c.Hugepages),
26382698
"transparent_hugepage_enabled": c.TransparentHugepageEnabled,
26392699
"transparent_hugepage_defrag": c.TransparentHugepageDefrag,
2700+
"node_kernel_module_loading": flattenNodeKernelModuleLoading(c.NodeKernelModuleLoading),
26402701
})
26412702
}
26422703
return result
@@ -2663,6 +2724,16 @@ func flattenHugepagesConfig(c *container.HugepagesConfig) []map[string]interface
26632724
return result
26642725
}
26652726

2727+
func flattenNodeKernelModuleLoading(c *container.NodeKernelModuleLoading) []map[string]interface{} {
2728+
result := []map[string]interface{}{}
2729+
if c != nil {
2730+
result = append(result, map[string]interface{}{
2731+
"policy": c.Policy,
2732+
})
2733+
}
2734+
return result
2735+
}
2736+
26662737
func flattenContainerdConfig(c *container.ContainerdConfig) []map[string]interface{} {
26672738
result := []map[string]interface{}{}
26682739
if c == nil {

‎mmv1/third_party/terraform/services/container/resource_container_cluster.go.tmpl‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6957,9 +6957,32 @@ func expandNodePoolAutoConfig(configured interface{}) *container.NodePoolAutoCon
69576957
npac.ResourceManagerTags = expandResourceManagerTags(v)
69586958
}
69596959

6960+
if v, ok := config["linux_node_config"]; ok {
6961+
npac.LinuxNodeConfig = expandNodePoolAutoConfigLinuxNodeConfig(v)
6962+
}
6963+
69606964
return npac
69616965
}
69626966

6967+
func expandNodePoolAutoConfigLinuxNodeConfig(configured interface{}) *container.LinuxNodeConfig {
6968+
if configured == nil {
6969+
return nil
6970+
}
6971+
ls := configured.([]interface{})
6972+
if len(ls) == 0 {
6973+
return nil
6974+
}
6975+
if ls[0] == nil {
6976+
return &container.LinuxNodeConfig{}
6977+
}
6978+
config := ls[0].(map[string]interface{})
6979+
linuxNodeConfig := &container.LinuxNodeConfig{}
6980+
if v, ok := config["node_kernel_module_loading"]; ok {
6981+
linuxNodeConfig.NodeKernelModuleLoading = expandNodeKernelModuleLoading(v)
6982+
}
6983+
return linuxNodeConfig
6984+
}
6985+
69636986
func expandNodePoolAutoConfigNetworkTags(configured interface{}) *container.NetworkTags {
69646987
l := configured.([]interface{})
69656988
if len(l) == 0 || l[0] == nil {
@@ -8053,9 +8076,13 @@ func flattenNodePoolAutoConfig(c *container.NodePoolAutoConfig) []map[string]int
80538076
result["resource_manager_tags"] = flattenResourceManagerTags(c.ResourceManagerTags)
80548077
}
80558078
if c.LinuxNodeConfig != nil {
8056-
result["linux_node_config"] = []map[string]interface{}{
8057-
{"cgroup_mode": c.LinuxNodeConfig.CgroupMode},
8079+
linuxNodeConfig := map[string]interface{}{
8080+
"cgroup_mode": c.LinuxNodeConfig.CgroupMode,
8081+
}
8082+
if c.LinuxNodeConfig.NodeKernelModuleLoading != nil {
8083+
linuxNodeConfig["node_kernel_module_loading"] = flattenNodeKernelModuleLoading(c.LinuxNodeConfig.NodeKernelModuleLoading)
80588084
}
8085+
result["linux_node_config"] = []map[string]interface{}{linuxNodeConfig}
80598086
}
80608087

80618088
return []map[string]interface{}{result}

‎mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.tmpl‎

Lines changed: 113 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -2104,7 +2104,7 @@ func TestAccContainerCluster_withNodeConfigLinuxNodeConfig(t *testing.T) {
21042104
Steps: []resource.TestStep{
21052105
// First test with empty `node_config.linux_node_config` (should result in "CGROUP_MODE_UNSPECIFIED")
21062106
{
2107-
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "", false),
2107+
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "", false, ""),
21082108
ConfigPlanChecks: resource.ConfigPlanChecks{
21092109
PreApply: []plancheck.PlanCheck{
21102110
acctest.ExpectNoDelete(),
@@ -2119,7 +2119,7 @@ func TestAccContainerCluster_withNodeConfigLinuxNodeConfig(t *testing.T) {
21192119
},
21202120
// Then add a config and make sure it updates.
21212121
{
2122-
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "CGROUP_MODE_V2", false),
2122+
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "CGROUP_MODE_V2", false, ""),
21232123
Check: resource.ComposeTestCheckFunc(
21242124
resource.TestCheckResourceAttr(
21252125
"google_container_cluster.with_linux_node_config",
@@ -2140,7 +2140,7 @@ func TestAccContainerCluster_withNodeConfigLinuxNodeConfig(t *testing.T) {
21402140
},
21412141
// Lastly, update the setting in-place. V1 since UNSPECIFIED is default
21422142
{
2143-
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "CGROUP_MODE_V1", false),
2143+
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "CGROUP_MODE_V1", false, ""),
21442144
Check: resource.ComposeTestCheckFunc(
21452145
resource.TestCheckResourceAttr(
21462146
"google_container_cluster.with_linux_node_config",
@@ -2161,29 +2161,75 @@ func TestAccContainerCluster_withNodeConfigLinuxNodeConfig(t *testing.T) {
21612161
},
21622162
// Update linux config transparent hugepage
21632163
{
2164-
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "", true),
2165-
Check: resource.ComposeTestCheckFunc(
2166-
resource.TestCheckResourceAttr(
2167-
"google_container_cluster.with_linux_node_config",
2168-
"node_config.0.linux_node_config.0.transparent_hugepage_enabled", "TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS",
2169-
),
2164+
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "", true, ""),
2165+
Check: resource.ComposeTestCheckFunc(
21702166
resource.TestCheckResourceAttr(
2171-
"google_container_cluster.with_linux_node_config",
2172-
"node_config.0.linux_node_config.0.transparent_hugepage_defrag", "TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS",
2173-
),
2174-
),
2175-
ConfigPlanChecks: resource.ConfigPlanChecks{
2176-
PreApply: []plancheck.PlanCheck{
2177-
acctest.ExpectNoDelete(),
2178-
},
2179-
},
2180-
},
2181-
{
2182-
ResourceName: "google_container_cluster.with_linux_node_config",
2183-
ImportState: true,
2184-
ImportStateVerify: true,
2185-
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
2186-
},
2167+
"google_container_cluster.with_linux_node_config",
2168+
"node_config.0.linux_node_config.0.transparent_hugepage_enabled", "TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS",
2169+
),
2170+
resource.TestCheckResourceAttr(
2171+
"google_container_cluster.with_linux_node_config",
2172+
"node_config.0.linux_node_config.0.transparent_hugepage_defrag", "TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS",
2173+
),
2174+
),
2175+
ConfigPlanChecks: resource.ConfigPlanChecks{
2176+
PreApply: []plancheck.PlanCheck{
2177+
acctest.ExpectNoDelete(),
2178+
},
2179+
},
2180+
},
2181+
{
2182+
ResourceName: "google_container_cluster.with_linux_node_config",
2183+
ImportState: true,
2184+
ImportStateVerify: true,
2185+
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
2186+
},
2187+
// Update node kernel module loading policy
2188+
{
2189+
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "CGROUP_MODE_V2", false, "ENFORCE_SIGNED_MODULES"),
2190+
Check: resource.ComposeTestCheckFunc(
2191+
resource.TestCheckResourceAttr(
2192+
"google_container_cluster.with_linux_node_config",
2193+
"node_config.0.linux_node_config.0.node_kernel_module_loading.0.policy", "ENFORCE_SIGNED_MODULES",
2194+
),
2195+
resource.TestCheckResourceAttr(
2196+
"google_container_cluster.with_linux_node_config",
2197+
"node_config.0.linux_node_config.0.cgroup_mode", "CGROUP_MODE_V2",
2198+
),
2199+
),
2200+
ConfigPlanChecks: resource.ConfigPlanChecks{
2201+
PreApply: []plancheck.PlanCheck{
2202+
acctest.ExpectNoDelete(),
2203+
},
2204+
},
2205+
},
2206+
{
2207+
ResourceName: "google_container_cluster.with_linux_node_config",
2208+
ImportState: true,
2209+
ImportStateVerify: true,
2210+
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
2211+
},
2212+
// Unset node kernel module loading policy
2213+
{
2214+
Config: testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, "", false, "DO_NOT_ENFORCE_SIGNED_MODULES"),
2215+
Check: resource.ComposeTestCheckFunc(
2216+
resource.TestCheckResourceAttr(
2217+
"google_container_cluster.with_linux_node_config",
2218+
"node_config.0.linux_node_config.0.node_kernel_module_loading.0.policy", "DO_NOT_ENFORCE_SIGNED_MODULES",
2219+
),
2220+
),
2221+
ConfigPlanChecks: resource.ConfigPlanChecks{
2222+
PreApply: []plancheck.PlanCheck{
2223+
acctest.ExpectNoDelete(),
2224+
},
2225+
},
2226+
},
2227+
{
2228+
ResourceName: "google_container_cluster.with_linux_node_config",
2229+
ImportState: true,
2230+
ImportStateVerify: true,
2231+
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
2232+
},
21872233
},
21882234
})
21892235
}
@@ -4424,7 +4470,7 @@ func TestAccContainerCluster_withAutopilot_withNodePoolAutoConfig(t *testing.T)
44244470
ResourceName: "google_container_cluster.primary",
44254471
ImportState: true,
44264472
ImportStateVerify: true,
4427-
ImportStateVerifyIgnore: []string{"deletion_protection"},
4473+
ImportStateVerifyIgnore: []string{"min_master_version", "deletion_protection"},
44284474
},
44294475
},
44304476
})
@@ -9354,24 +9400,30 @@ resource "google_container_cluster" "with_node_config" {
93549400
`, clusterName, networkName, subnetworkName)
93559401
}
93569402

9357-
func testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, cgroupMode string, thpEnabled bool) string {
9358-
// Empty block inside node_config if cgroupMode is empty
9403+
func testAccContainerCluster_withNodeConfigLinuxNodeConfig(clusterName, networkName, subnetworkName, cgroupMode string, thpEnabled bool, nkmlPolicy string) string {
9404+
// Empty block inside node_config if sub-fields are empty
93599405
linuxNodeConfig := ""
93609406

9361-
if cgroupMode != "" {
9362-
linuxNodeConfig = fmt.Sprintf(`
9363-
linux_node_config {
9364-
cgroup_mode = "%s"
9365-
}
9366-
`, cgroupMode)
9367-
}
9368-
9369-
if cgroupMode== "" && thpEnabled {
9370-
linuxNodeConfig = `
9371-
linux_node_config {
9372-
transparent_hugepage_defrag = "TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS"
9373-
transparent_hugepage_enabled = "TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS"
9374-
}`
9407+
if cgroupMode != "" || thpEnabled || nkmlPolicy != "" {
9408+
linuxNodeConfig = `linux_node_config {
9409+
`
9410+
if cgroupMode != "" {
9411+
linuxNodeConfig = linuxNodeConfig + fmt.Sprintf(`cgroup_mode="%s"
9412+
`, cgroupMode)
9413+
}
9414+
if thpEnabled {
9415+
linuxNodeConfig = linuxNodeConfig + `
9416+
transparent_hugepage_defrag = "TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS"
9417+
transparent_hugepage_enabled = "TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS"
9418+
`
9419+
}
9420+
if nkmlPolicy != "" {
9421+
linuxNodeConfig = linuxNodeConfig + fmt.Sprintf(`node_kernel_module_loading {
9422+
policy = "%s"
9423+
}
9424+
`, nkmlPolicy)
9425+
}
9426+
linuxNodeConfig = linuxNodeConfig + "}"
93759427
}
93769428

93779429
return fmt.Sprintf(`
@@ -9382,7 +9434,11 @@ resource "google_container_cluster" "with_linux_node_config" {
93829434
name = "%s"
93839435
location = "us-central1-f"
93849436
initial_node_count = 1
9385-
min_master_version = data.google_container_engine_versions.central1a.latest_master_version
9437+
min_master_version = data.google_container_engine_versions.central1a.release_channel_latest_version["RAPID"]
9438+
9439+
release_channel {
9440+
channel = "RAPID"
9441+
}
93869442

93879443
node_config {
93889444
disk_size_gb = 15
@@ -13541,18 +13597,31 @@ resource "google_container_cluster" "primary" {
1354113597
`, name, networkName, subnetworkName)
1354213598
}
1354313599

13544-
1354513600
func testAccContainerCluster_withAutopilot_withNodePoolAutoConfig(name, networkName, subnetworkName string, insecureKubeletReadonlyPortEnabled string) string {
1354613601
return fmt.Sprintf(`
13602+
data "google_container_engine_versions" "uscentral1a" {
13603+
location = "us-central1-a"
13604+
}
13605+
1354713606
resource "google_container_cluster" "primary" {
1354813607
name = "%s"
1354913608
location = "us-central1"
1355013609
enable_autopilot = true
13610+
min_master_version = data.google_container_engine_versions.uscentral1a.release_channel_latest_version["RAPID"]
13611+
13612+
release_channel {
13613+
channel = "RAPID"
13614+
}
1355113615

1355213616
node_pool_auto_config {
1355313617
node_kubelet_config {
1355413618
insecure_kubelet_readonly_port_enabled = "%s"
1355513619
}
13620+
linux_node_config {
13621+
node_kernel_module_loading {
13622+
policy = "ENFORCE_SIGNED_MODULES"
13623+
}
13624+
}
1355613625
}
1355713626

1355813627
deletion_protection = false

0 commit comments

Comments
 (0)