Skip to content

Commit 5d959a6

Browse files
mmorejonmmorejon
authored
feat: add security posture (terraform-google-modules#1750)
Signed-off-by: Manuel Morejon <[email protected]>
1 parent f43a241 commit 5d959a6

File tree

37 files changed

+250
-0
lines changed

37 files changed

+250
-0
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,8 @@ Then perform the following commands on the root folder:
212212
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
213213
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
214214
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
215+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
216+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
215217
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
216218
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
217219
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,6 +335,12 @@ resource "google_container_cluster" "primary" {
335335
workload_vulnerability_mode = var.workload_vulnerability_mode
336336
}
337337
{% endif %}
338+
339+
security_posture_config {
340+
mode = var.security_posture_mode
341+
vulnerability_mode = var.security_posture_vulnerability_mode
342+
}
343+
338344
ip_allocation_policy {
339345
cluster_secondary_range_name = var.ip_range_pods
340346
services_secondary_range_name = var.ip_range_services

‎autogen/main/variables.tf.tmpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -568,6 +568,18 @@ variable "enable_fqdn_network_policy" {
568568
}
569569
{% endif %}
570570

571+
variable "security_posture_mode" {
572+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
573+
type = string
574+
default = "DISABLED"
575+
}
576+
577+
variable "security_posture_vulnerability_mode" {
578+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
579+
type = string
580+
default = "VULNERABILITY_DISABLED"
581+
}
582+
571583
variable "disable_default_snat" {
572584
type = bool
573585
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎autogen/safer-cluster/main.tf.tmpl‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,4 +204,8 @@ module "gke" {
204204
// Enabling vulnerability and audit for workloads
205205
workload_vulnerability_mode = var.workload_vulnerability_mode
206206
workload_config_audit_mode = var.workload_config_audit_mode
207+
208+
// Enabling security posture
209+
security_posture_mode = var.security_posture_mode
210+
security_posture_vulnerability_mode = var.security_posture_vulnerability_mode
207211
}

‎autogen/safer-cluster/variables.tf.tmpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,18 @@ variable "gke_backup_agent_config" {
463463
default = false
464464
}
465465

466+
variable "security_posture_mode" {
467+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
468+
type = string
469+
default = "DISABLED"
470+
}
471+
472+
variable "security_posture_vulnerability_mode" {
473+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`."
474+
type = string
475+
default = null
476+
}
477+
466478
variable "disable_default_snat" {
467479
type = bool
468480
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎cluster.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,12 @@ resource "google_container_cluster" "primary" {
211211

212212
datapath_provider = var.datapath_provider
213213

214+
215+
security_posture_config {
216+
mode = var.security_posture_mode
217+
vulnerability_mode = var.security_posture_vulnerability_mode
218+
}
219+
214220
ip_allocation_policy {
215221
cluster_secondary_range_name = var.ip_range_pods
216222
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ Then perform the following commands on the root folder:
126126
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
127127
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
128128
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
129+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
130+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
129131
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
130132
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
131133
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,12 @@ resource "google_container_cluster" "primary" {
136136
}
137137
workload_vulnerability_mode = var.workload_vulnerability_mode
138138
}
139+
140+
security_posture_config {
141+
mode = var.security_posture_mode
142+
vulnerability_mode = var.security_posture_vulnerability_mode
143+
}
144+
139145
ip_allocation_policy {
140146
cluster_secondary_range_name = var.ip_range_pods
141147
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/variables.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -392,6 +392,18 @@ variable "enable_fqdn_network_policy" {
392392
default = null
393393
}
394394

395+
variable "security_posture_mode" {
396+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
397+
type = string
398+
default = "DISABLED"
399+
}
400+
401+
variable "security_posture_vulnerability_mode" {
402+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
403+
type = string
404+
default = "VULNERABILITY_DISABLED"
405+
}
406+
395407
variable "disable_default_snat" {
396408
type = bool
397409
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-public-cluster/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,8 @@ Then perform the following commands on the root folder:
115115
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
116116
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
117117
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
118+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
119+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
118120
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
119121
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
120122
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

0 commit comments

Comments
 (0)