Skip to content

Commit 48bfedf

Browse files
author
chrislovecnm
committed
Enabling two features in beta clusters
This allow pod security policies and binary authorization to be used by both beta private and beta public clusters. Previously these two features where limited to only private clusters, and this commit also removes that functionality from private clusters.
1 parent ce40193 commit 48bfedf

File tree

22 files changed

+78
-84
lines changed

22 files changed

+78
-84
lines changed

‎autogen/cluster_regional.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,10 @@ resource "google_container_cluster" "primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
{% if private_cluster %}
45+
{% if beta_cluster %}
4646
enable_binary_authorization = "${var.enable_binary_authorization}"
4747
pod_security_policy_config = "${var.pod_security_policy_config}"
48-
{% endif %}
48+
{% endif %}
4949
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
5050

5151
master_auth {

‎autogen/cluster_zonal.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,11 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45-
{% if private_cluster %}
45+
{% if beta_cluster %}
4646
enable_binary_authorization = "${var.enable_binary_authorization}"
4747
pod_security_policy_config = "${var.pod_security_policy_config}"
48-
{% endif %}
48+
{% endif %}
49+
4950
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
5051

5152
master_auth {

‎autogen/main.tf‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,10 @@ locals {
140140
regional = "${element(concat(google_container_cluster.primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
141141
zonal = "${element(concat(google_container_cluster.zonal_primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
142142
}
143+
cluster_type_output_pod_security_policy_enabled = {
144+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
145+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
146+
}
143147
# /BETA features
144148
{% endif %}
145149

@@ -153,13 +157,6 @@ locals {
153157
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
154158
}
155159

156-
{% if private_cluster %}
157-
cluster_type_output_pod_security_policy_enabled = {
158-
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
159-
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
160-
}
161-
162-
{% endif %}
163160
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
164161
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
165162
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -184,10 +181,9 @@ locals {
184181
# BETA features
185182
cluster_istio_enabled = "${local.cluster_type_output_istio_enabled[local.cluster_type] ? false : true}"
186183
cluster_cloudrun_enabled = "${local.cluster_type_output_cloudrun_enabled[local.cluster_type] ? false : true}"
187-
# /BETA features
188-
{% endif %}
189-
{% if private_cluster %}
184+
190185
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
186+
# /BETA features
191187
{% endif %}
192188
}
193189

‎autogen/outputs.tf‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,6 @@ output "service_account" {
113113
value = "${local.service_account}"
114114
}
115115
{% if beta_cluster %}
116-
117116
output "istio_enabled" {
118117
description = "Whether Istio is enabled"
119118
value = "${local.cluster_istio_enabled}"
@@ -123,8 +122,6 @@ output "cloudrun_enabled" {
123122
description = "Whether CloudRun enabled"
124123
value = "${local.cluster_cloudrun_enabled}"
125124
}
126-
{% endif %}
127-
{% if private_cluster %}
128125

129126
output "pod_security_policy_enabled" {
130127
description = "Whether pod security policy is enabled"

‎autogen/variables.tf‎

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -86,21 +86,6 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89-
{% if private_cluster %}
90-
variable "enable_binary_authorization" {
91-
description = "Enable BinAuthZ Admission controller"
92-
default = false
93-
}
94-
95-
variable "pod_security_policy_config" {
96-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
97-
98-
default = [{
99-
"enabled" = false
100-
}]
101-
}
102-
103-
{% endif %}
10489
variable "horizontal_pod_autoscaling" {
10590
description = "Enable horizontal pod autoscaling addon"
10691
default = true
@@ -279,7 +264,6 @@ variable "master_ipv4_cidr_block" {
279264
}
280265
{% endif %}
281266
{% if beta_cluster %}
282-
283267
variable "istio" {
284268
description = "(Beta) Enable Istio addon"
285269
default = false
@@ -304,6 +288,18 @@ variable "database_encryption" {
304288
key_name = ""
305289
}]
306290
}
291+
292+
variable "enable_binary_authorization" {
293+
description = "Enable BinAuthZ Admission controller"
294+
default = false
295+
}
296+
297+
variable "pod_security_policy_config" {
298+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
299+
default = [{
300+
"enabled" = false
301+
}]
302+
}
307303
{% endif %}
308304

309305
variable "basic_auth_username" {

‎cluster_zonal.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ resource "google_container_cluster" "zonal_primary" {
4242
logging_service = "${var.logging_service}"
4343
monitoring_service = "${var.monitoring_service}"
4444

45+
4546
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4647

4748
master_auth {

‎modules/beta-private-cluster/cluster_zonal.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ resource "google_container_cluster" "zonal_primary" {
4444

4545
enable_binary_authorization = "${var.enable_binary_authorization}"
4646
pod_security_policy_config = "${var.pod_security_policy_config}"
47+
4748
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4849

4950
master_auth {

‎modules/beta-private-cluster/main.tf‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,11 @@ locals {
133133
zonal = "${element(concat(google_container_cluster.zonal_primary.*.addons_config.0.cloudrun_config.0.disabled, list("")), 0)}"
134134
}
135135

136+
cluster_type_output_pod_security_policy_enabled = {
137+
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
138+
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
139+
}
140+
136141
# /BETA features
137142

138143
cluster_type_output_node_pools_names = {
@@ -143,10 +148,6 @@ locals {
143148
regional = "${concat(google_container_node_pool.pools.*.version, list(""))}"
144149
zonal = "${concat(google_container_node_pool.zonal_pools.*.version, list(""))}"
145150
}
146-
cluster_type_output_pod_security_policy_enabled = {
147-
regional = "${element(concat(google_container_cluster.primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
148-
zonal = "${element(concat(google_container_cluster.zonal_primary.*.pod_security_policy_config.0.enabled, list("")), 0)}"
149-
}
150151
cluster_master_auth_list_layer1 = "${local.cluster_type_output_master_auth[local.cluster_type]}"
151152
cluster_master_auth_list_layer2 = "${local.cluster_master_auth_list_layer1[0]}"
152153
cluster_master_auth_map = "${local.cluster_master_auth_list_layer2[0]}"
@@ -170,8 +171,9 @@ locals {
170171
# BETA features
171172
cluster_istio_enabled = "${local.cluster_type_output_istio_enabled[local.cluster_type] ? false : true}"
172173
cluster_cloudrun_enabled = "${local.cluster_type_output_cloudrun_enabled[local.cluster_type] ? false : true}"
173-
# /BETA features
174174
cluster_pod_security_policy_enabled = "${local.cluster_type_output_pod_security_policy_enabled[local.cluster_type] ? true : false}"
175+
176+
# /BETA features
175177
}
176178

177179
/******************************************

‎modules/beta-private-cluster/outputs.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,6 @@ output "service_account" {
112112
description = "The service account to default running nodes as if not overridden in `node_pools`."
113113
value = "${local.service_account}"
114114
}
115-
116115
output "istio_enabled" {
117116
description = "Whether Istio is enabled"
118117
value = "${local.cluster_istio_enabled}"

‎modules/beta-private-cluster/variables.tf‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -86,19 +86,6 @@ variable "master_authorized_networks_config" {
8686
default = []
8787
}
8888

89-
variable "enable_binary_authorization" {
90-
description = "Enable BinAuthZ Admission controller"
91-
default = false
92-
}
93-
94-
variable "pod_security_policy_config" {
95-
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
96-
97-
default = [{
98-
"enabled" = false
99-
}]
100-
}
101-
10289
variable "horizontal_pod_autoscaling" {
10390
description = "Enable horizontal pod autoscaling addon"
10491
default = true
@@ -302,6 +289,19 @@ variable "database_encryption" {
302289
}]
303290
}
304291

292+
variable "enable_binary_authorization" {
293+
description = "Enable BinAuthZ Admission controller"
294+
default = false
295+
}
296+
297+
variable "pod_security_policy_config" {
298+
description = "enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created."
299+
300+
default = [{
301+
"enabled" = false
302+
}]
303+
}
304+
305305
variable "basic_auth_username" {
306306
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
307307
default = ""

0 commit comments

Comments
 (0)