Skip to content

Commit d90503a

Browse files
DrFaust92DrFaust92
committed
add support for rbac_binding_config
Signed-off-by: drfaust92 <[email protected]>
1 parent 85c0487 commit d90503a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+289
-21
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,7 @@ Then perform the following commands on the root folder:
250250
| parallelstore\_csi\_driver | Whether the Parallelstore CSI driver Addon is enabled for this cluster. | `bool` | `null` | no |
251251
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
252252
| ray\_operator\_config | The Ray Operator Addon configuration for this cluster. | <pre>object({<br> enabled = bool<br> logging_enabled = optional(bool, false)<br> monitoring_enabled = optional(bool, false)<br> })</pre> | <pre>{<br> "enabled": false,<br> "logging_enabled": false,<br> "monitoring_enabled": false<br>}</pre> | no |
253+
| rbac\_binding\_config | RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created. | <pre>object({<br> enable_insecure_binding_system_unauthenticated = optional(bool, false)<br> enable_insecure_binding_system_authenticated = optional(bool, false)<br> })</pre> | n/a | yes |
253254
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
254255
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
255256
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,14 @@ resource "google_container_cluster" "primary" {
274274
}
275275
}
276276

277+
dynamic "rbac_binding_config" {
278+
for_each = var.rbac_binding_config
279+
content {
280+
enable_insecure_binding_system_unauthenticated = rbac_binding_config.value["enable_insecure_binding_system_unauthenticated"]
281+
enable_insecure_binding_system_authenticated = rbac_binding_config.value["enable_insecure_binding_system_authenticated"]
282+
}
283+
}
284+
277285
dynamic "secret_manager_config" {
278286
for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
279287
content {

‎autogen/main/variables.tf.tmpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1149,3 +1149,11 @@ variable "ip_endpoints_enabled" {
11491149
type = bool
11501150
default = null
11511151
}
1152+
1153+
variable "rbac_binding_config" {
1154+
type = object({
1155+
enable_insecure_binding_system_unauthenticated = optional(bool, false)
1156+
enable_insecure_binding_system_authenticated = optional(bool, false)
1157+
})
1158+
description = "RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created."
1159+
}

‎autogen/main/versions.tf.tmpl‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,33 +24,33 @@ terraform {
2424
required_providers {
2525
google = {
2626
source = "hashicorp/google"
27-
version = ">= 6.42.0, < 7"
27+
version = ">= 6.47.0, < 7"
2828
}
2929
google-beta = {
3030
source = "hashicorp/google-beta"
31-
version = ">= 6.42.0, < 7"
31+
version = ">= 6.47.0, < 7"
3232
}
3333
{% elif beta_cluster and autopilot_cluster %}
3434
required_providers {
3535
google = {
3636
source = "hashicorp/google"
37-
version = ">= 6.42.0, < 7"
37+
version = ">= 6.47.0, < 7"
3838
}
3939
google-beta = {
4040
source = "hashicorp/google-beta"
41-
version = ">= 6.42.0, < 7"
41+
version = ">= 6.47.0, < 7"
4242
}
4343
{% elif autopilot_cluster %}
4444
required_providers {
4545
google = {
4646
source = "hashicorp/google"
47-
version = ">= 6.42.0, < 7"
47+
version = ">= 6.47.0, < 7"
4848
}
4949
{% else %}
5050
required_providers {
5151
google = {
5252
source = "hashicorp/google"
53-
version = ">= 6.42.0, < 7"
53+
version = ">= 6.47.0, < 7"
5454
}
5555
{% endif %}
5656
kubernetes = {

‎cluster.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,14 @@ resource "google_container_cluster" "primary" {
213213
}
214214
}
215215

216+
dynamic "rbac_binding_config" {
217+
for_each = var.rbac_binding_config
218+
content {
219+
enable_insecure_binding_system_unauthenticated = rbac_binding_config.value["enable_insecure_binding_system_unauthenticated"]
220+
enable_insecure_binding_system_authenticated = rbac_binding_config.value["enable_insecure_binding_system_authenticated"]
221+
}
222+
}
223+
216224
dynamic "secret_manager_config" {
217225
for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
218226
content {

‎metadata.display.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,9 @@ spec:
357357
ray_operator_config:
358358
name: ray_operator_config
359359
title: Ray Operator Config
360+
rbac_binding_config:
361+
name: rbac_binding_config
362+
title: Rbac Binding Config
360363
region:
361364
name: region
362365
title: Region

‎metadata.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -754,6 +754,14 @@ spec:
754754
- name: ip_endpoints_enabled
755755
description: (Optional) Controls whether to allow direct IP access. Defaults to `true`.
756756
varType: bool
757+
- name: rbac_binding_config
758+
description: RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created.
759+
varType: |-
760+
object({
761+
enable_insecure_binding_system_unauthenticated = optional(bool, false)
762+
enable_insecure_binding_system_authenticated = optional(bool, false)
763+
})
764+
required: true
757765
outputs:
758766
- name: ca_certificate
759767
description: Cluster ca certificate (base64 encoded)

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,7 @@ Then perform the following commands on the root folder:
147147
| private\_endpoint\_subnetwork | The subnetwork to use for the hosted master network. | `string` | `null` | no |
148148
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
149149
| ray\_operator\_config | The Ray Operator Addon configuration for this cluster. | <pre>object({<br> enabled = bool<br> logging_enabled = optional(bool, false)<br> monitoring_enabled = optional(bool, false)<br> })</pre> | <pre>{<br> "enabled": false,<br> "logging_enabled": false,<br> "monitoring_enabled": false<br>}</pre> | no |
150+
| rbac\_binding\_config | RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created. | <pre>object({<br> enable_insecure_binding_system_unauthenticated = optional(bool, false)<br> enable_insecure_binding_system_authenticated = optional(bool, false)<br> })</pre> | n/a | yes |
150151
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
151152
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
152153
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,14 @@ resource "google_container_cluster" "primary" {
133133
}
134134
}
135135

136+
dynamic "rbac_binding_config" {
137+
for_each = var.rbac_binding_config
138+
content {
139+
enable_insecure_binding_system_unauthenticated = rbac_binding_config.value["enable_insecure_binding_system_unauthenticated"]
140+
enable_insecure_binding_system_authenticated = rbac_binding_config.value["enable_insecure_binding_system_authenticated"]
141+
}
142+
}
143+
136144
dynamic "secret_manager_config" {
137145
for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
138146
content {

‎modules/beta-autopilot-private-cluster/metadata.display.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,9 @@ spec:
262262
ray_operator_config:
263263
name: ray_operator_config
264264
title: Ray Operator Config
265+
rbac_binding_config:
266+
name: rbac_binding_config
267+
title: Rbac Binding Config
265268
region:
266269
name: region
267270
title: Region

0 commit comments

Comments
 (0)