Skip to content

Commit e89d29b

Browse files
martin-kulich-whalebonemartin-kulich-whalebone
authored
feat: add support for in_transit_encryption_config (#2370)
1 parent b62bd0b commit e89d29b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+143
-0
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@ Then perform the following commands on the root folder:
199199
| hpa\_profile | Enable the Horizontal Pod Autoscaling profile for this cluster. Values are "NONE" and "PERFORMANCE". | `string` | `""` | no |
200200
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
201201
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
202+
| in\_transit\_encryption\_config | Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`. | `string` | `null` | no |
202203
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
203204
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. Note: this can be set at the node pool level separately within `node_pools`. | `bool` | `null` | no |
204205
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,8 @@ resource "google_container_cluster" "primary" {
254254
disable_l4_lb_firewall_reconciliation = var.disable_l4_lb_firewall_reconciliation
255255

256256
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
257+
258+
in_transit_encryption_config = var.in_transit_encryption_config
257259

258260
dynamic "secret_manager_config" {
259261
for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []

‎autogen/main/variables.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -696,6 +696,12 @@ variable "enable_cilium_clusterwide_network_policy" {
696696
default = false
697697
}
698698

699+
variable "in_transit_encryption_config" {
700+
type = string
701+
description = "Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`."
702+
default = null
703+
}
704+
699705
variable "security_posture_mode" {
700706
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
701707
type = string

‎cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,8 @@ resource "google_container_cluster" "primary" {
194194

195195
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
196196

197+
in_transit_encryption_config = var.in_transit_encryption_config
198+
197199
dynamic "secret_manager_config" {
198200
for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
199201
content {

‎metadata.display.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,9 @@ spec:
204204
identity_namespace:
205205
name: identity_namespace
206206
title: Identity Namespace
207+
in_transit_encryption_config:
208+
name: in_transit_encryption_config
209+
title: In Transit Encryption Config
207210
initial_node_count:
208211
name: initial_node_count
209212
title: Initial Node Count

‎metadata.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -540,6 +540,9 @@ spec:
540540
description: Enable Cilium Cluster Wide Network Policies on the cluster
541541
varType: bool
542542
defaultValue: false
543+
- name: in_transit_encryption_config
544+
description: Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
545+
varType: string
543546
- name: security_posture_mode
544547
description: Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`.
545548
varType: string

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ Then perform the following commands on the root folder:
118118
| hpa\_profile | Enable the Horizontal Pod Autoscaling profile for this cluster. Values are "NONE" and "PERFORMANCE". | `string` | `""` | no |
119119
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
120120
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
121+
| in\_transit\_encryption\_config | Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`. | `string` | `null` | no |
121122
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. | `bool` | `null` | no |
122123
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
123124
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used. | `string` | `null` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,8 @@ resource "google_container_cluster" "primary" {
114114

115115
enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy
116116

117+
in_transit_encryption_config = var.in_transit_encryption_config
118+
117119
dynamic "secret_manager_config" {
118120
for_each = var.enable_secret_manager_addon ? [var.enable_secret_manager_addon] : []
119121
content {

‎modules/beta-autopilot-private-cluster/metadata.display.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,9 @@ spec:
166166
identity_namespace:
167167
name: identity_namespace
168168
title: Identity Namespace
169+
in_transit_encryption_config:
170+
name: in_transit_encryption_config
171+
title: In Transit Encryption Config
169172
insecure_kubelet_readonly_port_enabled:
170173
name: insecure_kubelet_readonly_port_enabled
171174
title: Insecure Kubelet Readonly Port Enabled

‎modules/beta-autopilot-private-cluster/metadata.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,9 @@ spec:
375375
description: Enable Cilium Cluster Wide Network Policies on the cluster
376376
varType: bool
377377
defaultValue: false
378+
- name: in_transit_encryption_config
379+
description: Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
380+
varType: string
378381
- name: security_posture_mode
379382
description: Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`.
380383
varType: string

0 commit comments

Comments
 (0)