Skip to content

Commit f15c674

Browse files
aaron-laneaaron-lane
authored
Merge pull request #203 from marko7460/node_metadata
Restrict node access to cluster metadata service
2 parents 1d64f99 + 589e7c9 commit f15c674

File tree

28 files changed

+432
-0
lines changed

28 files changed

+432
-0
lines changed

‎.kitchen.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,3 +104,10 @@ suites:
104104
systems:
105105
- name: stub_domains_private
106106
backend: local
107+
- name: "workload_metadata_config"
108+
driver:
109+
root_module_directory: test/fixtures/workload_metadata_config
110+
verifier:
111+
systems:
112+
- name: workload_metadata_config
113+
backend: local

‎autogen/cluster_regional.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,9 @@ resource "google_container_cluster" "primary" {
106106

107107
node_config {
108108
service_account = "${lookup(var.node_pools[0], "service_account", local.service_account)}"
109+
{% if beta_cluster %}
110+
workload_metadata_config = "${local.cluster_node_metadata_config["${var.node_metadata == "UNSPECIFIED" ? "unspecified" : "specified"}"]}"
111+
{% endif %}
109112
}
110113
}
111114
{% if private_cluster %}
@@ -168,6 +171,10 @@ resource "google_container_node_pool" "pools" {
168171
type = "${lookup(var.node_pools[count.index], "accelerator_type", "")}"
169172
count = "${lookup(var.node_pools[count.index], "accelerator_count", 0)}"
170173
}
174+
{% if beta_cluster %}
175+
176+
workload_metadata_config = "${local.cluster_node_metadata_config["${var.node_metadata == "UNSPECIFIED" ? "unspecified" : "specified"}"]}"
177+
{% endif %}
171178
}
172179

173180
lifecycle {

‎autogen/cluster_zonal.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,9 @@ resource "google_container_cluster" "zonal_primary" {
107107

108108
node_config {
109109
service_account = "${lookup(var.node_pools[0], "service_account", local.service_account)}"
110+
{% if beta_cluster %}
111+
workload_metadata_config = "${local.cluster_node_metadata_config["${var.node_metadata == "UNSPECIFIED" ? "unspecified" : "specified"}"]}"
112+
{% endif %}
110113
}
111114
}
112115
{% if private_cluster %}
@@ -169,6 +172,10 @@ resource "google_container_node_pool" "zonal_pools" {
169172
type = "${lookup(var.node_pools[count.index], "accelerator_type", "")}"
170173
count = "${lookup(var.node_pools[count.index], "accelerator_count", 0)}"
171174
}
175+
{% if beta_cluster %}
176+
177+
workload_metadata_config = "${local.cluster_node_metadata_config["${var.node_metadata == "UNSPECIFIED" ? "unspecified" : "specified"}"]}"
178+
{% endif %}
172179
}
173180

174181
lifecycle {

‎autogen/main.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,14 @@ locals {
5252
enabled = [{disabled = "false"}]
5353
disabled = []
5454
}
55+
{% if beta_cluster %}
56+
57+
cluster_node_metadata_config = {
58+
specified = [{node_metadata = "${var.node_metadata}"}]
59+
unspecified = []
60+
}
5561

62+
{% endif %}
5663
cluster_type_output_name = {
5764
regional = "${element(concat(google_container_cluster.primary.*.name, list("")), 0)}"
5865
zonal = "${element(concat(google_container_cluster.zonal_primary.*.name, list("")), 0)}"

‎autogen/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,11 @@ variable "pod_security_policy_config" {
300300
"enabled" = false
301301
}]
302302
}
303+
304+
variable "node_metadata" {
305+
description = "Specifies how node metadata is exposed to the workload running on the node"
306+
default = "UNSPECIFIED"
307+
}
303308
{% endif %}
304309

305310
variable "basic_auth_username" {

‎examples/workload_metadata_config/README.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Workload Metadata Config Cluster
2+
3+
This example illustrates how to use a cluster with `workload_metadata_config` defined.
4+
5+
[^]: (autogen_docs_start)
6+
7+
## Inputs
8+
9+
| Name | Description | Type | Default | Required |
10+
|------|-------------|:----:|:-----:|:-----:|
11+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
12+
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
13+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
14+
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
15+
| network | The VPC network to host the cluster in | string | n/a | yes |
16+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
17+
| region | The region to host the cluster in | string | n/a | yes |
18+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
19+
| zones | The zone to host the cluster in (required if is a zonal cluster) | list | n/a | yes |
20+
21+
## Outputs
22+
23+
| Name | Description |
24+
|------|-------------|
25+
| ca\_certificate | |
26+
| client\_token | |
27+
| cluster\_name | Cluster name |
28+
| ip\_range\_pods | The secondary IP range used for pods |
29+
| ip\_range\_services | The secondary IP range used for services |
30+
| kubernetes\_endpoint | |
31+
| location | |
32+
| master\_kubernetes\_version | The master Kubernetes version |
33+
| network | |
34+
| project\_id | |
35+
| region | |
36+
| service\_account | The service account to default running nodes as if not overridden in `node_pools`. |
37+
| subnetwork | |
38+
| zones | List of zones in which the cluster resides |
39+
40+
[^]: (autogen_docs_end)
41+
42+
To provision this example, run the following from within this directory:
43+
- `terraform init` to get the plugins
44+
- `terraform plan` to see the infrastructure plan
45+
- `terraform apply` to apply the infrastructure build
46+
- `terraform destroy` to destroy the built infrastructure

‎examples/workload_metadata_config/main.tf‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "workload-metadata-private"
19+
}
20+
21+
provider "google-beta" {
22+
version = "~> 2.9.0"
23+
region = "${var.region}"
24+
}
25+
26+
data "google_compute_subnetwork" "subnetwork" {
27+
name = "${var.subnetwork}"
28+
project = "${var.project_id}"
29+
region = "${var.region}"
30+
}
31+
32+
module "gke" {
33+
source = "../../modules/beta-private-cluster/"
34+
project_id = "${var.project_id}"
35+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
36+
regional = false
37+
region = "${var.region}"
38+
zones = "${var.zones}"
39+
network = "${var.network}"
40+
subnetwork = "${var.subnetwork}"
41+
ip_range_pods = "${var.ip_range_pods}"
42+
ip_range_services = "${var.ip_range_services}"
43+
service_account = "${var.compute_engine_service_account}"
44+
enable_private_endpoint = true
45+
enable_private_nodes = true
46+
master_ipv4_cidr_block = "172.16.0.0/28"
47+
node_metadata = "SECURE"
48+
49+
master_authorized_networks_config = [{
50+
cidr_blocks = [{
51+
cidr_block = "${data.google_compute_subnetwork.subnetwork.ip_cidr_range}"
52+
display_name = "VPC"
53+
}]
54+
}]
55+
}
56+
57+
data "google_client_config" "default" {}

‎examples/workload_metadata_config/outputs.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = "${module.gke.endpoint}"
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = "${base64encode(data.google_client_config.default.access_token)}"
25+
}
26+
27+
output "ca_certificate" {
28+
value = "${module.gke.ca_certificate}"
29+
}
30+
31+
output "service_account" {
32+
description = "The service account to default running nodes as if not overridden in `node_pools`."
33+
value = "${module.gke.service_account}"
34+
}

‎examples/workload_metadata_config/test_outputs.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../test/fixtures/all_examples/test_outputs.tf

‎examples/workload_metadata_config/variables.tf‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "The project ID to host the cluster in"
19+
}
20+
21+
variable "cluster_name_suffix" {
22+
description = "A suffix to append to the default cluster name"
23+
default = ""
24+
}
25+
26+
variable "region" {
27+
description = "The region to host the cluster in"
28+
}
29+
30+
variable "zones" {
31+
type = "list"
32+
description = "The zone to host the cluster in (required if is a zonal cluster)"
33+
}
34+
35+
variable "network" {
36+
description = "The VPC network to host the cluster in"
37+
}
38+
39+
variable "subnetwork" {
40+
description = "The subnetwork to host the cluster in"
41+
}
42+
43+
variable "ip_range_pods" {
44+
description = "The secondary ip range to use for pods"
45+
}
46+
47+
variable "ip_range_services" {
48+
description = "The secondary ip range to use for pods"
49+
}
50+
51+
variable "compute_engine_service_account" {
52+
description = "Service account to associate to the nodes in the cluster"
53+
}

0 commit comments

Comments
 (0)