Skip to content

Commit f27a2dd

Browse files
DrFaust92DrFaust92
authored
feat: add support for anonymous_authentication_config (#2436)
Signed-off-by: drfaust92 <[email protected]>
1 parent b61584c commit f27a2dd

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+193
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,7 @@ Then perform the following commands on the root folder:
146146
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
147147
| additional\_ip\_ranges\_config | the configuration for individual additional subnetworks attached to the cluster | `list(object({ subnetwork = string, pod_ipv4_range_names = list(string) }))` | `[]` | no |
148148
| additive\_vpc\_scope\_dns\_domain | This will enable Cloud DNS additive VPC scope. Must provide a domain name that is unique within the VPC. For this to work cluster\_dns = `CLOUD_DNS` and cluster\_dns\_scope = `CLUSTER_SCOPE` must both be set as well. | `string` | `""` | no |
149+
| anonymous\_authentication\_config\_mode | Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`. | `string` | `null` | no |
149150
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
150151
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
151152
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = optional(number)<br> max_cpu_cores = optional(number)<br> min_memory_gb = optional(number)<br> max_memory_gb = optional(number)<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,13 @@ resource "google_container_cluster" "primary" {
276276

277277
in_transit_encryption_config = var.in_transit_encryption_config
278278

279+
dynamic "anonymous_authentication_config" {
280+
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
281+
content {
282+
mode = var.anonymous_authentication_config_mode
283+
}
284+
}
285+
279286
dynamic "network_performance_config" {
280287
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
281288
content {

‎autogen/main/variables.tf.tmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -728,6 +728,12 @@ variable "in_transit_encryption_config" {
728728
default = null
729729
}
730730

731+
variable "anonymous_authentication_config_mode" {
732+
description = "Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`."
733+
type = string
734+
default = null
735+
}
736+
731737
variable "total_egress_bandwidth_tier" {
732738
type = string
733739
description = "Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`."

‎cluster.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,13 @@ resource "google_container_cluster" "primary" {
214214

215215
in_transit_encryption_config = var.in_transit_encryption_config
216216

217+
dynamic "anonymous_authentication_config" {
218+
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
219+
content {
220+
mode = var.anonymous_authentication_config_mode
221+
}
222+
}
223+
217224
dynamic "network_performance_config" {
218225
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
219226
content {

‎metadata.display.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ spec:
4848
additive_vpc_scope_dns_domain:
4949
name: additive_vpc_scope_dns_domain
5050
title: Additive Vpc Scope Dns Domain
51+
anonymous_authentication_config_mode:
52+
name: anonymous_authentication_config_mode
53+
title: Anonymous Authentication Config Mode
5154
authenticator_security_group:
5255
name: authenticator_security_group
5356
title: Authenticator Security Group

‎metadata.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -570,6 +570,9 @@ spec:
570570
- name: in_transit_encryption_config
571571
description: Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
572572
varType: string
573+
- name: anonymous_authentication_config_mode
574+
description: Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`.
575+
varType: string
573576
- name: total_egress_bandwidth_tier
574577
description: Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`.
575578
varType: string

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ Then perform the following commands on the root folder:
7979
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
8080
| additional\_ip\_ranges\_config | the configuration for individual additional subnetworks attached to the cluster | `list(object({ subnetwork = string, pod_ipv4_range_names = list(string) }))` | `[]` | no |
8181
| allow\_net\_admin | (Optional) Enable NET\_ADMIN for the cluster. | `bool` | `null` | no |
82+
| anonymous\_authentication\_config\_mode | Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`. | `string` | `null` | no |
8283
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
8384
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
8485
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | `string` | `null` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,13 @@ resource "google_container_cluster" "primary" {
134134

135135
in_transit_encryption_config = var.in_transit_encryption_config
136136

137+
dynamic "anonymous_authentication_config" {
138+
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
139+
content {
140+
mode = var.anonymous_authentication_config_mode
141+
}
142+
}
143+
137144
dynamic "network_performance_config" {
138145
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
139146
content {

‎modules/beta-autopilot-private-cluster/metadata.display.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ spec:
4949
allow_net_admin:
5050
name: allow_net_admin
5151
title: Allow Net Admin
52+
anonymous_authentication_config_mode:
53+
name: anonymous_authentication_config_mode
54+
title: Anonymous Authentication Config Mode
5255
authenticator_security_group:
5356
name: authenticator_security_group
5457
title: Authenticator Security Group

‎modules/beta-autopilot-private-cluster/metadata.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,9 @@ spec:
399399
- name: in_transit_encryption_config
400400
description: Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
401401
varType: string
402+
- name: anonymous_authentication_config_mode
403+
description: Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`.
404+
varType: string
402405
- name: total_egress_bandwidth_tier
403406
description: Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`.
404407
varType: string

0 commit comments

Comments
 (0)