Skip to content

Commit 8e92f6e

Browse files
MajorBreakfastMajorBreakfast
authored
fix: set image_type, machine_type, and sandboxing on default node pool to comply with validation policies (terraform-google-modules#1038)
1 parent bb86214 commit 8e92f6e

File tree

8 files changed

+118
-8
lines changed

8 files changed

+118
-8
lines changed

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,13 @@ resource "google_container_cluster" "primary" {
252252
initial_node_count = var.initial_node_count
253253

254254
node_config {
255+
{% if beta_cluster %}
256+
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
257+
{% else %}
258+
image_type = lookup(var.node_pools[0], "image_type", "COS")
259+
{% endif %}
260+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
261+
255262
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
256263

257264
dynamic "workload_metadata_config" {
@@ -263,6 +270,22 @@ resource "google_container_cluster" "primary" {
263270
}
264271

265272
metadata = local.node_pools_metadata["all"]
273+
274+
{% if beta_cluster %}
275+
dynamic "sandbox_config" {
276+
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
277+
content {
278+
sandbox_type = sandbox_config.value
279+
}
280+
}
281+
282+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
283+
{% endif %}
284+
285+
shielded_instance_config {
286+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
287+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
288+
}
266289
}
267290
}
268291

@@ -635,4 +658,3 @@ resource "google_container_node_pool" "pools" {
635658
delete = "45m"
636659
}
637660
}
638-

‎cluster.tf‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ resource "google_container_cluster" "primary" {
138138
initial_node_count = var.initial_node_count
139139

140140
node_config {
141+
image_type = lookup(var.node_pools[0], "image_type", "COS")
142+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
143+
141144
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
142145

143146
dynamic "workload_metadata_config" {
@@ -149,6 +152,12 @@ resource "google_container_cluster" "primary" {
149152
}
150153

151154
metadata = local.node_pools_metadata["all"]
155+
156+
157+
shielded_instance_config {
158+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
159+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
160+
}
152161
}
153162
}
154163

@@ -330,4 +339,3 @@ resource "google_container_node_pool" "pools" {
330339
delete = "45m"
331340
}
332341
}
333-

‎modules/beta-private-cluster-update-variant/cluster.tf‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,9 @@ resource "google_container_cluster" "primary" {
225225
initial_node_count = var.initial_node_count
226226

227227
node_config {
228+
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
229+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
230+
228231
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
229232

230233
dynamic "workload_metadata_config" {
@@ -236,6 +239,20 @@ resource "google_container_cluster" "primary" {
236239
}
237240

238241
metadata = local.node_pools_metadata["all"]
242+
243+
dynamic "sandbox_config" {
244+
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
245+
content {
246+
sandbox_type = sandbox_config.value
247+
}
248+
}
249+
250+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
251+
252+
shielded_instance_config {
253+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
254+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
255+
}
239256
}
240257
}
241258

@@ -578,4 +595,3 @@ resource "google_container_node_pool" "pools" {
578595
delete = "45m"
579596
}
580597
}
581-

‎modules/beta-private-cluster/cluster.tf‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,9 @@ resource "google_container_cluster" "primary" {
225225
initial_node_count = var.initial_node_count
226226

227227
node_config {
228+
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
229+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
230+
228231
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
229232

230233
dynamic "workload_metadata_config" {
@@ -236,6 +239,20 @@ resource "google_container_cluster" "primary" {
236239
}
237240

238241
metadata = local.node_pools_metadata["all"]
242+
243+
dynamic "sandbox_config" {
244+
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
245+
content {
246+
sandbox_type = sandbox_config.value
247+
}
248+
}
249+
250+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
251+
252+
shielded_instance_config {
253+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
254+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
255+
}
239256
}
240257
}
241258

@@ -493,4 +510,3 @@ resource "google_container_node_pool" "pools" {
493510
delete = "45m"
494511
}
495512
}
496-

‎modules/beta-public-cluster-update-variant/cluster.tf‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,9 @@ resource "google_container_cluster" "primary" {
225225
initial_node_count = var.initial_node_count
226226

227227
node_config {
228+
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
229+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
230+
228231
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
229232

230233
dynamic "workload_metadata_config" {
@@ -236,6 +239,20 @@ resource "google_container_cluster" "primary" {
236239
}
237240

238241
metadata = local.node_pools_metadata["all"]
242+
243+
dynamic "sandbox_config" {
244+
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
245+
content {
246+
sandbox_type = sandbox_config.value
247+
}
248+
}
249+
250+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
251+
252+
shielded_instance_config {
253+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
254+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
255+
}
239256
}
240257
}
241258

@@ -559,4 +576,3 @@ resource "google_container_node_pool" "pools" {
559576
delete = "45m"
560577
}
561578
}
562-

‎modules/beta-public-cluster/cluster.tf‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,9 @@ resource "google_container_cluster" "primary" {
225225
initial_node_count = var.initial_node_count
226226

227227
node_config {
228+
image_type = lookup(var.node_pools[0], "image_type", lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled) ? "COS_CONTAINERD" : "COS")
229+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
230+
228231
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
229232

230233
dynamic "workload_metadata_config" {
@@ -236,6 +239,20 @@ resource "google_container_cluster" "primary" {
236239
}
237240

238241
metadata = local.node_pools_metadata["all"]
242+
243+
dynamic "sandbox_config" {
244+
for_each = tobool((lookup(var.node_pools[0], "sandbox_enabled", var.sandbox_enabled))) ? ["gvisor"] : []
245+
content {
246+
sandbox_type = sandbox_config.value
247+
}
248+
}
249+
250+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
251+
252+
shielded_instance_config {
253+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
254+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
255+
}
239256
}
240257
}
241258

@@ -474,4 +491,3 @@ resource "google_container_node_pool" "pools" {
474491
delete = "45m"
475492
}
476493
}
477-

‎modules/private-cluster-update-variant/cluster.tf‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ resource "google_container_cluster" "primary" {
138138
initial_node_count = var.initial_node_count
139139

140140
node_config {
141+
image_type = lookup(var.node_pools[0], "image_type", "COS")
142+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
143+
141144
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
142145

143146
dynamic "workload_metadata_config" {
@@ -149,6 +152,12 @@ resource "google_container_cluster" "primary" {
149152
}
150153

151154
metadata = local.node_pools_metadata["all"]
155+
156+
157+
shielded_instance_config {
158+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
159+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
160+
}
152161
}
153162
}
154163

@@ -428,4 +437,3 @@ resource "google_container_node_pool" "pools" {
428437
delete = "45m"
429438
}
430439
}
431-

‎modules/private-cluster/cluster.tf‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ resource "google_container_cluster" "primary" {
138138
initial_node_count = var.initial_node_count
139139

140140
node_config {
141+
image_type = lookup(var.node_pools[0], "image_type", "COS")
142+
machine_type = lookup(var.node_pools[0], "machine_type", "e2-medium")
143+
141144
service_account = lookup(var.node_pools[0], "service_account", local.service_account)
142145

143146
dynamic "workload_metadata_config" {
@@ -149,6 +152,12 @@ resource "google_container_cluster" "primary" {
149152
}
150153

151154
metadata = local.node_pools_metadata["all"]
155+
156+
157+
shielded_instance_config {
158+
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)
159+
enable_integrity_monitoring = lookup(var.node_pools[0], "enable_integrity_monitoring", true)
160+
}
152161
}
153162
}
154163

@@ -343,4 +352,3 @@ resource "google_container_node_pool" "pools" {
343352
delete = "45m"
344353
}
345354
}
346-

0 commit comments

Comments
 (0)