feat: Add firewall support safer-cluster modules (terraform-google-modules#570)

Author: Dev25

.kitchen.yml

@@ -51,6 +51,12 @@ suites:
  systems:
  - name: safer_cluster
  backend: local
+ controls:
+ - gcloud
+ - name: inspec-gcp
+ backend: gcp
+ controls:
+ - network
  - name: "simple_regional"
  driver:
  root_module_directory: test/fixtures/simple_regional

autogen/main/cluster.tf.tmpl

@@ -509,7 +509,7 @@ resource "google_container_node_pool" "pools" {
  {% endif %}
 
  shielded_instance_config {
- enable_secure_boot =  lookup(each.value, "enable_secure_boot", false)
+ enable_secure_boot  = lookup(each.value, "enable_secure_boot", false)
  enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
  }
  }

autogen/main/firewall.tf.tmpl

@@ -48,9 +48,11 @@ resource "google_compute_firewall" "intra_egress" {
  allow { protocol = "esp" }
  allow { protocol = "ah" }
 
+ {% if not private_cluster %}
  depends_on = [
  google_container_cluster.primary,
  ]
+ {% endif %}
 }
 
 
@@ -77,8 +79,10 @@ resource "google_compute_firewall" "master_webhooks" {
  ports = var.firewall_inbound_ports
  }
 
+ {% if not private_cluster %}
  depends_on = [
  google_container_cluster.primary,
  ]
+ {% endif %}
 
 }

autogen/safer-cluster/main.tf.tmpl

@@ -49,6 +49,10 @@ module "gke" {
  ip_range_pods = var.ip_range_pods
  ip_range_services = var.ip_range_services
 
+ add_cluster_firewall_rules = var.add_cluster_firewall_rules
+ firewall_priority = var.firewall_priority
+ firewall_inbound_ports = var.firewall_inbound_ports
+
  horizontal_pod_autoscaling = var.horizontal_pod_autoscaling
  http_load_balancing = var.http_load_balancing
 

autogen/safer-cluster/variables.tf.tmpl

@@ -342,3 +342,21 @@ variable "gce_pd_csi_driver" {
  description = "(Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver."
  default = true
 }
+
+variable "add_cluster_firewall_rules" {
+ type = bool
+ description = "Create additional firewall rules"
+ default = false
+}
+
+variable "firewall_priority" {
+ type = number
+ description = "Priority rule for firewall rules"
+ default = 1000
+}
+
+variable "firewall_inbound_ports" {
+ type = list(string)
+ description = "List of TCP ports for admission/webhook controllers"
+ default = ["8443", "9443", "15017"]
+}

examples/safer_cluster/main.tf

@@ -49,6 +49,8 @@ module "gke" {
  ip_range_services = local.svc_range_name
  compute_engine_service_account = var.compute_engine_service_account
  master_ipv4_cidr_block = "172.16.0.0/28"
+ add_cluster_firewall_rules = true
+ firewall_inbound_ports = ["9443", "15017"]
 
  master_authorized_networks = [
  {

modules/beta-private-cluster-update-variant/firewall.tf

@@ -48,9 +48,6 @@ resource "google_compute_firewall" "intra_egress" {
  allow { protocol = "esp" }
  allow { protocol = "ah" }
 
- depends_on = [
- google_container_cluster.primary,
- ]
 }
 
 
@@ -77,8 +74,5 @@ resource "google_compute_firewall" "master_webhooks" {
  ports = var.firewall_inbound_ports
  }
 
- depends_on = [
- google_container_cluster.primary,
- ]
 
 }

modules/beta-private-cluster/firewall.tf

@@ -48,9 +48,6 @@ resource "google_compute_firewall" "intra_egress" {
  allow { protocol = "esp" }
  allow { protocol = "ah" }
 
- depends_on = [
- google_container_cluster.primary,
- ]
 }
 
 
@@ -77,8 +74,5 @@ resource "google_compute_firewall" "master_webhooks" {
  ports = var.firewall_inbound_ports
  }
 
- depends_on = [
- google_container_cluster.primary,
- ]
 
 }

modules/private-cluster-update-variant/firewall.tf

@@ -48,9 +48,6 @@ resource "google_compute_firewall" "intra_egress" {
  allow { protocol = "esp" }
  allow { protocol = "ah" }
 
- depends_on = [
- google_container_cluster.primary,
- ]
 }
 
 
@@ -77,8 +74,5 @@ resource "google_compute_firewall" "master_webhooks" {
  ports = var.firewall_inbound_ports
  }
 
- depends_on = [
- google_container_cluster.primary,
- ]
 
 }

modules/private-cluster/firewall.tf

@@ -48,9 +48,6 @@ resource "google_compute_firewall" "intra_egress" {
  allow { protocol = "esp" }
  allow { protocol = "ah" }
 
- depends_on = [
- google_container_cluster.primary,
- ]
 }
 
 
@@ -77,8 +74,5 @@ resource "google_compute_firewall" "master_webhooks" {
  ports = var.firewall_inbound_ports
  }
 
- depends_on = [
- google_container_cluster.primary,
- ]
 
 }