Skip to content

Commit 77787f2

Browse files
mmorejonmmorejon
committed
feat: add security posture
Signed-off-by: Manuel Morejon <manuel@mmorejon.io>
1 parent abdba8c commit 77787f2

File tree

37 files changed

+250
-0
lines changed

37 files changed

+250
-0
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,8 @@ Then perform the following commands on the root folder:
212212
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
213213
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
214214
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
215+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
216+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
215217
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
216218
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
217219
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,12 @@ resource "google_container_cluster" "primary" {
332332
workload_vulnerability_mode = var.workload_vulnerability_mode
333333
}
334334
{% endif %}
335+
336+
security_posture_config {
337+
mode = var.security_posture_mode
338+
vulnerability_mode = var.security_posture_vulnerability_mode
339+
}
340+
335341
ip_allocation_policy {
336342
cluster_secondary_range_name = var.ip_range_pods
337343
services_secondary_range_name = var.ip_range_services

‎autogen/main/variables.tf.tmpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,18 @@ variable "workload_config_audit_mode" {
561561
}
562562
{% endif %}
563563

564+
variable "security_posture_mode" {
565+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
566+
type = string
567+
default = "DISABLED"
568+
}
569+
570+
variable "security_posture_vulnerability_mode" {
571+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
572+
type = string
573+
default = "VULNERABILITY_DISABLED"
574+
}
575+
564576
variable "disable_default_snat" {
565577
type = bool
566578
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎autogen/safer-cluster/main.tf.tmpl‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,4 +200,8 @@ module "gke" {
200200
timeouts = var.timeouts
201201

202202
enable_gcfs = var.enable_gcfs
203+
204+
// Enabling security posture
205+
security_posture_mode = var.security_posture_mode
206+
security_posture_vulnerability_mode = var.security_posture_vulnerability_mode
203207
}

‎autogen/safer-cluster/variables.tf.tmpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -463,6 +463,18 @@ variable "gke_backup_agent_config" {
463463
default = false
464464
}
465465

466+
variable "security_posture_mode" {
467+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
468+
type = string
469+
default = "DISABLED"
470+
}
471+
472+
variable "security_posture_vulnerability_mode" {
473+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`."
474+
type = string
475+
default = null
476+
}
477+
466478
variable "disable_default_snat" {
467479
type = bool
468480
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎cluster.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,12 @@ resource "google_container_cluster" "primary" {
211211

212212
datapath_provider = var.datapath_provider
213213

214+
215+
security_posture_config {
216+
mode = var.security_posture_mode
217+
vulnerability_mode = var.security_posture_vulnerability_mode
218+
}
219+
214220
ip_allocation_policy {
215221
cluster_secondary_range_name = var.ip_range_pods
216222
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,8 @@ Then perform the following commands on the root folder:
125125
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
126126
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
127127
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
128+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
129+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
128130
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
129131
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
130132
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,12 @@ resource "google_container_cluster" "primary" {
135135
}
136136
workload_vulnerability_mode = var.workload_vulnerability_mode
137137
}
138+
139+
security_posture_config {
140+
mode = var.security_posture_mode
141+
vulnerability_mode = var.security_posture_vulnerability_mode
142+
}
143+
138144
ip_allocation_policy {
139145
cluster_secondary_range_name = var.ip_range_pods
140146
services_secondary_range_name = var.ip_range_services

‎modules/beta-autopilot-private-cluster/variables.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -385,6 +385,18 @@ variable "workload_config_audit_mode" {
385385
default = "DISABLED"
386386
}
387387

388+
variable "security_posture_mode" {
389+
description = "Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`."
390+
type = string
391+
default = "DISABLED"
392+
}
393+
394+
variable "security_posture_vulnerability_mode" {
395+
description = "Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`."
396+
type = string
397+
default = "VULNERABILITY_DISABLED"
398+
}
399+
388400
variable "disable_default_snat" {
389401
type = bool
390402
description = "Whether to disable the default SNAT to support the private use of public IP addresses"

‎modules/beta-autopilot-public-cluster/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,8 @@ Then perform the following commands on the root folder:
114114
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
115115
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. | `string` | `"REGULAR"` | no |
116116
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |
117+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. | `string` | `"DISABLED"` | no |
118+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED` and `VULNERABILITY_BASIC`. Defaults to `VULNERABILITY_DISABLED`. | `string` | `"VULNERABILITY_DISABLED"` | no |
117119
| service\_account | The service account to run nodes as if not overridden in `node_pools`. The create\_service\_account variable default value (true) will cause a cluster-specific service account to be created. This service account should already exists and it will be used by the node pools. If you wish to only override the service account name, you can use service\_account\_name variable. | `string` | `""` | no |
118120
| service\_account\_name | The name of the service account that will be created if create\_service\_account is true. If you wish to use an existing service account, use service\_account variable. | `string` | `""` | no |
119121
| service\_external\_ips | Whether external ips specified by a service will be allowed in this cluster | `bool` | `false` | no |

0 commit comments

Comments
 (0)