From 066149d417bc98cff1feefb8edcb16c7f45a2b51 Mon Sep 17 00:00:00 2001 From: Jonathan Meyers Date: Tue, 24 May 2022 06:31:39 -1000 Subject: [PATCH] feat: support database encryption and google group rbac for autopilot (#1265) * feat: database encryption and google rbac for autopilot * chore: cleanup ordering * chore: cleanup ordering vars * chore: more cleanup --- autogen/main/cluster.tf.tmpl | 5 +++-- autogen/main/variables.tf.tmpl | 2 ++ cluster.tf | 1 + .../beta-autopilot-private-cluster/README.md | 1 + .../beta-autopilot-private-cluster/cluster.tf | 17 +++++++++++++++++ .../beta-autopilot-private-cluster/variables.tf | 10 ++++++++++ modules/beta-autopilot-public-cluster/README.md | 1 + .../beta-autopilot-public-cluster/cluster.tf | 17 +++++++++++++++++ .../beta-autopilot-public-cluster/variables.tf | 10 ++++++++++ .../cluster.tf | 1 + modules/beta-private-cluster/cluster.tf | 1 + .../cluster.tf | 1 + modules/beta-public-cluster/cluster.tf | 1 + .../private-cluster-update-variant/cluster.tf | 1 + modules/private-cluster/cluster.tf | 1 + 15 files changed, 68 insertions(+), 2 deletions(-) diff --git a/autogen/main/cluster.tf.tmpl b/autogen/main/cluster.tf.tmpl index 194a2481c..af6cbd485 100644 --- a/autogen/main/cluster.tf.tmpl +++ b/autogen/main/cluster.tf.tmpl @@ -382,6 +382,7 @@ resource "google_container_cluster" "primary" { {% if autopilot_cluster != true %} remove_default_node_pool = var.remove_default_node_pool + {% endif %} dynamic "database_encryption" { for_each = var.database_encryption @@ -392,6 +393,7 @@ resource "google_container_cluster" "primary" { } } + {% if autopilot_cluster != true %} dynamic "workload_identity_config" { for_each = local.cluster_workload_identity_config @@ -401,14 +403,13 @@ resource "google_container_cluster" "primary" { } {% endif %} - {% if autopilot_cluster != true %} dynamic "authenticator_groups_config" { for_each = local.cluster_authenticator_security_group content { security_group = authenticator_groups_config.value.security_group } } - {% endif %} + {% if beta_cluster %} notification_config { pubsub { diff --git a/autogen/main/variables.tf.tmpl b/autogen/main/variables.tf.tmpl index 399b1db09..2b95c0948 100644 --- a/autogen/main/variables.tf.tmpl +++ b/autogen/main/variables.tf.tmpl @@ -540,6 +540,7 @@ variable "default_max_pods_per_node" { default = 110 } +{% endif %} variable "database_encryption" { description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key." type = list(object({ state = string, key_name = string })) @@ -550,6 +551,7 @@ variable "database_encryption" { }] } +{% if autopilot_cluster != true %} variable "enable_shielded_nodes" { type = bool description = "Enable Shielded Nodes features on all nodes in this cluster" diff --git a/cluster.tf b/cluster.tf index 22bdb5dec..77f24fcf1 100644 --- a/cluster.tf +++ b/cluster.tf @@ -222,6 +222,7 @@ resource "google_container_cluster" "primary" { security_group = authenticator_groups_config.value.security_group } } + } /****************************************** Create Container Cluster node pools diff --git a/modules/beta-autopilot-private-cluster/README.md b/modules/beta-autopilot-private-cluster/README.md index b529daa28..fa0975dc3 100644 --- a/modules/beta-autopilot-private-cluster/README.md +++ b/modules/beta-autopilot-private-cluster/README.md @@ -77,6 +77,7 @@ Then perform the following commands on the root folder: | cluster\_telemetry\_type | Available options include ENABLED, DISABLED, and SYSTEM\_ONLY | `string` | `null` | no | | configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | `bool` | `false` | no | | create\_service\_account | Defines if service account specified to run nodes should be created. | `bool` | `true` | no | +| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. | `list(object({ state = string, key_name = string }))` | 
[
  {
    "key_name": "",
    "state": "DECRYPTED"
  }
]
| no | | datapath\_provider | The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature. | `string` | `"DATAPATH_PROVIDER_UNSPECIFIED"` | no | | deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | `bool` | `false` | no | | description | The description of the cluster | `string` | `""` | no | diff --git a/modules/beta-autopilot-private-cluster/cluster.tf b/modules/beta-autopilot-private-cluster/cluster.tf index 7a9ae23e5..4240b0cb8 100644 --- a/modules/beta-autopilot-private-cluster/cluster.tf +++ b/modules/beta-autopilot-private-cluster/cluster.tf @@ -168,6 +168,23 @@ resource "google_container_cluster" "primary" { } + dynamic "database_encryption" { + for_each = var.database_encryption + + content { + key_name = database_encryption.value.key_name + state = database_encryption.value.state + } + } + + + dynamic "authenticator_groups_config" { + for_each = local.cluster_authenticator_security_group + content { + security_group = authenticator_groups_config.value.security_group + } + } + notification_config { pubsub { enabled = var.notification_config_topic != "" ? true : false diff --git a/modules/beta-autopilot-private-cluster/variables.tf b/modules/beta-autopilot-private-cluster/variables.tf index c59bd0576..c89550671 100644 --- a/modules/beta-autopilot-private-cluster/variables.tf +++ b/modules/beta-autopilot-private-cluster/variables.tf @@ -372,3 +372,13 @@ variable "enable_tpu" { description = "Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive!" default = false } +variable "database_encryption" { + description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key." + type = list(object({ state = string, key_name = string })) + + default = [{ + state = "DECRYPTED" + key_name = "" + }] +} + diff --git a/modules/beta-autopilot-public-cluster/README.md b/modules/beta-autopilot-public-cluster/README.md index dea8aa765..1fd93e290 100644 --- a/modules/beta-autopilot-public-cluster/README.md +++ b/modules/beta-autopilot-public-cluster/README.md @@ -71,6 +71,7 @@ Then perform the following commands on the root folder: | cluster\_telemetry\_type | Available options include ENABLED, DISABLED, and SYSTEM\_ONLY | `string` | `null` | no | | configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | `bool` | `false` | no | | create\_service\_account | Defines if service account specified to run nodes should be created. | `bool` | `true` | no | +| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. | `list(object({ state = string, key_name = string }))` | 
[
  {
    "key_name": "",
    "state": "DECRYPTED"
  }
]
| no | | datapath\_provider | The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature. | `string` | `"DATAPATH_PROVIDER_UNSPECIFIED"` | no | | description | The description of the cluster | `string` | `""` | no | | disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no | diff --git a/modules/beta-autopilot-public-cluster/cluster.tf b/modules/beta-autopilot-public-cluster/cluster.tf index ef848bc88..241e013d3 100644 --- a/modules/beta-autopilot-public-cluster/cluster.tf +++ b/modules/beta-autopilot-public-cluster/cluster.tf @@ -149,6 +149,23 @@ resource "google_container_cluster" "primary" { + dynamic "database_encryption" { + for_each = var.database_encryption + + content { + key_name = database_encryption.value.key_name + state = database_encryption.value.state + } + } + + + dynamic "authenticator_groups_config" { + for_each = local.cluster_authenticator_security_group + content { + security_group = authenticator_groups_config.value.security_group + } + } + notification_config { pubsub { enabled = var.notification_config_topic != "" ? true : false diff --git a/modules/beta-autopilot-public-cluster/variables.tf b/modules/beta-autopilot-public-cluster/variables.tf index dbeb0e9d3..59586b73b 100644 --- a/modules/beta-autopilot-public-cluster/variables.tf +++ b/modules/beta-autopilot-public-cluster/variables.tf @@ -341,3 +341,13 @@ variable "enable_tpu" { description = "Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive!" default = false } +variable "database_encryption" { + description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key." + type = list(object({ state = string, key_name = string })) + + default = [{ + state = "DECRYPTED" + key_name = "" + }] +} + diff --git a/modules/beta-private-cluster-update-variant/cluster.tf b/modules/beta-private-cluster-update-variant/cluster.tf index 1fbc76055..25868a019 100644 --- a/modules/beta-private-cluster-update-variant/cluster.tf +++ b/modules/beta-private-cluster-update-variant/cluster.tf @@ -355,6 +355,7 @@ resource "google_container_cluster" "primary" { security_group = authenticator_groups_config.value.security_group } } + notification_config { pubsub { enabled = var.notification_config_topic != "" ? true : false diff --git a/modules/beta-private-cluster/cluster.tf b/modules/beta-private-cluster/cluster.tf index 8934c7de0..bc424421d 100644 --- a/modules/beta-private-cluster/cluster.tf +++ b/modules/beta-private-cluster/cluster.tf @@ -355,6 +355,7 @@ resource "google_container_cluster" "primary" { security_group = authenticator_groups_config.value.security_group } } + notification_config { pubsub { enabled = var.notification_config_topic != "" ? true : false diff --git a/modules/beta-public-cluster-update-variant/cluster.tf b/modules/beta-public-cluster-update-variant/cluster.tf index 465179207..e51ff7e94 100644 --- a/modules/beta-public-cluster-update-variant/cluster.tf +++ b/modules/beta-public-cluster-update-variant/cluster.tf @@ -336,6 +336,7 @@ resource "google_container_cluster" "primary" { security_group = authenticator_groups_config.value.security_group } } + notification_config { pubsub { enabled = var.notification_config_topic != "" ? true : false diff --git a/modules/beta-public-cluster/cluster.tf b/modules/beta-public-cluster/cluster.tf index d8b97ae4e..c65dd4fcf 100644 --- a/modules/beta-public-cluster/cluster.tf +++ b/modules/beta-public-cluster/cluster.tf @@ -336,6 +336,7 @@ resource "google_container_cluster" "primary" { security_group = authenticator_groups_config.value.security_group } } + notification_config { pubsub { enabled = var.notification_config_topic != "" ? true : false diff --git a/modules/private-cluster-update-variant/cluster.tf b/modules/private-cluster-update-variant/cluster.tf index 7eebf9a78..e7cd7114b 100644 --- a/modules/private-cluster-update-variant/cluster.tf +++ b/modules/private-cluster-update-variant/cluster.tf @@ -235,6 +235,7 @@ resource "google_container_cluster" "primary" { security_group = authenticator_groups_config.value.security_group } } + } /****************************************** Create Container Cluster node pools diff --git a/modules/private-cluster/cluster.tf b/modules/private-cluster/cluster.tf index 3c90186dd..e1f2cdfa0 100644 --- a/modules/private-cluster/cluster.tf +++ b/modules/private-cluster/cluster.tf @@ -235,6 +235,7 @@ resource "google_container_cluster" "primary" { security_group = authenticator_groups_config.value.security_group } } + } /****************************************** Create Container Cluster node pools