From 8a5dcb8ed0c38e5f89eaa4b370f65c431d1c6bb8 Mon Sep 17 00:00:00 2001 From: Florian Date: Thu, 29 Apr 2021 23:16:02 +0200 Subject: [PATCH] feat: Introduce add_master_webhook_firewall_rules flag to add webhooks (#882) - Flag controls exclusive creation of a firewall rule for ports defined in firewall_inbound_ports - The existing flag add_cluster_firewall_rules is kept on the firewall rule resource for backwards compatibility --- README.md | 3 ++- autogen/main/firewall.tf.tmpl | 2 +- autogen/main/variables.tf.tmpl | 8 +++++++- firewall.tf | 2 +- modules/beta-private-cluster-update-variant/README.md | 3 ++- modules/beta-private-cluster-update-variant/firewall.tf | 2 +- modules/beta-private-cluster-update-variant/variables.tf | 8 +++++++- modules/beta-private-cluster/README.md | 3 ++- modules/beta-private-cluster/firewall.tf | 2 +- modules/beta-private-cluster/variables.tf | 8 +++++++- modules/beta-public-cluster-update-variant/README.md | 3 ++- modules/beta-public-cluster-update-variant/firewall.tf | 2 +- modules/beta-public-cluster-update-variant/variables.tf | 8 +++++++- modules/beta-public-cluster/README.md | 3 ++- modules/beta-public-cluster/firewall.tf | 2 +- modules/beta-public-cluster/variables.tf | 8 +++++++- modules/private-cluster-update-variant/README.md | 3 ++- modules/private-cluster-update-variant/firewall.tf | 2 +- modules/private-cluster-update-variant/variables.tf | 8 +++++++- modules/private-cluster/README.md | 3 ++- modules/private-cluster/firewall.tf | 2 +- modules/private-cluster/variables.tf | 8 +++++++- variables.tf | 8 +++++++- 23 files changed, 78 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index 7149dfaa8..41b163e19 100644 --- a/README.md +++ b/README.md @@ -124,6 +124,7 @@ Then perform the following commands on the root folder: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no | +| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no | | add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no | | basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no | | basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | `string` | `""` | no | @@ -141,7 +142,7 @@ Then perform the following commands on the root folder: | enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no | | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no | | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no | -| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | +| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | | firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no | | gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no | | grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | `bool` | `false` | no | diff --git a/autogen/main/firewall.tf.tmpl b/autogen/main/firewall.tf.tmpl index 6a227cde7..0f148e76f 100644 --- a/autogen/main/firewall.tf.tmpl +++ b/autogen/main/firewall.tf.tmpl @@ -72,7 +72,7 @@ resource "google_compute_firewall" "intra_egress" { https://github.com/kubernetes/kubernetes/issues/79739 *****************************************/ resource "google_compute_firewall" "master_webhooks" { - count = var.add_cluster_firewall_rules ? 1 : 0 + count = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules ? 1 : 0 name = "gke-${substr(var.name, 0, min(25, length(var.name)))}-webhooks" description = "Managed by terraform gke module: Allow master to hit pods for admission controllers/webhooks" project = local.network_project_id diff --git a/autogen/main/variables.tf.tmpl b/autogen/main/variables.tf.tmpl index 8e55b6a0d..aef40e21c 100644 --- a/autogen/main/variables.tf.tmpl +++ b/autogen/main/variables.tf.tmpl @@ -569,6 +569,12 @@ variable "add_cluster_firewall_rules" { default = false } +variable "add_master_webhook_firewall_rules" { + type = bool + description = "Create master_webhook firewall rules for ports defined in `firewall_inbound_ports`" + default = false +} + variable "firewall_priority" { type = number description = "Priority rule for firewall rules" @@ -577,7 +583,7 @@ variable "firewall_priority" { variable "firewall_inbound_ports" { type = list(string) - description = "List of TCP ports for admission/webhook controllers" + description = "List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied." default = ["8443", "9443", "15017"] } diff --git a/firewall.tf b/firewall.tf index d787d2dea..02df638f2 100644 --- a/firewall.tf +++ b/firewall.tf @@ -61,7 +61,7 @@ resource "google_compute_firewall" "intra_egress" { https://github.com/kubernetes/kubernetes/issues/79739 *****************************************/ resource "google_compute_firewall" "master_webhooks" { - count = var.add_cluster_firewall_rules ? 1 : 0 + count = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules ? 1 : 0 name = "gke-${substr(var.name, 0, min(25, length(var.name)))}-webhooks" description = "Managed by terraform gke module: Allow master to hit pods for admission controllers/webhooks" project = local.network_project_id diff --git a/modules/beta-private-cluster-update-variant/README.md b/modules/beta-private-cluster-update-variant/README.md index 211251033..863a6e537 100644 --- a/modules/beta-private-cluster-update-variant/README.md +++ b/modules/beta-private-cluster-update-variant/README.md @@ -155,6 +155,7 @@ Then perform the following commands on the root folder: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no | +| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no | | add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no | | authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no | | basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no | @@ -187,7 +188,7 @@ Then perform the following commands on the root folder: | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no | | enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no | | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no | -| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | +| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | | firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no | | gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no | | gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no | diff --git a/modules/beta-private-cluster-update-variant/firewall.tf b/modules/beta-private-cluster-update-variant/firewall.tf index d32a964e4..5dbab95e6 100644 --- a/modules/beta-private-cluster-update-variant/firewall.tf +++ b/modules/beta-private-cluster-update-variant/firewall.tf @@ -59,7 +59,7 @@ resource "google_compute_firewall" "intra_egress" { https://github.com/kubernetes/kubernetes/issues/79739 *****************************************/ resource "google_compute_firewall" "master_webhooks" { - count = var.add_cluster_firewall_rules ? 1 : 0 + count = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules ? 1 : 0 name = "gke-${substr(var.name, 0, min(25, length(var.name)))}-webhooks" description = "Managed by terraform gke module: Allow master to hit pods for admission controllers/webhooks" project = local.network_project_id diff --git a/modules/beta-private-cluster-update-variant/variables.tf b/modules/beta-private-cluster-update-variant/variables.tf index 4be21a5d7..384860a35 100644 --- a/modules/beta-private-cluster-update-variant/variables.tf +++ b/modules/beta-private-cluster-update-variant/variables.tf @@ -549,6 +549,12 @@ variable "add_cluster_firewall_rules" { default = false } +variable "add_master_webhook_firewall_rules" { + type = bool + description = "Create master_webhook firewall rules for ports defined in `firewall_inbound_ports`" + default = false +} + variable "firewall_priority" { type = number description = "Priority rule for firewall rules" @@ -557,7 +563,7 @@ variable "firewall_priority" { variable "firewall_inbound_ports" { type = list(string) - description = "List of TCP ports for admission/webhook controllers" + description = "List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied." default = ["8443", "9443", "15017"] } diff --git a/modules/beta-private-cluster/README.md b/modules/beta-private-cluster/README.md index 71c854e45..b402f22e7 100644 --- a/modules/beta-private-cluster/README.md +++ b/modules/beta-private-cluster/README.md @@ -133,6 +133,7 @@ Then perform the following commands on the root folder: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no | +| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no | | add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no | | authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no | | basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no | @@ -165,7 +166,7 @@ Then perform the following commands on the root folder: | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no | | enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no | | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no | -| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | +| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | | firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no | | gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no | | gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no | diff --git a/modules/beta-private-cluster/firewall.tf b/modules/beta-private-cluster/firewall.tf index d32a964e4..5dbab95e6 100644 --- a/modules/beta-private-cluster/firewall.tf +++ b/modules/beta-private-cluster/firewall.tf @@ -59,7 +59,7 @@ resource "google_compute_firewall" "intra_egress" { https://github.com/kubernetes/kubernetes/issues/79739 *****************************************/ resource "google_compute_firewall" "master_webhooks" { - count = var.add_cluster_firewall_rules ? 1 : 0 + count = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules ? 1 : 0 name = "gke-${substr(var.name, 0, min(25, length(var.name)))}-webhooks" description = "Managed by terraform gke module: Allow master to hit pods for admission controllers/webhooks" project = local.network_project_id diff --git a/modules/beta-private-cluster/variables.tf b/modules/beta-private-cluster/variables.tf index 4be21a5d7..384860a35 100644 --- a/modules/beta-private-cluster/variables.tf +++ b/modules/beta-private-cluster/variables.tf @@ -549,6 +549,12 @@ variable "add_cluster_firewall_rules" { default = false } +variable "add_master_webhook_firewall_rules" { + type = bool + description = "Create master_webhook firewall rules for ports defined in `firewall_inbound_ports`" + default = false +} + variable "firewall_priority" { type = number description = "Priority rule for firewall rules" @@ -557,7 +563,7 @@ variable "firewall_priority" { variable "firewall_inbound_ports" { type = list(string) - description = "List of TCP ports for admission/webhook controllers" + description = "List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied." default = ["8443", "9443", "15017"] } diff --git a/modules/beta-public-cluster-update-variant/README.md b/modules/beta-public-cluster-update-variant/README.md index 82c54f06a..d842e8b6c 100644 --- a/modules/beta-public-cluster-update-variant/README.md +++ b/modules/beta-public-cluster-update-variant/README.md @@ -149,6 +149,7 @@ Then perform the following commands on the root folder: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no | +| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no | | add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no | | authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no | | basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no | @@ -178,7 +179,7 @@ Then perform the following commands on the root folder: | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no | | enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no | | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no | -| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | +| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | | firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no | | gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no | | gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no | diff --git a/modules/beta-public-cluster-update-variant/firewall.tf b/modules/beta-public-cluster-update-variant/firewall.tf index 2bec4469c..b8a314f94 100644 --- a/modules/beta-public-cluster-update-variant/firewall.tf +++ b/modules/beta-public-cluster-update-variant/firewall.tf @@ -62,7 +62,7 @@ resource "google_compute_firewall" "intra_egress" { https://github.com/kubernetes/kubernetes/issues/79739 *****************************************/ resource "google_compute_firewall" "master_webhooks" { - count = var.add_cluster_firewall_rules ? 1 : 0 + count = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules ? 1 : 0 name = "gke-${substr(var.name, 0, min(25, length(var.name)))}-webhooks" description = "Managed by terraform gke module: Allow master to hit pods for admission controllers/webhooks" project = local.network_project_id diff --git a/modules/beta-public-cluster-update-variant/variables.tf b/modules/beta-public-cluster-update-variant/variables.tf index 83089297c..e449ed8e6 100644 --- a/modules/beta-public-cluster-update-variant/variables.tf +++ b/modules/beta-public-cluster-update-variant/variables.tf @@ -518,6 +518,12 @@ variable "add_cluster_firewall_rules" { default = false } +variable "add_master_webhook_firewall_rules" { + type = bool + description = "Create master_webhook firewall rules for ports defined in `firewall_inbound_ports`" + default = false +} + variable "firewall_priority" { type = number description = "Priority rule for firewall rules" @@ -526,7 +532,7 @@ variable "firewall_priority" { variable "firewall_inbound_ports" { type = list(string) - description = "List of TCP ports for admission/webhook controllers" + description = "List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied." default = ["8443", "9443", "15017"] } diff --git a/modules/beta-public-cluster/README.md b/modules/beta-public-cluster/README.md index bd98596a3..0520611df 100644 --- a/modules/beta-public-cluster/README.md +++ b/modules/beta-public-cluster/README.md @@ -127,6 +127,7 @@ Then perform the following commands on the root folder: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no | +| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no | | add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no | | authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no | | basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no | @@ -156,7 +157,7 @@ Then perform the following commands on the root folder: | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no | | enable\_tpu | Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no | | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no | -| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | +| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | | firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no | | gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no | | gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no | diff --git a/modules/beta-public-cluster/firewall.tf b/modules/beta-public-cluster/firewall.tf index 2bec4469c..b8a314f94 100644 --- a/modules/beta-public-cluster/firewall.tf +++ b/modules/beta-public-cluster/firewall.tf @@ -62,7 +62,7 @@ resource "google_compute_firewall" "intra_egress" { https://github.com/kubernetes/kubernetes/issues/79739 *****************************************/ resource "google_compute_firewall" "master_webhooks" { - count = var.add_cluster_firewall_rules ? 1 : 0 + count = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules ? 1 : 0 name = "gke-${substr(var.name, 0, min(25, length(var.name)))}-webhooks" description = "Managed by terraform gke module: Allow master to hit pods for admission controllers/webhooks" project = local.network_project_id diff --git a/modules/beta-public-cluster/variables.tf b/modules/beta-public-cluster/variables.tf index 83089297c..e449ed8e6 100644 --- a/modules/beta-public-cluster/variables.tf +++ b/modules/beta-public-cluster/variables.tf @@ -518,6 +518,12 @@ variable "add_cluster_firewall_rules" { default = false } +variable "add_master_webhook_firewall_rules" { + type = bool + description = "Create master_webhook firewall rules for ports defined in `firewall_inbound_ports`" + default = false +} + variable "firewall_priority" { type = number description = "Priority rule for firewall rules" @@ -526,7 +532,7 @@ variable "firewall_priority" { variable "firewall_inbound_ports" { type = list(string) - description = "List of TCP ports for admission/webhook controllers" + description = "List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied." default = ["8443", "9443", "15017"] } diff --git a/modules/private-cluster-update-variant/README.md b/modules/private-cluster-update-variant/README.md index 4ed14263c..759039a42 100644 --- a/modules/private-cluster-update-variant/README.md +++ b/modules/private-cluster-update-variant/README.md @@ -152,6 +152,7 @@ Then perform the following commands on the root folder: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no | +| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no | | add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no | | basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no | | basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | `string` | `""` | no | @@ -172,7 +173,7 @@ Then perform the following commands on the root folder: | enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no | | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no | | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no | -| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | +| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | | firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no | | gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no | | grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | `bool` | `false` | no | diff --git a/modules/private-cluster-update-variant/firewall.tf b/modules/private-cluster-update-variant/firewall.tf index 40ec45292..62d8463ee 100644 --- a/modules/private-cluster-update-variant/firewall.tf +++ b/modules/private-cluster-update-variant/firewall.tf @@ -58,7 +58,7 @@ resource "google_compute_firewall" "intra_egress" { https://github.com/kubernetes/kubernetes/issues/79739 *****************************************/ resource "google_compute_firewall" "master_webhooks" { - count = var.add_cluster_firewall_rules ? 1 : 0 + count = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules ? 1 : 0 name = "gke-${substr(var.name, 0, min(25, length(var.name)))}-webhooks" description = "Managed by terraform gke module: Allow master to hit pods for admission controllers/webhooks" project = local.network_project_id diff --git a/modules/private-cluster-update-variant/variables.tf b/modules/private-cluster-update-variant/variables.tf index 4559296d6..38ae5b7fd 100644 --- a/modules/private-cluster-update-variant/variables.tf +++ b/modules/private-cluster-update-variant/variables.tf @@ -431,6 +431,12 @@ variable "add_cluster_firewall_rules" { default = false } +variable "add_master_webhook_firewall_rules" { + type = bool + description = "Create master_webhook firewall rules for ports defined in `firewall_inbound_ports`" + default = false +} + variable "firewall_priority" { type = number description = "Priority rule for firewall rules" @@ -439,7 +445,7 @@ variable "firewall_priority" { variable "firewall_inbound_ports" { type = list(string) - description = "List of TCP ports for admission/webhook controllers" + description = "List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied." default = ["8443", "9443", "15017"] } diff --git a/modules/private-cluster/README.md b/modules/private-cluster/README.md index 1742a5437..6e35b68ec 100644 --- a/modules/private-cluster/README.md +++ b/modules/private-cluster/README.md @@ -130,6 +130,7 @@ Then perform the following commands on the root folder: | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | add\_cluster\_firewall\_rules | Create additional firewall rules | `bool` | `false` | no | +| add\_master\_webhook\_firewall\_rules | Create master\_webhook firewall rules for ports defined in `firewall_inbound_ports` | `bool` | `false` | no | | add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no | | basic\_auth\_password | The password to be used with Basic Authentication. | `string` | `""` | no | | basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | `string` | `""` | no | @@ -150,7 +151,7 @@ Then perform the following commands on the root folder: | enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no | | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no | | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | `bool` | `false` | no | -| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | +| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | 
[
  "8443",
  "9443",
  "15017"
]
| no | | firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no | | gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no | | grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | `bool` | `false` | no | diff --git a/modules/private-cluster/firewall.tf b/modules/private-cluster/firewall.tf index 40ec45292..62d8463ee 100644 --- a/modules/private-cluster/firewall.tf +++ b/modules/private-cluster/firewall.tf @@ -58,7 +58,7 @@ resource "google_compute_firewall" "intra_egress" { https://github.com/kubernetes/kubernetes/issues/79739 *****************************************/ resource "google_compute_firewall" "master_webhooks" { - count = var.add_cluster_firewall_rules ? 1 : 0 + count = var.add_cluster_firewall_rules || var.add_master_webhook_firewall_rules ? 1 : 0 name = "gke-${substr(var.name, 0, min(25, length(var.name)))}-webhooks" description = "Managed by terraform gke module: Allow master to hit pods for admission controllers/webhooks" project = local.network_project_id diff --git a/modules/private-cluster/variables.tf b/modules/private-cluster/variables.tf index 4559296d6..38ae5b7fd 100644 --- a/modules/private-cluster/variables.tf +++ b/modules/private-cluster/variables.tf @@ -431,6 +431,12 @@ variable "add_cluster_firewall_rules" { default = false } +variable "add_master_webhook_firewall_rules" { + type = bool + description = "Create master_webhook firewall rules for ports defined in `firewall_inbound_ports`" + default = false +} + variable "firewall_priority" { type = number description = "Priority rule for firewall rules" @@ -439,7 +445,7 @@ variable "firewall_priority" { variable "firewall_inbound_ports" { type = list(string) - description = "List of TCP ports for admission/webhook controllers" + description = "List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied." default = ["8443", "9443", "15017"] } diff --git a/variables.tf b/variables.tf index 9e43eaa5c..95cc1c63d 100644 --- a/variables.tf +++ b/variables.tf @@ -407,6 +407,12 @@ variable "add_cluster_firewall_rules" { default = false } +variable "add_master_webhook_firewall_rules" { + type = bool + description = "Create master_webhook firewall rules for ports defined in `firewall_inbound_ports`" + default = false +} + variable "firewall_priority" { type = number description = "Priority rule for firewall rules" @@ -415,7 +421,7 @@ variable "firewall_priority" { variable "firewall_inbound_ports" { type = list(string) - description = "List of TCP ports for admission/webhook controllers" + description = "List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied." default = ["8443", "9443", "15017"] }