Add firewall support safer-cluster modules

autogen/main/cluster.tf.tmpl

@@ -509,7 +509,7 @@ resource "google_container_node_pool" "pools" {
     {% endif %}
 
     shielded_instance_config {
-      enable_secure_boot =  lookup(each.value, "enable_secure_boot", false)
+      enable_secure_boot          = lookup(each.value, "enable_secure_boot", false)
       enable_integrity_monitoring = lookup(each.value, "enable_integrity_monitoring", true)
     }
   }

autogen/main/firewall.tf.tmpl

@@ -48,9 +48,11 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "esp" }
   allow { protocol = "ah" }
 
+  {% if not private_cluster %}
   depends_on = [
     google_container_cluster.primary,
   ]
+  {% endif %}
 }
 
 
@@ -77,8 +79,10 @@ resource "google_compute_firewall" "master_webhooks" {
     ports    = var.firewall_inbound_ports
   }
 
+  {% if not private_cluster %}
   depends_on = [
     google_container_cluster.primary,
   ]
+  {% endif %}
 
 }

autogen/safer-cluster/main.tf.tmpl

@@ -49,6 +49,10 @@ module "gke" {
   ip_range_pods     = var.ip_range_pods
   ip_range_services = var.ip_range_services
 
+  add_cluster_firewall_rules = var.add_cluster_firewall_rules
+  firewall_priority          = var.firewall_priority
+  firewall_inbound_ports     = var.firewall_inbound_ports
+
   horizontal_pod_autoscaling = var.horizontal_pod_autoscaling
   http_load_balancing        = var.http_load_balancing
 

autogen/safer-cluster/variables.tf.tmpl

@@ -342,3 +342,21 @@ variable "gce_pd_csi_driver" {
   description = "(Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver."
   default     = true
 }
+
+variable "add_cluster_firewall_rules" {
+  type        = bool
+  description = "Create additional firewall rules"
+  default     = false
+}
+
+variable "firewall_priority" {
+  type        = number
+  description = "Priority rule for firewall rules"
+  default     = 1000
+}
+
+variable "firewall_inbound_ports" {
+  type        = list(string)
+  description = "List of TCP ports for admission/webhook controllers"
+  default     = ["8443", "9443", "15017"]
+}

examples/safer_cluster/main.tf

@@ -49,6 +49,8 @@ module "gke" {
   ip_range_services              = local.svc_range_name
   compute_engine_service_account = var.compute_engine_service_account
   master_ipv4_cidr_block         = "172.16.0.0/28"
+  add_cluster_firewall_rules     = true
+  firewall_inbound_ports         = ["9443", "15017"]
 
   master_authorized_networks = [
     {

modules/beta-private-cluster-update-variant/firewall.tf

@@ -48,9 +48,6 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "esp" }
   allow { protocol = "ah" }
 
-  depends_on = [
-    google_container_cluster.primary,
-  ]
 }
 
 
@@ -77,8 +74,5 @@ resource "google_compute_firewall" "master_webhooks" {
     ports    = var.firewall_inbound_ports
   }
 
-  depends_on = [
-    google_container_cluster.primary,
-  ]
 
 }

modules/beta-private-cluster/firewall.tf

@@ -48,9 +48,6 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "esp" }
   allow { protocol = "ah" }
 
-  depends_on = [
-    google_container_cluster.primary,
-  ]
 }
 
 
@@ -77,8 +74,5 @@ resource "google_compute_firewall" "master_webhooks" {
     ports    = var.firewall_inbound_ports
   }
 
-  depends_on = [
-    google_container_cluster.primary,
-  ]
 
 }

modules/private-cluster-update-variant/firewall.tf

@@ -48,9 +48,6 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "esp" }
   allow { protocol = "ah" }
 
-  depends_on = [
-    google_container_cluster.primary,
-  ]
 }
 
 
@@ -77,8 +74,5 @@ resource "google_compute_firewall" "master_webhooks" {
     ports    = var.firewall_inbound_ports
   }
 
-  depends_on = [
-    google_container_cluster.primary,
-  ]
 
 }

modules/private-cluster/firewall.tf

@@ -48,9 +48,6 @@ resource "google_compute_firewall" "intra_egress" {
   allow { protocol = "esp" }
   allow { protocol = "ah" }
 
-  depends_on = [
-    google_container_cluster.primary,
-  ]
 }
 
 
@@ -77,8 +74,5 @@ resource "google_compute_firewall" "master_webhooks" {
     ports    = var.firewall_inbound_ports
   }
 
-  depends_on = [
-    google_container_cluster.primary,
-  ]
 
 }

modules/safer-cluster-update-variant/README.md

@@ -200,6 +200,7 @@ For simplicity, we suggest using `roles/container.admin` and
 
 | Name | Description | Type | Default | Required |
 |------|-------------|:----:|:-----:|:-----:|
+| add\_cluster\_firewall\_rules | Create additional firewall rules | bool | `"false"` | no |
 | authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | string | `"null"` | no |
 | cloudrun | (Beta) Enable CloudRun addon | string | `"false"` | no |
 | cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | map(string) | `<map>` | no |
@@ -214,6 +215,8 @@ For simplicity, we suggest using `roles/container.admin` and
 | enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | bool | `"true"` | no |
 | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster. | bool | `"true"` | no |
 | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
+| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | list(string) | `<list>` | no |
+| firewall\_priority | Priority rule for firewall rules | number | `"1000"` | no |
 | gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | bool | `"true"` | no |
 | grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"true"` | no |
 | horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |

modules/safer-cluster-update-variant/main.tf

@@ -45,6 +45,10 @@ module "gke" {
   ip_range_pods     = var.ip_range_pods
   ip_range_services = var.ip_range_services
 
+  add_cluster_firewall_rules = var.add_cluster_firewall_rules
+  firewall_priority          = var.firewall_priority
+  firewall_inbound_ports     = var.firewall_inbound_ports
+
   horizontal_pod_autoscaling = var.horizontal_pod_autoscaling
   http_load_balancing        = var.http_load_balancing
 

modules/safer-cluster-update-variant/variables.tf

@@ -342,3 +342,21 @@ variable "gce_pd_csi_driver" {
   description = "(Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver."
   default     = true
 }
+
+variable "add_cluster_firewall_rules" {
+  type        = bool
+  description = "Create additional firewall rules"
+  default     = false
+}
+
+variable "firewall_priority" {
+  type        = number
+  description = "Priority rule for firewall rules"
+  default     = 1000
+}
+
+variable "firewall_inbound_ports" {
+  type        = list(string)
+  description = "List of TCP ports for admission/webhook controllers"
+  default     = ["8443", "9443", "15017"]
+}

modules/safer-cluster/README.md

@@ -200,6 +200,7 @@ For simplicity, we suggest using `roles/container.admin` and
 
 | Name | Description | Type | Default | Required |
 |------|-------------|:----:|:-----:|:-----:|
+| add\_cluster\_firewall\_rules | Create additional firewall rules | bool | `"false"` | no |
 | authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | string | `"null"` | no |
 | cloudrun | (Beta) Enable CloudRun addon | string | `"false"` | no |
 | cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster | map(string) | `<map>` | no |
@@ -214,6 +215,8 @@ For simplicity, we suggest using `roles/container.admin` and
 | enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | bool | `"true"` | no |
 | enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster. | bool | `"true"` | no |
 | enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it | bool | `"false"` | no |
+| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers | list(string) | `<list>` | no |
+| firewall\_priority | Priority rule for firewall rules | number | `"1000"` | no |
 | gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | bool | `"true"` | no |
 | grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | bool | `"true"` | no |
 | horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | bool | `"true"` | no |

modules/safer-cluster/main.tf

@@ -45,6 +45,10 @@ module "gke" {
   ip_range_pods     = var.ip_range_pods
   ip_range_services = var.ip_range_services
 
+  add_cluster_firewall_rules = var.add_cluster_firewall_rules
+  firewall_priority          = var.firewall_priority
+  firewall_inbound_ports     = var.firewall_inbound_ports
+
   horizontal_pod_autoscaling = var.horizontal_pod_autoscaling
   http_load_balancing        = var.http_load_balancing
 

modules/safer-cluster/variables.tf

@@ -342,3 +342,21 @@ variable "gce_pd_csi_driver" {
   description = "(Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver."
   default     = true
 }
+
+variable "add_cluster_firewall_rules" {
+  type        = bool
+  description = "Create additional firewall rules"
+  default     = false
+}
+
+variable "firewall_priority" {
+  type        = number
+  description = "Priority rule for firewall rules"
+  default     = 1000
+}
+
+variable "firewall_inbound_ports" {
+  type        = list(string)
+  description = "List of TCP ports for admission/webhook controllers"
+  default     = ["8443", "9443", "15017"]
+}