Skip to content

Commit 066149d

Browse files
jmymyjmymy
authored
feat: support database encryption and google group rbac for autopilot (#1265)
* feat: database encryption and google rbac for autopilot * chore: cleanup ordering * chore: cleanup ordering vars * chore: more cleanup
1 parent 4b7eeb3 commit 066149d

File tree

15 files changed

+68
-2
lines changed

15 files changed

+68
-2
lines changed

Diff for: ‎autogen/main/cluster.tf.tmpl

+3-2
Original file line numberDiff line numberDiff line change
@@ -382,6 +382,7 @@ resource "google_container_cluster" "primary" {
382382

383383
{% if autopilot_cluster != true %}
384384
remove_default_node_pool = var.remove_default_node_pool
385+
{% endif %}
385386

386387
dynamic "database_encryption" {
387388
for_each = var.database_encryption
@@ -392,6 +393,7 @@ resource "google_container_cluster" "primary" {
392393
}
393394
}
394395

396+
{% if autopilot_cluster != true %}
395397
dynamic "workload_identity_config" {
396398
for_each = local.cluster_workload_identity_config
397399

@@ -401,14 +403,13 @@ resource "google_container_cluster" "primary" {
401403
}
402404
{% endif %}
403405

404-
{% if autopilot_cluster != true %}
405406
dynamic "authenticator_groups_config" {
406407
for_each = local.cluster_authenticator_security_group
407408
content {
408409
security_group = authenticator_groups_config.value.security_group
409410
}
410411
}
411-
{% endif %}
412+
412413
{% if beta_cluster %}
413414
notification_config {
414415
pubsub {

Diff for: ‎autogen/main/variables.tf.tmpl

+2
Original file line numberDiff line numberDiff line change
@@ -540,6 +540,7 @@ variable "default_max_pods_per_node" {
540540
default = 110
541541
}
542542

543+
{% endif %}
543544
variable "database_encryption" {
544545
description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key."
545546
type = list(object({ state = string, key_name = string }))
@@ -550,6 +551,7 @@ variable "database_encryption" {
550551
}]
551552
}
552553

554+
{% if autopilot_cluster != true %}
553555
variable "enable_shielded_nodes" {
554556
type = bool
555557
description = "Enable Shielded Nodes features on all nodes in this cluster"

Diff for: ‎cluster.tf

+1
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,7 @@ resource "google_container_cluster" "primary" {
222222
security_group = authenticator_groups_config.value.security_group
223223
}
224224
}
225+
225226
}
226227
/******************************************
227228
Create Container Cluster node pools

Diff for: ‎modules/beta-autopilot-private-cluster/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ Then perform the following commands on the root folder:
7777
| cluster\_telemetry\_type | Available options include ENABLED, DISABLED, and SYSTEM\_ONLY | `string` | `null` | no |
7878
| configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | `bool` | `false` | no |
7979
| create\_service\_account | Defines if service account specified to run nodes should be created. | `bool` | `true` | no |
80+
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. | `list(object({ state = string, key_name = string }))` | <pre>[<br> {<br> "key_name": "",<br> "state": "DECRYPTED"<br> }<br>]</pre> | no |
8081
| datapath\_provider | The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature. | `string` | `"DATAPATH_PROVIDER_UNSPECIFIED"` | no |
8182
| deploy\_using\_private\_endpoint | (Beta) A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | `bool` | `false` | no |
8283
| description | The description of the cluster | `string` | `""` | no |

Diff for: ‎modules/beta-autopilot-private-cluster/cluster.tf

+17
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,23 @@ resource "google_container_cluster" "primary" {
168168
}
169169

170170

171+
dynamic "database_encryption" {
172+
for_each = var.database_encryption
173+
174+
content {
175+
key_name = database_encryption.value.key_name
176+
state = database_encryption.value.state
177+
}
178+
}
179+
180+
181+
dynamic "authenticator_groups_config" {
182+
for_each = local.cluster_authenticator_security_group
183+
content {
184+
security_group = authenticator_groups_config.value.security_group
185+
}
186+
}
187+
171188
notification_config {
172189
pubsub {
173190
enabled = var.notification_config_topic != "" ? true : false

Diff for: ‎modules/beta-autopilot-private-cluster/variables.tf

+10
Original file line numberDiff line numberDiff line change
@@ -372,3 +372,13 @@ variable "enable_tpu" {
372372
description = "Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive!"
373373
default = false
374374
}
375+
variable "database_encryption" {
376+
description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key."
377+
type = list(object({ state = string, key_name = string }))
378+
379+
default = [{
380+
state = "DECRYPTED"
381+
key_name = ""
382+
}]
383+
}
384+

Diff for: ‎modules/beta-autopilot-public-cluster/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ Then perform the following commands on the root folder:
7171
| cluster\_telemetry\_type | Available options include ENABLED, DISABLED, and SYSTEM\_ONLY | `string` | `null` | no |
7272
| configure\_ip\_masq | Enables the installation of ip masquerading, which is usually no longer required when using aliasied IP addresses. IP masquerading uses a kubectl call, so when you have a private cluster, you will need access to the API server. | `bool` | `false` | no |
7373
| create\_service\_account | Defines if service account specified to run nodes should be created. | `bool` | `true` | no |
74+
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. | `list(object({ state = string, key_name = string }))` | <pre>[<br> {<br> "key_name": "",<br> "state": "DECRYPTED"<br> }<br>]</pre> | no |
7475
| datapath\_provider | The desired datapath provider for this cluster. By default, `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation. `ADVANCED_DATAPATH` enables Dataplane-V2 feature. | `string` | `"DATAPATH_PROVIDER_UNSPECIFIED"` | no |
7576
| description | The description of the cluster | `string` | `""` | no |
7677
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |

Diff for: ‎modules/beta-autopilot-public-cluster/cluster.tf

+17
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,23 @@ resource "google_container_cluster" "primary" {
149149

150150

151151

152+
dynamic "database_encryption" {
153+
for_each = var.database_encryption
154+
155+
content {
156+
key_name = database_encryption.value.key_name
157+
state = database_encryption.value.state
158+
}
159+
}
160+
161+
162+
dynamic "authenticator_groups_config" {
163+
for_each = local.cluster_authenticator_security_group
164+
content {
165+
security_group = authenticator_groups_config.value.security_group
166+
}
167+
}
168+
152169
notification_config {
153170
pubsub {
154171
enabled = var.notification_config_topic != "" ? true : false

Diff for: ‎modules/beta-autopilot-public-cluster/variables.tf

+10
Original file line numberDiff line numberDiff line change
@@ -341,3 +341,13 @@ variable "enable_tpu" {
341341
description = "Enable Cloud TPU resources in the cluster. WARNING: changing this after cluster creation is destructive!"
342342
default = false
343343
}
344+
variable "database_encryption" {
345+
description = "Application-layer Secrets Encryption settings. The object format is {state = string, key_name = string}. Valid values of state are: \"ENCRYPTED\"; \"DECRYPTED\". key_name is the name of a CloudKMS key."
346+
type = list(object({ state = string, key_name = string }))
347+
348+
default = [{
349+
state = "DECRYPTED"
350+
key_name = ""
351+
}]
352+
}
353+

Diff for: ‎modules/beta-private-cluster-update-variant/cluster.tf

+1
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,7 @@ resource "google_container_cluster" "primary" {
355355
security_group = authenticator_groups_config.value.security_group
356356
}
357357
}
358+
358359
notification_config {
359360
pubsub {
360361
enabled = var.notification_config_topic != "" ? true : false

Diff for: ‎modules/beta-private-cluster/cluster.tf

+1
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,7 @@ resource "google_container_cluster" "primary" {
355355
security_group = authenticator_groups_config.value.security_group
356356
}
357357
}
358+
358359
notification_config {
359360
pubsub {
360361
enabled = var.notification_config_topic != "" ? true : false

Diff for: ‎modules/beta-public-cluster-update-variant/cluster.tf

+1
Original file line numberDiff line numberDiff line change
@@ -336,6 +336,7 @@ resource "google_container_cluster" "primary" {
336336
security_group = authenticator_groups_config.value.security_group
337337
}
338338
}
339+
339340
notification_config {
340341
pubsub {
341342
enabled = var.notification_config_topic != "" ? true : false

Diff for: ‎modules/beta-public-cluster/cluster.tf

+1
Original file line numberDiff line numberDiff line change
@@ -336,6 +336,7 @@ resource "google_container_cluster" "primary" {
336336
security_group = authenticator_groups_config.value.security_group
337337
}
338338
}
339+
339340
notification_config {
340341
pubsub {
341342
enabled = var.notification_config_topic != "" ? true : false

Diff for: ‎modules/private-cluster-update-variant/cluster.tf

+1
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,7 @@ resource "google_container_cluster" "primary" {
235235
security_group = authenticator_groups_config.value.security_group
236236
}
237237
}
238+
238239
}
239240
/******************************************
240241
Create Container Cluster node pools

Diff for: ‎modules/private-cluster/cluster.tf

+1
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,7 @@ resource "google_container_cluster" "primary" {
235235
security_group = authenticator_groups_config.value.security_group
236236
}
237237
}
238+
238239
}
239240
/******************************************
240241
Create Container Cluster node pools

0 commit comments

Comments
 (0)