Skip to content

Commit 654868e

Browse files
CPL-markusCPL-markus
authored
feat: Set boot_disk_kms_key cluster wide and for cluster_autoscaling (#1959)
1 parent eec38a2 commit 654868e

File tree

23 files changed

+78
-5
lines changed

23 files changed

+78
-5
lines changed

Diff for: ‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ Then perform the following commands on the root folder:
143143
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
144144
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
145145
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
146+
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
146147
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
147148
| cluster\_dns\_domain | The suffix used for all cluster service records. | `string` | `""` | no |
148149
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. | `string` | `"PROVIDER_UNSPECIFIED"` | no |

Diff for: ‎autogen/main/cluster.tf.tmpl

+3-1
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,8 @@ resource "google_container_cluster" "primary" {
139139
service_account = local.service_account
140140
oauth_scopes = local.node_pools_oauth_scopes["all"]
141141

142+
boot_disk_kms_key = var.boot_disk_kms_key
143+
142144
management {
143145
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
144146
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade",true)
@@ -524,7 +526,7 @@ resource "google_container_cluster" "primary" {
524526
}
525527
}
526528

527-
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
529+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
528530
{% endif %}
529531

530532
shielded_instance_config {

Diff for: ‎autogen/main/variables.tf.tmpl

+8
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,14 @@ variable "service_account_name" {
413413
default = ""
414414
}
415415

416+
{% if autopilot_cluster != true %}
417+
variable "boot_disk_kms_key" {
418+
type = string
419+
description = "The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption"
420+
default = null
421+
}
422+
423+
{% endif %}
416424
variable "issue_client_certificate" {
417425
type = bool
418426
description = "Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive!"

Diff for: ‎cluster.tf

+2
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,8 @@ resource "google_container_cluster" "primary" {
112112
service_account = local.service_account
113113
oauth_scopes = local.node_pools_oauth_scopes["all"]
114114

115+
boot_disk_kms_key = var.boot_disk_kms_key
116+
115117
management {
116118
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
117119
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade", true)

Diff for: ‎modules/beta-private-cluster-update-variant/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,7 @@ Then perform the following commands on the root folder:
174174
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
175175
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
176176
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
177+
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
177178
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
178179
| cloudrun\_load\_balancer\_type | (Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer. | `string` | `""` | no |
179180
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |

Diff for: ‎modules/beta-private-cluster-update-variant/cluster.tf

+3-1
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@ resource "google_container_cluster" "primary" {
118118
service_account = local.service_account
119119
oauth_scopes = local.node_pools_oauth_scopes["all"]
120120

121+
boot_disk_kms_key = var.boot_disk_kms_key
122+
121123
management {
122124
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
123125
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade", true)
@@ -450,7 +452,7 @@ resource "google_container_cluster" "primary" {
450452
}
451453
}
452454

453-
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
455+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
454456

455457
shielded_instance_config {
456458
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)

Diff for: ‎modules/beta-private-cluster-update-variant/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,12 @@ variable "service_account_name" {
403403
default = ""
404404
}
405405

406+
variable "boot_disk_kms_key" {
407+
type = string
408+
description = "The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption"
409+
default = null
410+
}
411+
406412
variable "issue_client_certificate" {
407413
type = bool
408414
description = "Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive!"

Diff for: ‎modules/beta-private-cluster/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ Then perform the following commands on the root folder:
152152
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
153153
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
154154
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
155+
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
155156
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
156157
| cloudrun\_load\_balancer\_type | (Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer. | `string` | `""` | no |
157158
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |

Diff for: ‎modules/beta-private-cluster/cluster.tf

+3-1
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@ resource "google_container_cluster" "primary" {
118118
service_account = local.service_account
119119
oauth_scopes = local.node_pools_oauth_scopes["all"]
120120

121+
boot_disk_kms_key = var.boot_disk_kms_key
122+
121123
management {
122124
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
123125
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade", true)
@@ -450,7 +452,7 @@ resource "google_container_cluster" "primary" {
450452
}
451453
}
452454

453-
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
455+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
454456

455457
shielded_instance_config {
456458
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)

Diff for: ‎modules/beta-private-cluster/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,12 @@ variable "service_account_name" {
403403
default = ""
404404
}
405405

406+
variable "boot_disk_kms_key" {
407+
type = string
408+
description = "The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption"
409+
default = null
410+
}
411+
406412
variable "issue_client_certificate" {
407413
type = bool
408414
description = "Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive!"

Diff for: ‎modules/beta-public-cluster-update-variant/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ Then perform the following commands on the root folder:
168168
| add\_shadow\_firewall\_rules | Create GKE shadow firewall (the same as default firewall rules with firewall logs enabled). | `bool` | `false` | no |
169169
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
170170
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format gke-security-groups@yourdomain.com | `string` | `null` | no |
171+
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
171172
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
172173
| cloudrun\_load\_balancer\_type | (Beta) Configure the Cloud Run load balancer type. External by default. Set to `LOAD_BALANCER_TYPE_INTERNAL` to configure as an internal load balancer. | `string` | `""` | no |
173174
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = number<br> max_cpu_cores = number<br> min_memory_gb = number<br> max_memory_gb = number<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |

Diff for: ‎modules/beta-public-cluster-update-variant/cluster.tf

+3-1
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@ resource "google_container_cluster" "primary" {
118118
service_account = local.service_account
119119
oauth_scopes = local.node_pools_oauth_scopes["all"]
120120

121+
boot_disk_kms_key = var.boot_disk_kms_key
122+
121123
management {
122124
auto_repair = lookup(var.cluster_autoscaling, "auto_repair", true)
123125
auto_upgrade = lookup(var.cluster_autoscaling, "auto_upgrade", true)
@@ -450,7 +452,7 @@ resource "google_container_cluster" "primary" {
450452
}
451453
}
452454

453-
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", "")
455+
boot_disk_kms_key = lookup(var.node_pools[0], "boot_disk_kms_key", var.boot_disk_kms_key)
454456

455457
shielded_instance_config {
456458
enable_secure_boot = lookup(var.node_pools[0], "enable_secure_boot", false)

Diff for: ‎modules/beta-public-cluster-update-variant/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,12 @@ variable "service_account_name" {
403403
default = ""
404404
}
405405

406+
variable "boot_disk_kms_key" {
407+
type = string
408+
description = "The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption"
409+
default = null
410+
}
411+
406412
variable "issue_client_certificate" {
407413
type = bool
408414
description = "Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive!"

0 commit comments

Comments
 (0)