github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/gke/enable_auto_repair.tf.go (about)

     1  package gke
     2  
     3  var terraformEnableAutoRepairGoodExamples = []string{
     4  	`
     5   resource "google_service_account" "default" {
     6     account_id   = "service-account-id"
     7     display_name = "Service Account"
     8   }
     9   
    10   resource "google_container_cluster" "primary" {
    11     name     = "my-gke-cluster"
    12     location = "us-central1"
    13   
    14     # We can't create a cluster with no node pool defined, but we want to only use
    15     # separately managed node pools. So we create the smallest possible default
    16     # node pool and immediately delete it.
    17     remove_default_node_pool = true
    18     initial_node_count       = 1
    19   }
    20   
    21   resource "google_container_node_pool" "good_example" {
    22     name       = "my-node-pool"
    23     cluster    = google_container_cluster.primary.id
    24     node_count = 1
    25   
    26     node_config {
    27       preemptible  = true
    28       machine_type = "e2-medium"
    29   
    30       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    31       service_account = google_service_account.default.email
    32       oauth_scopes = [
    33         "https://www.googleapis.com/auth/cloud-platform"
    34       ]
    35     }
    36     management {
    37       auto_repair = true
    38     }
    39   }
    40   `,
    41  }
    42  
    43  var terraformEnableAutoRepairBadExamples = []string{
    44  	`
    45   resource "google_service_account" "default" {
    46     account_id   = "service-account-id"
    47     display_name = "Service Account"
    48   }
    49   
    50   resource "google_container_cluster" "primary" {
    51     name     = "my-gke-cluster"
    52     location = "us-central1"
    53   
    54     # We can't create a cluster with no node pool defined, but we want to only use
    55     # separately managed node pools. So we create the smallest possible default
    56     # node pool and immediately delete it.
    57     remove_default_node_pool = true
    58     initial_node_count       = 1
    59   }
    60   
    61   resource "google_container_node_pool" "bad_example" {
    62     name       = "my-node-pool"
    63     cluster    = google_container_cluster.primary.id
    64     node_count = 1
    65   
    66     node_config {
    67       preemptible  = true
    68       machine_type = "e2-medium"
    69   
    70       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    71       service_account = google_service_account.default.email
    72       oauth_scopes = [
    73         "https://www.googleapis.com/auth/cloud-platform"
    74       ]
    75     }
    76     management {
    77       auto_repair = false
    78     }
    79   }
    80   `,
    81  }
    82  
    83  var terraformEnableAutoRepairLinks = []string{
    84  	`https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_node_pool#auto_repair`,
    85  }
    86  
    87  var terraformEnableAutoRepairRemediationMarkdown = ``