github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/gke/enable_auto_repair.tf.go (about) 1 package gke 2 3 var terraformEnableAutoRepairGoodExamples = []string{ 4 ` 5 resource "google_service_account" "default" { 6 account_id = "service-account-id" 7 display_name = "Service Account" 8 } 9 10 resource "google_container_cluster" "primary" { 11 name = "my-gke-cluster" 12 location = "us-central1" 13 14 # We can't create a cluster with no node pool defined, but we want to only use 15 # separately managed node pools. So we create the smallest possible default 16 # node pool and immediately delete it. 17 remove_default_node_pool = true 18 initial_node_count = 1 19 } 20 21 resource "google_container_node_pool" "good_example" { 22 name = "my-node-pool" 23 cluster = google_container_cluster.primary.id 24 node_count = 1 25 26 node_config { 27 preemptible = true 28 machine_type = "e2-medium" 29 30 # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles. 31 service_account = google_service_account.default.email 32 oauth_scopes = [ 33 "https://www.googleapis.com/auth/cloud-platform" 34 ] 35 } 36 management { 37 auto_repair = true 38 } 39 } 40 `, 41 } 42 43 var terraformEnableAutoRepairBadExamples = []string{ 44 ` 45 resource "google_service_account" "default" { 46 account_id = "service-account-id" 47 display_name = "Service Account" 48 } 49 50 resource "google_container_cluster" "primary" { 51 name = "my-gke-cluster" 52 location = "us-central1" 53 54 # We can't create a cluster with no node pool defined, but we want to only use 55 # separately managed node pools. So we create the smallest possible default 56 # node pool and immediately delete it. 57 remove_default_node_pool = true 58 initial_node_count = 1 59 } 60 61 resource "google_container_node_pool" "bad_example" { 62 name = "my-node-pool" 63 cluster = google_container_cluster.primary.id 64 node_count = 1 65 66 node_config { 67 preemptible = true 68 machine_type = "e2-medium" 69 70 # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles. 71 service_account = google_service_account.default.email 72 oauth_scopes = [ 73 "https://www.googleapis.com/auth/cloud-platform" 74 ] 75 } 76 management { 77 auto_repair = false 78 } 79 } 80 `, 81 } 82 83 var terraformEnableAutoRepairLinks = []string{ 84 `https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_node_pool#auto_repair`, 85 } 86 87 var terraformEnableAutoRepairRemediationMarkdown = ``