github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/gke/no_legacy_authentication.tf.go (about)

     1  package gke
     2  
     3  var terraformNoLegacyAuthenticationGoodExamples = []string{
     4  	`
     5   resource "google_service_account" "default" {
     6     account_id   = "service-account-id"
     7     display_name = "Service Account"
     8   }
     9   
    10   resource "google_container_cluster" "good_example" {
    11     name     = "my-gke-cluster"
    12     location = "us-central1"
    13   
    14     # We can't create a cluster with no node pool defined, but we want to only use
    15     # separately managed node pools. So we create the smallest possible default
    16     # node pool and immediately delete it.
    17     remove_default_node_pool = true
    18     initial_node_count       = 1
    19   }
    20   
    21   resource "google_container_node_pool" "primary_preemptible_nodes" {
    22     name       = "my-node-pool"
    23     location   = "us-central1"
    24     cluster    = google_container_cluster.primary.name
    25     node_count = 1
    26   
    27     node_config {
    28       preemptible  = true
    29       machine_type = "e2-medium"
    30   
    31       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    32       service_account = google_service_account.default.email
    33       oauth_scopes    = [
    34         "https://www.googleapis.com/auth/cloud-platform"
    35       ]
    36     }
    37   }
    38   `,
    39  }
    40  
    41  var terraformNoLegacyAuthenticationBadExamples = []string{
    42  	`
    43   resource "google_service_account" "default" {
    44     account_id   = "service-account-id"
    45     display_name = "Service Account"
    46   }
    47   
    48   resource "google_container_cluster" "good_example" {
    49     name     = "my-gke-cluster"
    50     location = "us-central1"
    51   
    52     # We can't create a cluster with no node pool defined, but we want to only use
    53     # separately managed node pools. So we create the smallest possible default
    54     # node pool and immediately delete it.
    55     remove_default_node_pool = true
    56     initial_node_count       = 1
    57     master_auth {
    58       client_certificate_config {
    59         issue_client_certificate = true
    60       }
    61     }
    62   }
    63   
    64   resource "google_container_node_pool" "primary_preemptible_nodes" {
    65     name       = "my-node-pool"
    66     location   = "us-central1"
    67     cluster    = google_container_cluster.primary.name
    68     node_count = 1
    69   
    70     node_config {
    71       preemptible  = true
    72       machine_type = "e2-medium"
    73   
    74       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    75       service_account = google_service_account.default.email
    76       oauth_scopes    = [
    77         "https://www.googleapis.com/auth/cloud-platform"
    78       ]
    79     }
    80   }
    81   `,
    82  }
    83  
    84  var terraformNoLegacyAuthenticationLinks = []string{
    85  	`https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#master_auth`,
    86  }
    87  
    88  var terraformNoLegacyAuthenticationRemediationMarkdown = ``