github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/gke/no_public_control_plane.tf.go (about)

     1  package gke
     2  
     3  var terraformNoPublicControlPlaneGoodExamples = []string{
     4  	`
     5   resource "google_service_account" "default" {
     6     account_id   = "service-account-id"
     7     display_name = "Service Account"
     8   }
     9   
    10   resource "google_container_cluster" "primary" {
    11     name     = "my-gke-cluster"
    12     location = "us-central1"
    13   
    14     # We can't create a cluster with no node pool defined, but we want to only use
    15     # separately managed node pools. So we create the smallest possible default
    16     # node pool and immediately delete it.
    17     remove_default_node_pool = true
    18     initial_node_count       = 1
    19     master_authorized_networks_config {
    20       cidr_blocks {
    21         cidr_block = "10.10.128.0/24"
    22         display_name = "internal"
    23       }
    24     }
    25   }
    26   
    27   resource "google_container_node_pool" "primary_preemptible_nodes" {
    28     name       = "my-node-pool"
    29     location   = "us-central1"
    30     cluster    = google_container_cluster.primary.name
    31     node_count = 1
    32   
    33     node_config {
    34       preemptible  = true
    35       machine_type = "e2-medium"
    36   
    37       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    38       service_account = google_service_account.default.email
    39       oauth_scopes    = [
    40         "https://www.googleapis.com/auth/cloud-platform"
    41       ]
    42     }
    43   }
    44   `,
    45  }
    46  
    47  var terraformNoPublicControlPlaneBadExamples = []string{
    48  	`
    49   resource "google_service_account" "default" {
    50     account_id   = "service-account-id"
    51     display_name = "Service Account"
    52   }
    53   
    54   resource "google_container_cluster" "primary" {
    55     name     = "my-gke-cluster"
    56     location = "us-central1"
    57   
    58     # We can't create a cluster with no node pool defined, but we want to only use
    59     # separately managed node pools. So we create the smallest possible default
    60     # node pool and immediately delete it.
    61     remove_default_node_pool = true
    62     initial_node_count       = 1
    63     master_authorized_networks_config {
    64       cidr_blocks {
    65         cidr_block = "0.0.0.0/0"
    66         display_name = "external"
    67       }
    68     }
    69   }
    70   
    71   resource "google_container_node_pool" "primary_preemptible_nodes" {
    72     name       = "my-node-pool"
    73     location   = "us-central1"
    74     cluster    = google_container_cluster.primary.name
    75     node_count = 1
    76   
    77     node_config {
    78       preemptible  = true
    79       machine_type = "e2-medium"
    80   
    81       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    82       service_account = google_service_account.default.email
    83       oauth_scopes    = [
    84         "https://www.googleapis.com/auth/cloud-platform"
    85       ]
    86     }
    87   }
    88   `,
    89  }
    90  
    91  var terraformNoPublicControlPlaneLinks = []string{
    92  	`https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#`,
    93  }
    94  
    95  var terraformNoPublicControlPlaneRemediationMarkdown = ``