github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/gke/use_cluster_labels.tf.go (about)

     1  package gke
     2  
     3  var terraformUseClusterLabelsGoodExamples = []string{
     4  	`
     5   resource "google_service_account" "default" {
     6     account_id   = "service-account-id"
     7     display_name = "Service Account"
     8   }
     9   
    10   resource "google_container_cluster" "good_example" {
    11     name     = "my-gke-cluster"
    12     location = "us-central1"
    13   
    14     # We can't create a cluster with no node pool defined, but we want to only use
    15     # separately managed node pools. So we create the smallest possible default
    16     # node pool and immediately delete it.
    17     remove_default_node_pool = true
    18     initial_node_count       = 1
    19     resource_labels = {
    20       "env" = "staging"
    21     }
    22   }
    23   
    24   resource "google_container_node_pool" "primary_preemptible_nodes" {
    25     name       = "my-node-pool"
    26     location   = "us-central1"
    27     cluster    = google_container_cluster.primary.name
    28     node_count = 1
    29   
    30     node_config {
    31       preemptible  = true
    32       machine_type = "e2-medium"
    33   
    34       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    35       service_account = google_service_account.default.email
    36       oauth_scopes    = [
    37         "https://www.googleapis.com/auth/cloud-platform"
    38       ]
    39     }
    40   }
    41   `,
    42  }
    43  
    44  var terraformUseClusterLabelsBadExamples = []string{
    45  	`
    46   resource "google_service_account" "default" {
    47     account_id   = "service-account-id"
    48     display_name = "Service Account"
    49   }
    50   
    51   resource "google_container_cluster" "bad_example" {
    52     name     = "my-gke-cluster"
    53     location = "us-central1"
    54   
    55     # We can't create a cluster with no node pool defined, but we want to only use
    56     # separately managed node pools. So we create the smallest possible default
    57     # node pool and immediately delete it.
    58     remove_default_node_pool = true
    59     initial_node_count       = 1
    60   }
    61   
    62   resource "google_container_node_pool" "primary_preemptible_nodes" {
    63     name       = "my-node-pool"
    64     location   = "us-central1"
    65     cluster    = google_container_cluster.primary.name
    66     node_count = 1
    67   
    68     node_config {
    69       preemptible  = true
    70       machine_type = "e2-medium"
    71   
    72       # Google recommends custom service accounts that have cloud-platform scope and permissions granted via IAM Roles.
    73       service_account = google_service_account.default.email
    74       oauth_scopes    = [
    75         "https://www.googleapis.com/auth/cloud-platform"
    76       ]
    77     }
    78   }
    79   `,
    80  }
    81  
    82  var terraformUseClusterLabelsLinks = []string{
    83  	`https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#resource_labels`,
    84  }
    85  
    86  var terraformUseClusterLabelsRemediationMarkdown = ``