92 lines
3.5 KiB
HCL
92 lines
3.5 KiB
HCL
/**
|
|
* Copyright 2022 Google LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
resource "google_binary_authorization_policy" "policy" {
|
|
project = var.project_id
|
|
dynamic "admission_whitelist_patterns" {
|
|
for_each = toset(coalesce(var.admission_whitelist_patterns, []))
|
|
content {
|
|
name_pattern = admission_whitelist_patterns.value
|
|
}
|
|
}
|
|
default_admission_rule {
|
|
evaluation_mode = var.default_admission_rule.evaluation_mode
|
|
enforcement_mode = var.default_admission_rule.enforcement_mode
|
|
require_attestations_by = [for attestor in coalesce(var.default_admission_rule.attestors, []) : google_binary_authorization_attestor.attestors[attestor].name]
|
|
}
|
|
dynamic "cluster_admission_rules" {
|
|
for_each = coalesce(var.cluster_admission_rules, {})
|
|
content {
|
|
cluster = cluster_admission_rules.key
|
|
evaluation_mode = cluster_admission_rules.value.evaluation_mode
|
|
enforcement_mode = cluster_admission_rules.value.enforcement_mode
|
|
require_attestations_by = [for attestor in cluster_admission_rules.value.attestors : google_binary_authorization_attestor.attestors[attestor].name]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "google_binary_authorization_attestor" "attestors" {
|
|
for_each = coalesce(var.attestors_config, {})
|
|
name = each.key
|
|
project = var.project_id
|
|
attestation_authority_note {
|
|
note_reference = each.value.note_reference == null ? google_container_analysis_note.notes[each.key].name : each.value.note_reference
|
|
dynamic "public_keys" {
|
|
for_each = coalesce(each.value.pgp_public_keys, [])
|
|
content {
|
|
ascii_armored_pgp_public_key = public_keys.value
|
|
}
|
|
}
|
|
dynamic "public_keys" {
|
|
for_each = {
|
|
for pkix_public_key in coalesce(each.value.pkix_public_keys, []) :
|
|
"${pkix_public_key.public_key_pem}-${pkix_public_key.signature_algorithm}" => pkix_public_key
|
|
}
|
|
content {
|
|
id = public_keys.value.id
|
|
pkix_public_key {
|
|
public_key_pem = public_keys.value.public_key_pem
|
|
signature_algorithm = public_keys.value.signature_algorithm
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "google_binary_authorization_attestor_iam_binding" "bindings" {
|
|
for_each = merge(flatten([
|
|
for name, attestor_config in var.attestors_config : { for role, members in coalesce(attestor_config.iam, {}) : "${name}-${role}" => {
|
|
name = name
|
|
role = role
|
|
members = members
|
|
} }])...)
|
|
project = google_binary_authorization_attestor.attestors[each.value.name].project
|
|
attestor = google_binary_authorization_attestor.attestors[each.value.name].name
|
|
role = each.value.role
|
|
members = each.value.members
|
|
}
|
|
|
|
resource "google_container_analysis_note" "notes" {
|
|
for_each = toset([for name, attestor_config in var.attestors_config : name if attestor_config.note_reference == null])
|
|
name = "${each.value}-note"
|
|
project = var.project_id
|
|
attestation_authority {
|
|
hint {
|
|
human_readable_name = "Attestor ${each.value} note"
|
|
}
|
|
}
|
|
}
|