Skip to content

Commit 2b23fd1

Browse files
nikpivkinnikpivkin
committed
fix: handle Autopilot clusters in gke checks
Signed-off-by: Nikita Pivkin <[email protected]>
1 parent 83ac3dd commit 2b23fd1

File tree

11 files changed

+304
-118
lines changed

11 files changed

+304
-118
lines changed

‎checks/cloud/google/gke/enable_auto_repair.rego‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,39 @@ package builtin.google.gke.google0063
2525
import rego.v1
2626

2727
import data.lib.cloud.metadata
28+
import data.lib.cloud.value
2829

2930
deny contains res if {
3031
some cluster in input.google.gke.clusters
3132
isManaged(cluster)
33+
autopilot_disabled(cluster)
3234
some pool in cluster.nodepools
33-
not pool.management.enableautorepair.value
35+
autorepair_is_disabled_for_pool(pool)
3436
res := result.new(
3537
"Node pool does not have auto-repair enabled.",
3638
metadata.obj_by_path(pool, ["management", "enableautorepair"]),
3739
)
3840
}
41+
42+
autorepair_is_disabled_for_pool(pool) if value.is_false(pool.management.enableautorepair)
43+
44+
autorepair_is_disabled_for_pool(pool) if not pool.management.enableautorepair
45+
46+
autopilot_disabled(cluster) if value.is_false(cluster.enableautpilot)
47+
48+
autopilot_disabled(cluster) if not cluster.enableautpilot
49+
50+
deny contains res if {
51+
some cluster in input.google.gke.clusters
52+
isManaged(cluster)
53+
cluster.enableautpilot.value
54+
autorepair_is_disabled(cluster)
55+
res := result.new(
56+
"Node pool does not have auto-repair enabled.",
57+
metadata.obj_by_path(cluster, ["autoscaling", "autoprovisioningdefaults", "management", "enableautorepair"]),
58+
)
59+
}
60+
61+
autorepair_is_disabled(cluster) if value.is_false(cluster.autoscaling.autoprovisioningdefaults.management.enableautorepair)
62+
63+
autorepair_is_disabled(cluster) if not cluster.autoscaling.autoprovisioningdefaults.management.enableautorepair

‎checks/cloud/google/gke/enable_auto_repair_test.rego‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,46 @@ test_deny_auto_repair_disabled if {
1111
count(res) == 1
1212
}
1313

14+
test_deny_auto_repair_disabled_for_autopilot if {
15+
inp := {"google": {"gke": {"clusters": [{
16+
"enableautpilot": {"value": true},
17+
"autoscaling": {"autoprovisioningdefaults": {"management": {"enableautorepair": {"value": false}}}},
18+
}]}}}
19+
20+
res := check.deny with input as inp
21+
count(res) == 1
22+
}
23+
24+
test_deny_auto_repair_missing_for_autopilot if {
25+
inp := {"google": {"gke": {"clusters": [{"enableautpilot": {"value": true}}]}}}
26+
27+
res := check.deny with input as inp
28+
count(res) == 1
29+
}
30+
1431
test_allow_auto_repair_enabled if {
1532
inp := {"google": {"gke": {"clusters": [{"nodepools": [{"management": {"enableautorepair": {"value": true}}}]}]}}}
1633

1734
res := check.deny with input as inp
1835
res == set()
1936
}
37+
38+
test_allow_auto_repair_enabled_for_autopilot if {
39+
inp := {"google": {"gke": {"clusters": [{
40+
"enableautpilot": {"value": true},
41+
"autoscaling": {"autoprovisioningdefaults": {"management": {"enableautorepair": {"value": true}}}},
42+
}]}}}
43+
44+
res := check.deny with input as inp
45+
res == set()
46+
}
47+
48+
test_allow_auto_repair_unresolvable_for_autopilot if {
49+
inp := {"google": {"gke": {"clusters": [{
50+
"enableautpilot": {"value": true},
51+
"autoscaling": {"autoprovisioningdefaults": {"management": {"enableautorepair": {"value": false, "unresolvable": true}}}},
52+
}]}}}
53+
54+
res := check.deny with input as inp
55+
res == set()
56+
}

‎checks/cloud/google/gke/enable_auto_upgrade.rego‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,39 @@ package builtin.google.gke.google0058
2525
import rego.v1
2626

2727
import data.lib.cloud.metadata
28+
import data.lib.cloud.value
2829

2930
deny contains res if {
3031
some cluster in input.google.gke.clusters
3132
isManaged(cluster)
33+
autopilot_disabled(cluster)
3234
some pool in cluster.nodepools
33-
not pool.management.enableautoupgrade.value
35+
autoupgrade_is_disabled_for_pool(pool)
3436
res := result.new(
35-
"Node pool does not have auto-upgraade enabled.",
37+
"Node pool does not have auto-repair enabled.",
3638
metadata.obj_by_path(pool, ["management", "enableautoupgrade"]),
3739
)
3840
}
41+
42+
autoupgrade_is_disabled_for_pool(pool) if value.is_false(pool.management.enableautoupgrade)
43+
44+
autoupgrade_is_disabled_for_pool(pool) if not pool.management.enableautoupgrade
45+
46+
autopilot_disabled(cluster) if value.is_false(cluster.enableautpilot)
47+
48+
autopilot_disabled(cluster) if not cluster.enableautpilot
49+
50+
deny contains res if {
51+
some cluster in input.google.gke.clusters
52+
isManaged(cluster)
53+
cluster.enableautpilot.value
54+
autoupgrade_is_disabled(cluster)
55+
res := result.new(
56+
"Node pool does not have auto-repair enabled.",
57+
metadata.obj_by_path(cluster, ["autoscaling", "autoprovisioningdefaults", "management", "enableautoupgrade"]),
58+
)
59+
}
60+
61+
autoupgrade_is_disabled(cluster) if value.is_false(cluster.autoscaling.autoprovisioningdefaults.management.enableautoupgrade)
62+
63+
autoupgrade_is_disabled(cluster) if not cluster.autoscaling.autoprovisioningdefaults.management.enableautoupgrade

‎checks/cloud/google/gke/enable_auto_upgrade_test.rego‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,46 @@ test_deny_auto_upgrade_disabled if {
1111
count(res) == 1
1212
}
1313

14+
test_deny_auto_repair_disabled_for_autopilot if {
15+
inp := {"google": {"gke": {"clusters": [{
16+
"enableautpilot": {"value": true},
17+
"autoscaling": {"autoprovisioningdefaults": {"management": {"enableautoupgrade": {"value": false}}}},
18+
}]}}}
19+
20+
res := check.deny with input as inp
21+
count(res) == 1
22+
}
23+
24+
test_deny_auto_repair_missing_for_autopilot if {
25+
inp := {"google": {"gke": {"clusters": [{"enableautpilot": {"value": true}}]}}}
26+
27+
res := check.deny with input as inp
28+
count(res) == 1
29+
}
30+
1431
test_allow_auto_upgrade_enabled if {
1532
inp := {"google": {"gke": {"clusters": [{"nodepools": [{"management": {"enableautoupgrade": {"value": true}}}]}]}}}
1633

1734
res := check.deny with input as inp
1835
res == set()
1936
}
37+
38+
test_allow_auto_repair_enabled_for_autopilot if {
39+
inp := {"google": {"gke": {"clusters": [{
40+
"enableautpilot": {"value": true},
41+
"autoscaling": {"autoprovisioningdefaults": {"management": {"enableautoupgrade": {"value": true}}}},
42+
}]}}}
43+
44+
res := check.deny with input as inp
45+
res == set()
46+
}
47+
48+
test_allow_auto_repair_unresolvable_for_autopilot if {
49+
inp := {"google": {"gke": {"clusters": [{
50+
"enableautpilot": {"value": true},
51+
"autoscaling": {"autoprovisioningdefaults": {"management": {"enableautoupgrade": {"value": false, "unresolvable": true}}}},
52+
}]}}}
53+
54+
res := check.deny with input as inp
55+
res == set()
56+
}

‎checks/cloud/google/gke/node_pool_uses_cos.rego‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,15 @@
2222
# examples: checks/cloud/google/gke/node_pool_uses_cos.yaml
2323
package builtin.google.gke.google0054
2424

25+
import data.lib.cloud.value
2526
import rego.v1
2627

2728
deny contains res if {
2829
some cluster in input.google.gke.clusters
2930
isManaged(cluster)
31+
autopilot_disabled(cluster)
3032
image_type := cluster.nodeconfig.imagetype
31-
not lower(image_type.value) in {"cos", "cos_containerd", ""}
33+
image_type_is_not_cos(image_type, {"cos", "cos_containerd", ""})
3234
res := result.new(
3335
"Cluster is not configuring node pools to use the COS containerd image type by default.",
3436
image_type,
@@ -38,11 +40,35 @@ deny contains res if {
3840
deny contains res if {
3941
some cluster in input.google.gke.clusters
4042
isManaged(cluster)
43+
autopilot_disabled(cluster)
4144
some pool in cluster.nodepools
4245
image_type := pool.nodeconfig.imagetype
43-
not lower(image_type.value) in {"cos", "cos_containerd"}
46+
image_type_is_not_cos(image_type, {"cos", "cos_containerd"})
4447
res := result.new(
4548
"Node pool is not using the COS containerd image type.",
4649
image_type,
4750
)
4851
}
52+
53+
autopilot_disabled(cluster) if value.is_false(cluster.enableautpilot)
54+
55+
autopilot_disabled(cluster) if not cluster.enableautpilot
56+
57+
deny contains res if {
58+
some cluster in input.google.gke.clusters
59+
isManaged(cluster)
60+
cluster.enableautpilot.value
61+
image_type := cluster.autoscaling.autoprovisioningdefaults.imagetype
62+
image_type_is_not_cos(image_type, {"cos", "cos_containerd"})
63+
res := result.new(
64+
"Node pool is not using the COS containerd image type.",
65+
image_type,
66+
)
67+
}
68+
69+
image_type_is_not_cos(image_type, _) if value.is_empty(image_type)
70+
71+
image_type_is_not_cos(image_type, allowed) if {
72+
value.is_not_empty(image_type)
73+
not lower(image_type.value) in allowed
74+
}

‎checks/cloud/google/gke/node_pool_uses_cos_test.rego‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,16 @@ test_deny_node_pool_image_type_is_ubuntu if {
1818
count(res) == 1
1919
}
2020

21+
test_deny_autopilot_image_type_is_ubuntu if {
22+
inp := {"google": {"gke": {"clusters": [{
23+
"enableautpilot": {"value": true},
24+
"autoscaling": {"autoprovisioningdefaults": {"imagetype": {"value": "UBUNTU"}}},
25+
}]}}}
26+
27+
res := check.deny with input as inp
28+
count(res) == 1
29+
}
30+
2131
test_allow_node_config_image_type_is_cos if {
2232
inp := {"google": {"gke": {"clusters": [{"nodeconfig": {"imagetype": {"value": "COS"}}}]}}}
2333

@@ -31,3 +41,23 @@ test_allow_node_pool_image_type_is_cos if {
3141
res := check.deny with input as inp
3242
res == set()
3343
}
44+
45+
test_allow_autopilot_image_type_is_cos if {
46+
inp := {"google": {"gke": {"clusters": [{
47+
"enableautpilot": {"value": true},
48+
"autoscaling": {"autoprovisioningdefaults": {"imagetype": {"value": "COS"}}},
49+
}]}}}
50+
51+
res := check.deny with input as inp
52+
res == set()
53+
}
54+
55+
test_allow_autopilot_image_type_is_unresolvable if {
56+
inp := {"google": {"gke": {"clusters": [{
57+
"enableautpilot": {"value": true},
58+
"autoscaling": {"autoprovisioningdefaults": {"imagetype": {"value": "", "unresolvable": true}}},
59+
}]}}}
60+
61+
res := check.deny with input as inp
62+
res == set()
63+
}

‎checks/cloud/google/gke/use_service_account.rego‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import data.lib.cloud.value
3232
deny contains res if {
3333
some cluster in input.google.gke.clusters
3434
isManaged(cluster)
35+
autopilot_disabled(cluster)
3536
value.is_false(cluster.removedefaultnodepool)
3637
default_account_is_not_overrided(cluster.nodeconfig)
3738
res := result.new(
@@ -43,6 +44,7 @@ deny contains res if {
4344
deny contains res if {
4445
some cluster in input.google.gke.clusters
4546
isManaged(cluster)
47+
autopilot_disabled(cluster)
4648
some pool in cluster.nodepools
4749
default_account_is_not_overrided(pool.nodeconfig)
4850
res := result.new(
@@ -51,6 +53,21 @@ deny contains res if {
5153
)
5254
}
5355

56+
deny contains res if {
57+
some cluster in input.google.gke.clusters
58+
isManaged(cluster)
59+
cluster.enableautpilot.value
60+
default_account_is_not_overrided(cluster.autoscaling.autoprovisioningdefaults)
61+
res := result.new(
62+
"Cluster does not override the default service account.",
63+
metadata.obj_by_path(cluster, ["nodeconfig", "serviceaccount"]),
64+
)
65+
}
66+
67+
autopilot_disabled(cluster) if value.is_false(cluster.enableautpilot)
68+
69+
autopilot_disabled(cluster) if not cluster.enableautpilot
70+
5471
default_account_is_not_overrided(nodeconfig) if value.is_empty(nodeconfig.serviceaccount)
5572

5673
default_account_is_not_overrided(nodeconfig) if not nodeconfig.serviceaccount

‎examples/serverless/python2.rego‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@
88
# Ensure that you use a supported runtime version, such as Python 3.x,
99
# to maintain the security and reliability of your serverless application.
1010
# scope: package
11-
# schemas:
12-
# - input: schema["yaml"]
1311
# related_resources:
1412
# - https://www.python.org/doc/sunset-python-2/
1513
# custom:

‎examples/terraform-plan/asg_capacity.rego‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@
66
#
77
# Ensure that the desired capacity for Auto Scaling Groups is set to a reasonable value, typically within limits defined by your organization.
88
# scope: package
9-
# schemas:
10-
# - input: schema["json"]
119
# related_resources:
1210
# - https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_group
1311
# custom:

0 commit comments

Comments
 (0)