fix: update control_plane_user_managed_keys.yaml (#216)

Removing forward slash as Cloud KMS nor CA Service recognize the path
GoogleCloudPlatform · Oct 31, 2024 · 5da3883 · 5da3883
1 parent 3247b6f
commit 5da3883
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/gke-custom-org-policy/samples/control-plane-authority/control_plane_user_managed_keys.yaml b/gke-custom-org-policy/samples/control-plane-authority/control_plane_user_managed_keys.yaml
@@ -3,7 +3,7 @@ resource_types: container.googleapis.com/Cluster
 method_types:
  - CREATE
  - UPDATE
-condition: resource.userManagedKeysConfig.clusterCa.startsWith("/projects/${PROJECT_ID}") && resource.userManagedKeysConfig.etcdApiCa.startsWith("/projects/${PROJECT_ID}") && resource.userManagedKeysConfig.etcdPeerCa.startsWith("/projects/${PROJECT_ID}") && resource.userManagedKeysConfig.aggregationCa.startsWith("/projects/${PROJECT_ID}") && resource.userManagedKeysConfig.controlPlaneDiskEncryptionKey.startsWith("/projects/${PROJECT_ID}") && resource.userManagedKeysConfig.gkeopsEtcdBackupEncryptionKey.startsWith("/projects/${PROJECT_ID}") && resource.userManagedKeysConfig.serviceAccountSigningKeys.all(key, key.startsWith("/projects/${PROJECT_ID}")) && resource.userManagedKeysConfig.serviceAccountVerificationKeys.all(key, key.startsWith("/projects/${PROJECT_ID}"))
+condition: resource.userManagedKeysConfig.clusterCa.startsWith("projects/${PROJECT_ID}") && resource.userManagedKeysConfig.etcdApiCa.startsWith("projects/${PROJECT_ID}") && resource.userManagedKeysConfig.etcdPeerCa.startsWith("projects/${PROJECT_ID}") && resource.userManagedKeysConfig.aggregationCa.startsWith("projects/${PROJECT_ID}") && resource.userManagedKeysConfig.controlPlaneDiskEncryptionKey.startsWith("projects/${PROJECT_ID}") && resource.userManagedKeysConfig.gkeopsEtcdBackupEncryptionKey.startsWith("projects/${PROJECT_ID}") && resource.userManagedKeysConfig.serviceAccountSigningKeys.all(key, key.startsWith("projects/${PROJECT_ID}")) && resource.userManagedKeysConfig.serviceAccountVerificationKeys.all(key, key.startsWith("projects/${PROJECT_ID}"))
 action_type: ALLOW
 display_name: GKE Control Plane Authority CMEK
 description: Only allow Clusters to be created and updated with GKE Control Plane Authority features, namely inputting the Cluster CA, etcd-API CA, etcd-peer CA, service account signing & verification key, etcd backup encryption key, and the control plane boot disk & etcd storage key housed in Certificate Authority Service and Cloud KMS from specific project.