feat: Add another example constraint for CPA user managed keys. (#217)

GoogleCloudPlatform · Oct 31, 2024 · ee400f9 · ee400f9
1 parent 5da3883
commit ee400f9
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/...rg-policy/samples/control-plane-authority/control_plane_user_managed_keys_must_exist.yaml b/...rg-policy/samples/control-plane-authority/control_plane_user_managed_keys_must_exist.yaml
@@ -0,0 +1,9 @@
+name: organizations/${ORG_ID}/customConstraints/custom.controlPlaneUserManagedKeys
+resource_types: container.googleapis.com/Cluster
+method_types:
+ - CREATE
+ - UPDATE
+condition: resource.userManagedKeysConfig.clusterCa != "" && resource.userManagedKeysConfig.etcdApiCa != "" && resource.userManagedKeysConfig.etcdPeerCa != "" && resource.userManagedKeysConfig.aggregationCa != "" && resource.userManagedKeysConfig.controlPlaneDiskEncryptionKey != "" && resource.userManagedKeysConfig.gkeopsEtcdBackupEncryptionKey != "" && size(resource.userManagedKeysConfig.serviceAccountSigningKeys) != 0 && size(resource.userManagedKeysConfig.serviceAccountVerificationKeys) != 0
+action_type: ALLOW
+display_name: GKE Control Plane Authority CMEK
+description: Only allow Clusters to be created and updated with GKE Control Plane Authority features, namely inputting the Cluster CA, etcd-API CA, etcd-peer CA, service account signing & verification key, etcd backup encryption key, and the control plane boot disk & etcd storage key.
diff --git a/...rity/control_plane_user_managed_keys.yaml → ...aged_keys_must_start_with_project_id.yaml b/...rity/control_plane_user_managed_keys.yaml → ...aged_keys_must_start_with_project_id.yaml
@@ -7,4 +7,3 @@ condition: resource.userManagedKeysConfig.clusterCa.startsWith("projects/${PROJE
 action_type: ALLOW
 display_name: GKE Control Plane Authority CMEK
 description: Only allow Clusters to be created and updated with GKE Control Plane Authority features, namely inputting the Cluster CA, etcd-API CA, etcd-peer CA, service account signing & verification key, etcd backup encryption key, and the control plane boot disk & etcd storage key housed in Certificate Authority Service and Cloud KMS from specific project.
-
Original file line number	Diff line number	Diff line change
Expand Up		@@ -7,4 +7,3 @@ condition: resource.userManagedKeysConfig.clusterCa.startsWith("projects/${PROJE
		action_type: ALLOW
		display_name: GKE Control Plane Authority CMEK
		description: Only allow Clusters to be created and updated with GKE Control Plane Authority features, namely inputting the Cluster CA, etcd-API CA, etcd-peer CA, service account signing & verification key, etcd backup encryption key, and the control plane boot disk & etcd storage key housed in Certificate Authority Service and Cloud KMS from specific project.