binary authorization is now ga #2007

danawillow · 2019-07-02T22:15:30Z

Since Container Analysis is a dependency and it isn't GA, I tested with the following config (apply, apply again to check no diffs, destroy):

provider "google" {}
provider "google-beta" {}

// Use a separate project since each project can only have one policy
resource "google_project" "project" {
  provider = "google"
  project_id      = "tf-test-b-72237747-3"
  name            = "tf-test-b-72237747-3"
  org_id          = "[redacted]"
  billing_account = "[redacted]"
}

resource "google_project_service" "binauthz" {
  provider = "google"
  project = "${google_project.project.project_id}"
  service = "binaryauthorization.googleapis.com"
}

resource "google_container_analysis_note" "note" {
  provider = "google-beta"
  project = "${google_project.project.project_id}"

  name = "tf-test-b-72237747"
  attestation_authority {
    hint {
      human_readable_name = "My attestor"
    }
  }

  depends_on = ["google_project_service.binauthz"]
}

resource "google_binary_authorization_attestor" "attestor" {
  provider = "google"
  project = "${google_project.project.project_id}"

  name = "tf-test-b-72237747"
  description = "my description"
  attestation_authority_note {
    note_reference = "${google_container_analysis_note.note.name}"
  }

  depends_on = ["google_project_service.binauthz"]
}

resource "google_binary_authorization_policy" "policy" {
  provider = "google"
  project = "${google_project.project.project_id}"

  admission_whitelist_patterns {
    name_pattern= "gcr.io/google_containers/*"
  }

  default_admission_rule {
    evaluation_mode = "ALWAYS_ALLOW"
    enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"
  }

  cluster_admission_rules {
    cluster = "us-central1-a.prod-cluster"
    evaluation_mode = "REQUIRE_ATTESTATION"
    enforcement_mode = "ENFORCED_BLOCK_AND_AUDIT_LOG"
    require_attestations_by = ["${google_binary_authorization_attestor.attestor.name}"]
  }
}

The other options were:

Vendor the entire beta provider into the GA provider so that we could include it in tests
Move Container Analysis to the GA provider even though the product is still beta

Release Note for Downstream PRs (will be copied)

`google_binary_authorization_attestor` and `google_binary_authorization_policy` are available in the GA provider

modular-magician · 2019-07-02T22:27:04Z

Hi! I'm the modular magician, I work on Magic Modules.
This PR seems not to have generated downstream PRs before, as of edc32bb.

Pull request statuses

No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: hashicorp/terraform-provider-google-beta#913
depends: GoogleCloudPlatform/terraform-google-conversion#121
depends: hashicorp/terraform-provider-google#3960

modular-magician · 2019-07-02T22:44:45Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, bc6af09.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

modular-magician · 2019-07-02T22:46:30Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 2e420c7.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

modular-magician · 2019-07-02T23:20:11Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 7db1663.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

modular-magician · 2019-07-02T23:53:56Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 5c7fc45.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

modular-magician · 2019-07-03T16:52:29Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 1d7474f.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

modular-magician · 2019-07-03T20:39:05Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 83a8b70.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: modular-magician/ansible#300
depends: modular-magician/inspec-gcp#170

modular-magician · 2019-07-03T21:50:27Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 84b449d.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

modular-magician · 2019-07-03T23:07:51Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 23046ca.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

chrisst · 2019-07-08T15:39:21Z

templates/terraform/decoders/binauth_attestor_note_field_name.go.erb

+	# limitations under the License.
+-%>
+<% if version == 'ga' -%>
+res["userOwnedDrydockNote"] = res["userOwnedGrafeasNote"]


Can you add a comment that this field was renamed from beta->ga so we don't lose that context?

modular-magician · 2019-07-15T20:47:14Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 365293d.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

modular-magician · 2019-07-17T03:43:26Z

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 1c6738b.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

Tracked submodules are build/terraform-beta build/terraform-mapper build/terraform build/ansible build/inspec.

googlebot added the cla: yes label Jul 2, 2019

modular-magician added downstream-generated terraform-google-conversion terraform-provider-google-beta terraform-provider-google labels Jul 2, 2019

modular-magician added ansible inspec labels Jul 3, 2019

danawillow force-pushed the binauth branch from 83a8b70 to 84b449d Compare July 3, 2019 21:37

danawillow requested a review from chrisst July 4, 2019 17:19

chrisst approved these changes Jul 8, 2019

View reviewed changes

danawillow force-pushed the binauth branch from 981f2bf to 1c6738b Compare July 17, 2019 03:32

modular-magician added the automerged label Jul 17, 2019

danawillow added 7 commits July 17, 2019 23:08

binary authorization is now ga

54da987

sidebar

d09da6d

tests

aa5b285

provider.go

34d340f

config.go

7c5c43a

container analysis is still beta, get rid of binauth tests that use it

228259b

add custom code to handle field rename in ga api

6c42fb3

danawillow and others added 4 commits July 17, 2019 23:08

fix lint

1f470f5

add comment about rename

629b3e0

update provider reference with v1 endpoint

6496d1c

Update tracked submodules -> HEAD on Wed Jul 17 23:08:40 UTC 2019

7f919cb

Tracked submodules are build/terraform-beta build/terraform-mapper build/terraform build/ansible build/inspec.

modular-magician force-pushed the binauth branch from 1c6738b to 7f919cb Compare July 17, 2019 23:08

modular-magician merged commit 76ed72d into GoogleCloudPlatform:master Jul 17, 2019

danawillow deleted the binauth branch July 17, 2019 23:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

binary authorization is now ga #2007

binary authorization is now ga #2007

danawillow commented Jul 2, 2019 •

edited

Loading

modular-magician commented Jul 2, 2019

modular-magician commented Jul 2, 2019

modular-magician commented Jul 2, 2019

modular-magician commented Jul 2, 2019

modular-magician commented Jul 2, 2019

modular-magician commented Jul 3, 2019

modular-magician commented Jul 3, 2019

modular-magician commented Jul 3, 2019

modular-magician commented Jul 3, 2019

chrisst Jul 8, 2019

modular-magician commented Jul 15, 2019

modular-magician commented Jul 17, 2019

binary authorization is now ga #2007

binary authorization is now ga #2007

Conversation

danawillow commented Jul 2, 2019 • edited Loading

Release Note for Downstream PRs (will be copied)

modular-magician commented Jul 2, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 2, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 2, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 2, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 2, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 3, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 3, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 3, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 3, 2019

Pull request statuses

New Pull Requests

chrisst Jul 8, 2019

Choose a reason for hiding this comment

modular-magician commented Jul 15, 2019

Pull request statuses

New Pull Requests

modular-magician commented Jul 17, 2019

Pull request statuses

New Pull Requests

danawillow commented Jul 2, 2019 •

edited

Loading