Add support for pod security policy (hashicorp#1192)

* move setid calls back

* add support for pod security policy

* pod security policy docs

* Revert "move setid calls back"

This reverts commit 0c7b2db.

* cleanup

* remove comments about disabling update

google/config.go

@@ -167,6 +167,13 @@ func (c *Config) loadAndValidate() error {
 	}
 	c.clientContainer.UserAgent = userAgent
 
+	log.Printf("[INFO] Instantiating GKE Beta client...")
+	c.clientContainerBeta, err = containerBeta.New(client)
+	if err != nil {
+		return err
+	}
+	c.clientContainerBeta.UserAgent = userAgent
+
 	log.Printf("[INFO] Instantiating Google Cloud DNS client...")
 	c.clientDns, err = dns.New(client)
 	if err != nil {

google/resource_container_cluster.go

@@ -18,7 +18,7 @@ import (
 var (
 	instanceGroupManagerURL           = regexp.MustCompile("^https://www.googleapis.com/compute/v1/projects/([a-z][a-z0-9-]{5}(?:[-a-z0-9]{0,23}[a-z0-9])?)/zones/([a-z0-9-]*)/instanceGroupManagers/([^/]*)")
 	ContainerClusterBaseApiVersion    = v1
-	ContainerClusterVersionedFeatures = []Feature{}
+	ContainerClusterVersionedFeatures = []Feature{Feature{Version: v1beta1, Item: "pod_security_policy_config"}}
 
 	networkConfig = &schema.Resource{
 		Schema: map[string]*schema.Schema{
@@ -356,6 +356,22 @@ func resourceContainerCluster() *schema.Resource {
 				Computed: true,
 			},
 
+			"pod_security_policy_config": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				ForceNew: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:     schema.TypeBool,
+							Required: true,
+							ForceNew: true,
+						},
+					},
+				},
+			},
+
 			"project": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -575,6 +591,10 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 		}
 	}
 
+	if v, ok := d.GetOk("pod_security_policy_config"); ok {
+		cluster.PodSecurityPolicyConfig = expandPodSecurityPolicyConfig(v)
+	}
+
 	req := &containerBeta.CreateClusterRequest{
 		Cluster: cluster,
 	}
@@ -742,6 +762,12 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
 		d.Set("instance_group_urls", igUrls)
 	}
 
+	if cluster.PodSecurityPolicyConfig != nil {
+		if err := d.Set("pod_security_policy_config", flattenPodSecurityPolicyConfig(cluster.PodSecurityPolicyConfig)); err != nil {
+			return err
+		}
+	}
+
 	return nil
 }
 
@@ -1270,6 +1296,16 @@ func expandNetworkPolicy(configured interface{}) *containerBeta.NetworkPolicy {
 	return result
 }
 
+func expandPodSecurityPolicyConfig(configured interface{}) *containerBeta.PodSecurityPolicyConfig {
+	result := &containerBeta.PodSecurityPolicyConfig{}
+	if len(configured.([]interface{})) > 0 {
+		config := configured.([]interface{})[0].(map[string]interface{})
+		result.Enabled = config["enabled"].(bool)
+		result.ForceSendFields = []string{"Enabled"}
+	}
+	return result
+}
+
 func flattenNetworkPolicy(c *containerBeta.NetworkPolicy) []map[string]interface{} {
 	result := []map[string]interface{}{}
 	if c != nil {
@@ -1358,6 +1394,14 @@ func flattenMasterAuthorizedNetworksConfig(c *containerBeta.MasterAuthorizedNetw
 	return []map[string]interface{}{result}
 }
 
+func flattenPodSecurityPolicyConfig(c *containerBeta.PodSecurityPolicyConfig) []map[string]interface{} {
+	return []map[string]interface{}{
+		{
+			"enabled": c.Enabled,
+		},
+	}
+}
+
 func resourceContainerClusterStateImporter(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
 	parts := strings.Split(d.Id(), "/")
 	if len(parts) != 2 {

google/resource_container_cluster_test.go

@@ -719,6 +719,29 @@ func TestAccContainerCluster_withIPAllocationPolicy(t *testing.T) {
 	})
 }
 
+func TestAccContainerCluster_withPodSecurityPolicy(t *testing.T) {
+	t.Parallel()
+
+	clusterName := fmt.Sprintf("cluster-test-%s", acctest.RandString(10))
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckContainerClusterDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerCluster_withPodSecurityPolicy(clusterName, true),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContainerCluster(
+						"google_container_cluster.with_pod_security_policy"),
+					resource.TestCheckResourceAttr("google_container_cluster.with_pod_security_policy",
+						"pod_security_policy_config.0.enabled", "true"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckContainerClusterDestroy(s *terraform.State) error {
 	config := testAccProvider.Meta().(*Config)
 
@@ -1643,3 +1666,16 @@ resource "google_container_cluster" "with_ip_allocation_policy" {
 	}
 }`, acctest.RandString(10), secondaryRanges.String(), cluster, ipAllocationPolicy.String())
 }
+
+func testAccContainerCluster_withPodSecurityPolicy(clusterName string, enabled bool) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "with_pod_security_policy" {
+	name = "cluster-test-%s"
+	zone = "us-central1-a"
+	initial_node_count = 1
+
+	pod_security_policy_config {
+		enabled = %v
+	}
+}`, clusterName, enabled)
+}

website/docs/r/container_cluster.html.markdown

@@ -148,6 +148,10 @@ output "cluster_ca_certificate" {
     or set to the same value as `min_master_version` on create. Defaults to the default
     version set by GKE which is not necessarily the latest version.
 
+* `pod_security_policy_config` - (Optional, [Beta](/docs/providers/google/index.html#beta-features)) Configuration for the
+    [PodSecurityPolicy](https://cloud.google.com/kubernetes-engine/docs/how-to/pod-security-policies) feature.
+    Structure is documented below.
+
 * `project` - (Optional) The ID of the project in which the resource belongs. If it
     is not provided, the provider project is used.
 
@@ -292,6 +296,11 @@ The `guest_accelerator` block supports:
 
 * `count` (Required) - The number of the guest accelerator cards exposed to this instance.
 
+The `pod_security_policy_config` block supports:
+
+* `enabled` (Required) - Enable the PodSecurityPolicy controller for this cluster.
+    If enabled, pods must be valid under a PodSecurityPolicy to be created.
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are