Organisation Policies | restrictVpcPeering and kubernetes

user_16500911 0
Viewed 191

I want to have VPC peering denied over whole organisation. Currently it is implemented with organisation policy constraints/compute.restrictVpcPeering set to deny all.

Unfortunately, as a part of kubernetes cluster creation over shared vpc, there is some peering done to the subnets on google side (according to this). I would like to lose up my constrains, so those could be allowed, but I couldn't find the way to only allow those yet.

Subnets on GCP side has resource path like this:

network projects/gke-prod-europe-west3-XXXX/global/networks/gke-ndaXXXXXYYYYYZZZZ-ZZZZ-YYY-net

where XYZ are random.

At first I wanted to use under: notation to allow all peering with networks in under:projects/gke-prod-europe-west3-* but looks like wildcard is not supported format there.

Is there known organization_id that google k8s resource fall under? Or there is other way that I'm missing?

Original error:

Constraint constraints/compute.restrictVpcPeering violated for project 1234567890. Peering the network projects/gke-prod-europe-west3-XXXX/global/networks/gke-ndaXXXXXYYYYYZZZZ-ZZZZ-YYY-net is not allowed.
kubernetes google-cloud-platform
1 Answers

There's no way you can use any wildcard characters; you need to specify project id's by name one by one - no other way around it.

If you have a look at the "Constraints for specific services" documentation:

This list constraint defines the set of VPC networks that are allowed to be peered with the VPC networks belonging to this project, folder, or organization. By default, a Network Admin for one network can peer with any other network. The allowed/denied list of networks must be identified in the form: under:organizations/ORGANIZATION_ID, under:folders/FOLDER_ID, under:projects/PROJECT_ID, or projects/PROJECT_ID/global/networks/NETWORK_NAME. constraints/compute.restrictVpcPeering

You can however request to implement this feature, you can do this by raising a new issue on IssueTracker.

user_122572500
Related