[FR]: Custom organization policies

[markusl]

The feature request

Hi!

We recently learned about a GKE security issue and about the proposed fix, which is a Custom Organization Policy.

We are looking for the preferred way of deploying custom organization policies in our GCP organization using the GCP Fast framework.

An example policy for the GKE looks like this according to the GCP support:

name: >-
  organizations/1001108820753/customConstraints/custom.disableKubeletReadOnlyPort
resource_types: container.googleapis.com/Cluster
method_types:
  - CREATE
  - UPDATE
condition: resource.nodeConfig.kubeletConfig.insecureKubeletReadonlyPortEnabled == true
action_type: DENY
display_name: Disable Kubelet Read-Only Port 10255
description: Disallows the use of Kubelet read-only port 10255 to enhance security

Can you please provide instructions on how can we deploy a custom policy in addition to the managed policies using the framework?

Proposed solution

Additional context

No response

[juliocc]

Does this help?

[juliocc]

Ah you're asking how to do it from FAST.

While the org-policies folder is the correct place to apply an existing policy (including your custom one once it's created), the challenge is that FAST's bootstrap stage doesn't currently expose the org_policy_custom_constraints variable (or its factory). This means you can't create the custom constraint itself using FAST directly.

This is a straightforward fix. Would you be interested in submitting a pull request to add this functionality?

[markusl]

I think it would be best if the example is provided directly by the FAST team so that we get it right from the start :)

I see there are already some examples that look like what we need https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/blob/master/tests/modules/organization/org_policies_custom_constraints.tfvars

Once the upstream is exposing the org_policy_custom_constraints it would probably be easy for us to backport it to our own fork. Fixing the security problem is an official Google Cloud recommendation, and we would greatly appreciate it if it was made possible in the FAST so that it is as easy as possible for the customers.

Thank you!

[juliocc]

Sounds good. We'll add this to the backlog and address it when someone on the team has availability

[juliocc]

Added support to Fabric and FAST in #2869, #2876 and #2884

[markusl]

Thanks! We will look into integrating these changes back to our code base :)