Require PSC Clusters

badcluster.tf

resource "google_compute_network" "badcluster_vpc" {
  name                    = "badcluster-vpc"
  auto_create_subnetworks = "false"
}


resource "google_compute_subnetwork" "badcluster_node_subnet" {
  name          = "badcluster-node-subnet"
  region        = var.region
  network       = google_compute_network.badcluster_vpc.name
  ip_cidr_range = "10.10.0.0/24"
}

resource "google_container_cluster" "badcluster-01" {
  provider = google-beta
  name     = "badcluster-01"

  location = var.region

  network    = google_compute_network.badcluster_vpc.id
  subnetwork = google_compute_subnetwork.badcluster_node_subnet.id

  min_master_version = "1.29"
  initial_node_count = 1
  node_version       = "1.29"

  private_cluster_config {
    enable_private_nodes        = true
    enable_private_endpoint     = true
    master_ipv4_cidr_block = "172.18.0.0/28"
  }

  master_authorized_networks_config {
  }

  deletion_protection = false
}

goodcluster.tf

provider "google-beta" {
  project = var.project_id
  region  = var.region
}

resource "google_compute_network" "goodcluster_vpc" {
  name                    = "goodcluster-vpc"
  auto_create_subnetworks = "false"
}


resource "google_compute_subnetwork" "goodcluster_node_subnet" {
  name          = "goodcluster-node-subnet"
  region        = var.region
  network       = google_compute_network.goodcluster_vpc.name
  ip_cidr_range = "10.10.0.0/24"
}

resource "google_container_cluster" "default" {
  provider = google-beta
  name     = "goodcluster-01"

  location = var.region

  network    = google_compute_network.goodcluster_vpc.id
  subnetwork = google_compute_subnetwork.goodcluster_node_subnet.id

  min_master_version = "1.29"
  initial_node_count = 1
  node_version       = "1.29"

  private_cluster_config {
    enable_private_nodes        = true
    enable_private_endpoint     = true
    private_endpoint_subnetwork = google_compute_subnetwork.goodcluster_node_subnet.id
  }

  master_authorized_networks_config {
  }

  deletion_protection = false
}

orgpolicy.tf

resource "google_org_policy_custom_constraint" "require_psc_clusters" {
  name           = "custom.requirePscClusters"
  parent         = "organizations/${var.organization_id}"
  description    = "Enforce an empty masterIpv4CidrBlock so that connectivity is provided by Private Service Connect"
  action_type    = "DENY"
  condition      = "resource.privateClusterConfig.masterIpv4CidrBlock != ''"
  method_types   = ["CREATE", "UPDATE"]
  resource_types = ["container.googleapis.com/Cluster"]
}

variables.tf

variable "project_id" {
  description = "project id"
}

variable "region" {
  description = "region"
}

variable "organization_id" {
    description = "organization id"
}