rules:
    - id: gcp-gke-nodepool-metadata-server-enabled
      patterns:
        - pattern: resource
        - pattern-inside: |
              resource "google_container_node_pool" "..." {
              ...
              }
        - pattern-not-inside: |
              resource "google_container_node_pool" "..." {
              ...
              node_config {
                ...
                workload_metadata_config {
                  ...
                  node_metadata = "GKE_METADATA_SERVER"
                  ...
                }
                ...
              }
              ...
              }
        - pattern-not-inside: |
              resource "google_container_node_pool" "..." {
              ...
              node_config {
                ...
                workload_metadata_config {
                  ...
                  mode = "GKE_METADATA"
                  ...
                }
                ...
              }
              ...
              }
      message: >-
        Ensure the GKE Metadata Server is Enabled	
      metadata:
        category: best-practice
        technology:
          - terraform
          - gcp
      languages: [hcl]
      severity: WARNING