fix!: dns_allow_external_traffic on private clusters (#2334)

apeabody · web-flow · commit 1c6ff12b9c01 · 2025-04-25T17:48:33.000Z
diff --git a/autogen/main/cluster.tf.tmpl b/autogen/main/cluster.tf.tmpl
@@ -697,15 +697,10 @@ resource "google_container_cluster" "primary" {
 
 {% endif %}
   dynamic "control_plane_endpoints_config" {
-    for_each = var.dns_allow_external_traffic != null {% if private_cluster %}|| (var.enable_private_endpoint && var.deploy_using_private_endpoint) {% endif %}? [1] : []
+    for_each = var.dns_allow_external_traffic != null ? [1] : []
     content {
       dns_endpoint_config {
- {% if private_cluster %}
-        # TODO: Migrate to only dns_allow_external_traffic in next breaking release
-        allow_external_traffic = var.dns_allow_external_traffic == true || var.deploy_using_private_endpoint
-{% else %}
         allow_external_traffic = var.dns_allow_external_traffic
-{% endif %}
       }
     }
   }
diff --git a/docs/upgrading_to_v37.0.md b/docs/upgrading_to_v37.0.md
@@ -0,0 +1,18 @@
+# Upgrading to v37.0
+The v37.0 release of *kubernetes-engine* is a backwards incompatible release.
+
+### Google Cloud Platform Provider upgrade
+The Terraform Kubernetes Engine Module now requires version 6.27 or higher of the Google Cloud Platform Providers.
+
+### Private Cluster DNS Allow External Traffic
+DNS allow external traffic is now controlled solely by `dns_allow_external_traffic` for private clusters.
+To enable, set `dns_allow_external_traffic` to `true`.
+
+```diff
+  module "cluster" {
+-   version          = "~> 36.0"
++   version          = "~> 37.0"
+
++   dns_allow_external_traffic = true
+}
+```
diff --git a/modules/beta-autopilot-private-cluster/cluster.tf b/modules/beta-autopilot-private-cluster/cluster.tf
@@ -351,11 +351,10 @@ resource "google_container_cluster" "primary" {
   }
 
   dynamic "control_plane_endpoints_config" {
-    for_each = var.dns_allow_external_traffic != null || (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []
+    for_each = var.dns_allow_external_traffic != null ? [1] : []
     content {
       dns_endpoint_config {
-        # TODO: Migrate to only dns_allow_external_traffic in next breaking release
-        allow_external_traffic = var.dns_allow_external_traffic == true || var.deploy_using_private_endpoint
+        allow_external_traffic = var.dns_allow_external_traffic
       }
     }
   }
diff --git a/modules/beta-private-cluster-update-variant/cluster.tf b/modules/beta-private-cluster-update-variant/cluster.tf
@@ -592,11 +592,10 @@ resource "google_container_cluster" "primary" {
   }
 
   dynamic "control_plane_endpoints_config" {
-    for_each = var.dns_allow_external_traffic != null || (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []
+    for_each = var.dns_allow_external_traffic != null ? [1] : []
     content {
       dns_endpoint_config {
-        # TODO: Migrate to only dns_allow_external_traffic in next breaking release
-        allow_external_traffic = var.dns_allow_external_traffic == true || var.deploy_using_private_endpoint
+        allow_external_traffic = var.dns_allow_external_traffic
       }
     }
   }
diff --git a/modules/beta-private-cluster/cluster.tf b/modules/beta-private-cluster/cluster.tf
@@ -592,11 +592,10 @@ resource "google_container_cluster" "primary" {
   }
 
   dynamic "control_plane_endpoints_config" {
-    for_each = var.dns_allow_external_traffic != null || (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []
+    for_each = var.dns_allow_external_traffic != null ? [1] : []
     content {
       dns_endpoint_config {
-        # TODO: Migrate to only dns_allow_external_traffic in next breaking release
-        allow_external_traffic = var.dns_allow_external_traffic == true || var.deploy_using_private_endpoint
+        allow_external_traffic = var.dns_allow_external_traffic
       }
     }
   }
diff --git a/modules/private-cluster-update-variant/cluster.tf b/modules/private-cluster-update-variant/cluster.tf
@@ -541,11 +541,10 @@ resource "google_container_cluster" "primary" {
   }
 
   dynamic "control_plane_endpoints_config" {
-    for_each = var.dns_allow_external_traffic != null || (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []
+    for_each = var.dns_allow_external_traffic != null ? [1] : []
     content {
       dns_endpoint_config {
-        # TODO: Migrate to only dns_allow_external_traffic in next breaking release
-        allow_external_traffic = var.dns_allow_external_traffic == true || var.deploy_using_private_endpoint
+        allow_external_traffic = var.dns_allow_external_traffic
       }
     }
   }
diff --git a/modules/private-cluster/cluster.tf b/modules/private-cluster/cluster.tf
@@ -541,11 +541,10 @@ resource "google_container_cluster" "primary" {
   }
 
   dynamic "control_plane_endpoints_config" {
-    for_each = var.dns_allow_external_traffic != null || (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []
+    for_each = var.dns_allow_external_traffic != null ? [1] : []
     content {
       dns_endpoint_config {
-        # TODO: Migrate to only dns_allow_external_traffic in next breaking release
-        allow_external_traffic = var.dns_allow_external_traffic == true || var.deploy_using_private_endpoint
+        allow_external_traffic = var.dns_allow_external_traffic
       }
     }
   }

Original file line number	Diff line number	Diff line change
`@@ -697,15 +697,10 @@ resource "google_container_cluster" "primary" {`
`697`	`697`
`698`	`698`	`{% endif %}`
`699`	`699`	`dynamic "control_plane_endpoints_config" {`
`700`		`- for_each = var.dns_allow_external_traffic != null {% if private_cluster %}\|\| (var.enable_private_endpoint && var.deploy_using_private_endpoint) {% endif %}? [1] : []`
	`700`	`+ for_each = var.dns_allow_external_traffic != null ? [1] : []`
`701`	`701`	`content {`
`702`	`702`	`dns_endpoint_config {`
`703`		`- {% if private_cluster %}`
`704`		`- # TODO: Migrate to only dns_allow_external_traffic in next breaking release`
`705`		`- allow_external_traffic = var.dns_allow_external_traffic == true \|\| var.deploy_using_private_endpoint`
`706`		`-{% else %}`
`707`	`703`	`allow_external_traffic = var.dns_allow_external_traffic`
`708`		`-{% endif %}`
`709`	`704`	`}`
`710`	`705`	`}`
`711`	`706`	`}`
Original file line number	Diff line number	Diff line change
`@@ -351,11 +351,10 @@ resource "google_container_cluster" "primary" {`
`351`	`351`	`}`
`352`	`352`
`353`	`353`	`dynamic "control_plane_endpoints_config" {`
`354`		`- for_each = var.dns_allow_external_traffic != null \|\| (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []`
	`354`	`+ for_each = var.dns_allow_external_traffic != null ? [1] : []`
`355`	`355`	`content {`
`356`	`356`	`dns_endpoint_config {`
`357`		`- # TODO: Migrate to only dns_allow_external_traffic in next breaking release`
`358`		`- allow_external_traffic = var.dns_allow_external_traffic == true \|\| var.deploy_using_private_endpoint`
	`357`	`+ allow_external_traffic = var.dns_allow_external_traffic`
`359`	`358`	`}`
`360`	`359`	`}`
`361`	`360`	`}`
Original file line number	Diff line number	Diff line change
`@@ -592,11 +592,10 @@ resource "google_container_cluster" "primary" {`
`592`	`592`	`}`
`593`	`593`
`594`	`594`	`dynamic "control_plane_endpoints_config" {`
`595`		`- for_each = var.dns_allow_external_traffic != null \|\| (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []`
	`595`	`+ for_each = var.dns_allow_external_traffic != null ? [1] : []`
`596`	`596`	`content {`
`597`	`597`	`dns_endpoint_config {`
`598`		`- # TODO: Migrate to only dns_allow_external_traffic in next breaking release`
`599`		`- allow_external_traffic = var.dns_allow_external_traffic == true \|\| var.deploy_using_private_endpoint`
	`598`	`+ allow_external_traffic = var.dns_allow_external_traffic`
`600`	`599`	`}`
`601`	`600`	`}`
`602`	`601`	`}`
Original file line number	Diff line number	Diff line change
`@@ -541,11 +541,10 @@ resource "google_container_cluster" "primary" {`
`541`	`541`	`}`
`542`	`542`
`543`	`543`	`dynamic "control_plane_endpoints_config" {`
`544`		`- for_each = var.dns_allow_external_traffic != null \|\| (var.enable_private_endpoint && var.deploy_using_private_endpoint) ? [1] : []`
	`544`	`+ for_each = var.dns_allow_external_traffic != null ? [1] : []`
`545`	`545`	`content {`
`546`	`546`	`dns_endpoint_config {`
`547`		`- # TODO: Migrate to only dns_allow_external_traffic in next breaking release`
`548`		`- allow_external_traffic = var.dns_allow_external_traffic == true \|\| var.deploy_using_private_endpoint`
	`547`	`+ allow_external_traffic = var.dns_allow_external_traffic`
`549`	`548`	`}`
`550`	`549`	`}`
`551`	`550`	`}`