Skip to content

Commit 9195380

Browse files
apeabodyapeabody
authored
feat: add ip_endpoints_enabled variable (#2380)
1 parent b405ea5 commit 9195380

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+243
-30
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,7 @@ Then perform the following commands on the root folder:
202202
| in\_transit\_encryption\_config | Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`. | `string` | `null` | no |
203203
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. | `number` | `0` | no |
204204
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. Note: this can be set at the node pool level separately within `node_pools`. | `bool` | `null` | no |
205+
| ip\_endpoints\_enabled | (Optional) Controls whether to allow direct IP access. Defaults to `true`. | `bool` | `null` | no |
205206
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | `bool` | `false` | no |
206207
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | `string` | `"60s"` | no |
207208
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -721,10 +721,19 @@ resource "google_container_cluster" "primary" {
721721

722722
{% endif %}
723723
dynamic "control_plane_endpoints_config" {
724-
for_each = var.dns_allow_external_traffic != null ? [1] : []
724+
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
725725
content {
726-
dns_endpoint_config {
727-
allow_external_traffic = var.dns_allow_external_traffic
726+
dynamic "dns_endpoint_config" {
727+
for_each = var.dns_allow_external_traffic != null ? [1] : []
728+
content {
729+
allow_external_traffic = var.dns_allow_external_traffic
730+
}
731+
}
732+
dynamic "ip_endpoints_config" {
733+
for_each = var.ip_endpoints_enabled != null ? [1] : []
734+
content {
735+
enabled = var.ip_endpoints_enabled
736+
}
728737
}
729738
}
730739
}

‎autogen/main/variables.tf.tmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1125,3 +1125,9 @@ variable "dns_allow_external_traffic" {
11251125
type = bool
11261126
default = null
11271127
}
1128+
1129+
variable "ip_endpoints_enabled" {
1130+
description = "(Optional) Controls whether to allow direct IP access. Defaults to `true`."
1131+
type = bool
1132+
default = null
1133+
}

‎cluster.tf‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -547,10 +547,19 @@ resource "google_container_cluster" "primary" {
547547
}
548548

549549
dynamic "control_plane_endpoints_config" {
550-
for_each = var.dns_allow_external_traffic != null ? [1] : []
550+
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
551551
content {
552-
dns_endpoint_config {
553-
allow_external_traffic = var.dns_allow_external_traffic
552+
dynamic "dns_endpoint_config" {
553+
for_each = var.dns_allow_external_traffic != null ? [1] : []
554+
content {
555+
allow_external_traffic = var.dns_allow_external_traffic
556+
}
557+
}
558+
dynamic "ip_endpoints_config" {
559+
for_each = var.ip_endpoints_enabled != null ? [1] : []
560+
content {
561+
enabled = var.ip_endpoints_enabled
562+
}
554563
}
555564
}
556565
}

‎metadata.display.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,9 @@ spec:
213213
insecure_kubelet_readonly_port_enabled:
214214
name: insecure_kubelet_readonly_port_enabled
215215
title: Insecure Kubelet Readonly Port Enabled
216+
ip_endpoints_enabled:
217+
name: ip_endpoints_enabled
218+
title: Ip Endpoints Enabled
216219
ip_masq_link_local:
217220
name: ip_masq_link_local
218221
title: Ip Masq Link Local

‎metadata.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -732,6 +732,9 @@ spec:
732732
- name: dns_allow_external_traffic
733733
description: (Optional) Controls whether external traffic is allowed over the dns endpoint.
734734
varType: bool
735+
- name: ip_endpoints_enabled
736+
description: (Optional) Controls whether to allow direct IP access. Defaults to `true`.
737+
varType: bool
735738
outputs:
736739
- name: ca_certificate
737740
description: Cluster ca certificate (base64 encoded)

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ Then perform the following commands on the root folder:
120120
| identity\_namespace | The workload pool to attach all Kubernetes service accounts to. (Default value of `enabled` automatically sets project-based pool `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
121121
| in\_transit\_encryption\_config | Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`. | `string` | `null` | no |
122122
| insecure\_kubelet\_readonly\_port\_enabled | Whether or not to set `insecure_kubelet_readonly_port_enabled` for node pool defaults and autopilot clusters. | `bool` | `null` | no |
123+
| ip\_endpoints\_enabled | (Optional) Controls whether to allow direct IP access. Defaults to `true`. | `bool` | `null` | no |
123124
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | `string` | n/a | yes |
124125
| ip\_range\_services | The _name_ of the secondary subnet range to use for services. If not provided, the default `34.118.224.0/20` range will be used. | `string` | `null` | no |
125126
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -362,10 +362,19 @@ resource "google_container_cluster" "primary" {
362362
}
363363

364364
dynamic "control_plane_endpoints_config" {
365-
for_each = var.dns_allow_external_traffic != null ? [1] : []
365+
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
366366
content {
367-
dns_endpoint_config {
368-
allow_external_traffic = var.dns_allow_external_traffic
367+
dynamic "dns_endpoint_config" {
368+
for_each = var.dns_allow_external_traffic != null ? [1] : []
369+
content {
370+
allow_external_traffic = var.dns_allow_external_traffic
371+
}
372+
}
373+
dynamic "ip_endpoints_config" {
374+
for_each = var.ip_endpoints_enabled != null ? [1] : []
375+
content {
376+
enabled = var.ip_endpoints_enabled
377+
}
369378
}
370379
}
371380
}

‎modules/beta-autopilot-private-cluster/metadata.display.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,9 @@ spec:
172172
insecure_kubelet_readonly_port_enabled:
173173
name: insecure_kubelet_readonly_port_enabled
174174
title: Insecure Kubelet Readonly Port Enabled
175+
ip_endpoints_enabled:
176+
name: ip_endpoints_enabled
177+
title: Ip Endpoints Enabled
175178
ip_masq_link_local:
176179
name: ip_masq_link_local
177180
title: Ip Masq Link Local

‎modules/beta-autopilot-private-cluster/metadata.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,9 @@ spec:
481481
- name: dns_allow_external_traffic
482482
description: (Optional) Controls whether external traffic is allowed over the dns endpoint.
483483
varType: bool
484+
- name: ip_endpoints_enabled
485+
description: (Optional) Controls whether to allow direct IP access. Defaults to `true`.
486+
varType: bool
484487
outputs:
485488
- name: ca_certificate
486489
description: Cluster ca certificate (base64 encoded)

0 commit comments

Comments
 (0)