feat: add a flag to allow access through Google Cloud public IP addresses #2078

laurentgrangeau · 2024-09-10T16:23:14Z

This PR add a flag to allow access through Google Cloud public IP addresses only. This is usefull to increase security in private cluster mode

apeabody · 2024-09-10T19:57:48Z

/gcbrun

apeabody

Thanks for the contribution @laurentgrangeau!

From the INT tests:

TestSimpleZonalPrivate 2024-09-10T20:24:48Z command.go:100: Running command gcloud with args [config get-value project --format json]
TestSimpleZonalPrivate 2024-09-10T20:24:49Z command.go:185: "cloud-foundation-cicd"
    golden.go:157: 
        	Error Trace:	/builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/[email protected]/pkg/golden/golden.go:157
        	            				/workspace/test/integration/simple_zonal_private/simple_zonal_private_test.go:70
        	            				/builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/[email protected]/pkg/tft/terraform.go:638
        	            				/builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/[email protected]/pkg/tft/terraform.go:670
        	            				/builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/[email protected]/pkg/utils/stages.go:31
        	            				/builder/home/go/pkg/mod/github.com/!google!cloud!platform/cloud-foundation-toolkit/infra/[email protected]/pkg/tft/terraform.go:670
        	Error:      	Not equal: 
        	            	expected: "{\n    \"cidrBlocks\": [\n      {\n        \"cidrBlock\": \"10.0.0.0/17\",\n        \"displayName\": \"VPC\"\n      }\n    ],\n    \"enabled\": true\n  }"
        	            	actual  : "{\n    \"cidrBlocks\": [\n      {\n        \"cidrBlock\": \"10.0.0.0/17\",\n        \"displayName\": \"VPC\"\n      }\n    ],\n    \"enabled\": true,\n    \"gcpPublicCidrsAccessEnabled\": false\n  }"
        	            	
        	            	Diff:
        	            	--- Expected
        	            	+++ Actual
        	            	@@ -7,3 +7,4 @@
        	            	     ],
        	            	-    "enabled": true
        	            	+    "enabled": true,
        	            	+    "gcpPublicCidrsAccessEnabled": false
        	            	   }
        	Test:       	TestSimpleZonalPrivate
        	Messages:   	expected masterAuthorizedNetworksConfig to match fixture {
        	            	    "cidrBlocks": [
        	            	      {
        	            	        "cidrBlock": "10.0.0.0/17",
        	            	        "displayName": "VPC"
        	            	      }
        	            	    ],
        	            	    "enabled": true
        	            	  }

autogen/main/variables.tf.tmpl

apeabody · 2024-09-11T16:16:21Z

Thanks @laurentgrangeau!

Let's also add the new gcp_public_cidrs_access_enabled variable to a relevant example and update it's test date to expect the correct cluster configuration. e.g. "gcpPublicCidrsAccessEnabled": true

apeabody · 2024-09-17T17:36:55Z

/gcbrun

cluster.tf

autogen/main/cluster.tf.tmpl

…access_enabled in not null

apeabody · 2024-09-18T16:26:24Z

/gcbrun

stale

apeabody · 2024-09-19T16:24:18Z

/gcbrun

autogen/main/cluster.tf.tmpl

apeabody · 2024-09-20T17:02:30Z

/gcbrun

apeabody · 2024-09-23T16:30:20Z

/gcbrun

apeabody · 2024-09-23T19:29:46Z

From the test:

TestSimpleZonalPrivate 2024-09-23T16:52:22Z command.go:185: module.example.module.gke.google_container_cluster.primary: Creating...
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185: 
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185: Error: googleapi: Error 400: Invalid value for "cluster.master_authorized_networks_config": "cluster.master_authorized_networks_config.gcp_public_cidrs_access_enabled" cannot be enabled if private endpoint is enabled.
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185: Details:
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185: [
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185:   {
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185:     "@type": "type.googleapis.com/google.rpc.RequestInfo",
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185:     "requestId": "0x3fd58076f9492418"
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185:   }
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185: ]
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185: , badRequest
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185: 
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185:   with module.example.module.gke.google_container_cluster.primary,
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185:   on ../../../modules/private-cluster/cluster.tf line 22, in resource "google_container_cluster" "primary":
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185:   22: resource "google_container_cluster" "primary" {
TestSimpleZonalPrivate 2024-09-23T16:52:24Z command.go:185:

apeabody · 2024-09-23T19:43:38Z

/gcbrun

test/integration/simple_zonal_private/testdata/TestSimpleZonalPrivate.json

laurentgrangeau · 2024-10-01T17:02:25Z

/gcbrun

apeabody · 2024-10-01T17:12:36Z

/gcbrun

apeabody · 2024-10-01T18:16:14Z

/gcbrun

apeabody · 2024-10-01T19:04:25Z

/gcbrun

Laurent Grangeau and others added 2 commits September 10, 2024 18:21

feat: Add allow access through Google Cloud public IP addresses only

361a7af

Merge branch 'terraform-google-modules:master' into master

4d13276

laurentgrangeau requested review from a team, ericyz and gtsorbo as code owners September 10, 2024 16:23

apeabody changed the title ~~Add a flag to allow access through Google Cloud public IP addresses~~ feat: add a flag to allow access through Google Cloud public IP addresses Sep 10, 2024

apeabody self-assigned this Sep 10, 2024

Merge branch 'master' into master

9e506f9

apeabody previously requested changes Sep 10, 2024

View reviewed changes

apeabody reviewed Sep 11, 2024

View reviewed changes

autogen/main/variables.tf.tmpl Outdated Show resolved Hide resolved

Laurent Grangeau and others added 2 commits September 17, 2024 09:17

fix: make gcpPublicCidrsAccessEnabled default to null

1527817

Merge branch 'master' into master

1ae972b

apeabody reviewed Sep 17, 2024

View reviewed changes

cluster.tf Outdated Show resolved Hide resolved

autogen/main/cluster.tf.tmpl Outdated Show resolved Hide resolved

feat: enable master_authorized_networks_config when gcp_public_cidrs_…

d889e28

…access_enabled in not null

Merge branch 'master' into master

31e22ce

apeabody requested changes Sep 19, 2024

View reviewed changes

autogen/main/cluster.tf.tmpl Outdated Show resolved Hide resolved

laurentgrangeau and others added 2 commits September 20, 2024 10:27

Merge branch 'master' into master

f1aa5fc

fix: test gcp_public_cidrs_access_enabled is not null

dc1d26a

apeabody force-pushed the master branch from 21b15b6 to dc1d26a Compare September 23, 2024 19:43

apeabody reviewed Sep 23, 2024

View reviewed changes

test/integration/simple_zonal_private/testdata/TestSimpleZonalPrivate.json Outdated Show resolved Hide resolved

apeabody reviewed Sep 23, 2024

View reviewed changes

test/integration/simple_zonal_private/testdata/TestSimpleZonalPrivate.json Outdated Show resolved Hide resolved

fix: move gcpPublicCidrsAccessEnabled to a public endpoint

140112a

Merge branch 'master' into master

186fd07

fix: add effectiveCgroupMode on test data

0ea8177

fix: test data

4bd2584

apeabody approved these changes Oct 1, 2024

View reviewed changes

apeabody merged commit 2f412bb into terraform-google-modules:master Oct 1, 2024
4 checks passed

release-please bot mentioned this pull request Oct 1, 2024

chore(master): release 33.1.0 #2107

Merged

feat: add a flag to allow access through Google Cloud public IP addresses #2078

feat: add a flag to allow access through Google Cloud public IP addresses #2078

Uh oh!

Conversation

laurentgrangeau commented Sep 10, 2024

Uh oh!

apeabody commented Sep 10, 2024

Uh oh!

apeabody left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

apeabody commented Sep 11, 2024

Uh oh!

apeabody commented Sep 17, 2024

Uh oh!

Uh oh!

Uh oh!

apeabody commented Sep 18, 2024

Uh oh!

apeabody commented Sep 19, 2024

Uh oh!

Uh oh!

apeabody commented Sep 20, 2024

Uh oh!

apeabody commented Sep 23, 2024

Uh oh!

apeabody commented Sep 23, 2024

Uh oh!

apeabody commented Sep 23, 2024

Uh oh!

Uh oh!

Uh oh!

laurentgrangeau commented Oct 1, 2024

Uh oh!

apeabody commented Oct 1, 2024

Uh oh!

apeabody commented Oct 1, 2024

Uh oh!

apeabody commented Oct 1, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants