fix!: allow dns endpoints only

[TheKangaroo]

fixes #2216

[apeabody]

/gcbrun

[apeabody]

Thanks for the contribution @TheKangaroo!

[apeabody]

/gcbrun

[apeabody]

/gcbrun

[apeabody]

Hi @TheKangaroo - We could likely resolve this error with for_each = {% if private_cluster %}var.enable_private_endpoint || {% endif %} var.master_authorized_networks != null ? [true] : [], however my impression from #2216 is your use case is specifically private_endpoint = true with no master_authorized_networks_config block? If so, it appears that combination might not be possible?

TestSimpleAutopilotPrivate 2024-12-18T00:49:44Z command.go:185: module.example.module.gke.google_container_cluster.primary: Creating...
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185: 
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185: Error: googleapi: Error 400: 
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185: 	- invalid value for "cluster.master_authorized_networks_config": "cluster.master_authorized_networks_config.enable_master_authorized_networks" should be enabled if private endpoint is enabled
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185: 	- master authorized networks must be enabled if private endpoint is enabled.
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185: Details:
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185: [
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185:   {
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185:     "@type": "type.googleapis.com/google.rpc.RequestInfo",
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185:     "requestId": "0x31e37f9a8468168d"
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185:   }
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185: ]
TestSimpleAutopilotPrivate 2024-12-18T00:49:47Z command.go:185: , badRequest

[TheKangaroo]

@apeabody You are right that that's exactly what I am trying to achieve: a private endpoint cluster (with a DNS endpoint) and no master_authorized_networks_config. I can plan/apply my cluster with this feature branch, so it seems to be fine with the beta-private-cluster-update-variant with:

enable_private_endpoint       = true
deploy_using_private_endpoint = true

to enable the DNS endpoint. To be honest, I don't fully understand which combinations of variables are possible and supported by the modules and the API. The only things I can imagine are:

• This works differently on autopilot, and I need to exclude autopilot in the config.
• Omitting master_authorized_networks_config is only allowed if the DNS endpoint is enabled.

[apeabody]

I can plan/apply my cluster with this feature branch, so it seems to be fine with the beta-private-cluster-update-variant with:

enable_private_endpoint       = true
deploy_using_private_endpoint = true

to enable the DNS endpoint.

Thanks @TheKangaroo - I suspect this resulted in the IP Endpoints enabled? Unfortunately, I suspect we need hashicorp/terraform-provider-google#20369 to "cleanly" implement your goal. This is because currently setting enable_private_endpoint = true results in IPEndpointsConfig. EnablePublicEndpoint = false (but with hardcoded IPEndpointsConfig.Enabled = true).

More research here: #2216 (comment)

[TheKangaroo]

Yes, this resulted in IP endpoints being enabled, but with my PR, without master_authorized_networks_config configured, I can disable IP endpoints in the UI, and Terraform won't complain.

I read through your explanation in #2216, and I'll continue working on this PR when the provider supports disabling IPEndpointsConfig.

[apeabody]

Yes, this resulted in IP endpoints being enabled, but with my PR, without master_authorized_networks_config configured, I can disable IP endpoints in the UI, and Terraform won't complain.

I read through your explanation in #2216, and I'll continue working on this PR when the provider supports disabling IPEndpointsConfig.

Hi @TheKangaroo - This may now be possible with https://github.com/hashicorp/terraform-provider-google/releases/tag/v6.27.0 adding ip_endpoints_config.

[apeabody]

Hi @TheKangaroo - Just checking if you are still working on this PR. Thanks!

[TheKangaroo]

Hi @apeabody,

I'm a bit confused about the current state of this module's inputs regarding DNS endpoints, authorised networks, IP endpoints, etc.
I'm not sure if this PR is still necessary, since merging #2380 should have resolved the associated issue.
I haven't had time to test the new inputs recently, but I'll do so and open a new issue/pull request if necessary.

[apeabody]

Hi @apeabody,

I'm a bit confused about the current state of this module's inputs regarding DNS endpoints, authorised networks, IP endpoints, etc. I'm not sure if this PR is still necessary, since merging #2380 should have resolved the associated issue. I haven't had time to test the new inputs recently, but I'll do so and open a new issue/pull request if necessary.

Thanks @TheKangaroo! - You are correct this thread pre-dates #2380. I'll close this PR, and please open a new one if needed.