Skip to content

feat: add support for anonymous_authentication_config #2436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 1, 2025
Merged

feat: add support for anonymous_authentication_config #2436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a83830d
add support for anonymous_authentication_config
DrFaust92 Sep 4, 2025
41b1b72
rebase
DrFaust92 Sep 16, 2025
e56e762
Merge branch 'main' into anonymous_authentication_config
apeabody Sep 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,7 @@ Then perform the following commands on the root folder:
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
| additional\_ip\_ranges\_config | the configuration for individual additional subnetworks attached to the cluster | `list(object({ subnetwork = string, pod_ipv4_range_names = list(string) }))` | `[]` | no |
| additive\_vpc\_scope\_dns\_domain | This will enable Cloud DNS additive VPC scope. Must provide a domain name that is unique within the VPC. For this to work cluster\_dns = `CLOUD_DNS` and cluster\_dns\_scope = `CLUSTER_SCOPE` must both be set as well. | `string` | `""` | no |
| anonymous\_authentication\_config\_mode | Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`. | `string` | `null` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
| cluster\_autoscaling | Cluster autoscaling configuration. See [more details](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#clusterautoscaling) | <pre>object({<br> enabled = bool<br> autoscaling_profile = string<br> min_cpu_cores = optional(number)<br> max_cpu_cores = optional(number)<br> min_memory_gb = optional(number)<br> max_memory_gb = optional(number)<br> gpu_resources = list(object({ resource_type = string, minimum = number, maximum = number }))<br> auto_repair = bool<br> auto_upgrade = bool<br> disk_size = optional(number)<br> disk_type = optional(string)<br> image_type = optional(string)<br> strategy = optional(string)<br> max_surge = optional(number)<br> max_unavailable = optional(number)<br> node_pool_soak_duration = optional(string)<br> batch_soak_duration = optional(string)<br> batch_percentage = optional(number)<br> batch_node_count = optional(number)<br> enable_secure_boot = optional(bool, false)<br> enable_integrity_monitoring = optional(bool, true)<br> })</pre> | <pre>{<br> "auto_repair": true,<br> "auto_upgrade": true,<br> "autoscaling_profile": "BALANCED",<br> "disk_size": 100,<br> "disk_type": "pd-standard",<br> "enable_integrity_monitoring": true,<br> "enable_secure_boot": false,<br> "enabled": false,<br> "gpu_resources": [],<br> "image_type": "COS_CONTAINERD",<br> "max_cpu_cores": 0,<br> "max_memory_gb": 0,<br> "min_cpu_cores": 0,<br> "min_memory_gb": 0<br>}</pre> | no |
Expand Down
7 changes: 7 additions & 0 deletions autogen/main/cluster.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,6 +276,13 @@ resource "google_container_cluster" "primary" {

in_transit_encryption_config = var.in_transit_encryption_config

dynamic "anonymous_authentication_config" {
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
content {
mode = var.anonymous_authentication_config_mode
}
}

dynamic "network_performance_config" {
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
content {
Expand Down
6 changes: 6 additions & 0 deletions autogen/main/variables.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -728,6 +728,12 @@ variable "in_transit_encryption_config" {
default = null
}

variable "anonymous_authentication_config_mode" {
description = "Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`."
type = string
default = null
}

variable "total_egress_bandwidth_tier" {
type = string
description = "Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`."
Expand Down
7 changes: 7 additions & 0 deletions cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,6 +214,13 @@ resource "google_container_cluster" "primary" {

in_transit_encryption_config = var.in_transit_encryption_config

dynamic "anonymous_authentication_config" {
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
content {
mode = var.anonymous_authentication_config_mode
}
}

dynamic "network_performance_config" {
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
content {
Expand Down
3 changes: 3 additions & 0 deletions metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,9 @@ spec:
additive_vpc_scope_dns_domain:
name: additive_vpc_scope_dns_domain
title: Additive Vpc Scope Dns Domain
anonymous_authentication_config_mode:
name: anonymous_authentication_config_mode
title: Anonymous Authentication Config Mode
authenticator_security_group:
name: authenticator_security_group
title: Authenticator Security Group
Expand Down
3 changes: 3 additions & 0 deletions metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -570,6 +570,9 @@ spec:
- name: in_transit_encryption_config
description: Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
varType: string
- name: anonymous_authentication_config_mode
description: Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`.
varType: string
- name: total_egress_bandwidth_tier
description: Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`.
varType: string
Expand Down
1 change: 1 addition & 0 deletions modules/beta-autopilot-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ Then perform the following commands on the root folder:
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
| additional\_ip\_ranges\_config | the configuration for individual additional subnetworks attached to the cluster | `list(object({ subnetwork = string, pod_ipv4_range_names = list(string) }))` | `[]` | no |
| allow\_net\_admin | (Optional) Enable NET\_ADMIN for the cluster. | `bool` | `null` | no |
| anonymous\_authentication\_config\_mode | Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`. | `string` | `null` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | `string` | `null` | no |
Expand Down
7 changes: 7 additions & 0 deletions modules/beta-autopilot-private-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,13 @@ resource "google_container_cluster" "primary" {

in_transit_encryption_config = var.in_transit_encryption_config

dynamic "anonymous_authentication_config" {
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
content {
mode = var.anonymous_authentication_config_mode
}
}

dynamic "network_performance_config" {
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
content {
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-autopilot-private-cluster/metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ spec:
allow_net_admin:
name: allow_net_admin
title: Allow Net Admin
anonymous_authentication_config_mode:
name: anonymous_authentication_config_mode
title: Anonymous Authentication Config Mode
authenticator_security_group:
name: authenticator_security_group
title: Authenticator Security Group
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-autopilot-private-cluster/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -399,6 +399,9 @@ spec:
- name: in_transit_encryption_config
description: Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
varType: string
- name: anonymous_authentication_config_mode
description: Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`.
varType: string
- name: total_egress_bandwidth_tier
description: Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`.
varType: string
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-autopilot-private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -454,6 +454,12 @@ variable "in_transit_encryption_config" {
default = null
}

variable "anonymous_authentication_config_mode" {
description = "Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`."
type = string
default = null
}

variable "total_egress_bandwidth_tier" {
type = string
description = "Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`."
Expand Down
1 change: 1 addition & 0 deletions modules/beta-autopilot-public-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@ Then perform the following commands on the root folder:
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
| additional\_ip\_ranges\_config | the configuration for individual additional subnetworks attached to the cluster | `list(object({ subnetwork = string, pod_ipv4_range_names = list(string) }))` | `[]` | no |
| allow\_net\_admin | (Optional) Enable NET\_ADMIN for the cluster. | `bool` | `null` | no |
| anonymous\_authentication\_config\_mode | Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`. | `string` | `null` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
| cluster\_ipv4\_cidr | The IP address range of the kubernetes pods in this cluster. Default is an automatically assigned CIDR. | `string` | `null` | no |
Expand Down
7 changes: 7 additions & 0 deletions modules/beta-autopilot-public-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,13 @@ resource "google_container_cluster" "primary" {

in_transit_encryption_config = var.in_transit_encryption_config

dynamic "anonymous_authentication_config" {
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
content {
mode = var.anonymous_authentication_config_mode
}
}

dynamic "network_performance_config" {
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
content {
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-autopilot-public-cluster/metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ spec:
allow_net_admin:
name: allow_net_admin
title: Allow Net Admin
anonymous_authentication_config_mode:
name: anonymous_authentication_config_mode
title: Anonymous Authentication Config Mode
authenticator_security_group:
name: authenticator_security_group
title: Authenticator Security Group
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-autopilot-public-cluster/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,6 +377,9 @@ spec:
- name: in_transit_encryption_config
description: Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
varType: string
- name: anonymous_authentication_config_mode
description: Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`.
varType: string
- name: total_egress_bandwidth_tier
description: Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`.
varType: string
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-autopilot-public-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -418,6 +418,12 @@ variable "in_transit_encryption_config" {
default = null
}

variable "anonymous_authentication_config_mode" {
description = "Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`."
type = string
default = null
}

variable "total_egress_bandwidth_tier" {
type = string
description = "Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`."
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,7 @@ Then perform the following commands on the root folder:
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
| additional\_ip\_ranges\_config | the configuration for individual additional subnetworks attached to the cluster | `list(object({ subnetwork = string, pod_ipv4_range_names = list(string) }))` | `[]` | no |
| additive\_vpc\_scope\_dns\_domain | This will enable Cloud DNS additive VPC scope. Must provide a domain name that is unique within the VPC. For this to work cluster\_dns = `CLOUD_DNS` and cluster\_dns\_scope = `CLUSTER_SCOPE` must both be set as well. | `string` | `""` | no |
| anonymous\_authentication\_config\_mode | Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`. | `string` | `null` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
Expand Down
7 changes: 7 additions & 0 deletions modules/beta-private-cluster-update-variant/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,13 @@ resource "google_container_cluster" "primary" {

in_transit_encryption_config = var.in_transit_encryption_config

dynamic "anonymous_authentication_config" {
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
content {
mode = var.anonymous_authentication_config_mode
}
}

dynamic "network_performance_config" {
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
content {
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-private-cluster-update-variant/metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ spec:
additive_vpc_scope_dns_domain:
name: additive_vpc_scope_dns_domain
title: Additive Vpc Scope Dns Domain
anonymous_authentication_config_mode:
name: anonymous_authentication_config_mode
title: Anonymous Authentication Config Mode
authenticator_security_group:
name: authenticator_security_group
title: Authenticator Security Group
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-private-cluster-update-variant/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -563,6 +563,9 @@ spec:
- name: in_transit_encryption_config
description: Defines the config of in-transit encryption. Valid values are `IN_TRANSIT_ENCRYPTION_DISABLED` and `IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT`.
varType: string
- name: anonymous_authentication_config_mode
description: Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`.
varType: string
- name: total_egress_bandwidth_tier
description: Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`.
varType: string
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -685,6 +685,12 @@ variable "in_transit_encryption_config" {
default = null
}

variable "anonymous_authentication_config_mode" {
description = "Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`."
type = string
default = null
}

variable "total_egress_bandwidth_tier" {
type = string
description = "Specifies the total network bandwidth tier for NodePools in the cluster. Valid values are `TIER_UNSPECIFIED` and `TIER_1`. Defaults to `TIER_UNSPECIFIED`."
Expand Down
1 change: 1 addition & 0 deletions modules/beta-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@ Then perform the following commands on the root folder:
| additional\_ip\_range\_pods | List of _names_ of the additional secondary subnet ip ranges to use for pods | `list(string)` | `[]` | no |
| additional\_ip\_ranges\_config | the configuration for individual additional subnetworks attached to the cluster | `list(object({ subnetwork = string, pod_ipv4_range_names = list(string) }))` | `[]` | no |
| additive\_vpc\_scope\_dns\_domain | This will enable Cloud DNS additive VPC scope. Must provide a domain name that is unique within the VPC. For this to work cluster\_dns = `CLOUD_DNS` and cluster\_dns\_scope = `CLUSTER_SCOPE` must both be set as well. | `string` | `""` | no |
| anonymous\_authentication\_config\_mode | Allows users to restrict or enable anonymous access to the cluster. Valid values are `ENABLED` and `LIMITED`. | `string` | `null` | no |
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected] | `string` | `null` | no |
| boot\_disk\_kms\_key | The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool, if not overridden in `node_pools`. This should be of the form projects/[KEY\_PROJECT\_ID]/locations/[LOCATION]/keyRings/[RING\_NAME]/cryptoKeys/[KEY\_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption | `string` | `null` | no |
| cloudrun | (Beta) Enable CloudRun addon | `bool` | `false` | no |
Expand Down
7 changes: 7 additions & 0 deletions modules/beta-private-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,13 @@ resource "google_container_cluster" "primary" {

in_transit_encryption_config = var.in_transit_encryption_config

dynamic "anonymous_authentication_config" {
for_each = var.anonymous_authentication_config_mode != null ? [1] : []
content {
mode = var.anonymous_authentication_config_mode
}
}

dynamic "network_performance_config" {
for_each = var.total_egress_bandwidth_tier != null ? [1] : []
content {
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-private-cluster/metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,9 @@ spec:
additive_vpc_scope_dns_domain:
name: additive_vpc_scope_dns_domain
title: Additive Vpc Scope Dns Domain
anonymous_authentication_config_mode:
name: anonymous_authentication_config_mode
title: Anonymous Authentication Config Mode
authenticator_security_group:
name: authenticator_security_group
title: Authenticator Security Group
Expand Down
Loading