Skip to content

Commit 7e3b22c

Browse files
apeabodyapeabody
committed
feat: add dns_allow_external_traffic
1 parent 3cd930c commit 7e3b22c

File tree

31 files changed

+116
-14
lines changed

31 files changed

+116
-14
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ Then perform the following commands on the root folder:
161161
| description | The description of the cluster | `string` | `""` | no |
162162
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
163163
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
164+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
164165
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
165166
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
166167
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl

+3-3
Original file line numberDiff line numberDiff line change
@@ -666,15 +666,15 @@ resource "google_container_cluster" "primary" {
666666
}
667667
}
668668

669+
{% endif %}
669670
dynamic "control_plane_endpoints_config" {
670-
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : []
671+
for_each = var.dns_allow_external_traffic != null ? [1] : []
671672
content {
672673
dns_endpoint_config {
673-
allow_external_traffic = var.deploy_using_private_endpoint
674+
allow_external_traffic = var.dns_allow_external_traffic
674675
}
675676
}
676677
}
677-
{% endif %}
678678

679679
{% if autopilot_cluster != true %}
680680
remove_default_node_pool = var.remove_default_node_pool

‎autogen/main/variables.tf.tmpl

+6
Original file line numberDiff line numberDiff line change
@@ -1043,3 +1043,9 @@ variable "enterprise_config" {
10431043
type = string
10441044
default = null
10451045
}
1046+
1047+
variable "dns_allow_external_traffic" {
1048+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
1049+
type = bool
1050+
default = null
1051+
}

‎cluster.tf

+8
Original file line numberDiff line numberDiff line change
@@ -508,6 +508,14 @@ resource "google_container_cluster" "primary" {
508508
}
509509
}
510510

511+
dynamic "control_plane_endpoints_config" {
512+
for_each = var.dns_allow_external_traffic != null ? [1] : []
513+
content {
514+
dns_endpoint_config {
515+
allow_external_traffic = var.dns_allow_external_traffic
516+
}
517+
}
518+
}
511519

512520
remove_default_node_pool = var.remove_default_node_pool
513521

‎examples/node_pool/main.tf

+1
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ module "gke" {
4545
deletion_protection = false
4646
service_account = "default"
4747
logging_variant = "MAX_THROUGHPUT"
48+
dns_allow_external_traffic = true
4849

4950
node_pools = [
5051
{

‎modules/beta-autopilot-private-cluster/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ Then perform the following commands on the root folder:
8787
| deploy\_using\_private\_endpoint | A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | `bool` | `false` | no |
8888
| description | The description of the cluster | `string` | `""` | no |
8989
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
90+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
9091
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
9192
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
9293
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -334,10 +334,10 @@ resource "google_container_cluster" "primary" {
334334
}
335335

336336
dynamic "control_plane_endpoints_config" {
337-
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : []
337+
for_each = var.dns_allow_external_traffic != null ? [1] : []
338338
content {
339339
dns_endpoint_config {
340-
allow_external_traffic = var.deploy_using_private_endpoint
340+
allow_external_traffic = var.dns_allow_external_traffic
341341
}
342342
}
343343
}

‎modules/beta-autopilot-private-cluster/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -613,3 +613,9 @@ variable "enterprise_config" {
613613
type = string
614614
default = null
615615
}
616+
617+
variable "dns_allow_external_traffic" {
618+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
619+
type = bool
620+
default = null
621+
}

‎modules/beta-autopilot-public-cluster/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ Then perform the following commands on the root folder:
8181
| deletion\_protection | Whether or not to allow Terraform to destroy the cluster. | `bool` | `true` | no |
8282
| description | The description of the cluster | `string` | `""` | no |
8383
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
84+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
8485
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
8586
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
8687
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎modules/beta-autopilot-public-cluster/cluster.tf

+8
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,14 @@ resource "google_container_cluster" "primary" {
311311
}
312312
}
313313

314+
dynamic "control_plane_endpoints_config" {
315+
for_each = var.dns_allow_external_traffic != null ? [1] : []
316+
content {
317+
dns_endpoint_config {
318+
allow_external_traffic = var.dns_allow_external_traffic
319+
}
320+
}
321+
}
314322

315323

316324
dynamic "database_encryption" {

‎modules/beta-autopilot-public-cluster/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -577,3 +577,9 @@ variable "enterprise_config" {
577577
type = string
578578
default = null
579579
}
580+
581+
variable "dns_allow_external_traffic" {
582+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
583+
type = bool
584+
default = null
585+
}

‎modules/beta-private-cluster-update-variant/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ Then perform the following commands on the root folder:
195195
| description | The description of the cluster | `string` | `""` | no |
196196
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
197197
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
198+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
198199
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
199200
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
200201
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎modules/beta-private-cluster-update-variant/cluster.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -576,10 +576,10 @@ resource "google_container_cluster" "primary" {
576576
}
577577

578578
dynamic "control_plane_endpoints_config" {
579-
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : []
579+
for_each = var.dns_allow_external_traffic != null ? [1] : []
580580
content {
581581
dns_endpoint_config {
582-
allow_external_traffic = var.deploy_using_private_endpoint
582+
allow_external_traffic = var.dns_allow_external_traffic
583583
}
584584
}
585585
}

‎modules/beta-private-cluster-update-variant/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -990,3 +990,9 @@ variable "enterprise_config" {
990990
type = string
991991
default = null
992992
}
993+
994+
variable "dns_allow_external_traffic" {
995+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
996+
type = bool
997+
default = null
998+
}

‎modules/beta-private-cluster/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ Then perform the following commands on the root folder:
173173
| description | The description of the cluster | `string` | `""` | no |
174174
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
175175
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
176+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
176177
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
177178
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
178179
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎modules/beta-private-cluster/cluster.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -576,10 +576,10 @@ resource "google_container_cluster" "primary" {
576576
}
577577

578578
dynamic "control_plane_endpoints_config" {
579-
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : []
579+
for_each = var.dns_allow_external_traffic != null ? [1] : []
580580
content {
581581
dns_endpoint_config {
582-
allow_external_traffic = var.deploy_using_private_endpoint
582+
allow_external_traffic = var.dns_allow_external_traffic
583583
}
584584
}
585585
}

‎modules/beta-private-cluster/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -990,3 +990,9 @@ variable "enterprise_config" {
990990
type = string
991991
default = null
992992
}
993+
994+
variable "dns_allow_external_traffic" {
995+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
996+
type = bool
997+
default = null
998+
}

‎modules/beta-public-cluster-update-variant/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,7 @@ Then perform the following commands on the root folder:
189189
| description | The description of the cluster | `string` | `""` | no |
190190
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
191191
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
192+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
192193
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
193194
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
194195
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎modules/beta-public-cluster-update-variant/cluster.tf

+8
Original file line numberDiff line numberDiff line change
@@ -553,6 +553,14 @@ resource "google_container_cluster" "primary" {
553553
}
554554
}
555555

556+
dynamic "control_plane_endpoints_config" {
557+
for_each = var.dns_allow_external_traffic != null ? [1] : []
558+
content {
559+
dns_endpoint_config {
560+
allow_external_traffic = var.dns_allow_external_traffic
561+
}
562+
}
563+
}
556564

557565
remove_default_node_pool = var.remove_default_node_pool
558566

‎modules/beta-public-cluster-update-variant/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -954,3 +954,9 @@ variable "enterprise_config" {
954954
type = string
955955
default = null
956956
}
957+
958+
variable "dns_allow_external_traffic" {
959+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
960+
type = bool
961+
default = null
962+
}

‎modules/beta-public-cluster/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,7 @@ Then perform the following commands on the root folder:
167167
| description | The description of the cluster | `string` | `""` | no |
168168
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
169169
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
170+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
170171
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
171172
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
172173
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎modules/beta-public-cluster/cluster.tf

+8
Original file line numberDiff line numberDiff line change
@@ -553,6 +553,14 @@ resource "google_container_cluster" "primary" {
553553
}
554554
}
555555

556+
dynamic "control_plane_endpoints_config" {
557+
for_each = var.dns_allow_external_traffic != null ? [1] : []
558+
content {
559+
dns_endpoint_config {
560+
allow_external_traffic = var.dns_allow_external_traffic
561+
}
562+
}
563+
}
556564

557565
remove_default_node_pool = var.remove_default_node_pool
558566

‎modules/beta-public-cluster/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -954,3 +954,9 @@ variable "enterprise_config" {
954954
type = string
955955
default = null
956956
}
957+
958+
variable "dns_allow_external_traffic" {
959+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
960+
type = bool
961+
default = null
962+
}

‎modules/private-cluster-update-variant/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,7 @@ Then perform the following commands on the root folder:
189189
| description | The description of the cluster | `string` | `""` | no |
190190
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
191191
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
192+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
192193
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
193194
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
194195
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎modules/private-cluster-update-variant/cluster.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -531,10 +531,10 @@ resource "google_container_cluster" "primary" {
531531
}
532532

533533
dynamic "control_plane_endpoints_config" {
534-
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : []
534+
for_each = var.dns_allow_external_traffic != null ? [1] : []
535535
content {
536536
dns_endpoint_config {
537-
allow_external_traffic = var.deploy_using_private_endpoint
537+
allow_external_traffic = var.dns_allow_external_traffic
538538
}
539539
}
540540
}

‎modules/private-cluster-update-variant/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -924,3 +924,9 @@ variable "enterprise_config" {
924924
type = string
925925
default = null
926926
}
927+
928+
variable "dns_allow_external_traffic" {
929+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
930+
type = bool
931+
default = null
932+
}

‎modules/private-cluster/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,7 @@ Then perform the following commands on the root folder:
167167
| description | The description of the cluster | `string` | `""` | no |
168168
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
169169
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
170+
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
170171
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
171172
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
172173
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |

‎modules/private-cluster/cluster.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -531,10 +531,10 @@ resource "google_container_cluster" "primary" {
531531
}
532532

533533
dynamic "control_plane_endpoints_config" {
534-
for_each = var.enable_private_endpoint && var.deploy_using_private_endpoint ? [1] : []
534+
for_each = var.dns_allow_external_traffic != null ? [1] : []
535535
content {
536536
dns_endpoint_config {
537-
allow_external_traffic = var.deploy_using_private_endpoint
537+
allow_external_traffic = var.dns_allow_external_traffic
538538
}
539539
}
540540
}

‎modules/private-cluster/variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -924,3 +924,9 @@ variable "enterprise_config" {
924924
type = string
925925
default = null
926926
}
927+
928+
variable "dns_allow_external_traffic" {
929+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
930+
type = bool
931+
default = null
932+
}

‎test/integration/node_pool/testdata/TestNodePool.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@
5757
"clusterIpv4Cidr": "192.168.0.0/18",
5858
"controlPlaneEndpointsConfig": {
5959
"dnsEndpointConfig": {
60-
"allowExternalTraffic": false
60+
"allowExternalTraffic": true
6161
},
6262
"ipEndpointsConfig": {
6363
"authorizedNetworksConfig": {

‎variables.tf

+6
Original file line numberDiff line numberDiff line change
@@ -888,3 +888,9 @@ variable "enterprise_config" {
888888
type = string
889889
default = null
890890
}
891+
892+
variable "dns_allow_external_traffic" {
893+
description = "(Optional) Controls whether external traffic is allowed over the dns endpoint."
894+
type = bool
895+
default = null
896+
}

0 commit comments

Comments
 (0)