You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| add\_cluster\_firewall\_rules | Create additional firewall rules |`bool`|`false`| no |
205
+
| authenticator\_security\_group | The name of the RBAC security group for use with Google security groups in Kubernetes RBAC. Group name must be in format [email protected]|`string`|`null`| no |
206
+
| cloudrun | (Beta) Enable CloudRun addon |`bool`|`false`| no |
| cluster\_dns\_domain | The suffix used for all cluster service records. |`string`|`""`| no |
209
+
| cluster\_dns\_provider | Which in-cluster DNS provider should be used. PROVIDER\_UNSPECIFIED (default) or PLATFORM\_DEFAULT or CLOUD\_DNS. |`string`|`"PROVIDER_UNSPECIFIED"`| no |
210
+
| cluster\_dns\_scope | The scope of access to cluster DNS records. DNS\_SCOPE\_UNSPECIFIED (default) or CLUSTER\_SCOPE or VPC\_SCOPE. |`string`|`"DNS_SCOPE_UNSPECIFIED"`| no |
211
+
| cluster\_resource\_labels | The GCE resource labels (a map of key/value pairs) to be applied to the cluster |`map(string)`|`{}`| no |
212
+
| compute\_engine\_service\_account | Use the given service account for nodes rather than creating a new dedicated service account. If set then also set var.create\_service\_account to false to avoid 'value depends on resource attributes that cannot be determined until apply' errors. |`string`|`""`| no |
213
+
| config\_connector | Whether ConfigConnector is enabled for this cluster. |`bool`|`false`| no |
214
+
| create\_service\_account | Defines if service account specified to run nodes should be created. Explicitly set to false if var.compute\_engine\_service\_account is set to avoid 'value depends on resource attributes that cannot be determined until apply' errors. |`bool`|`true`| no |
215
+
| database\_encryption | Application-layer Secrets Encryption settings. The object format is {state = string, key\_name = string}. Valid values of state are: "ENCRYPTED"; "DECRYPTED". key\_name is the name of a CloudKMS key. |`list(object({ state = string, key_name = string }))`| <pre>[<br> {<br> "key_name": "",<br> "state": "DECRYPTED"<br> }<br>]</pre> | no |
216
+
| datapath\_provider | The desired datapath provider for this cluster. By default, `ADVANCED_DATAPATH` enables Dataplane-V2 feature. `DATAPATH_PROVIDER_UNSPECIFIED` enables the IPTables-based kube-proxy implementation as a fallback since upgrading to V2 requires a cluster re-creation. |`string`|`"ADVANCED_DATAPATH"`| no |
217
+
| default\_max\_pods\_per\_node | The maximum number of pods to schedule per node |`number`|`110`| no |
218
+
| deletion\_protection | Whether or not to allow Terraform to destroy the cluster. |`bool`|`true`| no |
219
+
| description | The description of the cluster |`string`|`""`| no |
220
+
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses |`bool`|`false`| no |
221
+
| dns\_cache | (Beta) The status of the NodeLocal DNSCache addon. |`bool`|`false`| no |
222
+
| enable\_confidential\_nodes | An optional flag to enable confidential node config. |`bool`|`false`| no |
223
+
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery |`bool`|`false`| no |
224
+
| enable\_gcfs | Enable image streaming on cluster level. |`bool`|`false`| no |
225
+
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network |`bool`|`false`| no |
226
+
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster |`bool`|`false`| no |
227
+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. |`bool`|`false`| no |
228
+
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. |`bool`|`false`| no |
229
+
| enable\_private\_endpoint | When true, the cluster's private endpoint is used as the cluster endpoint and access through the public endpoint is disabled. When false, either endpoint can be used. This field only applies to private clusters, when enable\_private\_nodes is true |`bool`|`true`| no |
230
+
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster. |`bool`|`true`| no |
231
+
| enable\_vertical\_pod\_autoscaling | Vertical Pod Autoscaling automatically adjusts the resources of pods controlled by it |`bool`|`false`| no |
232
+
| filestore\_csi\_driver | The status of the Filestore CSI driver addon, which allows the usage of filestore instance as volumes |`bool`|`false`| no |
233
+
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers |`list(string)`| <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
234
+
| firewall\_priority | Priority rule for firewall rules |`number`|`1000`| no |
235
+
| gateway\_api\_channel | The gateway api channel of this cluster. Accepted values are `CHANNEL_STANDARD` and `CHANNEL_DISABLED`. |`string`|`null`| no |
236
+
| gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. |`bool`|`true`| no |
237
+
| gke\_backup\_agent\_config | (Beta) Whether Backup for GKE agent is enabled for this cluster. |`bool`|`false`| no |
238
+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. |`bool`|`true`| no |
239
+
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon |`bool`|`true`| no |
240
+
| http\_load\_balancing | Enable httpload balancer addon. The addon allows whoever can create Ingress objects to expose an application to a public IP. Network policies or Gatekeeper policies should be used to verify that only authorized applications are exposed. |`bool`|`true`| no |
241
+
| initial\_node\_count | The number of nodes to create in this cluster's default node pool. |`number`|`0`| no |
242
+
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods |`string`| n/a | yes |
243
+
| ip\_range\_services | The _name_ of the secondary subnet range to use for services |`string`| n/a | yes |
244
+
| istio | (Beta) Enable Istio addon |`bool`|`false`| no |
245
+
| istio\_auth | (Beta) The authentication type between services in Istio. |`string`|`"AUTH_MUTUAL_TLS"`| no |
246
+
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. The module enforces certain minimum versions to ensure that specific features are available. |`string`|`null`| no |
247
+
| logging\_service | The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none |`string`|`"logging.googleapis.com/kubernetes"`| no |
248
+
| maintenance\_end\_time | Time window specified for recurring maintenance operations in RFC3339 format |`string`|`""`| no |
249
+
| maintenance\_exclusions | List of maintenance exclusions. A cluster can have up to three |`list(object({ name = string, start_time = string, end_time = string, exclusion_scope = string }))`|`[]`| no |
250
+
| maintenance\_recurrence | Frequency of the recurring maintenance window in RFC5545 format. |`string`|`""`| no |
251
+
| maintenance\_start\_time | Time window specified for daily maintenance operations in RFC3339 format |`string`|`"05:00"`| no |
252
+
| master\_authorized\_networks | List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists). |`list(object({ cidr_block = string, display_name = string }))`|`[]`| no |
253
+
| master\_ipv4\_cidr\_block | The IP range in CIDR notation to use for the hosted master network |`string`|`"10.0.0.0/28"`| no |
254
+
| monitoring\_enable\_managed\_prometheus | (Beta) Configuration for Managed Service for Prometheus. Whether or not the managed collection is enabled. |`bool`|`false`| no |
255
+
| monitoring\_enable\_observability\_metrics | Whether or not the advanced datapath metrics are enabled. |`bool`|`false`| no |
256
+
| monitoring\_enable\_observability\_relay | Whether or not the advanced datapath relay is enabled. |`bool`|`false`| no |
257
+
| monitoring\_enabled\_components | List of services to monitor: SYSTEM\_COMPONENTS, WORKLOADS. Empty list is default GKE configuration. |`list(string)`|`[]`| no |
258
+
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none |`string`|`"monitoring.googleapis.com/kubernetes"`| no |
259
+
| name | The name of the cluster |`string`| n/a | yes |
260
+
| network | The VPC network to host the cluster in |`string`| n/a | yes |
261
+
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) |`string`|`""`| no |
262
+
| node\_pools | List of maps containing node pools |`list(map(string))`| <pre>[<br> {<br> "name": "default-node-pool"<br> }<br>]</pre> | no |
263
+
| node\_pools\_labels | Map of maps containing node labels by node-pool name |`map(map(string))`| <pre>{<br> "all": {},<br> "default-node-pool": {}<br>}</pre> | no |
264
+
| node\_pools\_metadata | Map of maps containing node metadata by node-pool name |`map(map(string))`| <pre>{<br> "all": {},<br> "default-node-pool": {}<br>}</pre> | no |
265
+
| node\_pools\_oauth\_scopes | Map of lists containing node oauth scopes by node-pool name |`map(list(string))`| <pre>{<br> "all": [<br> "https://www.googleapis.com/auth/cloud-platform"<br> ],<br> "default-node-pool": []<br>}</pre> | no |
266
+
| node\_pools\_resource\_labels | Map of maps containing resource labels by node-pool name |`map(map(string))`| <pre>{<br> "all": {},<br> "default-node-pool": {}<br>}</pre> | no |
267
+
| node\_pools\_tags | Map of lists containing node network tags by node-pool name |`map(list(string))`| <pre>{<br> "all": [],<br> "default-node-pool": []<br>}</pre> | no |
268
+
| node\_pools\_taints | Map of lists containing node taints by node-pool name |`map(list(object({ key = string, value = string, effect = string })))`| <pre>{<br> "all": [],<br> "default-node-pool": []<br>}</pre> | no |
269
+
| notification\_config\_topic | The desired Pub/Sub topic to which notifications will be sent by GKE. Format is projects/{project}/topics/{topic}. |`string`|`""`| no |
270
+
| project\_id | The project ID to host the cluster in |`string`| n/a | yes |
271
+
| region | The region to host the cluster in |`string`| n/a | yes |
272
+
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) |`bool`|`true`| no |
273
+
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects. |`list(string)`|`[]`| no |
274
+
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`. |`string`|`"REGULAR"`| no |
275
+
| resource\_usage\_export\_dataset\_id | The dataset id for which network egress metering for this cluster will be enabled. If enabled, a daemonset will be created in the cluster to meter network egress traffic. |`string`|`""`| no |
276
+
| sandbox\_enabled | (Beta) Enable GKE Sandbox (Do not forget to set `image_type` = `COS_CONTAINERD` to use it). |`bool`|`false`| no |
277
+
| security\_posture\_mode | Security posture mode. Accepted values are `DISABLED` and `BASIC`. Defaults to `DISABLED`. |`string`|`"DISABLED"`| no |
278
+
| security\_posture\_vulnerability\_mode | Security posture vulnerability mode. Accepted values are `VULNERABILITY_DISABLED`, `VULNERABILITY_BASIC`, and `VULNERABILITY_ENTERPRISE`|`string`|`null`| no |
279
+
| stub\_domains | Map of stub domains and their resolvers to forward DNS queries for a certain domain to an external DNS server |`map(list(string))`|`{}`| no |
280
+
| subnetwork | The subnetwork to host the cluster in |`string`| n/a | yes |
281
+
| timeouts | Timeout for cluster operations. |`map(string)`|`{}`| no |
282
+
| upstream\_nameservers | If specified, the values replace the nameservers taken by default from the node’s /etc/resolv.conf |`list(string)`|`[]`| no |
283
+
| windows\_node\_pools | List of maps containing node pools |`list(map(string))`|`[]`| no |
0 commit comments