Skip to content

Commit a88d1ae

Browse files
wyardleyapeabody
wyardley
and
apeabody
committed
fix: add insecureKubeletReadonlyPortEnabled to node_config
Add `insecureKubeletReadonlyPortEnabled` to `node_config.kubelet_config` for the default node-pool and for additional pools. It may also be necessary to define the top level `node_config` more broadly for the case where `remove_default_node_pool` is set to false, which should probably be handled separately. Also, the upstream provider (intentionally) uses an enum of `"TRUE"` / `"FALSE"` vs. a boolean. Update the code to follow this, and add a test case that covers the cluster level setting vs node pool one. Fixes terraform-google-modules#2013 Co-authored-by: Andrew Peabody <[email protected]>
1 parent 7828a0f commit a88d1ae

File tree

12 files changed

+30
-25
lines changed

12 files changed

+30
-25
lines changed

‎autogen/main/cluster.tf.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -694,7 +694,7 @@ resource "google_container_cluster" "primary" {
694694
enabled = var.enable_gcfs
695695
}
696696
{% endif %}
697-
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
697+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? upper(tostring(var.insecure_kubelet_readonly_port_enabled)) : null
698698
{% endif %}
699699
}
700700
}
@@ -1069,7 +1069,7 @@ resource "google_container_node_pool" "windows_pools" {
10691069
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
10701070
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
10711071
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1072-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1072+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
10731073
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
10741074
}
10751075
}

‎cluster.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -518,7 +518,7 @@ resource "google_container_cluster" "primary" {
518518

519519
node_pool_defaults {
520520
node_config_defaults {
521-
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
521+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? upper(tostring(var.insecure_kubelet_readonly_port_enabled)) : null
522522
}
523523
}
524524

@@ -768,7 +768,7 @@ resource "google_container_node_pool" "pools" {
768768
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
769769
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
770770
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
771-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
771+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
772772
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
773773
}
774774
}
@@ -1059,7 +1059,7 @@ resource "google_container_node_pool" "windows_pools" {
10591059
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
10601060
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
10611061
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1062-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1062+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
10631063
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
10641064
}
10651065
}

‎examples/node_pool/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ module "gke" {
7979
sandbox_enabled = true
8080
cpu_manager_policy = "static"
8181
cpu_cfs_quota = true
82-
insecure_kubelet_readonly_port_enabled = "FALSE"
82+
insecure_kubelet_readonly_port_enabled = false
8383
local_ssd_ephemeral_count = 2
8484
pod_pids_limit = 4096
8585
},

‎examples/node_pool_update_variant/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ module "gke" {
6666
max_count = 2
6767
service_account = var.compute_engine_service_account
6868
auto_upgrade = true
69-
insecure_kubelet_readonly_port_enabled = "FALSE"
69+
insecure_kubelet_readonly_port_enabled = false
7070
},
7171
{
7272
name = "pool-02"

‎examples/private_zonal_with_networking/main.tf

+2
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,8 @@ module "gke" {
7979
master_ipv4_cidr_block = "172.16.0.0/28"
8080
deletion_protection = false
8181

82+
insecure_kubelet_readonly_port_enabled = false
83+
8284
master_authorized_networks = [
8385
{
8486
cidr_block = data.google_compute_subnetwork.subnetwork.ip_cidr_range

‎modules/beta-private-cluster-update-variant/cluster.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -596,7 +596,7 @@ resource "google_container_cluster" "primary" {
596596
gcfs_config {
597597
enabled = var.enable_gcfs
598598
}
599-
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
599+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? upper(tostring(var.insecure_kubelet_readonly_port_enabled)) : null
600600
}
601601
}
602602

@@ -938,7 +938,7 @@ resource "google_container_node_pool" "pools" {
938938
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
939939
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
940940
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
941-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
941+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
942942
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
943943
}
944944
}
@@ -1243,7 +1243,7 @@ resource "google_container_node_pool" "windows_pools" {
12431243
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
12441244
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
12451245
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1246-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1246+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
12471247
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
12481248
}
12491249
}

‎modules/beta-private-cluster/cluster.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -596,7 +596,7 @@ resource "google_container_cluster" "primary" {
596596
gcfs_config {
597597
enabled = var.enable_gcfs
598598
}
599-
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
599+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? upper(tostring(var.insecure_kubelet_readonly_port_enabled)) : null
600600
}
601601
}
602602

@@ -853,7 +853,7 @@ resource "google_container_node_pool" "pools" {
853853
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
854854
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
855855
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
856-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
856+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
857857
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
858858
}
859859
}
@@ -1157,7 +1157,7 @@ resource "google_container_node_pool" "windows_pools" {
11571157
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
11581158
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
11591159
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1160-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1160+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
11611161
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
11621162
}
11631163
}

‎modules/beta-public-cluster-update-variant/cluster.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -575,7 +575,7 @@ resource "google_container_cluster" "primary" {
575575
gcfs_config {
576576
enabled = var.enable_gcfs
577577
}
578-
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
578+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? upper(tostring(var.insecure_kubelet_readonly_port_enabled)) : null
579579
}
580580
}
581581

@@ -917,7 +917,7 @@ resource "google_container_node_pool" "pools" {
917917
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
918918
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
919919
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
920-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
920+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
921921
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
922922
}
923923
}
@@ -1222,7 +1222,7 @@ resource "google_container_node_pool" "windows_pools" {
12221222
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
12231223
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
12241224
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1225-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1225+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
12261226
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
12271227
}
12281228
}

‎modules/beta-public-cluster/cluster.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -575,7 +575,7 @@ resource "google_container_cluster" "primary" {
575575
gcfs_config {
576576
enabled = var.enable_gcfs
577577
}
578-
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
578+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? upper(tostring(var.insecure_kubelet_readonly_port_enabled)) : null
579579
}
580580
}
581581

@@ -832,7 +832,7 @@ resource "google_container_node_pool" "pools" {
832832
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
833833
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
834834
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
835-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
835+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
836836
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
837837
}
838838
}
@@ -1136,7 +1136,7 @@ resource "google_container_node_pool" "windows_pools" {
11361136
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
11371137
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
11381138
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1139-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1139+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
11401140
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
11411141
}
11421142
}

‎modules/private-cluster-update-variant/cluster.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -539,7 +539,7 @@ resource "google_container_cluster" "primary" {
539539

540540
node_pool_defaults {
541541
node_config_defaults {
542-
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
542+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? upper(tostring(var.insecure_kubelet_readonly_port_enabled)) : null
543543
}
544544
}
545545

@@ -873,7 +873,7 @@ resource "google_container_node_pool" "pools" {
873873
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
874874
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
875875
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
876-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
876+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
877877
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
878878
}
879879
}
@@ -1165,7 +1165,7 @@ resource "google_container_node_pool" "windows_pools" {
11651165
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
11661166
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
11671167
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1168-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1168+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
11691169
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
11701170
}
11711171
}

‎modules/private-cluster/cluster.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -539,7 +539,7 @@ resource "google_container_cluster" "primary" {
539539

540540
node_pool_defaults {
541541
node_config_defaults {
542-
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null
542+
insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled != null ? upper(tostring(var.insecure_kubelet_readonly_port_enabled)) : null
543543
}
544544
}
545545

@@ -789,7 +789,7 @@ resource "google_container_node_pool" "pools" {
789789
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
790790
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
791791
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
792-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
792+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
793793
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
794794
}
795795
}
@@ -1080,7 +1080,7 @@ resource "google_container_node_pool" "windows_pools" {
10801080
cpu_manager_policy = lookup(each.value, "cpu_manager_policy", "static")
10811081
cpu_cfs_quota = lookup(each.value, "cpu_cfs_quota", null)
10821082
cpu_cfs_quota_period = lookup(each.value, "cpu_cfs_quota_period", null)
1083-
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", var.insecure_kubelet_readonly_port_enabled != null ? var.insecure_kubelet_readonly_port_enabled : null)
1083+
insecure_kubelet_readonly_port_enabled = lookup(each.value, "insecure_kubelet_readonly_port_enabled", null) != null ? upper(tostring(each.value.insecure_kubelet_readonly_port_enabled)) : null
10841084
pod_pids_limit = lookup(each.value, "pod_pids_limit", null)
10851085
}
10861086
}

‎test/integration/private_zonal_with_networking/testdata/TestPrivateZonalWithNetworking.json

+3
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,9 @@
107107
"diskSizeGb": 100,
108108
"diskType": "pd-balanced",
109109
"imageType": "COS_CONTAINERD",
110+
"kubeletConfig": {
111+
"insecureKubeletReadonlyPortEnabled": false
112+
},
110113
"loggingConfig": {
111114
"variantConfig": {
112115
"variant": "DEFAULT"

0 commit comments

Comments
 (0)