Skip to content

Commit 59dbfdc

Browse files
craigmunrocraigmunro
authored
feat: expose dns_enable_k8s_tokens_via_dns for GKE DNS endpoint (#2587)
1 parent 5f0a2be commit 59dbfdc

47 files changed

Lines changed: 163 additions & 30 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ Then perform the following commands on the root folder:
168168
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
169169
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
170170
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
171+
| dns\_enable\_k8s\_tokens\_via\_dns | (Optional) Controls whether Kubernetes ServiceAccount token authentication is allowed via the DNS endpoint. | `bool` | `null` | no |
171172
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
172173
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
173174
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |

‎autogen/main/cluster.tf.tmpl‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -813,12 +813,13 @@ resource "google_container_cluster" "primary" {
813813

814814
{% endif %}
815815
dynamic "control_plane_endpoints_config" {
816-
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
816+
for_each = var.dns_allow_external_traffic != null || var.dns_enable_k8s_tokens_via_dns != null || var.ip_endpoints_enabled != null ? [1] : []
817817
content {
818818
dynamic "dns_endpoint_config" {
819-
for_each = var.dns_allow_external_traffic != null ? [1] : []
819+
for_each = var.dns_allow_external_traffic != null || var.dns_enable_k8s_tokens_via_dns != null ? [1] : []
820820
content {
821-
allow_external_traffic = var.dns_allow_external_traffic
821+
allow_external_traffic = var.dns_allow_external_traffic
822+
enable_k8s_tokens_via_dns = var.dns_enable_k8s_tokens_via_dns
822823
}
823824
}
824825
dynamic "ip_endpoints_config" {

‎autogen/main/variables.tf.tmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1217,6 +1217,12 @@ variable "dns_allow_external_traffic" {
12171217
default = null
12181218
}
12191219

1220+
variable "dns_enable_k8s_tokens_via_dns" {
1221+
description = "(Optional) Controls whether Kubernetes ServiceAccount token authentication is allowed via the DNS endpoint."
1222+
type = bool
1223+
default = null
1224+
}
1225+
12201226
variable "ip_endpoints_enabled" {
12211227
description = "(Optional) Controls whether to allow direct IP access. Defaults to `true`."
12221228
type = bool

‎cluster.tf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -636,12 +636,13 @@ resource "google_container_cluster" "primary" {
636636
}
637637

638638
dynamic "control_plane_endpoints_config" {
639-
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
639+
for_each = var.dns_allow_external_traffic != null || var.dns_enable_k8s_tokens_via_dns != null || var.ip_endpoints_enabled != null ? [1] : []
640640
content {
641641
dynamic "dns_endpoint_config" {
642-
for_each = var.dns_allow_external_traffic != null ? [1] : []
642+
for_each = var.dns_allow_external_traffic != null || var.dns_enable_k8s_tokens_via_dns != null ? [1] : []
643643
content {
644-
allow_external_traffic = var.dns_allow_external_traffic
644+
allow_external_traffic = var.dns_allow_external_traffic
645+
enable_k8s_tokens_via_dns = var.dns_enable_k8s_tokens_via_dns
645646
}
646647
}
647648
dynamic "ip_endpoints_config" {

‎metadata.display.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,9 @@ spec:
117117
dns_cache:
118118
name: dns_cache
119119
title: Dns Cache
120+
dns_enable_k8s_tokens_via_dns:
121+
name: dns_enable_k8s_tokens_via_dns
122+
title: Dns Enable K8s Tokens Via Dns
120123
enable_binary_authorization:
121124
name: enable_binary_authorization
122125
title: Enable Binary Authorization

‎metadata.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -795,6 +795,9 @@ spec:
795795
- name: dns_allow_external_traffic
796796
description: (Optional) Controls whether external traffic is allowed over the dns endpoint.
797797
varType: bool
798+
- name: dns_enable_k8s_tokens_via_dns
799+
description: (Optional) Controls whether Kubernetes ServiceAccount token authentication is allowed via the DNS endpoint.
800+
varType: bool
798801
- name: ip_endpoints_enabled
799802
description: (Optional) Controls whether to allow direct IP access. Defaults to `true`.
800803
varType: bool

‎modules/beta-autopilot-private-cluster/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ Then perform the following commands on the root folder:
9494
| disable\_l4\_lb\_firewall\_reconciliation | Disable L4 Load Balancer firewall reconciliation | `bool` | `null` | no |
9595
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
9696
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
97+
| dns\_enable\_k8s\_tokens\_via\_dns | (Optional) Controls whether Kubernetes ServiceAccount token authentication is allowed via the DNS endpoint. | `bool` | `null` | no |
9798
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
9899
| enable\_cilium\_clusterwide\_network\_policy | Enable Cilium Cluster Wide Network Policies on the cluster | `bool` | `false` | no |
99100
| enable\_confidential\_nodes | An optional flag to enable confidential node config. | `bool` | `false` | no |

‎modules/beta-autopilot-private-cluster/cluster.tf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -432,12 +432,13 @@ resource "google_container_cluster" "primary" {
432432
}
433433

434434
dynamic "control_plane_endpoints_config" {
435-
for_each = var.dns_allow_external_traffic != null || var.ip_endpoints_enabled != null ? [1] : []
435+
for_each = var.dns_allow_external_traffic != null || var.dns_enable_k8s_tokens_via_dns != null || var.ip_endpoints_enabled != null ? [1] : []
436436
content {
437437
dynamic "dns_endpoint_config" {
438-
for_each = var.dns_allow_external_traffic != null ? [1] : []
438+
for_each = var.dns_allow_external_traffic != null || var.dns_enable_k8s_tokens_via_dns != null ? [1] : []
439439
content {
440-
allow_external_traffic = var.dns_allow_external_traffic
440+
allow_external_traffic = var.dns_allow_external_traffic
441+
enable_k8s_tokens_via_dns = var.dns_enable_k8s_tokens_via_dns
441442
}
442443
}
443444
dynamic "ip_endpoints_config" {

‎modules/beta-autopilot-private-cluster/metadata.display.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,9 @@ spec:
9797
dns_cache:
9898
name: dns_cache
9999
title: Dns Cache
100+
dns_enable_k8s_tokens_via_dns:
101+
name: dns_enable_k8s_tokens_via_dns
102+
title: Dns Enable K8s Tokens Via Dns
100103
enable_binary_authorization:
101104
name: enable_binary_authorization
102105
title: Enable Binary Authorization

‎modules/beta-autopilot-private-cluster/metadata.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -527,6 +527,9 @@ spec:
527527
- name: dns_allow_external_traffic
528528
description: (Optional) Controls whether external traffic is allowed over the dns endpoint.
529529
varType: bool
530+
- name: dns_enable_k8s_tokens_via_dns
531+
description: (Optional) Controls whether Kubernetes ServiceAccount token authentication is allowed via the DNS endpoint.
532+
varType: bool
530533
- name: ip_endpoints_enabled
531534
description: (Optional) Controls whether to allow direct IP access. Defaults to `true`.
532535
varType: bool

0 commit comments

Comments
 (0)