fix: avoid master_global_access_config drift when private endpoint is disabled (#2591)

nacholiya · web-flow · commit 94bdc6a2e552 · 2026-05-19T15:50:36.000-07:00
diff --git a/autogen/main/cluster.tf.tmpl b/autogen/main/cluster.tf.tmpl
@@ -803,7 +803,7 @@ resource "google_container_cluster" "primary" {
       master_ipv4_cidr_block      = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null
       private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork
       dynamic "master_global_access_config" {
-        for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []
+        for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []
         content {
           enabled = master_global_access_config.value
         }
diff --git a/modules/beta-autopilot-private-cluster/cluster.tf b/modules/beta-autopilot-private-cluster/cluster.tf
@@ -423,7 +423,7 @@ resource "google_container_cluster" "primary" {
       master_ipv4_cidr_block      = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null
       private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork
       dynamic "master_global_access_config" {
-        for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []
+        for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []
         content {
           enabled = master_global_access_config.value
         }
diff --git a/modules/beta-private-cluster-update-variant/cluster.tf b/modules/beta-private-cluster-update-variant/cluster.tf
@@ -691,7 +691,7 @@ resource "google_container_cluster" "primary" {
       master_ipv4_cidr_block      = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null
       private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork
       dynamic "master_global_access_config" {
-        for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []
+        for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []
         content {
           enabled = master_global_access_config.value
         }
diff --git a/modules/beta-private-cluster/cluster.tf b/modules/beta-private-cluster/cluster.tf
@@ -691,7 +691,7 @@ resource "google_container_cluster" "primary" {
       master_ipv4_cidr_block      = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null
       private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork
       dynamic "master_global_access_config" {
-        for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []
+        for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []
         content {
           enabled = master_global_access_config.value
         }
diff --git a/modules/private-cluster-update-variant/cluster.tf b/modules/private-cluster-update-variant/cluster.tf
@@ -649,7 +649,7 @@ resource "google_container_cluster" "primary" {
       master_ipv4_cidr_block      = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null
       private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork
       dynamic "master_global_access_config" {
-        for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []
+        for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []
         content {
           enabled = master_global_access_config.value
         }
diff --git a/modules/private-cluster/cluster.tf b/modules/private-cluster/cluster.tf
@@ -649,7 +649,7 @@ resource "google_container_cluster" "primary" {
       master_ipv4_cidr_block      = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null
       private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork
       dynamic "master_global_access_config" {
-        for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []
+        for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []
         content {
           enabled = master_global_access_config.value
         }

Original file line number	Diff line number	Diff line change
`@@ -803,7 +803,7 @@ resource "google_container_cluster" "primary" {`
`803`	`803`	`master_ipv4_cidr_block = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null`
`804`	`804`	`private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork`
`805`	`805`	`dynamic "master_global_access_config" {`
`806`		`- for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []`
	`806`	`+ for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []`
`807`	`807`	`content {`
`808`	`808`	`enabled = master_global_access_config.value`
`809`	`809`	`}`
Original file line number	Diff line number	Diff line change
`@@ -423,7 +423,7 @@ resource "google_container_cluster" "primary" {`
`423`	`423`	`master_ipv4_cidr_block = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null`
`424`	`424`	`private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork`
`425`	`425`	`dynamic "master_global_access_config" {`
`426`		`- for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []`
	`426`	`+ for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []`
`427`	`427`	`content {`
`428`	`428`	`enabled = master_global_access_config.value`
`429`	`429`	`}`
Original file line number	Diff line number	Diff line change
`@@ -691,7 +691,7 @@ resource "google_container_cluster" "primary" {`
`691`	`691`	`master_ipv4_cidr_block = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null`
`692`	`692`	`private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork`
`693`	`693`	`dynamic "master_global_access_config" {`
`694`		`- for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []`
	`694`	`+ for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []`
`695`	`695`	`content {`
`696`	`696`	`enabled = master_global_access_config.value`
`697`	`697`	`}`
Original file line number	Diff line number	Diff line change
`@@ -649,7 +649,7 @@ resource "google_container_cluster" "primary" {`
`649`	`649`	`master_ipv4_cidr_block = var.private_endpoint_subnetwork == null ? private_cluster_config.value.master_ipv4_cidr_block : null`
`650`	`650`	`private_endpoint_subnetwork = private_cluster_config.value.private_endpoint_subnetwork`
`651`	`651`	`dynamic "master_global_access_config" {`
`652`		`- for_each = var.master_global_access_enabled ? [var.master_global_access_enabled] : []`
	`652`	`+ for_each = var.master_global_access_enabled && var.enable_private_endpoint ? [var.master_global_access_enabled] : []`
`653`	`653`	`content {`
`654`	`654`	`enabled = master_global_access_config.value`
`655`	`655`	`}`