feat: extend secret_sync_config to GA modules and add rotation_config support#2596
feat: extend secret_sync_config to GA modules and add rotation_config support#2596litzius wants to merge 6 commits into
Conversation
… support
- Remove {% if beta_cluster %} guard from autogen templates so secret_sync_config
is now generated for all modules (root, private-cluster, private-cluster-update-variant)
now that google provider >= 7.33 exposes it as GA
- Rename enable_secret_sync (bool) → secret_sync_config (object) in autogen and
safer-cluster templates for consistency with gke-* modules (breaking change)
- Add rotation_config sub-block (enabled, rotation_interval) to secret_sync_config
across all modules including gke-standard-cluster and gke-autopilot-cluster
- Bump non-beta google provider minimum to >= 7.33.0 in versions.tf.tmpl
- Regenerate all autogen-derived modules and READMEs via make build
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request replaces the boolean enable_secret_sync variable with a structured secret_sync_config object across various GKE cluster modules, allowing for advanced configuration including secret rotation. The minimum Google provider version is also updated to >= 7.33.0 to support this block. The review feedback correctly identifies that the enabled attribute within the rotation_config object should not be marked as optional(bool) since it is a required field in the Google provider schema when rotation_config is defined. This issue needs to be addressed across several variable definition files, and the minimum provider version should be consistently updated in the autopilot and standard cluster modules.
…d gke-autopilot-cluster
… gke-autopilot-cluster
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request updates GKE cluster configurations across multiple modules to support the secret_sync_config block, including its nested rotation_config settings. Feedback from the review highlights critical issues with the updated provider versions, noting that the specified google version 7.33.0 and google-beta version 7.12.0 do not exist and will cause initialization failures. Additionally, the reviewer pointed out that the enabled field within rotation_config should be marked as required rather than optional in the variable definitions to prevent runtime errors during deployment.
litzius
requested review from
a team,
apeabody,
ayushmjain,
ericyz,
krprabhat-eng and
q2w
as code owners
|
/gcbrun |
2 participants
Summary
secret_sync_configto beta modulessecret_sync_configto all remaining cluster modules now that the block is GA ingoogleproviderv7.33.0 — root module,
private-cluster, andprivate-cluster-update-variantwerepreviously excluded
rotation_configsub-block tosecret_sync_configacross all modules (enabled,rotation_interval), enabling automatic secret rotation for the Secret Sync add-onenable_secret_sync(bool) →secret_sync_config(object) in autogen-based modules for consistency with the handwrittengke-*modules pattern — breaking changeautogen/main/,autogen/safer-cluster/) updated;{% if beta_cluster %}guard removed fromsecret_sync_configblockAffected modules
private-clustersecret_sync_configprivate-cluster-update-variantsecret_sync_configsecret_sync_configbeta-private-clustersecret_sync_configenable_secret_sync+rotation_configaddedbeta-private-cluster-update-variantsecret_sync_configrotation_configaddedbeta-public-clustersecret_sync_configrotation_configaddedbeta-public-cluster-update-variantsecret_sync_configrotation_configaddedbeta-autopilot-private-clustersecret_sync_configrotation_configaddedbeta-autopilot-public-clustersecret_sync_configrotation_configaddedsafer-clustersecret_sync_configrotation_configaddedsafer-cluster-update-variantsecret_sync_configrotation_configaddedgke-standard-clustersecret_sync_configrotation_configaddedgke-autopilot-clustersecret_sync_configrotation_configaddedBreaking change
Beta modules that previously used
enable_secret_sync = truemust now use:Test plan