Skip to content

Add TF support for Enable K8s Tokens and Certs via Dns Endpoint #15352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add TF support for Enable K8s Tokens and Certs via Dns Endpoint #15352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 24 additions & 2 deletions mmv1/third_party/terraform/services/container/resource_container_cluster.go.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1922,6 +1922,16 @@ func ResourceContainerCluster() *schema.Resource {
Optional: true,
Description: `Controls whether user traffic is allowed over this endpoint. Note that GCP-managed services may still use the endpoint even if this is false.`,
},
"enable_k8s_tokens_via_dns": {
Type: schema.TypeBool,
Optional: true,
Description: `Controls whether the k8s token auth is allowed via dns.`,
},
"enable_k8s_certs_via_dns": {
Type: schema.TypeBool,
Optional: true,
Description: `Controls whether the k8s certs auth is allowed via dns.`,
},
},
},
},
Expand Down Expand Up @@ -6246,6 +6256,16 @@ func expandControlPlaneEndpointsConfig(d *schema.ResourceData) *container.Contro
dns.ForceSendFields = []string{"AllowExternalTraffic"}
}

if v := d.Get("control_plane_endpoints_config.0.dns_endpoint_config.0.enable_k8s_tokens_via_dns"); v != nil {
dns.EnableK8sTokensViaDns = v.(bool)
dns.ForceSendFields = []string{"EnableK8sTokensViaDns"}
}

if v := d.Get("control_plane_endpoints_config.0.dns_endpoint_config.0.enable_k8s_certs_via_dns"); v != nil {
dns.EnableK8sCertsViaDns = v.(bool)
dns.ForceSendFields = []string{"EnableK8sCertsViaDns"}
}

ip := &container.IPEndpointsConfig{
Enabled: true,
ForceSendFields: []string{"Enabled"},
Expand Down Expand Up @@ -7073,8 +7093,10 @@ func flattenDnsEndpointConfig(dns *container.DNSEndpointConfig) []map[string]int
}
return []map[string]interface{}{
{
"endpoint": dns.Endpoint,
"allow_external_traffic": dns.AllowExternalTraffic,
"endpoint": dns.Endpoint,
"allow_external_traffic": dns.AllowExternalTraffic,
"enable_k8s_tokens_via_dns": dns.EnableK8sTokensViaDns,
"enable_k8s_certs_via_dns": dns.EnableK8sCertsViaDns,
},
}
}
Expand Down
116 changes: 116 additions & 0 deletions mmv1/third_party/terraform/services/container/resource_container_cluster_test.go.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14016,6 +14016,122 @@ resource "google_container_cluster" "primary" {
}`, name, networkName, subnetworkName, enabled)
}

func TestAccContainerCluster_withDnsEndpointAndEnableK8sTokensViaDns(t *testing.T) {
t.Parallel()

clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccContainerCluster_withDnsEndpointAndEnablek8sTokensViaDns(clusterName, networkName, subnetworkName, false),
Check: resource.ComposeAggregateTestCheckFunc(
resource.TestCheckResourceAttr("google_container_cluster.primary", "control_plane_endpoints_config.0.dns_endpoint_config.0.enable_k8s_tokens_via_dns", "false"),
),
},
{
ResourceName: "google_container_cluster.primary",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
{
Config: testAccContainerCluster_withDnsEndpointAndEnablek8sTokensViaDns(clusterName, networkName, subnetworkName, true),
Check: resource.ComposeAggregateTestCheckFunc(
resource.TestCheckResourceAttr("google_container_cluster.primary", "control_plane_endpoints_config.0.dns_endpoint_config.0.enable_k8s_tokens_via_dns", "true"),
),
},
{
ResourceName: "google_container_cluster.primary",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
},
})
}

func testAccContainerCluster_withDnsEndpointAndEnablek8sTokensViaDns(name, networkName, subnetworkName string, enabled bool) string {
return fmt.Sprintf(`
resource "google_container_cluster" "primary" {
name = "%s"
location = "us-central1-a"
initial_node_count = 1
network = "%s"
subnetwork = "%s"
deletion_protection = false
control_plane_endpoints_config {
dns_endpoint_config {
allow_external_traffic = true
enable_k8s_tokens_via_dns = %t
}
}
}`, name, networkName, subnetworkName, enabled)
}

func TestAccContainerCluster_withDnsEndpointAndEnableK8sCertsViaDns(t *testing.T) {
t.Parallel()

clusterName := fmt.Sprintf("tf-test-cluster-%s", acctest.RandString(t, 10))
networkName := acctest.BootstrapSharedTestNetwork(t, "gke-cluster")
subnetworkName := acctest.BootstrapSubnet(t, "gke-cluster", networkName)

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
CheckDestroy: testAccCheckContainerClusterDestroyProducer(t),
Steps: []resource.TestStep{
{
Config: testAccContainerCluster_withDnsEndpointAndEnablek8sCertsViaDns(clusterName, networkName, subnetworkName, false),
Check: resource.ComposeAggregateTestCheckFunc(
resource.TestCheckResourceAttr("google_container_cluster.primary", "control_plane_endpoints_config.0.dns_endpoint_config.0.enable_k8s_certs_via_dns", "false"),
),
},
{
ResourceName: "google_container_cluster.primary",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
{
Config: testAccContainerCluster_withDnsEndpointAndEnablek8sCertsViaDns(clusterName, networkName, subnetworkName, true),
Check: resource.ComposeAggregateTestCheckFunc(
resource.TestCheckResourceAttr("google_container_cluster.primary", "control_plane_endpoints_config.0.dns_endpoint_config.0.enable_k8s_certs_via_dns", "true"),
),
},
{
ResourceName: "google_container_cluster.primary",
ImportState: true,
ImportStateVerify: true,
ImportStateVerifyIgnore: []string{"deletion_protection"},
},
},
})
}

func testAccContainerCluster_withDnsEndpointAndEnablek8sCertsViaDns(name, networkName, subnetworkName string, enabled bool) string {
return fmt.Sprintf(`
resource "google_container_cluster" "primary" {
name = "%s"
location = "us-central1-a"
initial_node_count = 1
network = "%s"
subnetwork = "%s"
deletion_protection = false
control_plane_endpoints_config {
dns_endpoint_config {
allow_external_traffic = true
enable_k8s_certs_via_dns = %t
}
}
}`, name, networkName, subnetworkName, enabled)
}

func TestAccContainerCluster_withCgroupMode(t *testing.T) {
t.Parallel()

Expand Down
4 changes: 4 additions & 0 deletions mmv1/third_party/terraform/website/docs/r/container_cluster.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1320,6 +1320,10 @@ The `control_plane_endpoints_config.dns_endpoint_config` block supports:

* `allow_external_traffic` - (Optional) Controls whether user traffic is allowed over this endpoint. Note that GCP-managed services may still use the endpoint even if this is false.

* `enable_k8s_tokens_via_dns` - (Optional) Controls whether the k8s token auth is allowed via Dns.

* `enable_k8s_certs_via_dns` - (Optional) Controls whether the k8s certs auth is allowed via Dns.

The `control_plane_endpoints_config.ip_endpoints_config` block supports:

* `enabled` - (Optional) Controls whether to allow direct IP access. Defaults to `true`.
Expand Down
Loading