Allow users to specify network tags for the default node pool

[tomasgareau]

Addresses #1118.

This will apply the following tags to the default node pool:

• the cluster_network_tag (gke-${var.name})
• the pool variant of the cluster_network_tag (gke-${var.name}-default-pool)
• user-specified tags in var.node_pools_tags["all"]
• user-specified tags in var.node_pools_tags["default-pool"]

This may be needed for private clusters in VPC networks with a "default-deny-all" firewall rule that use network tags to define exceptions for e.g., egress to the master_ipv4_cidr_block.

Two quick notes/questions:

• I deviated slightly from @morgante's suggestion in the related issue (adding the network tags from the first pool in the cluster config like for the service account): node_pools_tags is a map-of-lists unlike node_pools, which is a list-of-maps. The "first" pool here wouldn't be well defined -- I think the approach I went with is more natural in any case.
• Are there any existing tests where we'd like to add coverage for this?
  • It's unfortunately a bit difficult for me to spin up tests as described in CONTRIBUTING.md (we have an org policy that blocks the creation of service account keys), so I'm afraid the only testing I have of the above is manually spinning up an instance in our existing env and confirming that it contained the desired tags.
  • For some tests it seems like I could add an it "has the expected network tags" do block to the default pool checks (e.g., simple_regional)

[comment-bot-dev]

Thanks for the PR! 🚀
✅ Lint checks have passed.

[morgante]

Thanks for working on this!

I deviated slightly from @morgante's suggestion in the related issue (adding the network tags from the first pool in the cluster config like for the service account): node_pools_tags is a map-of-lists unlike node_pools, which is a list-of-maps. The "first" pool here wouldn't be well defined -- I think the approach I went with is more natural in any case.

I'd like to avoid introducing a new "default-pool" concept because we already have precedent for using the first node pool as the default pool (example). In this case, what we should do is retrieve the name of the first node pool (from var.node_pools) and use the network tags associated with that node pool (in var.node_pools_tags).

[tomasgareau]

Ah, I see -- makes sense! I've changed the "default-pool" lookup to var.node_pools[0].name in 0391098 -- from what I can see

• node_pools[0] should always exist
• node_pools entries are assumed to have the attribute name

so I have no error checking for the cases where either of these aren't true. Let me know if either is not the case.

Did we want to keep the "${local.cluster_network_tag}-default-pool" tag?

[morgante]

Looks good, yeah you shouldn't need error checking.

Did we want to keep the "${local.cluster_network_tag}-default-pool" tag?

Yes, I think it's helpful.