feat: mesh_certificates support #1712
Conversation
bgvdiscord
changed the title
bgvdiscord
changed the title
bgvdiscord
force-pushed
the
feat/safer-cluster-mesh-certificates
branch
2 times, most recently
from
e2b2fcb
to
6a5093b
Compare
|
Hi @bgvdiscord , thank you for your contribution. Please help to resolve the conflicts and I will help to review this |
bgvdiscord
force-pushed
the
feat/safer-cluster-mesh-certificates
branch
from
6a5093b
to
55e447d
Compare
bgvdiscord
changed the title
@ericyz : conflicts are resolved. Thanks! |
|
/gcbrun |
| @@ -185,6 +185,9 @@ module "gke" { | |||
| // We enable Workload Identity by default. | |||
| identity_namespace = "${var.project_id}.svc.id.goog" | |||
|
|
|||
| // Enabling mesh certificates requires Workload Identity | |||
| enable_mesh_certificates = var.enable_mesh_certificates | |||
There was a problem hiding this comment.
Please wrap this in {% if autopilot_cluster != true %} so it doesn't render for autopilot clusters.
bgvdiscord
force-pushed
the
feat/safer-cluster-mesh-certificates
branch
from
91145cd
to
ba8641c
Compare
bgvdiscord
force-pushed
the
feat/safer-cluster-mesh-certificates
branch
from
ba8641c
to
00878e5
Compare
| @@ -219,6 +219,12 @@ locals { | |||
| cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{ | |||
| workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace | |||
| }] | |||
| {% if autopilot_cluster != true %} | |||
There was a problem hiding this comment.
Fixed: cluster_mesh_certificates_config no longer in autopilot clusters.
| @@ -219,6 +219,12 @@ locals { | |||
| cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{ | |||
| workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace | |||
| }] | |||
| {% if autopilot_cluster != true %} | |||
| cluster_mesh_certificates_config = local.workload_identity_enabled ? [{ | |||
There was a problem hiding this comment.
Applied readability suggestion - thanks!
|
@g-awmalik those changes are made; thanks! |
|
/gcbrun |
|
Thanks for the updates @bgvdiscord. There still seem to be a few references in the autopilot modules. Please take a look at the lint check and resolve them. |
| @@ -170,6 +170,17 @@ output "identity_namespace" { | |||
| google_container_cluster.primary | |||
| ] | |||
| } | |||
|
|
|||
| {% if autopilot_cluster != true %} | |||
There was a problem hiding this comment.
Wrapped to fix lint
|
/gcbrun |
Implements feature request from #1691 (quoted below) to add
enable_mesh_certificatesconfiguration option, including to safer-cluster.Defaults to
false/ not enabled, which is the default behavior for clusters without it set. Not sure whether to call this a breaking change due to overwriting if value was set totruewith another module or gcloud command.Happy to take feedback.