Thanks @TheKangaroo - Interesting, it looks like the presence of the (empty) master_authorized_networks_config block is actually being used as a substitute for enabled: https://github.com/hashicorp/terraform-provider-google/blob/main/google/services/container/resource_container_cluster.go#L5035

Interesting @TheKangaroo - So currently the module's enable_private_endpoint actuates the provider's private_cluster_config.enable_private_endpoint which actuates the API's PrivateClusterConfig.enablePrivateEndpoint which is deprecated. The recommendation is to use ControlPlaneEndpointsConfig.IPEndpointsConfig.enable_public_endpoint, however ControlPlaneEndpointsConfig.IPEndpointsConfig.enabled is currently hardcoded to true in the Provider.

As masterAuthorizedNetworksConfig is part of ControlPlaneEndpointsConfig.IPEndpointsConfig, if masterAuthorizedNetworksConfig is created using the Provider, it is likely resulting in the side-effect of ControlPlaneEndpointsConfig.IPEndpointsConfig.enabled = true.

Here is a PR to add Provider support for ControlPlaneEndpointsConfig.IPEndpointsConfig.enabled: hashicorp/terraform-provider-google#20369

Ah, I think I understand now. Thanks for reviewing the current implementation and providing the explanation. Since we can already use DNS endpoints and disabling IP endpoints would just be an added benefit, I'm fine with waiting for hashicorp/terraform-provider-google#20369.

Here is a PR to add Provider support for ControlPlaneEndpointsConfig.IPEndpointsConfig.enabled: hashicorp/terraform-provider-google#20369

That provider's PR is merged. Can we fix this in the module?

I haven't been able to find the time to work on the PR since then, but I will do so as soon as possible.

I just checked and saw that @apeabody already improved the dns endpoint config a couple of days ago (1c6ff12).
Is my understanding correct, that after these changes we only need to add something like:

   dynamic "control_plane_endpoints_config" {
-    for_each = var.dns_allow_external_traffic != null ? [1] : []
+    for_each = var.dns_allow_external_traffic != null || var.master_authorized_networks == null ? [1] : []
     content {
+      ip_endpoints_config {
+        enabled = var.master_authorized_networks == null ? false : true
+      }
       dns_endpoint_config {
         allow_external_traffic = var.dns_allow_external_traffic
       }
    }
  }

and let master_authorized_networks default to null

   variable "master_authorized_networks" {
     type        = list(object({ cidr_block = string, display_name = string }))
     description = "List of master authorized networks. If none are provided, disallow external access (except the cluster node IPs, which GKE automatically whitelists)."
-    default     = []
+    default     = null
   }

to actually disable ip endpoints on empty master_authoritzed_networks?