Skip to content

feat(TPG>=6.28)!: add support for disable_l4_lb_firewall_reconciliation #2338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
May 30, 2025
Merged

feat(TPG>=6.28)!: add support for disable_l4_lb_firewall_reconciliation #2338

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
96fa379
add disable_l4_lb_firewall_reconciliation
DrFaust92 Apr 29, 2025
6239588
change to null
DrFaust92 May 17, 2025
1fe5307
Merge branch 'main' into disable_l4_lb_firewall_reconciliation
apeabody May 29, 2025
c82f5e2
Merge branch 'main' into disable_l4_lb_firewall_reconciliation
apeabody May 29, 2025
2397b19
Merge branch 'main' into disable_l4_lb_firewall_reconciliation
apeabody May 29, 2025
f6c8558
regenerate docs
DrFaust92 May 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,7 @@ Then perform the following commands on the root folder:
| deletion\_protection | Whether or not to allow Terraform to destroy the cluster. | `bool` | `true` | no |
| description | The description of the cluster | `string` | `""` | no |
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
| disable\_l4\_lb\_firewall\_reconciliation | Disable L4 Load Balancer firewall reconciliation | `bool` | `null` | no |
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
Expand Down Expand Up @@ -414,7 +415,7 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
#### Terraform and Plugins

- [Terraform](https://www.terraform.io/downloads.html) 1.3+
- [Terraform Provider for GCP][terraform-provider-google] v6.27+
- [Terraform Provider for GCP][terraform-provider-google] v6.28+

#### gcloud

Expand Down
4 changes: 2 additions & 2 deletions autogen/main/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,9 +306,9 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog

- [Terraform](https://www.terraform.io/downloads.html) 1.3+
{% if beta_cluster %}
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.27+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.28+
{% else %}
- [Terraform Provider for GCP][terraform-provider-google] v6.27+
- [Terraform Provider for GCP][terraform-provider-google] v6.28+
{% endif %}

#### gcloud
Expand Down
2 changes: 2 additions & 0 deletions autogen/main/cluster.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,6 +251,8 @@ resource "google_container_cluster" "primary" {

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting

disable_l4_lb_firewall_reconciliation = var.disable_l4_lb_firewall_reconciliation

enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy

dynamic "secret_manager_config" {
Expand Down
6 changes: 6 additions & 0 deletions autogen/main/variables.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -979,6 +979,12 @@ variable "enable_l4_ilb_subsetting" {
description = "Enable L4 ILB Subsetting on the cluster"
default = false
}

variable "disable_l4_lb_firewall_reconciliation" {
type = bool
description = "Disable L4 Load Balancer firewall reconciliation"
default = null
}
{% if beta_cluster %}
{% if autopilot_cluster != true %}

Expand Down
12 changes: 6 additions & 6 deletions autogen/main/versions.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,33 +24,33 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
{% elif beta_cluster and autopilot_cluster %}
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
{% elif autopilot_cluster %}
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
{% else %}
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
{% endif %}
kubernetes = {
Expand Down
2 changes: 2 additions & 0 deletions cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,8 @@ resource "google_container_cluster" "primary" {

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting

disable_l4_lb_firewall_reconciliation = var.disable_l4_lb_firewall_reconciliation

enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy

dynamic "secret_manager_config" {
Expand Down
3 changes: 3 additions & 0 deletions metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,9 @@ spec:
disable_default_snat:
name: disable_default_snat
title: Disable Default Snat
disable_l4_lb_firewall_reconciliation:
name: disable_l4_lb_firewall_reconciliation
title: Disable L4 Lb Firewall Reconciliation
disable_legacy_metadata_endpoints:
name: disable_legacy_metadata_endpoints
title: Disable Legacy Metadata Endpoints
Expand Down
3 changes: 3 additions & 0 deletions metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -689,6 +689,9 @@ spec:
description: Enable L4 ILB Subsetting on the cluster
varType: bool
defaultValue: false
- name: disable_l4_lb_firewall_reconciliation
description: Disable L4 Load Balancer firewall reconciliation
varType: bool
- name: enable_identity_service
description: (Optional) Enable the Identity Service component, which allows customers to use external identity providers with the K8S API.
varType: bool
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-autopilot-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@ Then perform the following commands on the root folder:
| deploy\_using\_private\_endpoint | A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | `bool` | `false` | no |
| description | The description of the cluster | `string` | `""` | no |
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
| disable\_l4\_lb\_firewall\_reconciliation | Disable L4 Load Balancer firewall reconciliation | `bool` | `null` | no |
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
Expand Down Expand Up @@ -227,7 +228,7 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
#### Terraform and Plugins

- [Terraform](https://www.terraform.io/downloads.html) 1.3+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.27+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.28+

#### gcloud

Expand Down
2 changes: 2 additions & 0 deletions modules/beta-autopilot-private-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,8 @@ resource "google_container_cluster" "primary" {

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting

disable_l4_lb_firewall_reconciliation = var.disable_l4_lb_firewall_reconciliation

enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy

dynamic "secret_manager_config" {
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-autopilot-private-cluster/metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,9 @@ spec:
disable_default_snat:
name: disable_default_snat
title: Disable Default Snat
disable_l4_lb_firewall_reconciliation:
name: disable_l4_lb_firewall_reconciliation
title: Disable L4 Lb Firewall Reconciliation
dns_allow_external_traffic:
name: dns_allow_external_traffic
title: Dns Allow External Traffic
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-autopilot-private-cluster/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -473,6 +473,9 @@ spec:
description: Enable L4 ILB Subsetting on the cluster
varType: bool
defaultValue: false
- name: disable_l4_lb_firewall_reconciliation
description: Disable L4 Load Balancer firewall reconciliation
varType: bool
- name: allow_net_admin
description: (Optional) Enable NET_ADMIN for the cluster.
varType: bool
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-autopilot-private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -604,6 +604,12 @@ variable "enable_l4_ilb_subsetting" {
default = false
}

variable "disable_l4_lb_firewall_reconciliation" {
type = bool
description = "Disable L4 Load Balancer firewall reconciliation"
default = null
}

variable "allow_net_admin" {
description = "(Optional) Enable NET_ADMIN for the cluster."
type = bool
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-autopilot-private-cluster/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-autopilot-public-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ Then perform the following commands on the root folder:
| deletion\_protection | Whether or not to allow Terraform to destroy the cluster. | `bool` | `true` | no |
| description | The description of the cluster | `string` | `""` | no |
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
| disable\_l4\_lb\_firewall\_reconciliation | Disable L4 Load Balancer firewall reconciliation | `bool` | `null` | no |
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `true` | no |
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
Expand Down Expand Up @@ -213,7 +214,7 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
#### Terraform and Plugins

- [Terraform](https://www.terraform.io/downloads.html) 1.3+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.27+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.28+

#### gcloud

Expand Down
2 changes: 2 additions & 0 deletions modules/beta-autopilot-public-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,8 @@ resource "google_container_cluster" "primary" {

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting

disable_l4_lb_firewall_reconciliation = var.disable_l4_lb_firewall_reconciliation

enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy

dynamic "secret_manager_config" {
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-autopilot-public-cluster/metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,9 @@ spec:
disable_default_snat:
name: disable_default_snat
title: Disable Default Snat
disable_l4_lb_firewall_reconciliation:
name: disable_l4_lb_firewall_reconciliation
title: Disable L4 Lb Firewall Reconciliation
dns_allow_external_traffic:
name: dns_allow_external_traffic
title: Dns Allow External Traffic
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-autopilot-public-cluster/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -451,6 +451,9 @@ spec:
description: Enable L4 ILB Subsetting on the cluster
varType: bool
defaultValue: false
- name: disable_l4_lb_firewall_reconciliation
description: Disable L4 Load Balancer firewall reconciliation
varType: bool
- name: allow_net_admin
description: (Optional) Enable NET_ADMIN for the cluster.
varType: bool
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-autopilot-public-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -568,6 +568,12 @@ variable "enable_l4_ilb_subsetting" {
default = false
}

variable "disable_l4_lb_firewall_reconciliation" {
type = bool
description = "Disable L4 Load Balancer firewall reconciliation"
default = null
}

variable "allow_net_admin" {
description = "(Optional) Enable NET_ADMIN for the cluster."
type = bool
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-autopilot-public-cluster/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,7 @@ Then perform the following commands on the root folder:
| deploy\_using\_private\_endpoint | A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | `bool` | `false` | no |
| description | The description of the cluster | `string` | `""` | no |
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
| disable\_l4\_lb\_firewall\_reconciliation | Disable L4 Load Balancer firewall reconciliation | `bool` | `null` | no |
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
Expand Down Expand Up @@ -469,7 +470,7 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
#### Terraform and Plugins

- [Terraform](https://www.terraform.io/downloads.html) 1.3+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.27+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.28+

#### gcloud

Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster-update-variant/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,8 @@ resource "google_container_cluster" "primary" {

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting

disable_l4_lb_firewall_reconciliation = var.disable_l4_lb_firewall_reconciliation

enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy

dynamic "secret_manager_config" {
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-private-cluster-update-variant/metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,9 @@ spec:
disable_default_snat:
name: disable_default_snat
title: Disable Default Snat
disable_l4_lb_firewall_reconciliation:
name: disable_l4_lb_firewall_reconciliation
title: Disable L4 Lb Firewall Reconciliation
disable_legacy_metadata_endpoints:
name: disable_legacy_metadata_endpoints
title: Disable Legacy Metadata Endpoints
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-private-cluster-update-variant/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -692,6 +692,9 @@ spec:
description: Enable L4 ILB Subsetting on the cluster
varType: bool
defaultValue: false
- name: disable_l4_lb_firewall_reconciliation
description: Disable L4 Load Balancer firewall reconciliation
varType: bool
- name: istio
description: (Beta) Enable Istio addon
varType: bool
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -923,6 +923,12 @@ variable "enable_l4_ilb_subsetting" {
default = false
}

variable "disable_l4_lb_firewall_reconciliation" {
type = bool
description = "Disable L4 Load Balancer firewall reconciliation"
default = null
}

variable "istio" {
description = "(Beta) Enable Istio addon"
type = bool
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-private-cluster-update-variant/versions.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ terraform {
required_providers {
google = {
source = "hashicorp/google"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
google-beta = {
source = "hashicorp/google-beta"
version = ">= 6.27.0, < 7"
version = ">= 6.28.0, < 7"
}
kubernetes = {
source = "hashicorp/kubernetes"
Expand Down
3 changes: 2 additions & 1 deletion modules/beta-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,7 @@ Then perform the following commands on the root folder:
| deploy\_using\_private\_endpoint | A toggle for Terraform and kubectl to connect to the master's internal IP address during deployment. | `bool` | `false` | no |
| description | The description of the cluster | `string` | `""` | no |
| disable\_default\_snat | Whether to disable the default SNAT to support the private use of public IP addresses | `bool` | `false` | no |
| disable\_l4\_lb\_firewall\_reconciliation | Disable L4 Load Balancer firewall reconciliation | `bool` | `null` | no |
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | `bool` | `true` | no |
| dns\_allow\_external\_traffic | (Optional) Controls whether external traffic is allowed over the dns endpoint. | `bool` | `null` | no |
| dns\_cache | The status of the NodeLocal DNSCache addon. | `bool` | `false` | no |
Expand Down Expand Up @@ -447,7 +448,7 @@ The [project factory](https://github.com/terraform-google-modules/terraform-goog
#### Terraform and Plugins

- [Terraform](https://www.terraform.io/downloads.html) 1.3+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.27+
- [Terraform Provider for GCP Beta][terraform-provider-google-beta] v6.28+

#### gcloud

Expand Down
2 changes: 2 additions & 0 deletions modules/beta-private-cluster/cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,6 +203,8 @@ resource "google_container_cluster" "primary" {

enable_l4_ilb_subsetting = var.enable_l4_ilb_subsetting

disable_l4_lb_firewall_reconciliation = var.disable_l4_lb_firewall_reconciliation

enable_cilium_clusterwide_network_policy = var.enable_cilium_clusterwide_network_policy

dynamic "secret_manager_config" {
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-private-cluster/metadata.display.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,9 @@ spec:
disable_default_snat:
name: disable_default_snat
title: Disable Default Snat
disable_l4_lb_firewall_reconciliation:
name: disable_l4_lb_firewall_reconciliation
title: Disable L4 Lb Firewall Reconciliation
disable_legacy_metadata_endpoints:
name: disable_legacy_metadata_endpoints
title: Disable Legacy Metadata Endpoints
Expand Down
3 changes: 3 additions & 0 deletions modules/beta-private-cluster/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -692,6 +692,9 @@ spec:
description: Enable L4 ILB Subsetting on the cluster
varType: bool
defaultValue: false
- name: disable_l4_lb_firewall_reconciliation
description: Disable L4 Load Balancer firewall reconciliation
varType: bool
- name: istio
description: (Beta) Enable Istio addon
varType: bool
Expand Down
6 changes: 6 additions & 0 deletions modules/beta-private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -923,6 +923,12 @@ variable "enable_l4_ilb_subsetting" {
default = false
}

variable "disable_l4_lb_firewall_reconciliation" {
type = bool
description = "Disable L4 Load Balancer firewall reconciliation"
default = null
}

variable "istio" {
description = "(Beta) Enable Istio addon"
type = bool
Expand Down
Loading