-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for disabling basic auth & client certificate #37
Comments
Yes, I think it's a good idea to add this. Do you think we would want it as a default? |
So I looked into this a few notes/questions: Our best practices guide says to name variables in the positive. Defaulting to disabled basic auth ( So:
Disabling client certificates is a destructive change. My assumption is we should name this in the positive and enable it by default. This is a catch-22 since its destructive to change. If we enable client certs by default, its not destructive to current users, but opts new users into a bad practice with the chance of being destructive if they did not notice the variable. If we disable it by default, its destructive to current users, but sets the module up for best practices. It may also be worth noting, to set the certificate explicitly, its a nested setting that also requires the username and password be set. So its technically not possible to make this non-breaking for current users, because as soon as the certificate setting is set, the username and password has to be as well. For setting basic auth, which do you prefer? enable_basic_auth = true
basic_auth_username = "xxx"
basic_auth_password = "xxx" basic_auth {
username = "xxx"
password = "yyy"
} The later would assume if the map is empty, it is disabled. |
Also, as per the docs it does seem to be possible to enable cluster cert but disable basic auth so we need to support that scenario: https://www.terraform.io/docs/providers/google/r/container_cluster.html#client_certificate_config |
Yep, I got that support in my first pass! Thanks for the input, sounds like a good approach to me. |
Fixed by #40. |
There isn't currently a way to disable basic authentication and the creation of a client certificate at cluster creation time. It looks like both of these can be accomplished by setting a
master_auth
config.https://www.terraform.io/docs/providers/google/r/container_cluster.html#master_auth
The text was updated successfully, but these errors were encountered: