You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm not able to directly use this module at my current job unfortunately, but I have used it for reference in creating the internal module. I implemented the webhook firewall rule as it was shown in this module but after it was created my nginx ingress webhook would not work.
I realized it needs to target the master cidr block (the whole /28 range), not the primary endpoint as a cidr block.
Previously I didn't know about the autogen feature of this repo. After looking more into it, I see that this difference in cluster_endpoint_for_nodes between the public and private cluster was explicitly added in #470. It is nothing that creeped in over time.
Any idea what was the reason that it was implemented like this?
I don't recall a particular reason for this separation, switching to cluster_endpoint_for_nodes = var.master_ipv4_cidr_block for everything makes sense.
Public GKE clusters do not have --master-ipv4-cidr as an argument or property and as such var.master_ipv4_cidr_block is a variable that is only available on private cluster configurations.
The code is correct.
Private Clusters
...
--master-ipv4-cidr=MASTER_IPV4_CIDR
IPv4 CIDR range to use for the master network. This should have a
netmask of size /28 and should be used in conjunction with the
--enable-private-nodes flag.
@dkpat12 likely copied the firewall rule from the root module firewall.tf, but when running a a private cluster it should have been copied from one of the private cluster submodules.
Hi team!
I'm not able to directly use this module at my current job unfortunately, but I have used it for reference in creating the internal module. I implemented the webhook firewall rule as it was shown in this module but after it was created my nginx ingress webhook would not work.
I realized it needs to target the master cidr block (the whole /28 range), not the primary endpoint as a cidr block.
terraform-google-kubernetes-engine/firewall.tf
Line 72 in e853cdd
The text was updated successfully, but these errors were encountered: