-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Only one flag for two unrelated additional firewall rules #880
Comments
If that's the case, might you want to manage all the rules outside the cluster anyways? It seems like in either case you'll end up with repeated rules for each cluster.
This makes sense.
We try to have sensible defaults and these are the default ingress ports. You can always override but I don't think we will change the defaults (what would we even choose for a new default?).
This seems reasonable, though I'd like to do it without a breaking change. In particular, I suggest we add an |
I have a central place in my networking module to manage firewall rules, but GKE itself also creates firewall rules. I like the idea that all GKE related firewall rules are created inside my GKE terraform module (which simply wraps this module). This helps with consistency, since the rules need a lot of inputs/outputs from GKE. It's true that I end up with repeated rules for each cluster anyway but that's acceptable. I don't want to have repeated
I'll add that.
Basically an empty list
I agree that a solution without a breaking change is favourable. I'm not sure if I understand your suggestion with the always correctly, but this might work:
|
Got it, yeah I'd prefer to provide sensible defaults.
Exactly, that's what I had in mind. A PR would be very welcome. |
I'm currently using the beta-private-cluster module and I've installed Istio. I need to open the port
15017
from the GCP managed control-plane to my nodes and pods.The module has the property
firewall_inbound_ports
with the default values["8443", "9443", "15017"]
. I made use of this property, but nothing changes. After reading the TF code, I figured out that I need to setadd_cluster_firewall_rules
totrue
, so my configured inbound ports would be opened.The
add_cluster_firewall_rules
not only controls thefirewall_inbound_ports
, but also adds the resourcegoogle_compute_firewall.intra_egress
, even if I don't want those firewall rules to be applied. They don't do any harm, but I have a shared networking project with many clusters attached and I'd like to keep the firewall rules to an absolute minimum.Proposals:
firewall_inbound_ports
thatadd_cluster_firewall_rules
must be setfirewall_inbound_ports
. In my case I only need one of those ports, so I can overwrite the defaults. But I don't see a reason why a default setting should open more ports than necessary.google_compute_firewall.master_webhooks
andgoogle_compute_firewall.intra_egress
google_compute_firewall.master_webhooks
could only be applied iflength(var.firewall_inbound_ports) > 0
, making an additional flag obsolete. If there are no ports to be opened, there's no need for the firewall rule.firewall_inbound_ports
this would always be applied, adding rules for users that haven't had them before.firewall_inbound_ports
, the firewall rule would be removed for users that relied on the default valuesThe text was updated successfully, but these errors were encountered: