Restrict node access to cluster metadata service

[dmyerscough]

I was recently had my private GKE cluster pen test and one of the issues that were reported by this test was POD's had access the metadata service which exposes sensitive data:-

# curl -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/attributes/kube-env'
ALLOCATE_NODE_CIDRS: "true"                                                                                                                                            API_SERVER_TEST_LOG_LEVEL: --v=3
...
...
KUBE_PROXY_TOKEN: h9gjoyXnyaB2MDnBeOPmJG3OEJ0zS7GKXtU-9xMJRTw=
KUBELET_CERT: XXXXXXXXXX
KUBELET_KEY: XXXXXXXXX
KUBERNETES_MASTER: "false"
KUBERNETES_MASTER_NAME: 10.17.5.2
LOGGING_DESTINATION: gcp
...
...

By default, GKE clusters expose "UNSPECIFIED". However, you can switch this off by setting node_metadata to "SECURE".

$ curl -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/attributes/kube-env'
This metadata endpoint is concealed.

$ curl -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/attributes/disable-legacy-endpoints'
false

This PR will allow the clusters to move along as normal but will give anyone the ability to shut off metadata service by specifying "SECURE" instead of the default "UNSPECIFIED".

I have tested this on our internal zonal cluster and it worked as expected.

[dmyerscough]

@morgante @aaron-lane would you be able to review the above change?

[morgante]

Thanks for the contribution. Instead of directly editing the files, can you update the autogen templates (https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/blob/master/autogen/cluster_regional.tf#L104) and then generate the modules from it?

[dmyerscough]

Yeah, I can update that shortly.

[morgante]

Thanks for the contribution! Looks like workload_metadata_config is only available in beta so we will have to wait for the beta submodules with #124.

[aaron-lane]

@dmyerscough #124 has been merged. There are now submodules specifically for public and private clusters with beta features enabled, and templating logic to support that. Are you available to update this branch accordingly?

[aaron-lane]

Superseded by #203.