Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix: Change default value of network_policy variable to false #809

Merged
merged 9 commits into from
Feb 26, 2021
Merged

Fix: Change default value of network_policy variable to false #809

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
92284f8
fix: Change default value of network_policy variable to false
JeremyKeusters Feb 3, 2021
a7cbd48
fix: Set network_policy variable to false in the README usage example
JeremyKeusters Feb 3, 2021
29e5e09
Merge branch 'master' into fix/disable-network-policy-by-default
bharathkkb Feb 5, 2021
bdb2639
Merge branch 'master' into fix/disable-network-policy-by-default
bharathkkb Feb 24, 2021
1a95162
Merge branch 'master' into fix/disable-network-policy-by-default
morgante Feb 24, 2021
894dae3
Merge branch 'master' into fix/disable-network-policy-by-default
Feb 25, 2021
904aa53
Add documentation on network_policy disabled by default
JeremyKeusters Feb 25, 2021
dd38d1d
Improve documentation on network_policy disabled by default
JeremyKeusters Feb 25, 2021
ced1696
Remove trailing whitespaces
JeremyKeusters Feb 26, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ module "gke" {
ip_range_services = "us-central1-01-gke-01-services"
http_load_balancing = false
horizontal_pod_autoscaling = true
network_policy = true
network_policy = false

node_pools = [
{
Expand Down Expand Up @@ -164,7 +164,7 @@ Then perform the following commands on the root folder:
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
| name | The name of the cluster (required) | `string` | n/a | yes |
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
| network\_policy | Enable network policy addon | `bool` | `true` | no |
| network\_policy | Enable network policy addon | `bool` | `false` | no |
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |
Expand Down
2 changes: 1 addition & 1 deletion autogen/main/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ module "gke" {
ip_range_services = "us-central1-01-gke-01-services"
http_load_balancing = false
horizontal_pod_autoscaling = true
network_policy = true
network_policy = false
{% if private_cluster %}
enable_private_endpoint = true
enable_private_nodes = true
Expand Down
2 changes: 1 addition & 1 deletion autogen/main/variables.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ variable "http_load_balancing" {
variable "network_policy" {
type = bool
description = "Enable network policy addon"
default = true
default = false
}

variable "network_policy_provider" {
Expand Down
14 changes: 14 additions & 0 deletions docs/upgrading_to_v14.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,20 @@ The `registry_project_id` variable has been replaced with a `registry_project_id
}
```

### network_policy disabled by default
The `network_policy` variable is now `false` by default (instead of `true`).
If you want to keep using the network policy addon for your cluster, make
sure that the `network_policy` variable is set to `true`:
```diff
module "gke" {
source = "terraform-google-modules/kubernetes-engine/google"
- version = "~> 13.0"
+ version = "~> 14.0"

+ network_policy = true
}
```

### ASM default version changed to 1.8

[ASM submodule](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/tree/master/modules/asm) has been changed to use ASM v1.8 as default.
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ module "gke" {
ip_range_services = "us-central1-01-gke-01-services"
http_load_balancing = false
horizontal_pod_autoscaling = true
network_policy = true
network_policy = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
Expand Down Expand Up @@ -217,7 +217,7 @@ Then perform the following commands on the root folder:
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
| name | The name of the cluster (required) | `string` | n/a | yes |
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
| network\_policy | Enable network policy addon | `bool` | `true` | no |
| network\_policy | Enable network policy addon | `bool` | `false` | no |
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ variable "http_load_balancing" {
variable "network_policy" {
type = bool
description = "Enable network policy addon"
default = true
default = false
}

variable "network_policy_provider" {
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ module "gke" {
ip_range_services = "us-central1-01-gke-01-services"
http_load_balancing = false
horizontal_pod_autoscaling = true
network_policy = true
network_policy = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
Expand Down Expand Up @@ -195,7 +195,7 @@ Then perform the following commands on the root folder:
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
| name | The name of the cluster (required) | `string` | n/a | yes |
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
| network\_policy | Enable network policy addon | `bool` | `true` | no |
| network\_policy | Enable network policy addon | `bool` | `false` | no |
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ variable "http_load_balancing" {
variable "network_policy" {
type = bool
description = "Enable network policy addon"
default = true
default = false
}

variable "network_policy_provider" {
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-public-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ module "gke" {
ip_range_services = "us-central1-01-gke-01-services"
http_load_balancing = false
horizontal_pod_autoscaling = true
network_policy = true
network_policy = false
istio = true
cloudrun = true
dns_cache = false
Expand Down Expand Up @@ -206,7 +206,7 @@ Then perform the following commands on the root folder:
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
| name | The name of the cluster (required) | `string` | n/a | yes |
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
| network\_policy | Enable network policy addon | `bool` | `true` | no |
| network\_policy | Enable network policy addon | `bool` | `false` | no |
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ variable "http_load_balancing" {
variable "network_policy" {
type = bool
description = "Enable network policy addon"
default = true
default = false
}

variable "network_policy_provider" {
Expand Down
4 changes: 2 additions & 2 deletions modules/beta-public-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ module "gke" {
ip_range_services = "us-central1-01-gke-01-services"
http_load_balancing = false
horizontal_pod_autoscaling = true
network_policy = true
network_policy = false
istio = true
cloudrun = true
dns_cache = false
Expand Down Expand Up @@ -184,7 +184,7 @@ Then perform the following commands on the root folder:
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
| name | The name of the cluster (required) | `string` | n/a | yes |
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
| network\_policy | Enable network policy addon | `bool` | `true` | no |
| network\_policy | Enable network policy addon | `bool` | `false` | no |
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/beta-public-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ variable "http_load_balancing" {
variable "network_policy" {
type = bool
description = "Enable network policy addon"
default = true
default = false
}

variable "network_policy_provider" {
Expand Down
4 changes: 2 additions & 2 deletions modules/private-cluster-update-variant/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ module "gke" {
ip_range_services = "us-central1-01-gke-01-services"
http_load_balancing = false
horizontal_pod_autoscaling = true
network_policy = true
network_policy = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
Expand Down Expand Up @@ -196,7 +196,7 @@ Then perform the following commands on the root folder:
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
| name | The name of the cluster (required) | `string` | n/a | yes |
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
| network\_policy | Enable network policy addon | `bool` | `true` | no |
| network\_policy | Enable network policy addon | `bool` | `false` | no |
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster-update-variant/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ variable "http_load_balancing" {
variable "network_policy" {
type = bool
description = "Enable network policy addon"
default = true
default = false
}

variable "network_policy_provider" {
Expand Down
4 changes: 2 additions & 2 deletions modules/private-cluster/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ module "gke" {
ip_range_services = "us-central1-01-gke-01-services"
http_load_balancing = false
horizontal_pod_autoscaling = true
network_policy = true
network_policy = false
enable_private_endpoint = true
enable_private_nodes = true
master_ipv4_cidr_block = "10.0.0.0/28"
Expand Down Expand Up @@ -174,7 +174,7 @@ Then perform the following commands on the root folder:
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
| name | The name of the cluster (required) | `string` | n/a | yes |
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
| network\_policy | Enable network policy addon | `bool` | `true` | no |
| network\_policy | Enable network policy addon | `bool` | `false` | no |
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |
Expand Down
2 changes: 1 addition & 1 deletion modules/private-cluster/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ variable "http_load_balancing" {
variable "network_policy" {
type = bool
description = "Enable network policy addon"
default = true
default = false
}

variable "network_policy_provider" {
Expand Down
4 changes: 3 additions & 1 deletion test/integration/beta_cluster/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,9 @@
},
"kalmConfig" => {},
"configConnectorConfig" => {},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
"istioConfig" => {"auth"=>"AUTH_MUTUAL_TLS"},
"cloudRunConfig" => including(
"loadBalancerType" => "LOAD_BALANCER_TYPE_EXTERNAL",
Expand Down
4 changes: 3 additions & 1 deletion test/integration/private_zonal_with_networking/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/sandbox_enabled/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/simple_regional/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end

Expand Down
4 changes: 3 additions & 1 deletion test/integration/simple_regional_private/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/simple_regional_with_kubeconfig/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/simple_regional_with_networking/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/simple_zonal/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/simple_zonal_private/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/stub_domains/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/stub_domains_private/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/stub_domains_upstream_nameservers/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
4 changes: 3 additions & 1 deletion test/integration/upstream_nameservers/controls/gcloud.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@
"kubernetesDashboard" => {
"disabled" => true,
},
"networkPolicyConfig" => {},
"networkPolicyConfig" => {
"disabled" => true,
},
)
end
end
Expand Down
2 changes: 1 addition & 1 deletion variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ variable "http_load_balancing" {
variable "network_policy" {
type = bool
description = "Enable network policy addon"
default = true
default = false
}

variable "network_policy_provider" {
Expand Down