Skip to content

Commit 20d9450

Browse files
aaron-laneaaron-lane
committed
Simplify variable interface and disable by deafult
1 parent 7a249a1 commit 20d9450

18 files changed

+77
-95
lines changed

‎CHANGELOG.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,14 @@ Extending the adopted spec, each change should have a link to its corresponding
1212

1313
### Added
1414

15-
* Add `enable_basic_auth` set to `true` by default. This will cause a
16-
plan change for existing users. Enabling it will require them to set
17-
a username and password. [#40]
1815
* Add `basic_auth_username` set to `""` by default. [#40]
1916
* Add `basic_auth_password` set to `""` by default. [#40]
2017
* Add `issue_client_certificate` set to `false` by default. [#40]
2118

19+
### Changed
20+
21+
* Disabled Basic Authentication by default. [#40]
22+
2223
## [v1.0.1] - 2019-04-04
2324

2425
### Added

‎README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,10 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
106106

107107
| Name | Description | Type | Default | Required |
108108
|------|-------------|:----:|:-----:|:-----:|
109-
| basic\_auth\_password | Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true | string | `""` | no |
110-
| basic\_auth\_username | Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true | string | `""` | no |
109+
| basic\_auth\_password | The password to be used with Basic Authentication. | string | `""` | no |
110+
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string | `""` | no |
111111
| description | The description of the cluster | string | `""` | no |
112112
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
113-
| enable\_basic\_auth | Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials | string | `"false"` | no |
114113
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |
115114
| http\_load\_balancing | Enable httpload balancer addon | string | `"true"` | no |
116115
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | string | `"false"` | no |

‎autogen/cluster_regional.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎autogen/cluster_zonal.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "zonal_primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎autogen/main.tf

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,6 @@ locals {
145145
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
146146
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
147147
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
148-
149-
cluster_basic_auth_username = "${var.enable_basic_auth ? var.basic_auth_username : ""}"
150-
cluster_basic_auth_password = "${var.enable_basic_auth ? var.basic_auth_password : ""}"
151148
}
152149

153150
/******************************************

‎autogen/variables.tf

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -234,18 +234,13 @@ variable "master_ipv4_cidr_block" {
234234
}
235235
{% endif %}
236236

237-
variable "enable_basic_auth" {
238-
description = "Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials"
239-
default = "false"
240-
}
241-
242237
variable "basic_auth_username" {
243-
description = "Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true"
238+
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
244239
default = ""
245240
}
246241

247242
variable "basic_auth_password" {
248-
description = "Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true"
243+
description = "The password to be used with Basic Authentication."
249244
default = ""
250245
}
251246

‎cluster_regional.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎cluster_zonal.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "zonal_primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎docs/upgrading_to_v1.0.md

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎docs/upgrading_to_v2.0.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,44 @@ The v2.0 release of *kubernetes-engine* is a backwards incompatible
44
release.
55

66
## Migration Instructions
7+
8+
### Enabling Kubernetes Basic Authentication
9+
10+
Starting with GKE v1.12, clusters will have Basic Authentication and
11+
client certificate issuance disabled by default. In previous versions
12+
of *kubernetes-engine*, Basic Authentication was enabled and configured with the username `"admin"` and an automatically generated password. Basic Authentication is now disabled by default and requires credentials to be provided to remain enabled.
13+
14+
Using Basic Authentication causes Terraform to store the credentials in
15+
a state file. It is important to use a Terraform Backend which supports encryption at rest, like the [GCS Backend][gcs-backend]. The
16+
[Sensitive Data in State article][sensitive-data] provides more context
17+
and recommendations on how to handle scenarios like this.
18+
19+
```hcl
20+
terraform {
21+
backend "gcs" {
22+
bucket = "terraform-state"
23+
}
24+
}
25+
26+
module "enabling-basic-auth" {
27+
source = "terraform-google-modules/kubernetes-engine/google"
28+
version = "~> 2.0"
29+
30+
project_id = "${var.project_id}"
31+
name = "cluster-with-basic-auth"
32+
33+
basic_auth_username = "admin"
34+
basic_auth_password = "s3crets!"
35+
36+
regional = "true"
37+
region = "${var.region}"
38+
network = "${var.network}"
39+
subnetwork = "${var.subnetwork}"
40+
ip_range_pods = "${var.ip_range_pods}"
41+
ip_range_services = "${var.ip_range_services}"
42+
service_account = "${var.compute_engine_service_account}"
43+
}
44+
```
45+
46+
[gsc-backend]: https://www.terraform.io/docs/backends/types/gcs.html
47+
[sensitive-data]: https://www.terraform.io/docs/state/sensitive-data.html

‎examples/disable_client_cert/main.tf

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,17 @@ provider "google" {
2424
}
2525

2626
module "gke" {
27-
source = "../../"
28-
project_id = "${var.project_id}"
29-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30-
region = "${var.region}"
31-
network = "${var.network}"
32-
network_project_id = "${var.network_project_id}"
33-
subnetwork = "${var.subnetwork}"
34-
ip_range_pods = "${var.ip_range_pods}"
35-
ip_range_services = "${var.ip_range_services}"
36-
service_account = "${var.compute_engine_service_account}"
27+
source = "../../"
3728

38-
enable_basic_auth = false
29+
project_id = "${var.project_id}"
30+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
31+
region = "${var.region}"
32+
network = "${var.network}"
33+
network_project_id = "${var.network_project_id}"
34+
subnetwork = "${var.subnetwork}"
35+
ip_range_pods = "${var.ip_range_pods}"
36+
ip_range_services = "${var.ip_range_services}"
37+
service_account = "${var.compute_engine_service_account}"
3938
issue_client_certificate = false
4039
}
4140

‎main.tf

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,6 @@ locals {
145145
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
146146
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
147147
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
148-
149-
cluster_basic_auth_username = "${var.enable_basic_auth ? var.basic_auth_username : ""}"
150-
cluster_basic_auth_password = "${var.enable_basic_auth ? var.basic_auth_password : ""}"
151148
}
152149

153150
/******************************************

‎modules/private-cluster/README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,11 +111,10 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
111111

112112
| Name | Description | Type | Default | Required |
113113
|------|-------------|:----:|:-----:|:-----:|
114-
| basic\_auth\_password | Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true | string | `""` | no |
115-
| basic\_auth\_username | Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true | string | `""` | no |
114+
| basic\_auth\_password | The password to be used with Basic Authentication. | string | `""` | no |
115+
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string | `""` | no |
116116
| description | The description of the cluster | string | `""` | no |
117117
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
118-
| enable\_basic\_auth | Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials | string | `"false"` | no |
119118
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | string | `"false"` | no |
120119
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | string | `"false"` | no |
121120
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |

‎modules/private-cluster/cluster_regional.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎modules/private-cluster/cluster_zonal.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "zonal_primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎modules/private-cluster/main.tf

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,6 @@ locals {
145145
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
146146
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
147147
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
148-
149-
cluster_basic_auth_username = "${var.enable_basic_auth ? var.basic_auth_username : ""}"
150-
cluster_basic_auth_password = "${var.enable_basic_auth ? var.basic_auth_password : ""}"
151148
}
152149

153150
/******************************************

‎modules/private-cluster/variables.tf

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -232,18 +232,13 @@ variable "master_ipv4_cidr_block" {
232232
default = "10.0.0.0/28"
233233
}
234234

235-
variable "enable_basic_auth" {
236-
description = "Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials"
237-
default = "false"
238-
}
239-
240235
variable "basic_auth_username" {
241-
description = "Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true"
236+
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
242237
default = ""
243238
}
244239

245240
variable "basic_auth_password" {
246-
description = "Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true"
241+
description = "The password to be used with Basic Authentication."
247242
default = ""
248243
}
249244

‎variables.tf

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -217,18 +217,13 @@ variable "service_account" {
217217
default = ""
218218
}
219219

220-
variable "enable_basic_auth" {
221-
description = "Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials"
222-
default = "false"
223-
}
224-
225220
variable "basic_auth_username" {
226-
description = "Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true"
221+
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
227222
default = ""
228223
}
229224

230225
variable "basic_auth_password" {
231-
description = "Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true"
226+
description = "The password to be used with Basic Authentication."
232227
default = ""
233228
}
234229

0 commit comments

Comments
 (0)