Skip to content

Commit 75de0c7

Browse files
aaron-laneaaron-lane
committed
Simplify variable interface and disable by deafult
1 parent 10282ad commit 75de0c7

18 files changed

+75
-96
lines changed

‎CHANGELOG.md

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@ Extending the adopted spec, each change should have a link to its corresponding
1212

1313
### Added
1414

15-
* Add `enable_basic_auth` set to `true` by default. This will cause a
16-
plan change for existing users. Enabling it will require them to set
17-
a username and password. [#40]
1815
* Add `basic_auth_username` set to `""` by default. [#40]
1916
* Add `basic_auth_password` set to `""` by default. [#40]
2017
* Add `issue_client_certificate` set to `false` by default. [#40]
@@ -23,7 +20,8 @@ Extending the adopted spec, each change should have a link to its corresponding
2320

2421
* The `service_account` variable defaults to `"create"` which causes a
2522
cluster-specific service account to be created.
26-
23+
* Disabled Basic Authentication by default. [#40]
24+
2725
## [v1.0.1] - 2019-04-04
2826

2927
### Added

‎README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,10 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
106106

107107
| Name | Description | Type | Default | Required |
108108
|------|-------------|:----:|:-----:|:-----:|
109-
| basic\_auth\_password | Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true | string | `""` | no |
110-
| basic\_auth\_username | Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true | string | `""` | no |
109+
| basic\_auth\_password | The password to be used with Basic Authentication. | string | `""` | no |
110+
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string | `""` | no |
111111
| description | The description of the cluster | string | `""` | no |
112112
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
113-
| enable\_basic\_auth | Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials | string | `"false"` | no |
114113
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |
115114
| http\_load\_balancing | Enable httpload balancer addon | string | `"true"` | no |
116115
| ip\_masq\_link\_local | Whether to masquerade traffic to the link-local prefix (169.254.0.0/16). | string | `"false"` | no |

‎autogen/cluster_regional.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎autogen/cluster_zonal.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "zonal_primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎autogen/main.tf

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,6 @@ locals {
145145
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
146146
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
147147
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
148-
149-
cluster_basic_auth_username = "${var.enable_basic_auth ? var.basic_auth_username : ""}"
150-
cluster_basic_auth_password = "${var.enable_basic_auth ? var.basic_auth_password : ""}"
151148
}
152149

153150
/******************************************

‎autogen/variables.tf

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -234,18 +234,13 @@ variable "master_ipv4_cidr_block" {
234234
}
235235
{% endif %}
236236

237-
variable "enable_basic_auth" {
238-
description = "Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials"
239-
default = "false"
240-
}
241-
242237
variable "basic_auth_username" {
243-
description = "Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true"
238+
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
244239
default = ""
245240
}
246241

247242
variable "basic_auth_password" {
248-
description = "Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true"
243+
description = "The password to be used with Basic Authentication."
249244
default = ""
250245
}
251246

‎cluster_regional.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎cluster_zonal.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "zonal_primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎docs/upgrading_to_v1.0.md

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎docs/upgrading_to_v2.0.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,44 @@ module "kubernetes_engine" {
4141
service_account = "${module.project_factory.service_account_email}"
4242
}
4343
```
44+
45+
### Enabling Kubernetes Basic Authentication
46+
47+
Starting with GKE v1.12, clusters will have Basic Authentication and
48+
client certificate issuance disabled by default. In previous versions
49+
of *kubernetes-engine*, Basic Authentication was enabled and configured with the username `"admin"` and an automatically generated password. Basic Authentication is now disabled by default and requires credentials to be provided to remain enabled.
50+
51+
Using Basic Authentication causes Terraform to store the credentials in
52+
a state file. It is important to use a Terraform Backend which supports encryption at rest, like the [GCS Backend][gcs-backend]. The
53+
[Sensitive Data in State article][sensitive-data] provides more context
54+
and recommendations on how to handle scenarios like this.
55+
56+
```hcl
57+
terraform {
58+
backend "gcs" {
59+
bucket = "terraform-state"
60+
}
61+
}
62+
63+
module "enabling-basic-auth" {
64+
source = "terraform-google-modules/kubernetes-engine/google"
65+
version = "~> 2.0"
66+
67+
project_id = "${var.project_id}"
68+
name = "cluster-with-basic-auth"
69+
70+
basic_auth_username = "admin"
71+
basic_auth_password = "s3crets!"
72+
73+
regional = "true"
74+
region = "${var.region}"
75+
network = "${var.network}"
76+
subnetwork = "${var.subnetwork}"
77+
ip_range_pods = "${var.ip_range_pods}"
78+
ip_range_services = "${var.ip_range_services}"
79+
service_account = "${var.compute_engine_service_account}"
80+
}
81+
```
82+
83+
[gsc-backend]: https://www.terraform.io/docs/backends/types/gcs.html
84+
[sensitive-data]: https://www.terraform.io/docs/state/sensitive-data.html

‎examples/disable_client_cert/main.tf

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,17 @@ provider "google" {
2424
}
2525

2626
module "gke" {
27-
source = "../../"
28-
project_id = "${var.project_id}"
29-
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
30-
region = "${var.region}"
31-
network = "${var.network}"
32-
network_project_id = "${var.network_project_id}"
33-
subnetwork = "${var.subnetwork}"
34-
ip_range_pods = "${var.ip_range_pods}"
35-
ip_range_services = "${var.ip_range_services}"
36-
service_account = "${var.compute_engine_service_account}"
27+
source = "../../"
3728

38-
enable_basic_auth = false
29+
project_id = "${var.project_id}"
30+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
31+
region = "${var.region}"
32+
network = "${var.network}"
33+
network_project_id = "${var.network_project_id}"
34+
subnetwork = "${var.subnetwork}"
35+
ip_range_pods = "${var.ip_range_pods}"
36+
ip_range_services = "${var.ip_range_services}"
37+
service_account = "${var.compute_engine_service_account}"
3938
issue_client_certificate = false
4039
}
4140

‎main.tf

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,6 @@ locals {
145145
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
146146
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
147147
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
148-
149-
cluster_basic_auth_username = "${var.enable_basic_auth ? var.basic_auth_username : ""}"
150-
cluster_basic_auth_password = "${var.enable_basic_auth ? var.basic_auth_password : ""}"
151148
}
152149

153150
/******************************************

‎modules/private-cluster/README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,11 +111,10 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
111111

112112
| Name | Description | Type | Default | Required |
113113
|------|-------------|:----:|:-----:|:-----:|
114-
| basic\_auth\_password | Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true | string | `""` | no |
115-
| basic\_auth\_username | Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true | string | `""` | no |
114+
| basic\_auth\_password | The password to be used with Basic Authentication. | string | `""` | no |
115+
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string | `""` | no |
116116
| description | The description of the cluster | string | `""` | no |
117117
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
118-
| enable\_basic\_auth | Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials | string | `"false"` | no |
119118
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | string | `"false"` | no |
120119
| enable\_private\_nodes | (Beta) Whether nodes have internal IP addresses only | string | `"false"` | no |
121120
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |

‎modules/private-cluster/cluster_regional.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎modules/private-cluster/cluster_zonal.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,8 +39,8 @@ resource "google_container_cluster" "zonal_primary" {
3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

4141
master_auth {
42-
username = "${local.cluster_basic_auth_username}"
43-
password = "${local.cluster_basic_auth_password}"
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
4444

4545
client_certificate_config {
4646
issue_client_certificate = "${var.issue_client_certificate}"

‎modules/private-cluster/main.tf

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,9 +145,6 @@ locals {
145145
cluster_http_load_balancing_enabled = "${local.cluster_type_output_http_load_balancing_enabled[local.cluster_type] ? false : true}"
146146
cluster_horizontal_pod_autoscaling_enabled = "${local.cluster_type_output_horizontal_pod_autoscaling_enabled[local.cluster_type] ? false : true}"
147147
cluster_kubernetes_dashboard_enabled = "${local.cluster_type_output_kubernetes_dashboard_enabled[local.cluster_type] ? false : true}"
148-
149-
cluster_basic_auth_username = "${var.enable_basic_auth ? var.basic_auth_username : ""}"
150-
cluster_basic_auth_password = "${var.enable_basic_auth ? var.basic_auth_password : ""}"
151148
}
152149

153150
/******************************************

‎modules/private-cluster/variables.tf

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -232,18 +232,13 @@ variable "master_ipv4_cidr_block" {
232232
default = "10.0.0.0/28"
233233
}
234234

235-
variable "enable_basic_auth" {
236-
description = "Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials"
237-
default = "false"
238-
}
239-
240235
variable "basic_auth_username" {
241-
description = "Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true"
236+
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
242237
default = ""
243238
}
244239

245240
variable "basic_auth_password" {
246-
description = "Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true"
241+
description = "The password to be used with Basic Authentication."
247242
default = ""
248243
}
249244

‎variables.tf

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -217,18 +217,13 @@ variable "service_account" {
217217
default = "create"
218218
}
219219

220-
variable "enable_basic_auth" {
221-
description = "Basic authentication allows a user to authenticate to the cluster with a username and password. To maximize the security of your cluster, disable this option. Basic authentication is not recommended because it provides no confidentiality protection for transmitted credentials"
222-
default = "false"
223-
}
224-
225220
variable "basic_auth_username" {
226-
description = "Kubernetes HTTP Basic auth username. Only used if `enable_basic_auth` is true"
221+
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
227222
default = ""
228223
}
229224

230225
variable "basic_auth_password" {
231-
description = "Kubernetes HTTP Basic auth password. Only used if `enable_basic_auth` is true"
226+
description = "The password to be used with Basic Authentication."
232227
default = ""
233228
}
234229

0 commit comments

Comments
 (0)