Skip to content

Commit 8913ef2

Browse files
bgvdiscordbgvdiscord
authored
feat: mesh_certificates support (#1712)
1 parent 2f5a276 commit 8913ef2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+298
-5
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ Then perform the following commands on the root folder:
154154
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
155155
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
156156
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
157+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
157158
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
158159
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
159160
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no |
@@ -237,6 +238,7 @@ Then perform the following commands on the root folder:
237238
| logging\_service | Logging service used |
238239
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
239240
| master\_version | Current master kubernetes version |
241+
| mesh\_certificates\_config | Mesh certificates configuration |
240242
| min\_master\_version | Minimum master kubernetes version |
241243
| monitoring\_service | Monitoring service used |
242244
| name | Cluster name |

‎autogen/main/cluster.tf.tmpl

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -517,6 +517,16 @@ resource "google_container_cluster" "primary" {
517517
}
518518
{% endif %}
519519

520+
{% if autopilot_cluster != true %}
521+
dynamic "mesh_certificates" {
522+
for_each = local.cluster_mesh_certificates_config
523+
524+
content {
525+
enable_certificates = mesh_certificates.value.enable_certificates
526+
}
527+
}
528+
{% endif %}
529+
520530
dynamic "authenticator_groups_config" {
521531
for_each = local.cluster_authenticator_security_group
522532
content {

‎autogen/main/main.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,12 @@ locals {
219219
cluster_workload_identity_config = ! local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
220220
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
221221
}]
222+
{% if autopilot_cluster != true %}
223+
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
224+
enable_certificates = var.enable_mesh_certificates
225+
}] : []
226+
{% endif %}
227+
222228
{% if beta_cluster %}
223229
# BETA features
224230
cluster_istio_enabled = ! local.cluster_output_istio_disabled

‎autogen/main/outputs.tf.tmpl

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,17 @@ output "identity_namespace" {
170170
google_container_cluster.primary
171171
]
172172
}
173+
174+
{% if autopilot_cluster != true %}
175+
output "mesh_certificates_config" {
176+
description = "Mesh certificates configuration"
177+
value = local.cluster_mesh_certificates_config
178+
depends_on = [
179+
google_container_cluster.primary
180+
]
181+
}
182+
{% endif %}
183+
173184
{% if private_cluster %}
174185

175186
output "master_ipv4_cidr_block" {

‎autogen/main/variables.tf.tmpl

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,14 @@ variable "identity_namespace" {
466466
default = "enabled"
467467
}
468468

469+
{% if autopilot_cluster != true %}
470+
variable "enable_mesh_certificates" {
471+
type = bool
472+
default = false
473+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
474+
}
475+
{% endif %}
476+
469477
variable "release_channel" {
470478
type = string
471479
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -763,7 +771,6 @@ variable "enable_pod_security_policy" {
763771
default = false
764772
}
765773

766-
767774
variable "enable_l4_ilb_subsetting" {
768775
type = bool
769776
description = "Enable L4 ILB Subsetting on the cluster"

‎autogen/safer-cluster/main.tf.tmpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,9 @@ module "gke" {
185185
// We enable Workload Identity by default.
186186
identity_namespace = "${var.project_id}.svc.id.goog"
187187

188+
// Enabling mesh certificates requires Workload Identity
189+
enable_mesh_certificates = var.enable_mesh_certificates
190+
188191
authenticator_security_group = var.authenticator_security_group
189192

190193
enable_shielded_nodes = var.enable_shielded_nodes

‎autogen/safer-cluster/outputs.tf.tmpl

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,3 +122,8 @@ output "peering_name" {
122122
description = "The name of the peering between this cluster and the Google owned VPC."
123123
value = module.gke.peering_name
124124
}
125+
126+
output "enable_mesh_certificates" {
127+
description = "Mesh certificate configuration value"
128+
value = var.enable_mesh_certificates
129+
}

‎autogen/safer-cluster/variables.tf.tmpl

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -484,3 +484,9 @@ variable "timeouts" {
484484
error_message = "Only create, update, delete timeouts can be specified."
485485
}
486486
}
487+
488+
variable "enable_mesh_certificates" {
489+
type = bool
490+
default = false
491+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
492+
}

‎cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,14 @@ resource "google_container_cluster" "primary" {
359359
}
360360
}
361361

362+
dynamic "mesh_certificates" {
363+
for_each = local.cluster_mesh_certificates_config
364+
365+
content {
366+
enable_certificates = mesh_certificates.value.enable_certificates
367+
}
368+
}
369+
362370
dynamic "authenticator_groups_config" {
363371
for_each = local.cluster_authenticator_security_group
364372
content {

‎main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,10 @@ locals {
162162
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
163163
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
164164
}]
165+
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
166+
enable_certificates = var.enable_mesh_certificates
167+
}] : []
168+
165169

166170
cluster_maintenance_window_is_recurring = var.maintenance_recurrence != "" && var.maintenance_end_time != "" ? [1] : []
167171
cluster_maintenance_window_is_daily = length(local.cluster_maintenance_window_is_recurring) > 0 ? [] : [1]

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,7 @@ resource "google_container_cluster" "primary" {
228228
}
229229

230230

231+
231232
dynamic "authenticator_groups_config" {
232233
for_each = local.cluster_authenticator_security_group
233234
content {

‎modules/beta-autopilot-private-cluster/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@ locals {
121121
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
122122
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
123123
}]
124+
124125
# BETA features
125126
cluster_istio_enabled = !local.cluster_output_istio_disabled
126127
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-autopilot-private-cluster/outputs.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@ output "identity_namespace" {
142142
]
143143
}
144144

145+
146+
145147
output "master_ipv4_cidr_block" {
146148
description = "The IP range in CIDR notation used for the hosted master network"
147149
value = var.master_ipv4_cidr_block

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -299,6 +299,7 @@ variable "identity_namespace" {
299299
default = "enabled"
300300
}
301301

302+
302303
variable "release_channel" {
303304
type = string
304305
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,7 @@ resource "google_container_cluster" "primary" {
209209
}
210210

211211

212+
212213
dynamic "authenticator_groups_config" {
213214
for_each = local.cluster_authenticator_security_group
214215
content {

‎modules/beta-autopilot-public-cluster/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ locals {
120120
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
121121
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
122122
}]
123+
123124
# BETA features
124125
cluster_istio_enabled = !local.cluster_output_istio_disabled
125126
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-autopilot-public-cluster/outputs.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@ output "identity_namespace" {
142142
]
143143
}
144144

145+
146+
145147
output "cloudrun_enabled" {
146148
description = "Whether CloudRun enabled"
147149
value = false

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,7 @@ variable "identity_namespace" {
269269
default = "enabled"
270270
}
271271

272+
272273
variable "release_channel" {
273274
type = string
274275
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ Then perform the following commands on the root folder:
194194
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
195195
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
196196
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
197+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
197198
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
198199
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
199200
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
@@ -295,6 +296,7 @@ Then perform the following commands on the root folder:
295296
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
296297
| master\_ipv4\_cidr\_block | The IP range in CIDR notation used for the hosted master network |
297298
| master\_version | Current master kubernetes version |
299+
| mesh\_certificates\_config | Mesh certificates configuration |
298300
| min\_master\_version | Minimum master kubernetes version |
299301
| monitoring\_service | Monitoring service used |
300302
| name | Cluster name |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -443,6 +443,14 @@ resource "google_container_cluster" "primary" {
443443
}
444444
}
445445

446+
dynamic "mesh_certificates" {
447+
for_each = local.cluster_mesh_certificates_config
448+
449+
content {
450+
enable_certificates = mesh_certificates.value.enable_certificates
451+
}
452+
}
453+
446454
dynamic "authenticator_groups_config" {
447455
for_each = local.cluster_authenticator_security_group
448456
content {

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,10 @@ locals {
181181
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
182182
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
183183
}]
184+
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
185+
enable_certificates = var.enable_mesh_certificates
186+
}] : []
187+
184188
# BETA features
185189
cluster_istio_enabled = !local.cluster_output_istio_disabled
186190
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-private-cluster-update-variant/outputs.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,15 @@ output "identity_namespace" {
161161
]
162162
}
163163

164+
output "mesh_certificates_config" {
165+
description = "Mesh certificates configuration"
166+
value = local.cluster_mesh_certificates_config
167+
depends_on = [
168+
google_container_cluster.primary
169+
]
170+
}
171+
172+
164173
output "master_ipv4_cidr_block" {
165174
description = "The IP range in CIDR notation used for the hosted master network"
166175
value = var.master_ipv4_cidr_block

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,12 @@ variable "identity_namespace" {
439439
default = "enabled"
440440
}
441441

442+
variable "enable_mesh_certificates" {
443+
type = bool
444+
default = false
445+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
446+
}
447+
442448
variable "release_channel" {
443449
type = string
444450
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -722,7 +728,6 @@ variable "enable_pod_security_policy" {
722728
default = false
723729
}
724730

725-
726731
variable "enable_l4_ilb_subsetting" {
727732
type = bool
728733
description = "Enable L4 ILB Subsetting on the cluster"

‎modules/beta-private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,7 @@ Then perform the following commands on the root folder:
172172
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
173173
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
174174
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
175+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
175176
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
176177
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
177178
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
@@ -273,6 +274,7 @@ Then perform the following commands on the root folder:
273274
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
274275
| master\_ipv4\_cidr\_block | The IP range in CIDR notation used for the hosted master network |
275276
| master\_version | Current master kubernetes version |
277+
| mesh\_certificates\_config | Mesh certificates configuration |
276278
| min\_master\_version | Minimum master kubernetes version |
277279
| monitoring\_service | Monitoring service used |
278280
| name | Cluster name |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -443,6 +443,14 @@ resource "google_container_cluster" "primary" {
443443
}
444444
}
445445

446+
dynamic "mesh_certificates" {
447+
for_each = local.cluster_mesh_certificates_config
448+
449+
content {
450+
enable_certificates = mesh_certificates.value.enable_certificates
451+
}
452+
}
453+
446454
dynamic "authenticator_groups_config" {
447455
for_each = local.cluster_authenticator_security_group
448456
content {

‎modules/beta-private-cluster/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,10 @@ locals {
181181
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
182182
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
183183
}]
184+
cluster_mesh_certificates_config = local.workload_identity_enabled ? [{
185+
enable_certificates = var.enable_mesh_certificates
186+
}] : []
187+
184188
# BETA features
185189
cluster_istio_enabled = !local.cluster_output_istio_disabled
186190
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-private-cluster/outputs.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,15 @@ output "identity_namespace" {
161161
]
162162
}
163163

164+
output "mesh_certificates_config" {
165+
description = "Mesh certificates configuration"
166+
value = local.cluster_mesh_certificates_config
167+
depends_on = [
168+
google_container_cluster.primary
169+
]
170+
}
171+
172+
164173
output "master_ipv4_cidr_block" {
165174
description = "The IP range in CIDR notation used for the hosted master network"
166175
value = var.master_ipv4_cidr_block

‎modules/beta-private-cluster/variables.tf

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -439,6 +439,12 @@ variable "identity_namespace" {
439439
default = "enabled"
440440
}
441441

442+
variable "enable_mesh_certificates" {
443+
type = bool
444+
default = false
445+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
446+
}
447+
442448
variable "release_channel" {
443449
type = string
444450
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -722,7 +728,6 @@ variable "enable_pod_security_policy" {
722728
default = false
723729
}
724730

725-
726731
variable "enable_l4_ilb_subsetting" {
727732
type = bool
728733
description = "Enable L4 ILB Subsetting on the cluster"

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ Then perform the following commands on the root folder:
187187
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
188188
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
189189
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
190+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
190191
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
191192
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
192193
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
@@ -283,6 +284,7 @@ Then perform the following commands on the root folder:
283284
| logging\_service | Logging service used |
284285
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
285286
| master\_version | Current master kubernetes version |
287+
| mesh\_certificates\_config | Mesh certificates configuration |
286288
| min\_master\_version | Minimum master kubernetes version |
287289
| monitoring\_service | Monitoring service used |
288290
| name | Cluster name |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -424,6 +424,14 @@ resource "google_container_cluster" "primary" {
424424
}
425425
}
426426

427+
dynamic "mesh_certificates" {
428+
for_each = local.cluster_mesh_certificates_config
429+
430+
content {
431+
enable_certificates = mesh_certificates.value.enable_certificates
432+
}
433+
}
434+
427435
dynamic "authenticator_groups_config" {
428436
for_each = local.cluster_authenticator_security_group
429437
content {

0 commit comments

Comments
 (0)