Skip to content

Commit 92b342c

Browse files
morgantemorgante
authored
Merge pull request #40 from terraform-google-modules/37-disable-client-cert
Support for disabling basic auth / client cert
2 parents 5fd2a31 + 51f0472 commit 92b342c

File tree

26 files changed

+534
-1
lines changed

26 files changed

+534
-1
lines changed

‎.kitchen.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,19 @@ suites:
3737
backend: local
3838
provisioner:
3939
name: terraform
40+
- name: "disable_client_cert"
41+
driver:
42+
name: "terraform"
43+
command_timeout: 1800
44+
root_module_directory: test/fixtures/disable_client_cert
45+
verifier:
46+
name: terraform
47+
color: false
48+
systems:
49+
- name: disable_client_cert
50+
backend: local
51+
provisioner:
52+
name: terraform
4053
- name: "node_pool"
4154
driver:
4255
name: "terraform"

‎CHANGELOG.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,17 @@ Extending the adopted spec, each change should have a link to its corresponding
1010

1111
## [v2.0.0] - 2019-YY-ZZ
1212

13+
### Added
14+
15+
* Add `basic_auth_username` set to `""` by default. [#40]
16+
* Add `basic_auth_password` set to `""` by default. [#40]
17+
* Add `issue_client_certificate` set to `false` by default. [#40]
18+
1319
### Changed
1420

1521
* The `service_account` variable defaults to `"create"` which causes a
1622
cluster-specific service account to be created.
23+
* Disabled Basic Authentication by default. [#40]
1724

1825
## [v1.0.1] - 2019-04-04
1926

@@ -40,7 +47,9 @@ Extending the adopted spec, each change should have a link to its corresponding
4047
* Added `disable_legacy_metadata_endpoints` parameter. [#114]
4148

4249
### Changed
43-
* Set `horizontal_pod_autoscaling` to `true` by default. Fixes [#42]. [#54]
50+
51+
* Set `horizontal_pod_autoscaling` to `true` by default.
52+
Fixes [#42]. [#54]
4453
* Update simple-zonal example GKE version to supported version. [#49]
4554
* Drop explicit version from simple_zonal example. [#74]
4655
* Remove explicit versions from test cases and examples. [#62]
@@ -113,6 +122,7 @@ Extending the adopted spec, each change should have a link to its corresponding
113122
[#46]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/46
114123
[#43]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/43
115124
[#42]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/issues/42
125+
[#40]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/40
116126
[#38]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/38
117127
[#33]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/33
118128
[#31]: https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/pull/31

‎README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,8 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
106106

107107
| Name | Description | Type | Default | Required |
108108
|------|-------------|:----:|:-----:|:-----:|
109+
| basic\_auth\_password | The password to be used with Basic Authentication. | string | `""` | no |
110+
| basic\_auth\_username | The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration. | string | `""` | no |
109111
| description | The description of the cluster | string | `""` | no |
110112
| disable\_legacy\_metadata\_endpoints | Disable the /0.1/ and /v1beta1/ metadata server endpoints on the node. Changing this value will cause all node pools to be recreated. | string | `"true"` | no |
111113
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | string | `"true"` | no |
@@ -114,6 +116,7 @@ In either case, upgrading to module version `v1.0.0` will trigger a recreation o
114116
| ip\_masq\_resync\_interval | The interval at which the agent attempts to sync its ConfigMap file from the disk. | string | `"60s"` | no |
115117
| ip\_range\_pods | The _name_ of the secondary subnet ip range to use for pods | string | n/a | yes |
116118
| ip\_range\_services | The _name_ of the secondary subnet range to use for services | string | n/a | yes |
119+
| issue\_client\_certificate | Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive! | string | `"false"` | no |
117120
| kubernetes\_dashboard | Enable kubernetes dashboard addon | string | `"false"` | no |
118121
| kubernetes\_version | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version in the selected region. | string | `"latest"` | no |
119122
| logging\_service | The logging service that the cluster should write logs to. Available options include logging.googleapis.com, logging.googleapis.com/kubernetes (beta), and none | string | `"logging.googleapis.com"` | no |

‎autogen/cluster_regional.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,15 @@ resource "google_container_cluster" "primary" {
3838

3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

41+
master_auth {
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
44+
45+
client_certificate_config {
46+
issue_client_certificate = "${var.issue_client_certificate}"
47+
}
48+
}
49+
4150
addons_config {
4251
http_load_balancing {
4352
disabled = "${var.http_load_balancing ? 0 : 1}"

‎autogen/cluster_zonal.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,15 @@ resource "google_container_cluster" "zonal_primary" {
3838

3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

41+
master_auth {
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
44+
45+
client_certificate_config {
46+
issue_client_certificate = "${var.issue_client_certificate}"
47+
}
48+
}
49+
4150
addons_config {
4251
http_load_balancing {
4352
disabled = "${var.http_load_balancing ? 0 : 1}"

‎autogen/variables.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,3 +233,18 @@ variable "master_ipv4_cidr_block" {
233233
default = "10.0.0.0/28"
234234
}
235235
{% endif %}
236+
237+
variable "basic_auth_username" {
238+
description = "The username to be used with Basic Authentication. An empty value will disable Basic Authentication, which is the recommended configuration."
239+
default = ""
240+
}
241+
242+
variable "basic_auth_password" {
243+
description = "The password to be used with Basic Authentication."
244+
default = ""
245+
}
246+
247+
variable "issue_client_certificate" {
248+
description = "Issues a client certificate to authenticate to the cluster endpoint. To maximize the security of your cluster, leave this option disabled. Client certificates don't automatically rotate and aren't easily revocable. WARNING: changing this after cluster creation is destructive!"
249+
default = "false"
250+
}

‎cluster_regional.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,15 @@ resource "google_container_cluster" "primary" {
3838

3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

41+
master_auth {
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
44+
45+
client_certificate_config {
46+
issue_client_certificate = "${var.issue_client_certificate}"
47+
}
48+
}
49+
4150
addons_config {
4251
http_load_balancing {
4352
disabled = "${var.http_load_balancing ? 0 : 1}"

‎cluster_zonal.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,15 @@ resource "google_container_cluster" "zonal_primary" {
3838

3939
master_authorized_networks_config = ["${var.master_authorized_networks_config}"]
4040

41+
master_auth {
42+
username = "${var.basic_auth_username}"
43+
password = "${var.basic_auth_password}"
44+
45+
client_certificate_config {
46+
issue_client_certificate = "${var.issue_client_certificate}"
47+
}
48+
}
49+
4150
addons_config {
4251
http_load_balancing {
4352
disabled = "${var.http_load_balancing ? 0 : 1}"

‎docs/upgrading_to_v2.0.md

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,3 +41,77 @@ module "kubernetes_engine" {
4141
service_account = "${module.project_factory.service_account_email}"
4242
}
4343
```
44+
45+
### Enabling Kubernetes Basic Authentication
46+
47+
Starting with GKE v1.12, clusters will by default disable the Basic
48+
Authentication method of authenticating. In previous versions of
49+
*kubernetes-engine*, Basic Authentication was enabled and configured
50+
with the username `"admin"` and an automatically generated password if
51+
the managed version of Kubernetes was less than v1.12.
52+
Basic Authentication is now requires credentials to be provided to be
53+
enabled.
54+
55+
Using Basic Authentication causes Terraform to store the credentials in
56+
a state file. It is important to use a Terraform Backend which supports
57+
encryption at rest, like the [GCS Backend][gcs-backend]. The
58+
[Sensitive Data in State article][sensitive-data] provides more context
59+
and recommendations on how to handle scenarios like this.
60+
61+
```hcl
62+
terraform {
63+
backend "gcs" {
64+
bucket = "terraform-state"
65+
}
66+
}
67+
68+
module "enabling-basic-auth" {
69+
source = "terraform-google-modules/kubernetes-engine/google"
70+
version = "~> 2.0"
71+
72+
project_id = "${var.project_id}"
73+
name = "cluster-with-basic-auth"
74+
75+
basic_auth_username = "admin"
76+
basic_auth_password = "s3crets!"
77+
78+
regional = "true"
79+
region = "${var.region}"
80+
network = "${var.network}"
81+
subnetwork = "${var.subnetwork}"
82+
ip_range_pods = "${var.ip_range_pods}"
83+
ip_range_services = "${var.ip_range_services}"
84+
service_account = "${var.compute_engine_service_account}"
85+
}
86+
```
87+
88+
### Enabling Kubernetes Client Certificate
89+
90+
Starting with GKE v1.12, clusters will disable by default the client
91+
certificate method of authenticating. In previous versions
92+
of *kubernetes-engine*, client certificate authentication was enabled
93+
if the managed version of Kubernetes was less than v1.12. Client
94+
certificate authentication must now be explicitly enabled.
95+
96+
```hcl
97+
module "enabling-client-certificate" {
98+
source = "terraform-google-modules/kubernetes-engine/google"
99+
version = "~> 2.0"
100+
101+
project_id = "${var.project_id}"
102+
name = "cluster-with-client-certificate"
103+
104+
issue_client_certificate = "true"
105+
106+
regional = "true"
107+
region = "${var.region}"
108+
network = "${var.network}"
109+
subnetwork = "${var.subnetwork}"
110+
ip_range_pods = "${var.ip_range_pods}"
111+
ip_range_services = "${var.ip_range_services}"
112+
service_account = "${var.compute_engine_service_account}"
113+
}
114+
```
115+
116+
[gsc-backend]: https://www.terraform.io/docs/backends/types/gcs.html
117+
[sensitive-data]: https://www.terraform.io/docs/state/sensitive-data.html

‎examples/disable_client_cert/README.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Disable Client Certificate
2+
3+
This example illustrates how to create a simple cluster and disable deprecated security features:
4+
5+
* basic auth
6+
* client certificate
7+
8+
[^]: (autogen_docs_start)
9+
10+
## Inputs
11+
12+
| Name | Description | Type | Default | Required |
13+
|------|-------------|:----:|:-----:|:-----:|
14+
| cluster\_name\_suffix | A suffix to append to the default cluster name | string | `""` | no |
15+
| compute\_engine\_service\_account | Service account to associate to the nodes in the cluster | string | n/a | yes |
16+
| credentials\_path | The path to the GCP credentials JSON file | string | n/a | yes |
17+
| ip\_range\_pods | The secondary ip range to use for pods | string | n/a | yes |
18+
| ip\_range\_services | The secondary ip range to use for pods | string | n/a | yes |
19+
| network | The VPC network to host the cluster in | string | n/a | yes |
20+
| network\_project\_id | The GCP project housing the VPC network to host the cluster in | string | n/a | yes |
21+
| project\_id | The project ID to host the cluster in | string | n/a | yes |
22+
| region | The region to host the cluster in | string | n/a | yes |
23+
| subnetwork | The subnetwork to host the cluster in | string | n/a | yes |
24+
25+
## Outputs
26+
27+
| Name | Description |
28+
|------|-------------|
29+
| ca\_certificate | |
30+
| client\_token | |
31+
| cluster\_name | Cluster name |
32+
| ip\_range\_pods | The secondary IP range used for pods |
33+
| ip\_range\_services | The secondary IP range used for services |
34+
| kubernetes\_endpoint | |
35+
| location | |
36+
| master\_kubernetes\_version | The master Kubernetes version |
37+
| network | |
38+
| project\_id | |
39+
| region | |
40+
| subnetwork | |
41+
| zones | List of zones in which the cluster resides |
42+
43+
[^]: (autogen_docs_end)
44+
45+
To provision this example, run the following from within this directory:
46+
- `terraform init` to get the plugins
47+
- `terraform plan` to see the infrastructure plan
48+
- `terraform apply` to apply the infrastructure build
49+
- `terraform destroy` to destroy the built infrastructure

‎examples/disable_client_cert/main.tf

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
cluster_type = "disable-cluster-cert"
19+
}
20+
21+
provider "google" {
22+
credentials = "${file(var.credentials_path)}"
23+
region = "${var.region}"
24+
}
25+
26+
module "gke" {
27+
source = "../../"
28+
29+
project_id = "${var.project_id}"
30+
name = "${local.cluster_type}-cluster${var.cluster_name_suffix}"
31+
region = "${var.region}"
32+
network = "${var.network}"
33+
network_project_id = "${var.network_project_id}"
34+
subnetwork = "${var.subnetwork}"
35+
ip_range_pods = "${var.ip_range_pods}"
36+
ip_range_services = "${var.ip_range_services}"
37+
service_account = "${var.compute_engine_service_account}"
38+
issue_client_certificate = false
39+
}
40+
41+
data "google_client_config" "default" {}

‎examples/disable_client_cert/outputs.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "kubernetes_endpoint" {
18+
sensitive = true
19+
value = "${module.gke.endpoint}"
20+
}
21+
22+
output "client_token" {
23+
sensitive = true
24+
value = "${base64encode(data.google_client_config.default.access_token)}"
25+
}
26+
27+
output "ca_certificate" {
28+
value = "${module.gke.ca_certificate}"
29+
}

‎examples/disable_client_cert/test_outputs.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../test/fixtures/all_examples/test_outputs.tf

0 commit comments

Comments
 (0)