Skip to content

Commit accd710

Browse files
bgvdiscordbgvdiscord
committed
make build
1 parent 24c4ed4 commit accd710

File tree

54 files changed

+268
-5
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+268
-5
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,7 @@ Then perform the following commands on the root folder:
149149
| enable\_binary\_authorization | Enable BinAuthZ Admission controller | `bool` | `false` | no |
150150
| enable\_cost\_allocation | Enables Cost Allocation Feature and the cluster name and namespace of your GKE workloads appear in the labels field of the billing export to BigQuery | `bool` | `false` | no |
151151
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
152+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
152153
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
153154
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
154155
| enable\_shielded\_nodes | Enable Shielded Nodes features on all nodes in this cluster | `bool` | `true` | no |
@@ -231,6 +232,7 @@ Then perform the following commands on the root folder:
231232
| logging\_service | Logging service used |
232233
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
233234
| master\_version | Current master kubernetes version |
235+
| mesh\_certificates\_config | Mesh certificates configuration |
234236
| min\_master\_version | Minimum master kubernetes version |
235237
| monitoring\_service | Monitoring service used |
236238
| name | Cluster name |

‎cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,14 @@ resource "google_container_cluster" "primary" {
344344
}
345345
}
346346

347+
dynamic "mesh_certificates" {
348+
for_each = local.cluster_mesh_certificates_config
349+
350+
content {
351+
enable_certificates = mesh_certificates.value.enable_certificates
352+
}
353+
}
354+
347355
dynamic "authenticator_groups_config" {
348356
for_each = local.cluster_authenticator_security_group
349357
content {

‎main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,10 @@ locals {
157157
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
158158
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
159159
}]
160+
cluster_mesh_certificates_config = !local.workload_identity_enabled ? [] : [{
161+
enable_certificates = var.enable_mesh_certificates
162+
}]
163+
160164

161165
cluster_maintenance_window_is_recurring = var.maintenance_recurrence != "" && var.maintenance_end_time != "" ? [1] : []
162166
cluster_maintenance_window_is_daily = length(local.cluster_maintenance_window_is_recurring) > 0 ? [] : [1]

‎modules/acm/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ data "google_client_config" "default" {}
9191
| install\_template\_library | Whether to install the default Policy Controller template library | `bool` | `true` | no |
9292
| location | GCP location used to reach cluster. | `string` | n/a | yes |
9393
| metrics\_gcp\_sa\_name | The name of the Google service account for ACM metrics writing | `string` | `"acm-metrics-writer"` | no |
94-
| policy\_bundles | A list of Policy Controller policy bundles git urls (example: <https://github.com/GoogleCloudPlatform/acm-policy-controller-library.git/bundles/policy-essentials-v2022>) to install on the cluster. | `list(string)` | `[]` | no |
94+
| policy\_bundles | A list of Policy Controller policy bundles git urls (example: https://github.com/GoogleCloudPlatform/acm-policy-controller-library.git/bundles/policy-essentials-v2022) to install on the cluster. | `list(string)` | `[]` | no |
9595
| policy\_dir | Subfolder containing configs in ACM Git repo. If un-set, uses Config Management default. | `string` | `""` | no |
9696
| project\_id | GCP project\_id used to reach cluster. | `string` | n/a | yes |
9797
| secret\_type | git authentication secret type, is passed through to ConfigManagement spec.git.secretType. Overriden to value 'ssh' if `create_ssh_key` is true | `string` | `"ssh"` | no |

‎modules/beta-autopilot-private-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ Then perform the following commands on the root folder:
154154
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
155155
| master\_ipv4\_cidr\_block | The IP range in CIDR notation used for the hosted master network |
156156
| master\_version | Current master kubernetes version |
157+
| mesh\_certificates\_config | Mesh certificates configuration |
157158
| min\_master\_version | Minimum master kubernetes version |
158159
| monitoring\_service | Monitoring service used |
159160
| name | Cluster name |

‎modules/beta-autopilot-private-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -228,6 +228,7 @@ resource "google_container_cluster" "primary" {
228228
}
229229

230230

231+
231232
dynamic "authenticator_groups_config" {
232233
for_each = local.cluster_authenticator_security_group
233234
content {

‎modules/beta-autopilot-private-cluster/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,10 @@ locals {
117117
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
118118
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
119119
}]
120+
cluster_mesh_certificates_config = !local.workload_identity_enabled ? [] : [{
121+
enable_certificates = var.enable_mesh_certificates
122+
}]
123+
120124
# BETA features
121125
cluster_istio_enabled = !local.cluster_output_istio_disabled
122126
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-autopilot-private-cluster/outputs.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,14 @@ output "identity_namespace" {
142142
]
143143
}
144144

145+
output "mesh_certificates_config" {
146+
description = "Mesh certificates configuration"
147+
value = local.cluster_mesh_certificates_config
148+
depends_on = [
149+
google_container_cluster.primary
150+
]
151+
}
152+
145153
output "master_ipv4_cidr_block" {
146154
description = "The IP range in CIDR notation used for the hosted master network"
147155
value = var.master_ipv4_cidr_block

‎modules/beta-autopilot-private-cluster/variables.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -299,6 +299,7 @@ variable "identity_namespace" {
299299
default = "enabled"
300300
}
301301

302+
302303
variable "release_channel" {
303304
type = string
304305
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -416,3 +417,4 @@ variable "timeouts" {
416417
}
417418
}
418419

420+

‎modules/beta-autopilot-public-cluster/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ Then perform the following commands on the root folder:
142142
| logging\_service | Logging service used |
143143
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
144144
| master\_version | Current master kubernetes version |
145+
| mesh\_certificates\_config | Mesh certificates configuration |
145146
| min\_master\_version | Minimum master kubernetes version |
146147
| monitoring\_service | Monitoring service used |
147148
| name | Cluster name |

‎modules/beta-autopilot-public-cluster/cluster.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,7 @@ resource "google_container_cluster" "primary" {
209209
}
210210

211211

212+
212213
dynamic "authenticator_groups_config" {
213214
for_each = local.cluster_authenticator_security_group
214215
content {

‎modules/beta-autopilot-public-cluster/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,10 @@ locals {
116116
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
117117
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
118118
}]
119+
cluster_mesh_certificates_config = !local.workload_identity_enabled ? [] : [{
120+
enable_certificates = var.enable_mesh_certificates
121+
}]
122+
119123
# BETA features
120124
cluster_istio_enabled = !local.cluster_output_istio_disabled
121125
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-autopilot-public-cluster/outputs.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,14 @@ output "identity_namespace" {
142142
]
143143
}
144144

145+
output "mesh_certificates_config" {
146+
description = "Mesh certificates configuration"
147+
value = local.cluster_mesh_certificates_config
148+
depends_on = [
149+
google_container_cluster.primary
150+
]
151+
}
152+
145153
output "cloudrun_enabled" {
146154
description = "Whether CloudRun enabled"
147155
value = false

‎modules/beta-autopilot-public-cluster/variables.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,7 @@ variable "identity_namespace" {
269269
default = "enabled"
270270
}
271271

272+
272273
variable "release_channel" {
273274
type = string
274275
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -386,3 +387,4 @@ variable "timeouts" {
386387
}
387388
}
388389

390+

‎modules/beta-private-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ Then perform the following commands on the root folder:
190190
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
191191
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
192192
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
193+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
193194
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
194195
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
195196
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
@@ -290,6 +291,7 @@ Then perform the following commands on the root folder:
290291
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
291292
| master\_ipv4\_cidr\_block | The IP range in CIDR notation used for the hosted master network |
292293
| master\_version | Current master kubernetes version |
294+
| mesh\_certificates\_config | Mesh certificates configuration |
293295
| min\_master\_version | Minimum master kubernetes version |
294296
| monitoring\_service | Monitoring service used |
295297
| name | Cluster name |

‎modules/beta-private-cluster-update-variant/cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -432,6 +432,14 @@ resource "google_container_cluster" "primary" {
432432
}
433433
}
434434

435+
dynamic "mesh_certificates" {
436+
for_each = local.cluster_mesh_certificates_config
437+
438+
content {
439+
enable_certificates = mesh_certificates.value.enable_certificates
440+
}
441+
}
442+
435443
dynamic "authenticator_groups_config" {
436444
for_each = local.cluster_authenticator_security_group
437445
content {

‎modules/beta-private-cluster-update-variant/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,10 @@ locals {
176176
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
177177
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
178178
}]
179+
cluster_mesh_certificates_config = !local.workload_identity_enabled ? [] : [{
180+
enable_certificates = var.enable_mesh_certificates
181+
}]
182+
179183
# BETA features
180184
cluster_istio_enabled = !local.cluster_output_istio_disabled
181185
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-private-cluster-update-variant/outputs.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,14 @@ output "identity_namespace" {
161161
]
162162
}
163163

164+
output "mesh_certificates_config" {
165+
description = "Mesh certificates configuration"
166+
value = local.cluster_mesh_certificates_config
167+
depends_on = [
168+
google_container_cluster.primary
169+
]
170+
}
171+
164172
output "master_ipv4_cidr_block" {
165173
description = "The IP range in CIDR notation used for the hosted master network"
166174
value = var.master_ipv4_cidr_block

‎modules/beta-private-cluster-update-variant/variables.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -435,6 +435,12 @@ variable "identity_namespace" {
435435
default = "enabled"
436436
}
437437

438+
variable "enable_mesh_certificates" {
439+
type = bool
440+
default = false
441+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
442+
}
443+
438444
variable "release_channel" {
439445
type = string
440446
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -712,7 +718,6 @@ variable "enable_pod_security_policy" {
712718
default = false
713719
}
714720

715-
716721
variable "enable_l4_ilb_subsetting" {
717722
type = bool
718723
description = "Enable L4 ILB Subsetting on the cluster"
@@ -736,3 +741,4 @@ variable "enable_identity_service" {
736741
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
737742
default = false
738743
}
744+

‎modules/beta-private-cluster/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ Then perform the following commands on the root folder:
168168
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
169169
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
170170
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
171+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
171172
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
172173
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
173174
| enable\_private\_endpoint | (Beta) Whether the master's internal IP address is used as the cluster endpoint | `bool` | `false` | no |
@@ -268,6 +269,7 @@ Then perform the following commands on the root folder:
268269
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
269270
| master\_ipv4\_cidr\_block | The IP range in CIDR notation used for the hosted master network |
270271
| master\_version | Current master kubernetes version |
272+
| mesh\_certificates\_config | Mesh certificates configuration |
271273
| min\_master\_version | Minimum master kubernetes version |
272274
| monitoring\_service | Monitoring service used |
273275
| name | Cluster name |

‎modules/beta-private-cluster/cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -432,6 +432,14 @@ resource "google_container_cluster" "primary" {
432432
}
433433
}
434434

435+
dynamic "mesh_certificates" {
436+
for_each = local.cluster_mesh_certificates_config
437+
438+
content {
439+
enable_certificates = mesh_certificates.value.enable_certificates
440+
}
441+
}
442+
435443
dynamic "authenticator_groups_config" {
436444
for_each = local.cluster_authenticator_security_group
437445
content {

‎modules/beta-private-cluster/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,10 @@ locals {
176176
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
177177
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
178178
}]
179+
cluster_mesh_certificates_config = !local.workload_identity_enabled ? [] : [{
180+
enable_certificates = var.enable_mesh_certificates
181+
}]
182+
179183
# BETA features
180184
cluster_istio_enabled = !local.cluster_output_istio_disabled
181185
cluster_dns_cache_enabled = var.dns_cache

‎modules/beta-private-cluster/outputs.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,14 @@ output "identity_namespace" {
161161
]
162162
}
163163

164+
output "mesh_certificates_config" {
165+
description = "Mesh certificates configuration"
166+
value = local.cluster_mesh_certificates_config
167+
depends_on = [
168+
google_container_cluster.primary
169+
]
170+
}
171+
164172
output "master_ipv4_cidr_block" {
165173
description = "The IP range in CIDR notation used for the hosted master network"
166174
value = var.master_ipv4_cidr_block

‎modules/beta-private-cluster/variables.tf

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -435,6 +435,12 @@ variable "identity_namespace" {
435435
default = "enabled"
436436
}
437437

438+
variable "enable_mesh_certificates" {
439+
type = bool
440+
default = false
441+
description = "Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity."
442+
}
443+
438444
variable "release_channel" {
439445
type = string
440446
description = "The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `REGULAR`."
@@ -712,7 +718,6 @@ variable "enable_pod_security_policy" {
712718
default = false
713719
}
714720

715-
716721
variable "enable_l4_ilb_subsetting" {
717722
type = bool
718723
description = "Enable L4 ILB Subsetting on the cluster"
@@ -736,3 +741,4 @@ variable "enable_identity_service" {
736741
description = "Enable the Identity Service component, which allows customers to use external identity providers with the K8S API."
737742
default = false
738743
}
744+

‎modules/beta-public-cluster-update-variant/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,7 @@ Then perform the following commands on the root folder:
183183
| enable\_intranode\_visibility | Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network | `bool` | `false` | no |
184184
| enable\_kubernetes\_alpha | Whether to enable Kubernetes Alpha features for this cluster. Note that when this option is enabled, the cluster cannot be upgraded and will be automatically deleted after 30 days. | `bool` | `false` | no |
185185
| enable\_l4\_ilb\_subsetting | Enable L4 ILB Subsetting on the cluster | `bool` | `false` | no |
186+
| enable\_mesh\_certificates | Controls the issuance of workload mTLS certificates. When enabled the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster. Requires Workload Identity. | `bool` | `false` | no |
186187
| enable\_network\_egress\_export | Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. | `bool` | `false` | no |
187188
| enable\_pod\_security\_policy | enabled - Enable the PodSecurityPolicy controller for this cluster. If enabled, pods must be valid under a PodSecurityPolicy to be created. Pod Security Policy was removed from GKE clusters with version >= 1.25.0. | `bool` | `false` | no |
188189
| enable\_resource\_consumption\_export | Whether to enable resource consumption metering on this cluster. When enabled, a table will be created in the resource export BigQuery dataset to store resource consumption data. The resulting table can be joined with the resource usage table or with BigQuery billing export. | `bool` | `true` | no |
@@ -278,6 +279,7 @@ Then perform the following commands on the root folder:
278279
| logging\_service | Logging service used |
279280
| master\_authorized\_networks\_config | Networks from which access to master is permitted |
280281
| master\_version | Current master kubernetes version |
282+
| mesh\_certificates\_config | Mesh certificates configuration |
281283
| min\_master\_version | Minimum master kubernetes version |
282284
| monitoring\_service | Monitoring service used |
283285
| name | Cluster name |

‎modules/beta-public-cluster-update-variant/cluster.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,14 @@ resource "google_container_cluster" "primary" {
413413
}
414414
}
415415

416+
dynamic "mesh_certificates" {
417+
for_each = local.cluster_mesh_certificates_config
418+
419+
content {
420+
enable_certificates = mesh_certificates.value.enable_certificates
421+
}
422+
}
423+
416424
dynamic "authenticator_groups_config" {
417425
for_each = local.cluster_authenticator_security_group
418426
content {

‎modules/beta-public-cluster-update-variant/main.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,10 @@ locals {
175175
cluster_workload_identity_config = !local.workload_identity_enabled ? [] : var.identity_namespace == "enabled" ? [{
176176
workload_pool = "${var.project_id}.svc.id.goog" }] : [{ workload_pool = var.identity_namespace
177177
}]
178+
cluster_mesh_certificates_config = !local.workload_identity_enabled ? [] : [{
179+
enable_certificates = var.enable_mesh_certificates
180+
}]
181+
178182
# BETA features
179183
cluster_istio_enabled = !local.cluster_output_istio_disabled
180184
cluster_dns_cache_enabled = var.dns_cache

0 commit comments

Comments
 (0)