Skip to content

Commit 3354205

Browse files
author
Jérémy Keusters
authored
feat: Require actively enabling network policy (terraform-google-modules#809)
BREAKING CHANGE: The `network_policy` variable now defaults to `false`.
1 parent 76b9b75 commit 3354205

File tree

30 files changed

+76
-36
lines changed

30 files changed

+76
-36
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ module "gke" {
4343
ip_range_services = "us-central1-01-gke-01-services"
4444
http_load_balancing = false
4545
horizontal_pod_autoscaling = true
46-
network_policy = true
46+
network_policy = false
4747
4848
node_pools = [
4949
{
@@ -164,7 +164,7 @@ Then perform the following commands on the root folder:
164164
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
165165
| name | The name of the cluster (required) | `string` | n/a | yes |
166166
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
167-
| network\_policy | Enable network policy addon | `bool` | `true` | no |
167+
| network\_policy | Enable network policy addon | `bool` | `false` | no |
168168
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
169169
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
170170
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |

‎autogen/main/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ module "gke" {
7373
ip_range_services = "us-central1-01-gke-01-services"
7474
http_load_balancing = false
7575
horizontal_pod_autoscaling = true
76-
network_policy = true
76+
network_policy = false
7777
{% if private_cluster %}
7878
enable_private_endpoint = true
7979
enable_private_nodes = true

‎autogen/main/variables.tf.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ variable "http_load_balancing" {
9999
variable "network_policy" {
100100
type = bool
101101
description = "Enable network policy addon"
102-
default = true
102+
default = false
103103
}
104104

105105
variable "network_policy_provider" {

‎docs/upgrading_to_v14.0.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,20 @@ The `registry_project_id` variable has been replaced with a `registry_project_id
1717
}
1818
```
1919

20+
### network_policy disabled by default
21+
The `network_policy` variable is now `false` by default (instead of `true`).
22+
If you want to keep using the network policy addon for your cluster, make
23+
sure that the `network_policy` variable is set to `true`:
24+
```diff
25+
module "gke" {
26+
source = "terraform-google-modules/kubernetes-engine/google"
27+
- version = "~> 13.0"
28+
+ version = "~> 14.0"
29+
30+
+ network_policy = true
31+
}
32+
```
33+
2034
### ASM default version changed to 1.8
2135

2236
[ASM submodule](https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/tree/master/modules/asm) has been changed to use ASM v1.8 as default.

‎modules/beta-private-cluster-update-variant/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ module "gke" {
6868
ip_range_services = "us-central1-01-gke-01-services"
6969
http_load_balancing = false
7070
horizontal_pod_autoscaling = true
71-
network_policy = true
71+
network_policy = false
7272
enable_private_endpoint = true
7373
enable_private_nodes = true
7474
master_ipv4_cidr_block = "10.0.0.0/28"
@@ -217,7 +217,7 @@ Then perform the following commands on the root folder:
217217
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
218218
| name | The name of the cluster (required) | `string` | n/a | yes |
219219
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
220-
| network\_policy | Enable network policy addon | `bool` | `true` | no |
220+
| network\_policy | Enable network policy addon | `bool` | `false` | no |
221221
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
222222
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
223223
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |

‎modules/beta-private-cluster-update-variant/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ variable "http_load_balancing" {
9999
variable "network_policy" {
100100
type = bool
101101
description = "Enable network policy addon"
102-
default = true
102+
default = false
103103
}
104104

105105
variable "network_policy_provider" {

‎modules/beta-private-cluster/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ module "gke" {
4646
ip_range_services = "us-central1-01-gke-01-services"
4747
http_load_balancing = false
4848
horizontal_pod_autoscaling = true
49-
network_policy = true
49+
network_policy = false
5050
enable_private_endpoint = true
5151
enable_private_nodes = true
5252
master_ipv4_cidr_block = "10.0.0.0/28"
@@ -195,7 +195,7 @@ Then perform the following commands on the root folder:
195195
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
196196
| name | The name of the cluster (required) | `string` | n/a | yes |
197197
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
198-
| network\_policy | Enable network policy addon | `bool` | `true` | no |
198+
| network\_policy | Enable network policy addon | `bool` | `false` | no |
199199
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
200200
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
201201
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |

‎modules/beta-private-cluster/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ variable "http_load_balancing" {
9999
variable "network_policy" {
100100
type = bool
101101
description = "Enable network policy addon"
102-
default = true
102+
default = false
103103
}
104104

105105
variable "network_policy_provider" {

‎modules/beta-public-cluster-update-variant/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ module "gke" {
6565
ip_range_services = "us-central1-01-gke-01-services"
6666
http_load_balancing = false
6767
horizontal_pod_autoscaling = true
68-
network_policy = true
68+
network_policy = false
6969
istio = true
7070
cloudrun = true
7171
dns_cache = false
@@ -206,7 +206,7 @@ Then perform the following commands on the root folder:
206206
| monitoring\_service | The monitoring service that the cluster should write metrics to. Automatically send metrics from pods in the cluster to the Google Cloud Monitoring API. VM metrics will be collected by Google Compute Engine regardless of this setting Available options include monitoring.googleapis.com, monitoring.googleapis.com/kubernetes (beta) and none | `string` | `"monitoring.googleapis.com/kubernetes"` | no |
207207
| name | The name of the cluster (required) | `string` | n/a | yes |
208208
| network | The VPC network to host the cluster in (required) | `string` | n/a | yes |
209-
| network\_policy | Enable network policy addon | `bool` | `true` | no |
209+
| network\_policy | Enable network policy addon | `bool` | `false` | no |
210210
| network\_policy\_provider | The network policy provider. | `string` | `"CALICO"` | no |
211211
| network\_project\_id | The project ID of the shared VPC's host (for shared vpc support) | `string` | `""` | no |
212212
| node\_metadata | Specifies how node metadata is exposed to the workload running on the node | `string` | `"GKE_METADATA_SERVER"` | no |

‎modules/beta-public-cluster-update-variant/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ variable "http_load_balancing" {
9999
variable "network_policy" {
100100
type = bool
101101
description = "Enable network policy addon"
102-
default = true
102+
default = false
103103
}
104104

105105
variable "network_policy_provider" {

0 commit comments

Comments
 (0)