Creating a private cluster in GKE, terraform vs console

Question

I've been trying to setup a terraform module to create private cluster, and I'm struggling with a strange situation.

When creating a cluster with a master authorized network, if I do it through the GCP console, I can create the private cluster just fine. But when I do it with Terraform, I get a strange error:

 Invalid master authorized networks: network "<cidr>" is not a reserved network, which is required for private endpoints.

The interesting parts of the code are as follows:

....
master_authorized_networks_config {
  cidr_blocks {
    cidr_block = "<my-network-cidr>"
  }
}

private_cluster_config {
  enable_private_endpoint = true
  enable_private_nodes    = true
  master_ipv4_cidr_block  = "<cidr>"
}
....

Is there something I'm forgetting here?

Answer 1

According to Google Cloud Platform documentation here, it should be possible to have both private and public endpoints, and the master_authorized_networks_config argument should have networks which can reach either of those endpoints.

If setting the enable_private_endpoint argument to false means that the private endpoint is created, but it also creates the public endpoint, then that is a horribly mis-named argument; enable_private_endpoint is actually flipping the public endpoint off and on, not the private one. Apparently, specifying a private_cluster_config is sufficient to enable the private endpoint, and the flag toggles the public endpoint, if reported behavior is to be believed.

That is certainly the experience that I had: specifying my local IP address in the master_authorized_networks_config caused cluster creation to fail when enable_private_endpoint is true. When I set it to false, I get both endpoints and the config. is not rejected.

Answer 2

master_authorized_networks_config {
}

private_cluster_config {
  enable_private_endpoint = true
  enable_private_nodes    = true
  master_ipv4_cidr_block  = "<cidr>"
}

Should create the private_end_point and it won't complain about Invalid master authorized networks. The one you tried, is passing up the external CIDR for the whitelist to access the public endpoint while at the same time you want it to be strictly private.

Answer 3

I've had the same issue recently.

The solution I found is to set the enable_private_endpoint = false.

In this case the private endpoint created anyway, but you are allowed to add CIDR with external addresses to master authorized networks.