google_container_cluster network_policy_config doesn't enable Network Policy for GKE cluster

[kkleidal]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v0.12.0-rc1
+ provider.aws v2.9.0
+ provider.google v2.5.1
+ provider.google-beta v2.5.1
+ provider.local v1.2.1

Affected Resource(s)

• google_container_cluster

Terraform Configuration Files

resource "google_container_cluster" "gke" {
  provider = "google-beta"

  name       = "${var.environment}-cluster"
  location   = "${var.k8s_location}"
  network    = "${google_compute_network.default.self_link}"
  subnetwork = "${google_compute_subnetwork.private.self_link}"

  remove_default_node_pool = true
  initial_node_count = 1

  master_auth {
    username = ""
    password = ""
    client_certificate_config {
      issue_client_certificate = false
    }
  }

  master_authorized_networks_config {
    cidr_blocks {
      cidr_block = "${var.private_cidr_block}"
    }

    cidr_blocks {
      cidr_block   = "0.0.0.0/0"
      display_name = "Public"
    }
  }

  addons_config {
    network_policy_config {
      disabled = "false"
    }
    istio_config {
      disabled = "${!var.istio_enabled}"
      auth     = "AUTH_MUTUAL_TLS"
    }
  }

  maintenance_policy {
    daily_maintenance_window {
      start_time = "07:00"
    }
  }
  
  ip_allocation_policy {
    use_ip_aliases = true
  }

  pod_security_policy_config {
    enabled = "${var.pod_security_policy_enabled}"
  }

  private_cluster_config {
    enable_private_endpoint = false
    enable_private_nodes    = true
    # This CIDR must not overlap with node network's CIDR:
    master_ipv4_cidr_block  = "${var.k8s_master_cidr_block}"
  }
}

resource "google_container_node_pool" "gke_primary" {
  provider = "google-beta"

  name       = "${var.environment}-primary"
  location   = "${var.k8s_location}"
  cluster    = "${google_container_cluster.gke.name}"
  node_count = 2

  node_config {
    preemptible  = false
    machine_type = "n1-standard-4"
    oauth_scopes = [
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring",
    ]
  }
}

Debug Output

N/A

Panic Output

N/A

Expected Behavior

The GKE cluster created should have had Network Policy enabled.

Actual Behavior

The GKE cluster created does not have Network Policy enabled:

Steps to Reproduce

1. Attempt to create a cluster with istio and network policies enabled

Important Factoids

N/A

References

N/A

[danawillow]

Hey @kkleidal, you'll want to also add a block into the cluster that sets the network policy:

	network_policy {
		enabled = true
		provider = "CALICO"
	}

I agree that having two blocks that do really similar things is super confusing. I'll try to clarify that in the docs.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!