fix: Create separate firewall rule for egress to TPUs #1126
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tomasgareau
requested review from
bharathkkb,
Jberlinsky and
a team
as code owners
|
Thanks for the PR! 🚀 |
morgante
approved these changes
Jan 13, 2022
CPL-markus
pushed a commit
to WALTER-GROUP/terraform-google-kubernetes-engine
that referenced
this pull request
Jul 15, 2024
…le-modules#1126) BREAKING CHANGE: TPU firewall rule split into a separate resource
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Addresses #1124.
I bumped into this when trying to create a
safer-clusterin a VPC network with a default deny egress rule. Theintra_egressfirewall rule was required to allow the default pool to report back to the control plane so it could be deleted (as part of thegoogle_container_cluster.primarycreate operation).However, the
intra_egressfirewall rule had a Terraform dependency on thegoogle_container_cluster.primaryresource, so it was never created, preventing the cluster from creating successfully.This PR simply creates a separate rule for egress to the
tpu_ipv4_cidr_block, allowing theintra_egressrule to get created before thegoogle_container_clusterresource.