feat(google_gke): add insecure_kubelet_readonly_port_enabled - #486
Merged
Conversation
Exposes the kubelet read-only port (10255) setting on both the cluster node defaults and each node pool, defaulting to disabled.
bkochendorfer
requested review from
a team,
ahoneiser and
mikaeld
as code owners
August 5, 2026 19:47
Contributor
Release plan
|
jbuck
previously approved these changes
Aug 5, 2026
jasonthomas
reviewed
Aug 6, 2026
| # Defaults for new node pools only; existing pools are set per pool below. | ||
| node_pool_defaults { | ||
| node_config_defaults { | ||
| insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled ? "TRUE" : "FALSE" |
Member
There was a problem hiding this comment.
I don't think we should make this configurable.
jbuck
approved these changes
Aug 11, 2026
chore(docs): google_gke/README.md
bkochendorfer
force-pushed
the
feat/gke-disable-kubelet-readonly-port
branch
from
August 11, 2026 19:18
2e6e6f0 to
1fe03cc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
insecure_kubelet_readonly_port_enabled(bool, defaultfalse) to thegoogle_gkemodule, wiring it into both:google_container_cluster.primary.node_pool_defaults.node_config_defaults— the default for node pools created after this is appliedgoogle_container_node_pool.pools.node_config.kubelet_config— every pool the module managesBoth are needed: GKE does not retrofit the cluster-level default onto existing node pools.
The
node_pool_defaultsblock is no longer conditional onenable_gcfs/enable_high_throughput_logging, since the read-only port setting always needs to be present.gcfs_configmoved to adynamicblock so behavior is unchanged whenenable_gcfs = false.Behavior change for consumers
The default is
false, so bumping to this version disables port 10255 on all node pools. Consumers should stage the rollout per cluster/region rather than applying fleet-wide in one go, and can setinsecure_kubelet_readonly_port_enabled = trueto defer.Context
Unblocks MZCLD-1982, which has been on hold since Sept 2024 waiting for provider support. The provider fields landed in google/google-beta 6.x; the module already pins
>= 6.0, < 8.0, so no provider bump is required.Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port
Testing
tofu fmt -checkandtofu validateclean. No apply run yet — first apply will be againstsandbox-high-nonprod.