feat(google_gke): add insecure_kubelet_readonly_port_enabled

google_gke/README.md

@@ -399,6 +399,7 @@ module "gke" {
 | <a name="input_gateway_api_enabled"></a> [gateway\_api\_enabled](#input\_gateway\_api\_enabled) | Enabled Gateway in the GKE Cluster | `bool` | `false` | no |
 | <a name="input_google_group_name"></a> [google\_group\_name](#input\_google\_group\_name) | Name of the Google security group for use with Kubernetes RBAC. Must be in format: gke-security-groups@yourdomain.com | `string` | `null` | no |
 | <a name="input_grant_registry_access"></a> [grant\_registry\_access](#input\_grant\_registry\_access) | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `true` | no |
+| <a name="input_insecure_kubelet_readonly_port_enabled"></a> [insecure\_kubelet\_readonly\_port\_enabled](#input\_insecure\_kubelet\_readonly\_port\_enabled) | Set the unauthenticated kubelet read-only port (10255) on every node pool. Leave null to let pools inherit the cluster default, which is always disabled. | `bool` | `null` | no |
 | <a name="input_kubernetes_version"></a> [kubernetes\_version](#input\_kubernetes\_version) | The Kubernetes version of the masters. If set to 'latest' it will pull latest available version. Defaults to 'latest'. | `string` | `"latest"` | no |
 | <a name="input_labels"></a> [labels](#input\_labels) | The GCE resource labels (a map of key/value pairs) to be applied to the cluster & other cluster-related resources. Merged with default labels (see locals.tf). | `map(string)` | `{}` | no |
 | <a name="input_logging_config_components"></a> [logging\_config\_components](#input\_logging\_config\_components) | n/a | `list(string)` | <pre>[<br/>  "APISERVER",<br/>  "CONTROLLER_MANAGER",<br/>  "SCHEDULER",<br/>  "SYSTEM_COMPONENTS",<br/>  "WORKLOADS"<br/>]</pre> | no |

google_gke/cluster.tf

@@ -227,14 +227,17 @@ resource "google_container_cluster" "primary" {
     }
   }
 
-  dynamic "node_pool_defaults" {
-    for_each = var.enable_gcfs || var.enable_high_throughput_logging ? [1] : []
-    content {
-      node_config_defaults {
-        gcfs_config {
+  # Defaults for new node pools only; GKE does not retrofit existing pools.
+  node_pool_defaults {
+    node_config_defaults {
+      insecure_kubelet_readonly_port_enabled = "FALSE"
+      logging_variant                        = var.enable_high_throughput_logging ? "MAX_THROUGHPUT" : "DEFAULT"
+
+      dynamic "gcfs_config" {
+        for_each = var.enable_gcfs ? [1] : []
+        content {
           enabled = var.enable_gcfs
         }
-        logging_variant = var.enable_high_throughput_logging ? "MAX_THROUGHPUT" : "DEFAULT"
       }
     }
   }
@@ -294,6 +297,14 @@ resource "google_container_node_pool" "pools" {
     # ignore_changes below, so values here are not reconciled afterward.
     metadata = length(local.node_pools_metadata[each.key]) > 0 ? local.node_pools_metadata[each.key] : null
 
+    dynamic "kubelet_config" {
+      for_each = var.insecure_kubelet_readonly_port_enabled != null ? [1] : []
+
+      content {
+        insecure_kubelet_readonly_port_enabled = var.insecure_kubelet_readonly_port_enabled ? "TRUE" : "FALSE"
+      }
+    }
+
     dynamic "guest_accelerator" {
       for_each = length(local.node_pools_guest_accelerator[each.key]) != 0 ? [1] : []
 

google_gke/variables.tf

@@ -114,6 +114,12 @@ variable "enable_gcfs" {
   type        = bool
 }
 
+variable "insecure_kubelet_readonly_port_enabled" {
+  default     = null
+  description = "Set the unauthenticated kubelet read-only port (10255) on every node pool. Leave null to let pools inherit the cluster default, which is always disabled."
+  type        = bool
+}
+
 variable "enable_public_cidrs_access" {
   default     = false
   description = "Whether the control plane is open to Google public IPs. Defaults to false."