hashicorp / hashicorp/terraform-provider-google

Enable --tls-san configuration on google_container_cluster

Open
#17,543 1 comment 0 reactions 0 assignees View on GitHub
enhancement feature-request forward/linked service/container size/s upstream
Dominant language
Go
Stars
2.6k
Forks
1.9k
Avg merge
1h 7m
Merged PRs (30d)
259

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request.
* Please do not leave _+1_ or _me too_ comments, they generate extra noise for issue followers and do not help prioritize the request.
* If you are interested in working on this issue or have submitted a pull request, please leave a comment.
* If an issue is assigned to a user, that user is claiming responsibility for the issue.
* Customers working with a Google Technical Account Manager or Customer Engineer can ask them to [reach out internally](https://github.com/hashicorp/terraform-provider-google/wiki/Customer-Contact#raising-gcp-internal-issues-with-the-provider-development-team) to expedite investigation and resolution of this issue.

### Description

When attempting to connect to a private Kubernetes cluster via a jump VM and a local proxy, you'll encounter issues if you try using the generated client and CA certificates. This is because the local proxy operates on 127.0.0.1, but the certificates aren't set up to recognize this IP address. Consequently, if you try to configure a Kubernetes provider with these certificates, you'll receive an error indicating that the certificate validation failed because it's not configured for 127.0.0.1 but for other specific IP addresses. The error message looks like this:

```
Error: Get "https://127.0.0.1:8888/api/v1/namespaces/cube": tls: failed to verify certificate: x509: certificate is valid for [supported IPs], not 127.0.0.1
```

To resolve this issue, it would be beneficial if there were an option to include a **`--tls-san`** parameter when using the **`google_container_cluster resource`**, allowing for additional Subject Alternative Names to be specified in the TLS certificate.

### New or Affected Resource(s)

* google_container_cluster

### Potential Terraform Configuration

_No response_

### References

_No response_

b/329495851

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.