hashicorp / hashicorp/terraform-provider-google
Enable --tls-san configuration on google_container_cluster
- Dominant language
- Go
- Stars
- 2.6k
- Forks
- 1.9k
- Avg merge
- 1h 7m
- Merged PRs (30d)
- 259
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request.
* Please do not leave _+1_ or _me too_ comments, they generate extra noise for issue followers and do not help prioritize the request.
* If you are interested in working on this issue or have submitted a pull request, please leave a comment.
* If an issue is assigned to a user, that user is claiming responsibility for the issue.
* Customers working with a Google Technical Account Manager or Customer Engineer can ask them to [reach out internally](https://github.com/hashicorp/terraform-provider-google/wiki/Customer-Contact#raising-gcp-internal-issues-with-the-provider-development-team) to expedite investigation and resolution of this issue.
### Description
When attempting to connect to a private Kubernetes cluster via a jump VM and a local proxy, you'll encounter issues if you try using the generated client and CA certificates. This is because the local proxy operates on 127.0.0.1, but the certificates aren't set up to recognize this IP address. Consequently, if you try to configure a Kubernetes provider with these certificates, you'll receive an error indicating that the certificate validation failed because it's not configured for 127.0.0.1 but for other specific IP addresses. The error message looks like this:
```
Error: Get "https://127.0.0.1:8888/api/v1/namespaces/cube": tls: failed to verify certificate: x509: certificate is valid for [supported IPs], not 127.0.0.1
```
To resolve this issue, it would be beneficial if there were an option to include a **`--tls-san`** parameter when using the **`google_container_cluster resource`**, allowing for additional Subject Alternative Names to be specified in the TLS certificate.
### New or Affected Resource(s)
* google_container_cluster
### Potential Terraform Configuration
_No response_
### References
_No response_
b/329495851
Contributor guide
Assessment
This issue has not been assessed yet.