Add ability to Disable the kubelet read-only port in GKE clusters and Node Pools #2748
Open
3 tasks done
Labels
enhancement
New feature or request
Checklist
Describe the feature or resource
Google is sending out notifications to disable the insecure unauthenticated port in the kubelet server. This includes modifying both the Cluster and Node Pool configuration.
This is currently a manual process as there does not appear to be an ability to do this directly with the ContainerCluster or ContainerNodePool config connector resources.
Additional information
https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port
I imagine we will want to extend the nodePoolDefaults.nodeConfigDefaults section of ContainerCluster to include 'insecureKubeletReadonlyPortEnabled' (boolean)
E.G.
Additionally, modify nodeConfig.kubeletConfig section of ContainerNodePool to include 'insecureKubeletReadonlyPortEnabled' (boolean)
E.G.
Finally, for autopilot clusters, modify nodePoolAutoConfig to include \ control nodeKubeletConfig and be able to set 'insecureKubeletReadonlyPortEnabled' (boolean) within ContainerCluster
E.G.
Importance
I imagine that as more and more users get instruction to disable this insecure configuration, there will be more users that will want this capability using config-connector. In my opinion this should be considered a medium urgency.
The text was updated successfully, but these errors were encountered: