Allow user to specify authorized networks in settings

community/modules/scheduler/gke-cluster/README.md

@@ -118,6 +118,7 @@ No modules.
 | <a name="input_labels"></a> [labels](#input\_labels) | GCE resource labels to be applied to resources. Key-value pairs. | `map(string)` | n/a | yes |
 | <a name="input_maintenance_exclusions"></a> [maintenance\_exclusions](#input\_maintenance\_exclusions) | List of maintenance exclusions. A cluster can have up to three. | <pre>list(object({<br>    name            = string<br>    start_time      = string<br>    end_time        = string<br>    exclusion_scope = string<br>  }))</pre> | `[]` | no |
 | <a name="input_maintenance_start_time"></a> [maintenance\_start\_time](#input\_maintenance\_start\_time) | Start time for daily maintenance operations. Specified in GMT with `HH:MM` format. | `string` | `"09:00"` | no |
+| <a name="input_master_authorized_networks"></a> [master\_authorized\_networks](#input\_master\_authorized\_networks) | External network that can access Kubernetes master through HTTPS. Must be specified in CIDR notation. | <pre>list(object({<br>    cidr_block   = string<br>    display_name = string<br>  }))</pre> | `[]` | no |
 | <a name="input_master_ipv4_cidr_block"></a> [master\_ipv4\_cidr\_block](#input\_master\_ipv4\_cidr\_block) | (Beta) The IP range in CIDR notation to use for the hosted master network. | `string` | `"172.16.0.32/28"` | no |
 | <a name="input_name_suffix"></a> [name\_suffix](#input\_name\_suffix) | Custom cluster name postpended to the `deployment_name`. See `prefix_with_deployment_name`. | `string` | `""` | no |
 | <a name="input_network_id"></a> [network\_id](#input\_network\_id) | The ID of the GCE VPC network to host the cluster given in the format: `projects/<project_id>/global/networks/<network_name>`. | `string` | n/a | yes |

community/modules/scheduler/gke-cluster/main.tf

@@ -49,6 +49,13 @@ resource "google_container_cluster" "gke_cluster" {
   # Note: the existence of the "master_authorized_networks_config" block enables
   # the master authorized networks even if it's empty.
   master_authorized_networks_config {
+    dynamic "cidr_blocks" {
+      for_each = var.master_authorized_networks
+      content {
+        cidr_block   = cidr_blocks.value.cidr_block
+        display_name = cidr_blocks.value.display_name
+      }
+    }
   }
 
   private_ipv6_google_access = var.enable_private_ipv6_google_access ? "PRIVATE_IPV6_GOOGLE_ACCESS_TO_GOOGLE" : null

community/modules/scheduler/gke-cluster/outputs.tf

@@ -27,12 +27,19 @@ locals {
       One way to access this cluster is from a VM created in the GKE cluster subnet.
     EOT
   )
+  master_authorized_networks_message = length(var.master_authorized_networks) == 0 ? "" : trimspace(
+    <<-EOT
+    The following networks have been authorized to access this cluster:
+    ${join("\n", [for x in var.master_authorized_networks : "  ${x.display_name}: ${x.cidr_block}"])}"
+    EOT
+  )
   public_endpoint_message = trimspace(
     <<-EOT
-      To access this cluster from a public IP address you must allowlist your IP:
+      To add authorized networks you can allowlist your IP with this command:
         gcloud container clusters update ${google_container_cluster.gke_cluster.name} \
           --region ${google_container_cluster.gke_cluster.location} \
           --project ${var.project_id} \
+          --enable-master-authorized-networks \
           --master-authorized-networks <IP Address>/32
     EOT
   )
@@ -43,6 +50,8 @@ output "instructions" {
   description = "Instructions on how to connect to the created cluster."
   value = trimspace(
     <<-EOT
+      ${local.master_authorized_networks_message}
+
       ${local.allowlist_your_ip_message}
 
       Use the following command to fetch credentials for the created cluster:

community/modules/scheduler/gke-cluster/variables.tf

@@ -165,6 +165,15 @@ variable "enable_master_global_access" {
   default     = false
 }
 
+variable "master_authorized_networks" {
+  description = "External network that can access Kubernetes master through HTTPS. Must be specified in CIDR notation."
+  type = list(object({
+    cidr_block   = string
+    display_name = string
+  }))
+  default = []
+}
+
 variable "service_account" {
   description = "Service account to use with the system node pool"
   type = object({