Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug] fedramp-high/gitlab: GKE control plane authorized ranges and node settings are silently ignored

Abierto
  • ¿Algo no está bien?
#314 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@digitalresistor ya está trabajando en esto.

Desde el 20/10/2026.

  • #311 de @digitalresistor — abierto
  • #345 de @digitalresistor — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
1-2 días
Aptitud para principiantes
57/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
gcp, terraform
Área
cloud, infrastructure

Línea de trabajo

Compare blueprints/fedramp-high/gitlab/main.tf around lines 220–250 with the variable types in modules/gke-cluster-standard/variables.tf. Trace authorized ranges through access_config.ip_access.authorized_ranges, then inspect modules/gke-nodepool for the machine type and confidential node settings. Run terraform plan and confirm the control plane range and node settings appear in the plan.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Bug Framework - FedRAMP High Level of Effort - Low Priority - High Scope - Blueprint Scope - Module Security

Bug Description

The blueprints/fedramp-high/gitlab/main.tf file passes attributes that the modules/gke-cluster-standard module never declared, so Terraform silently discards them:

  • vpc_config.master_authorized_ranges, which should restrict the control plane to 10.203.0.0/16;
  • default_nodepool.remove_default_node_pool, next to the declared remove_pool;
  • the node pool settings that the blueprint places in node_config, such as machine_type and confidential_nodes.

Environment and Deployment Context

  • Stellar Engine Version/Commit: main at commit 2b112119e
  • Deployment Type:
    • US Region Restricted (e.g., Access Policy constraint)
    • FedRAMP Moderate
    • FedRAMP High
    • DoD IL4
    • DoD IL5
    • Stand-alone / Custom
  • FAST Stage (if applicable):
    • Stage 0 (Bootstrap)
    • Stage 1 (Resource Management)
    • Stage 2 (Network Creation)
    • Stage 3 (Security and Audit)
  • Affected Component: blueprints/fedramp-high/gitlab, modules/gke-cluster-standard
  • Terraform Version: any; static analysis of the configuration
  • GCP Provider Version: any

Steps to Reproduce

  1. Read blueprints/fedramp-high/gitlab/main.tf, lines 220 to 250.
  2. Compare each attribute with the vpc_config, default_nodepool and node_config types in modules/gke-cluster-standard/variables.tf.
  3. Run terraform plan and inspect master_authorized_networks_config and the node configuration of the cluster.

Expected Behavior

The control plane admits only the configured internal range, and the nodes use the configured machine type and confidential nodes.

Actual Behavior

The plan has no authorized network for 10.203.0.0/16 and uses the module defaults for the node settings.

Relevant Logs and Errors

No error appears, because Terraform discards object attributes that a variable type does not declare.

Additional Context

  • On the current module, the authorized ranges belong under access_config.ip_access.authorized_ranges. After the upstream sync in #311, the same attribute applies.
  • Confidential nodes and the machine type belong to a node pool, for example through modules/gke-nodepool.
  • Found while migrating module callers in #311.
Lenguaje dominante
HCL
Estrellas
58
Forks
25
Merge medio
1 d 16 h
PR fusionados (30 d)
61

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de google/stellar-engine

Todos los issues de google/stellar-engine

Issues similares

Más issues de Cloud

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.