Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Bug] fedramp-high/gitlab: GKE control plane authorized ranges and node settings are silently ignored

Aperta
  • Qualcosa non va?
#314 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@digitalresistor ci sta già lavorando.

Dal 23/10/2026.

  • #345 di @digitalresistor — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
57/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
gcp, terraform
Ambito
cloud, infrastructure

Direzione di ricerca

Compare blueprints/fedramp-high/gitlab/main.tf around lines 220–250 with the variable types in modules/gke-cluster-standard/variables.tf. Trace authorized ranges through access_config.ip_access.authorized_ranges, then inspect modules/gke-nodepool for the machine type and confidential node settings. Run terraform plan and confirm the control plane range and node settings appear in the plan.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Bug Framework - FedRAMP High Level of Effort - Low Priority - High Scope - Blueprint Scope - Module Security

Bug Description

The blueprints/fedramp-high/gitlab/main.tf file passes attributes that the modules/gke-cluster-standard module never declared, so Terraform silently discards them:

  • vpc_config.master_authorized_ranges, which should restrict the control plane to 10.203.0.0/16;
  • default_nodepool.remove_default_node_pool, next to the declared remove_pool;
  • the node pool settings that the blueprint places in node_config, such as machine_type and confidential_nodes.

Environment and Deployment Context

  • Stellar Engine Version/Commit: main at commit 2b112119e
  • Deployment Type:
    • US Region Restricted (e.g., Access Policy constraint)
    • FedRAMP Moderate
    • FedRAMP High
    • DoD IL4
    • DoD IL5
    • Stand-alone / Custom
  • FAST Stage (if applicable):
    • Stage 0 (Bootstrap)
    • Stage 1 (Resource Management)
    • Stage 2 (Network Creation)
    • Stage 3 (Security and Audit)
  • Affected Component: blueprints/fedramp-high/gitlab, modules/gke-cluster-standard
  • Terraform Version: any; static analysis of the configuration
  • GCP Provider Version: any

Steps to Reproduce

  1. Read blueprints/fedramp-high/gitlab/main.tf, lines 220 to 250.
  2. Compare each attribute with the vpc_config, default_nodepool and node_config types in modules/gke-cluster-standard/variables.tf.
  3. Run terraform plan and inspect master_authorized_networks_config and the node configuration of the cluster.

Expected Behavior

The control plane admits only the configured internal range, and the nodes use the configured machine type and confidential nodes.

Actual Behavior

The plan has no authorized network for 10.203.0.0/16 and uses the module defaults for the node settings.

Relevant Logs and Errors

No error appears, because Terraform discards object attributes that a variable type does not declare.

Additional Context

  • On the current module, the authorized ranges belong under access_config.ip_access.authorized_ranges. After the upstream sync in #311, the same attribute applies.
  • Confidential nodes and the machine type belong to a node pool, for example through modules/gke-nodepool.
  • Found while migrating module callers in #311.
Lingua principale
HCL
Stelle
58
Fork
25
Merge medio
1g 16h
PR unite (30g)
59

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di google/stellar-engine

Tutte le issue di google/stellar-engine

Issue simili

Altre issue su Cloud

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.