GCP Terraform Misconfiguration: GKE Cluster Certificate-Based Authentication

A Terraform configuration enables certificate-based authentication on a GKE cluster.

By default, the certificate-based authentication is disabled on new clusters that run GKE version 1.12 and later. With certificate-based authentication, a user presents a certificate that the Kubernetes API server verifies with the specified certificate authority. However, there is no way to revoke the certificate when the user leaves or loses the credentials. This makes the certificate-based authentication unsuitable for end users.

Example 1: The following example Terraform configuration enables GKE client certificate-based authentication by setting issue_client_certificate to true in the master_auth block.

resource "google_container_cluster" "container_cluster_demo" {
...
  master_auth {
    client_certificate_config {
      issue_client_certificate = true
      ...
    }
    ...
  }
...
}