GCP Terraform Misconfiguration: Weak GKE Cluster Network Management

A Terraform configuration does not set the cluster network mode to VPC-native.

GKE supports two cluster network modes: routes-based and VPC-native. VPC-native clusters use alias IP address ranges to route traffic from one Pod in a node to another Pod. This allows precise IP-based policies and firewall rules for Pods. In contrast, an entire node is the finest granularity level of control in routes-based clusters.

Example 1: The following example Terraform configuration does not enable a VPC-native cluster by setting networking_mode to ROUTES.

resource "google_container_cluster" "cluster_demo" {
...
  networking_mode = "ROUTES"
..
}