diff --git a/modules/gke-cluster-autopilot/README.md b/modules/gke-cluster-autopilot/README.md
index 78e15e6715..c7857755de 100644
--- a/modules/gke-cluster-autopilot/README.md
+++ b/modules/gke-cluster-autopilot/README.md
@@ -209,7 +209,7 @@ module "cluster-1" {
| [location](variables.tf#L110) | Autopilot clusters are always regional. | string | ✓ | |
| [name](variables.tf#L187) | Cluster name. | string | ✓ | |
| [project_id](variables.tf#L223) | Cluster project ID. | string | ✓ | |
-| [vpc_config](variables.tf#L239) | VPC-level configuration. | object({…}) | ✓ | |
+| [vpc_config](variables.tf#L245) | VPC-level configuration. | object({…}) | ✓ | |
| [backup_configs](variables.tf#L17) | Configuration for Backup for GKE. | object({…}) | | {} |
| [deletion_protection](variables.tf#L37) | Whether or not to allow Terraform to destroy the cluster. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. | bool | | true |
| [description](variables.tf#L44) | Cluster description. | string | | null |
@@ -225,6 +225,7 @@ module "cluster-1" {
| [node_locations](variables.tf#L202) | Zones in which the cluster's nodes are located. | list(string) | | [] |
| [private_cluster_config](variables.tf#L209) | Private cluster configuration. | object({…}) | | null |
| [release_channel](variables.tf#L228) | Release channel for GKE upgrades. Clusters created in the Autopilot mode must use a release channel. Choose between \"RAPID\", \"REGULAR\", and \"STABLE\". | string | | "REGULAR" |
+| [service_external_ips](variables.tf#L239) | Controls whether external ips specified by a service will be allowed. | bool | | true |
## Outputs
diff --git a/modules/gke-cluster-autopilot/main.tf b/modules/gke-cluster-autopilot/main.tf
index 4abd4ef491..626c52250e 100644
--- a/modules/gke-cluster-autopilot/main.tf
+++ b/modules/gke-cluster-autopilot/main.tf
@@ -58,6 +58,10 @@ resource "google_container_cluster" "cluster" {
}
}
+ service_external_ips_config {
+ enabled = var.service_external_ips
+ }
+
dynamic "authenticator_groups_config" {
for_each = var.enable_features.groups_for_rbac != null ? [""] : []
content {
diff --git a/modules/gke-cluster-autopilot/variables.tf b/modules/gke-cluster-autopilot/variables.tf
index fed9bd1ff2..c014356fb8 100644
--- a/modules/gke-cluster-autopilot/variables.tf
+++ b/modules/gke-cluster-autopilot/variables.tf
@@ -236,6 +236,12 @@ variable "release_channel" {
}
}
+variable "service_external_ips" {
+ description = "Controls whether external ips specified by a service will be allowed."
+ type = bool
+ default = true
+}
+
variable "vpc_config" {
description = "VPC-level configuration."
type = object({
diff --git a/modules/gke-cluster-standard/README.md b/modules/gke-cluster-standard/README.md
index 0cd7727f69..a08cd098b7 100644
--- a/modules/gke-cluster-standard/README.md
+++ b/modules/gke-cluster-standard/README.md
@@ -313,7 +313,7 @@ module "cluster-1" {
| [location](variables.tf#L211) | Cluster zone or region. | string | ✓ | |
| [name](variables.tf#L322) | Cluster name. | string | ✓ | |
| [project_id](variables.tf#L358) | Cluster project id. | string | ✓ | |
-| [vpc_config](variables.tf#L369) | VPC-level configuration. | object({…}) | ✓ | |
+| [vpc_config](variables.tf#L375) | VPC-level configuration. | object({…}) | ✓ | |
| [backup_configs](variables.tf#L17) | Configuration for Backup for GKE. | object({…}) | | {} |
| [cluster_autoscaling](variables.tf#L38) | Enable and configure limits for Node Auto-Provisioning with Cluster Autoscaler. | object({…}) | | null |
| [deletion_protection](variables.tf#L115) | Whether or not to allow Terraform to destroy the cluster. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the cluster will fail. | bool | | true |
@@ -331,6 +331,7 @@ module "cluster-1" {
| [node_locations](variables.tf#L337) | Zones in which the cluster's nodes are located. | list(string) | | [] |
| [private_cluster_config](variables.tf#L344) | Private cluster configuration. | object({…}) | | null |
| [release_channel](variables.tf#L363) | Release channel for GKE upgrades. | string | | null |
+| [service_external_ips](variables.tf#L369) | Controls whether external ips specified by a service will be allowed. | bool | | true |
## Outputs
diff --git a/modules/gke-cluster-standard/main.tf b/modules/gke-cluster-standard/main.tf
index 71d5eee2a1..763ec49b63 100644
--- a/modules/gke-cluster-standard/main.tf
+++ b/modules/gke-cluster-standard/main.tf
@@ -110,6 +110,9 @@ resource "google_container_cluster" "cluster" {
enabled = var.backup_configs.enable_backup_agent
}
}
+ service_external_ips_config {
+ enabled = var.service_external_ips
+ }
dynamic "authenticator_groups_config" {
for_each = var.enable_features.groups_for_rbac != null ? [""] : []
content {
diff --git a/modules/gke-cluster-standard/variables.tf b/modules/gke-cluster-standard/variables.tf
index 840dd5aeaa..c9358ddcb3 100644
--- a/modules/gke-cluster-standard/variables.tf
+++ b/modules/gke-cluster-standard/variables.tf
@@ -366,6 +366,12 @@ variable "release_channel" {
default = null
}
+variable "service_external_ips" {
+ description = "Controls whether external ips specified by a service will be allowed."
+ type = bool
+ default = true
+}
+
variable "vpc_config" {
description = "VPC-level configuration."
type = object({