Skip to content

Create the e2e GKE cluster with private nodes and no public control-plane IP #845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wallrj-cyberark merged 1 commit into from
Oct 6, 2026
Merged

Create the e2e GKE cluster with private nodes and no public control-plane IP #845

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions hack/e2e/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,23 @@ source release.env
popd

export USE_GKE_GCLOUD_AUTH_PLUGIN=True
if ! gcloud container clusters get-credentials "${CLUSTER_NAME}"; then

# The project's org policy forbids GKE nodes with public IPs and a public
# control-plane IP. The nodes rely on a Cloud NAT in the default network to
# reach the Venafi API and the image registries. The DNS endpoint is reachable
# from the GitHub runner and is authorised with IAM.
# Why?: https://cloud.google.com/kubernetes-engine/docs/concepts/network-isolation#dns-based_endpoint
if ! gcloud container clusters describe "${CLUSTER_NAME}" &>/dev/null; then
gcloud container clusters create "${CLUSTER_NAME}" \
--preemptible \
--machine-type e2-small \
--num-nodes 3
--num-nodes 3 \
--enable-ip-alias \
--enable-private-nodes \
--enable-private-endpoint \
--enable-dns-access
fi
gcloud container clusters get-credentials "${CLUSTER_NAME}" --dns-endpoint
kubectl create ns venafi || true

# Pull secret for Venafi OCI registry
Expand Down
Loading