fix: nil pointer dereferences in private cluster reconciliation (v1.11.0-beta.0)

[pkieszcz]

Summary

Patches CAPG v1.11.0-beta.0 to fix nil pointer dereferences when creating/reconciling private GKE clusters with PSC (Private Service Connect) mode - i.e., when enablePrivateEndpoint: true without specifying controlPlaneCidrBlock.

Fixes

1. Creation path (NetworkConfig initialization)

In createCluster, cluster.NetworkConfig.DefaultEnablePrivateNodes was accessed before NetworkConfig was initialized.

Changes:

• Initialize NetworkConfig before accessing DefaultEnablePrivateNodes
• Set EnablePrivateNodes on PrivateClusterConfig to match (GCP SDK requires both fields to have the same value)

2. Reconciliation path (DesiredControlPlaneEndpointsConfig initialization)

In checkDiffAndPrepareUpdate, clusterUpdate.DesiredControlPlaneEndpointsConfig.IpEndpointsConfig.AuthorizedNetworksConfig was assigned without initializing the parent structs.

Changes:

• Initialize DesiredControlPlaneEndpointsConfig and IpEndpointsConfig before assigning AuthorizedNetworksConfig

Related upstream issues

• gcpmanagedcontrolplane panics on nil pointer dereference for PrivateClusters kubernetes-sigs/cluster-api-provider-gcp#1497
• WIP: fix: panic on gke private cluster creation kubernetes-sigs/cluster-api-provider-gcp#1503 (closed)
• fix: nil pointer dereferences in private cluster creation and reconciliation kubernetes-sigs/cluster-api-provider-gcp#1591 (our upstream PR)

Image

Built and pushed to Artifact Registry:

europe-central2-docker.pkg.dev/bitropy-management/images/capg-controller:v1.11.0-beta.0-patched

Rebuild instructions

git clone -b v1.11.0-beta.0-patched https://github.com/Bitropy/cluster-api-provider-gcp.git
cd cluster-api-provider-gcp
docker build -t europe-central2-docker.pkg.dev/bitropy-management/images/capg-controller:v1.11.0-beta.0-patched .
docker push europe-central2-docker.pkg.dev/bitropy-management/images/capg-controller:v1.11.0-beta.0-patched

Usage in CAPI Operator

In argocd/applicationsets/capi-operator.yaml:

infrastructure:
  gcp:
    version: v1.11.0-beta.0
    deployment:
      serviceAccountName: capg-manager
      containers:
      - name: manager
        imageUrl: europe-central2-docker.pkg.dev/bitropy-management/images/capg-controller:v1.11.0-beta.0-patched

GCPManagedControlPlane requirements

When using private endpoint, master_authorized_networks_config must be set in the GCPManagedControlPlane spec:

apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: GCPManagedControlPlane
spec:
  clusterNetwork:
    privateCluster:
      enablePrivateEndpoint: true
      enablePrivateNodes: true
  # Required when enablePrivateEndpoint is true
  master_authorized_networks_config:
    gcp_public_cidrs_access_enabled: false

Prerequisites

Grant Artifact Registry read access to the management cluster's compute service account:

gcloud artifacts repositories add-iam-policy-binding images \
  --project=bitropy-management \
  --location=europe-central2 \
  --member="serviceAccount:<PROJECT_NUMBER>-compute@developer.gserviceaccount.com" \
  --role="roles/artifactregistry.reader"