Add support in GKE for DNS endpoint

[rosmo]

Add support in GKE for: control_plane_endpoints_config, gcp_public_cidrs_access, private_endpoint_enforcement

---

Checklist

I applicable, I acknowledge that I have:

• Read the contributing guide
• Ran terraform fmt on all modified files
• Regenerated the relevant README.md files using tools/tfdoc.py
• Made sure all relevant tests pass

[juliocc]

I know this aligns with what the API does, but I don't like the type of this variable. I'm also concerned that now we have endpoint configuration spread across multiple variables.

I really like what the UI is doing now:

Could we consider extending this variable to include all control plane endpoint configuration options (DNS, PSC, and PSA)?

Something like

variable "control_plane_endpoints_config" {
  description = "Configuration for all of the cluster's control plane endpoints."
  type = object({
    dns_endpoint = optional(object({...}))
    psc_endpoint = optional(object({...}))
    private_endpoint = optional(object({...}))
  })
}

I realize this is probably a larger change than what you had in mind. What do you think?

[rosmo]

I think it would be fine, though it makes a bit wary to differ a lot from the underlying Terraform resource (though granted, it has become a bit messy over the years). But it could look something like this:

variable "control_plane_endpoints_config" {
  description = "Configuration for all of the cluster's control plane endpoints."
  type = object({
    dns_endpoint = optional(object({
     allow_external_traffic = optional(bool) 
   }))
    psc_endpoint = optional(object({
      subnetwork = optional(string) # maps to vpc_config.master_endpoint_subnetwork
      # enabling PSC implies no master_ipv4_cidr_block, peering_configs etc
      master_global_access = optional(bool) #  maps to private_cluster_config.master_global_access, I think this is only for PSC?
   }))
    private_endpoint = optional(object({ # Maps to private_cluster_config.enable_private_endpoint 
     # put vpc_config.master_ipv4_cidr_block here too ?
     # and perhaps private_cluster_config.peering_config
   }))
   master_authorized_ranges = optional(map(string)) # maps to vpc_config.master_authorized_networks, top-level because it applies to public/private/PSC
  })
}

If we don't need backwards compatibility, it would be fairly straightforward I suppose.