Bug in Terraform module to disable GKE logging

[yogeshsardana-ag]

TL;DR

I'm using GKE Terraform module https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/blob/main/modules/beta-private-cluster/cluster.tf#L104

When I try to disable GKE logging by passing logging_enabled_components as [] & logging_config as "none", no changes are observed & logging doesn't gets turned off, however if I tweak this with other values for logging_enabled_components attribute as defined in https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/blob/main/modules/beta-private-cluster/variables.tf#L948

those are accepted & changes can be observed, however, it's not accepting default value which is [], thinking it's a bug?

Expected behavior

Logging should be turned off when logging_enabled_components is passed as []

Observed behavior

No changes observed

Terraform Configuration

- Installed hashicorp/template v2.2.0 (unauthenticated)



- Installing microsoft/azuredevops v1.10.0...



- Installed microsoft/azuredevops v1.10.0 (unauthenticated)



- Installing hashicorp/external v2.3.5...



- Installed hashicorp/external v2.3.5 (unauthenticated)



- Installing hashicorp/helm v2.17.0...



- Installed hashicorp/helm v2.17.0 (unauthenticated)



- Installing hashicorp/google v6.50.0...



- Installed hashicorp/google v6.50.0 (unauthenticated)



- Installing hashicorp/tls v4.0.6...



- Installed hashicorp/tls v4.0.6 (unauthenticated)



- Installing hashicorp/google-beta v6.50.0...



- Installed hashicorp/google-beta v6.50.0 (unauthenticated)

Terraform Version

"terraform_version": "1.12.2"

Terraform Provider Versions

- Installed hashicorp/template v2.2.0 (unauthenticated)



- Installing microsoft/azuredevops v1.10.0...



- Installed microsoft/azuredevops v1.10.0 (unauthenticated)



- Installing hashicorp/external v2.3.5...



- Installed hashicorp/external v2.3.5 (unauthenticated)



- Installing hashicorp/helm v2.17.0...



- Installed hashicorp/helm v2.17.0 (unauthenticated)



- Installing hashicorp/google v6.50.0...



- Installed hashicorp/google v6.50.0 (unauthenticated)



- Installing hashicorp/tls v4.0.6...



- Installed hashicorp/tls v4.0.6 (unauthenticated)



- Installing hashicorp/google-beta v6.50.0...



- Installed hashicorp/google-beta v6.50.0 (unauthenticated)

Additional information

No response

[yogeshsardana-ag]

@DrFaust92

[apeabody]

Thanks for reaching out @yogeshsardana-ag!

Looking at the description of logging_enabled_components : List of services to monitor: SYSTEM_COMPONENTS, APISERVER, CONTROLLER_MANAGER, KCP_CONNECTION, KCP_SSHD, KCP_HPA, SCHEDULER, and WORKLOADS. Empty list is default GKE configuration.

Therefore setting logging_enabled_components to an empty list [] results in using the documented default GKE configuration for logging.

I do concur the option to completely disable logging could be beneficial, so I'll change this to a feature request.

---

To add this (breaking change!) feature I would suggest:

1. Support null for logging_enabled_components. This would also become the new logging_enabled_components default value.
2. [] would be repurposed as truly an empty list and now passed to logging_config.enable_components.
3. The dynamic "logging_config" for_each would be updated to check for !null rather than length()>0.
4. Migration example added to /docs, example of [] -> null.
5. Update the description of logging_enabled_components for the new behavior.