From ee8ae023d050cb57e9c20a850293483c17449dd4 Mon Sep 17 00:00:00 2001
From: Ludovico Magnocavallo <ludomagno@google.com>
Date: Mon, 30 Mar 2026 09:24:58 +0200
Subject: [PATCH] fix(workstation-cluster): allow private_cluster_config to be
 null (#3821)

Fixes #3819 by changing the default of `private_cluster_config` to `null` instead of an empty object, preventing the module from unintentionally generating an empty `private_cluster_config` block and treating the cluster as private when it wasn't requested.
---
 modules/workstation-cluster/README.md                       | 6 +++---
 modules/workstation-cluster/variables.tf                    | 3 +--
 tests/modules/workstation_cluster/context.yaml              | 3 +--
 .../modules/workstation_cluster/examples/custom-image.yaml  | 3 +--
 tests/modules/workstation_cluster/examples/iam.yaml         | 3 +--
 tests/modules/workstation_cluster/examples/simple.yaml      | 3 +--
 6 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/modules/workstation-cluster/README.md b/modules/workstation-cluster/README.md
index c59cf17f3..7a513626e 100644
--- a/modules/workstation-cluster/README.md
+++ b/modules/workstation-cluster/README.md
@@ -175,15 +175,15 @@ module "workstation-cluster" {
 | [id](variables.tf#L59) | Workstation cluster ID. | <code>string</code> | ✓ |  |
 | [location](variables.tf#L70) | Location. | <code>string</code> | ✓ |  |
 | [network_config](variables.tf#L75) | Network configuration. | <code title="object&#40;&#123;&#10;  network    &#61; string&#10;  subnetwork &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ |  |
-| [project_id](variables.tf#L93) | Cluster ID. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L92) | Cluster ID. | <code>string</code> | ✓ |  |
 | [annotations](variables.tf#L17) | Workstation cluster annotations. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
 | [context](variables.tf#L23) | Context-specific interpolations. | <code title="object&#40;&#123;&#10;  condition_vars &#61; optional&#40;map&#40;map&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  custom_roles   &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  iam_principals &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  locations      &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  networks       &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  project_ids    &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;  subnetworks    &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [display_name](variables.tf#L38) | Display name. | <code>string</code> |  | <code>null</code> |
 | [domain](variables.tf#L44) | Domain. | <code>string</code> |  | <code>null</code> |
 | [factories_config](variables.tf#L50) | Path to folder with YAML resource description data files. | <code title="object&#40;&#123;&#10;  workstation_configs &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [labels](variables.tf#L64) | Workstation cluster labels. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
-| [private_cluster_config](variables.tf#L83) | Private cluster config. | <code title="object&#40;&#123;&#10;  enable_private_endpoint &#61; optional&#40;bool, false&#41;&#10;  allowed_projects        &#61; optional&#40;list&#40;string&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [workstation_configs](variables.tf#L98) | Workstation configurations. | <code title="map&#40;object&#40;&#123;&#10;  annotations        &#61; optional&#40;map&#40;string&#41;&#41;&#10;  display_name       &#61; optional&#40;string&#41;&#10;  enable_audit_agent &#61; optional&#40;bool&#41;&#10;  labels             &#61; optional&#40;map&#40;string&#41;&#41;&#10;  max_workstations   &#61; optional&#40;number&#41;&#10;  replica_zones      &#61; optional&#40;list&#40;string&#41;&#41;&#10;  container &#61; optional&#40;object&#40;&#123;&#10;    args        &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;    command     &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;    env         &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;    image       &#61; optional&#40;string&#41;&#10;    run_as_user &#61; optional&#40;string&#41;&#10;    working_dir &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  encryption_key &#61; optional&#40;object&#40;&#123;&#10;    kms_key                 &#61; string&#10;    kms_key_service_account &#61; string&#10;  &#125;&#41;&#41;&#10;  gce_instance &#61; optional&#40;object&#40;&#123;&#10;    boot_disk_size_gb            &#61; optional&#40;number&#41;&#10;    disable_public_ip_addresses  &#61; optional&#40;bool, false&#41;&#10;    enable_confidential_compute  &#61; optional&#40;bool, false&#41;&#10;    enable_nested_virtualization &#61; optional&#40;bool, false&#41;&#10;    machine_type                 &#61; optional&#40;string&#41;&#10;    pool_size                    &#61; optional&#40;number&#41;&#10;    service_account              &#61; optional&#40;string&#41;&#10;    service_account_scopes       &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;    tags                         &#61; optional&#40;list&#40;string&#41;&#41;&#10;    accelerators &#61; optional&#40;list&#40;object&#40;&#123;&#10;      type  &#61; optional&#40;string&#41;&#10;      count &#61; optional&#40;number&#41;&#10;    &#125;&#41;&#41;, &#91;&#93;&#41;&#10;    shielded_instance_config &#61; optional&#40;object&#40;&#123;&#10;      enable_secure_boot          &#61; optional&#40;bool, false&#41;&#10;      enable_vtpm                 &#61; optional&#40;bool, false&#41;&#10;      enable_integrity_monitoring &#61; optional&#40;bool, false&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;&#10;  iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    role    &#61; string&#10;    members &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    role   &#61; string&#10;    member &#61; string&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  persistent_directories &#61; optional&#40;list&#40;object&#40;&#123;&#10;    mount_path &#61; optional&#40;string&#41;&#10;    gce_pd &#61; optional&#40;object&#40;&#123;&#10;      size_gb         &#61; optional&#40;number&#41;&#10;      fs_type         &#61; optional&#40;string&#41;&#10;      disk_type       &#61; optional&#40;string&#41;&#10;      source_snapshot &#61; optional&#40;string&#41;&#10;      reclaim_policy  &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;  timeouts &#61; optional&#40;object&#40;&#123;&#10;    idle    &#61; optional&#40;number&#41;&#10;    running &#61; optional&#40;number&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  workstations &#61; optional&#40;map&#40;object&#40;&#123;&#10;    annotations  &#61; optional&#40;map&#40;string&#41;&#41;&#10;    display_name &#61; optional&#40;string&#41;&#10;    env          &#61; optional&#40;map&#40;string&#41;&#41;&#10;    iam          &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;      role    &#61; string&#10;      members &#61; list&#40;string&#41;&#10;    &#125;&#41;&#41;, &#123;&#125;&#41;&#10;    iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;      role   &#61; string&#10;      member &#61; string&#10;    &#125;&#41;&#41;, &#123;&#125;&#41;&#10;    labels &#61; optional&#40;map&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [private_cluster_config](variables.tf#L83) | Private cluster config. | <code title="object&#40;&#123;&#10;  enable_private_endpoint &#61; optional&#40;bool, false&#41;&#10;  allowed_projects        &#61; optional&#40;list&#40;string&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [workstation_configs](variables.tf#L97) | Workstation configurations. | <code title="map&#40;object&#40;&#123;&#10;  annotations        &#61; optional&#40;map&#40;string&#41;&#41;&#10;  display_name       &#61; optional&#40;string&#41;&#10;  enable_audit_agent &#61; optional&#40;bool&#41;&#10;  labels             &#61; optional&#40;map&#40;string&#41;&#41;&#10;  max_workstations   &#61; optional&#40;number&#41;&#10;  replica_zones      &#61; optional&#40;list&#40;string&#41;&#41;&#10;  container &#61; optional&#40;object&#40;&#123;&#10;    args        &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;    command     &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;    env         &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;    image       &#61; optional&#40;string&#41;&#10;    run_as_user &#61; optional&#40;string&#41;&#10;    working_dir &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  encryption_key &#61; optional&#40;object&#40;&#123;&#10;    kms_key                 &#61; string&#10;    kms_key_service_account &#61; string&#10;  &#125;&#41;&#41;&#10;  gce_instance &#61; optional&#40;object&#40;&#123;&#10;    boot_disk_size_gb            &#61; optional&#40;number&#41;&#10;    disable_public_ip_addresses  &#61; optional&#40;bool, false&#41;&#10;    enable_confidential_compute  &#61; optional&#40;bool, false&#41;&#10;    enable_nested_virtualization &#61; optional&#40;bool, false&#41;&#10;    machine_type                 &#61; optional&#40;string&#41;&#10;    pool_size                    &#61; optional&#40;number&#41;&#10;    service_account              &#61; optional&#40;string&#41;&#10;    service_account_scopes       &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;    tags                         &#61; optional&#40;list&#40;string&#41;&#41;&#10;    accelerators &#61; optional&#40;list&#40;object&#40;&#123;&#10;      type  &#61; optional&#40;string&#41;&#10;      count &#61; optional&#40;number&#41;&#10;    &#125;&#41;&#41;, &#91;&#93;&#41;&#10;    shielded_instance_config &#61; optional&#40;object&#40;&#123;&#10;      enable_secure_boot          &#61; optional&#40;bool, false&#41;&#10;      enable_vtpm                 &#61; optional&#40;bool, false&#41;&#10;      enable_integrity_monitoring &#61; optional&#40;bool, false&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;&#10;  iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    role    &#61; string&#10;    members &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    role   &#61; string&#10;    member &#61; string&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  persistent_directories &#61; optional&#40;list&#40;object&#40;&#123;&#10;    mount_path &#61; optional&#40;string&#41;&#10;    gce_pd &#61; optional&#40;object&#40;&#123;&#10;      size_gb         &#61; optional&#40;number&#41;&#10;      fs_type         &#61; optional&#40;string&#41;&#10;      disk_type       &#61; optional&#40;string&#41;&#10;      source_snapshot &#61; optional&#40;string&#41;&#10;      reclaim_policy  &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;  timeouts &#61; optional&#40;object&#40;&#123;&#10;    idle    &#61; optional&#40;number&#41;&#10;    running &#61; optional&#40;number&#41;&#10;  &#125;&#41;, &#123;&#125;&#41;&#10;  workstations &#61; optional&#40;map&#40;object&#40;&#123;&#10;    annotations  &#61; optional&#40;map&#40;string&#41;&#41;&#10;    display_name &#61; optional&#40;string&#41;&#10;    env          &#61; optional&#40;map&#40;string&#41;&#41;&#10;    iam          &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;    iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;      role    &#61; string&#10;      members &#61; list&#40;string&#41;&#10;    &#125;&#41;&#41;, &#123;&#125;&#41;&#10;    iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;      role   &#61; string&#10;      member &#61; string&#10;    &#125;&#41;&#41;, &#123;&#125;&#41;&#10;    labels &#61; optional&#40;map&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 
 ## Outputs
 
diff --git a/modules/workstation-cluster/variables.tf b/modules/workstation-cluster/variables.tf
index 38f448aa3..e6678eea4 100644
--- a/modules/workstation-cluster/variables.tf
+++ b/modules/workstation-cluster/variables.tf
@@ -86,8 +86,7 @@ variable "private_cluster_config" {
     enable_private_endpoint = optional(bool, false)
     allowed_projects        = optional(list(string))
   })
-  nullable = false
-  default  = {}
+  default = null
 }
 
 variable "project_id" {
diff --git a/tests/modules/workstation_cluster/context.yaml b/tests/modules/workstation_cluster/context.yaml
index d3dda752f..887181bb8 100644
--- a/tests/modules/workstation_cluster/context.yaml
+++ b/tests/modules/workstation_cluster/context.yaml
@@ -41,8 +41,7 @@ values:
     labels: null
     location: europe-west8
     network: projects/foo-dev-net-spoke-0/global/networks/dev-spoke-0
-    private_cluster_config:
-    - enable_private_endpoint: false
+    private_cluster_config: []
     project: dev-test-0
     subnetwork: projects/foo-dev-net-spoke-0/regions/europe-west8/subnetworks/default
     tags: null
diff --git a/tests/modules/workstation_cluster/examples/custom-image.yaml b/tests/modules/workstation_cluster/examples/custom-image.yaml
index bb1917cfd..a4ea2ca4f 100644
--- a/tests/modules/workstation_cluster/examples/custom-image.yaml
+++ b/tests/modules/workstation_cluster/examples/custom-image.yaml
@@ -36,8 +36,7 @@ values:
     labels: null
     location: europe-west8
     network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
-    private_cluster_config:
-    - enable_private_endpoint: false
+    private_cluster_config: []
     project: project-id
     subnetwork: subnet_self_link
     timeouts: null
diff --git a/tests/modules/workstation_cluster/examples/iam.yaml b/tests/modules/workstation_cluster/examples/iam.yaml
index 0510cd355..9e858b143 100644
--- a/tests/modules/workstation_cluster/examples/iam.yaml
+++ b/tests/modules/workstation_cluster/examples/iam.yaml
@@ -37,8 +37,7 @@ values:
     labels: null
     location: europe-west8
     network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
-    private_cluster_config:
-    - enable_private_endpoint: false
+    private_cluster_config: []
     project: project-id
     subnetwork: subnet_self_link
     timeouts: null
diff --git a/tests/modules/workstation_cluster/examples/simple.yaml b/tests/modules/workstation_cluster/examples/simple.yaml
index cd3651f15..379b4362d 100644
--- a/tests/modules/workstation_cluster/examples/simple.yaml
+++ b/tests/modules/workstation_cluster/examples/simple.yaml
@@ -36,8 +36,7 @@ values:
     labels: null
     location: europe-west8
     network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
-    private_cluster_config:
-    - enable_private_endpoint: false
+    private_cluster_config: []
     project: project-id
     subnetwork: subnet_self_link
     timeouts: null