gcloud container clusters update CLUSTER_NAME --enable-metadata-concealment=false

gcloud container clusters describe CLUSTER_NAME --format="value(masterAuth.clusterCaCertificate)"

pip install google-auth google-auth-oauthlib google-auth-httplib2 google-cloud-container

from google.oauth2 import service_account
from google.cloud import container_v1

credentials = service_account.Credentials.from_service_account_file('<path-to-service-account-key.json>')
client = container_v1.ClusterManagerClient(credentials=credentials)

project_id = '<your-project-id>'
zone = '<your-zone>'
cluster_id = '<your-cluster-id>'

cluster = client.get_cluster(project_id, zone, cluster_id)

if cluster.private_cluster_config.enable_private_endpoint:
    print('GKE Metadata Server is already enabled')
else:
    print('GKE Metadata Server is not enabled')

cluster.private_cluster_config.enable_private_endpoint = True

update_request = container_v1.types.UpdateClusterRequest(
    project_id=project_id,
    zone=zone,
    cluster_id=cluster_id,
    update=cluster,
)

operation = client.update_cluster(update_request)

print('Waiting for operation to complete...')
operation.result()

print('GKE Metadata Server has been enabled')

resource "google_container_cluster" "PRIMARY_CLUSTER" {
  name     = "PRIMARY_CLUSTER_NAME"          # replace with your cluster name
  location = "GCP_REGION_OR_ZONE"            # e.g. "us-central1" or "us-central1-c"
  project  = "GCP_PROJECT_ID"                # replace with your project ID

  # If using the default node pool (not recommended for production), you must
  # set workload_metadata_config there; example shown in a separate node pool
  # resource below for clarity.
  remove_default_node_pool = true
  initial_node_count       = 1

  # Optional but recommended for Workload Identity
  workload_identity_config {
    workload_pool = "GCP_PROJECT_ID.svc.id.goog"  # replace with your project ID
  }

  # ...other cluster settings...
}

resource "google_container_node_pool" "PRIMARY_NODE_POOL" {
  name       = "PRIMARY_NODE_POOL_NAME"      # replace with your node pool name
  cluster    = google_container_cluster.PRIMARY_CLUSTER.name
  location   = google_container_cluster.PRIMARY_CLUSTER.location
  project    = google_container_cluster.PRIMARY_CLUSTER.project
  node_count = 3                             # adjust as needed

  node_config {
    machine_type = "e2-medium"

    # This block enables the GKE Metadata Server for workloads on this node pool
    workload_metadata_config {
      mode = "GKE_METADATA"
    }
  }

  # ...other node pool settings...
}