From 6930f5ac31010876a71281b98fb4d6cfa23581cc Mon Sep 17 00:00:00 2001
From: Isaac Hollander McCreery <ihmccreery@google.com>
Date: Fri, 1 Sep 2017 14:06:40 -0700
Subject: [PATCH] Allow metadata firewall & proxy on in GCE, off by default

---
 cluster/common.sh             | 10 ++++++++++
 cluster/gce/config-default.sh |  8 +++++---
 cluster/gce/config-test.sh    |  5 ++---
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/cluster/common.sh b/cluster/common.sh
index f4ed595fdff..d1b8fdbd917 100755
--- a/cluster/common.sh
+++ b/cluster/common.sh
@@ -743,6 +743,16 @@ EOF
   if [ -n "${ENABLE_CUSTOM_METRICS:-}" ]; then
     cat >>$file <<EOF
 ENABLE_CUSTOM_METRICS: $(yaml-quote ${ENABLE_CUSTOM_METRICS})
+EOF
+  fi
+  if [ -n "${ENABLE_METADATA_PROXY:-}" ]; then
+    cat >>$file <<EOF
+ENABLE_METADATA_PROXY: $(yaml-quote ${ENABLE_METADATA_PROXY})
+EOF
+  fi
+  if [ -n "${KUBE_FIREWALL_METADATA_SERVER:-}" ]; then
+    cat >>$file <<EOF
+KUBE_FIREWALL_METADATA_SERVER: $(yaml-quote ${KUBE_FIREWALL_METADATA_SERVER})
 EOF
   fi
   if [ -n "${FEATURE_GATES:-}" ]; then
diff --git a/cluster/gce/config-default.sh b/cluster/gce/config-default.sh
index f36066d0767..60a2419f9c1 100755
--- a/cluster/gce/config-default.sh
+++ b/cluster/gce/config-default.sh
@@ -140,9 +140,11 @@ if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then
 	NODE_LABELS="${NODE_LABELS},projectcalico.org/ds-ready=true"
 fi
 
-# Turn the simple metadata proxy on by default.
-ENABLE_METADATA_PROXY="${ENABLE_METADATA_PROXY:-simple}"
-if [[ ${ENABLE_METADATA_PROXY} != "false" ]]; then
+# Currently, ENABLE_METADATA_PROXY supports only "simple".  In the future, we
+# may add other options.
+ENABLE_METADATA_PROXY="${ENABLE_METADATA_PROXY:-}"
+# Apply the right node label if metadata proxy is on.
+if [[ ${ENABLE_METADATA_PROXY:-} == "simple" ]]; then
         NODE_LABELS="${NODE_LABELS},beta.kubernetes.io/metadata-proxy-ready=true"
 fi
 
diff --git a/cluster/gce/config-test.sh b/cluster/gce/config-test.sh
index c8ef2496fb2..6a4d18b173c 100755
--- a/cluster/gce/config-test.sh
+++ b/cluster/gce/config-test.sh
@@ -194,9 +194,8 @@ if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then
 	NODE_LABELS="$NODE_LABELS,projectcalico.org/ds-ready=true"
 fi
 
-# Turn the simple metadata proxy on by default.
-ENABLE_METADATA_PROXY="${ENABLE_METADATA_PROXY:-simple}"
-if [[ ${ENABLE_METADATA_PROXY} != "false" ]]; then
+# Apply the right node label if metadata proxy is on.
+if [[ ${ENABLE_METADATA_PROXY:-} == "simple" ]]; then
         NODE_LABELS="${NODE_LABELS},beta.kubernetes.io/metadata-proxy-ready=true"
 fi