IssueTracker

# Summary

We want to apply the Google Cloud related Kubernetes configuration in the same deployment manager manifest withing the cluster resource, that way we will be able to provide a working cluster in a fast and reproducible way.

This seems to be support by using `deploymentmanager.v2beta.typeProvider`, but when creating k8s resources with deployment manager on a Private Cluster with IP Alias running in a Shared VPC fails while reaching the Kubernetes Master endpoint with `ERROR_EXCLUDED_IP`.

## What is the expected correct behavior?

Deployment Manager creates the k8s resources by accessing to the Kubernetes API in the Master endpoint and applying the manifests described in the deployment to reach the desired state.

## What is the current bug behavior?

Deployment manager raises a `ERROR_EXCLUDED_IP` while creating the k8s resources.

## Steps to reproduce

1-. Spin up a Private Virtual Cluster in a Shared VPC and IP Alias enabled with Deployment Manager .

2-. Add Deployment Manager typeProvider for k8s APIs.

```jinja
{% set K8S_ENDPOINTS = {
    'v1': 'api/v1',
    'apps-v1beta1': 'apis/apps/v1beta1',
    'extensions-v1beta1': 'apis/extensions/v1beta1',
    'rbac-v1': 'apis/rbac.authorization.k8s.io/v1',
  }
%}

{% for typeSuffix, endpoint in K8S_ENDPOINTS.iteritems() %}
- name: k8s-{{ typeSuffix }}-type
  type: deploymentmanager.v2beta.typeProvider
  properties:
    options:
      validationOptions:
        schemaValidation: IGNORE_WITH_WARNINGS
      inputMappings:
      - fieldName: name
        location: PATH
        methodMatch: ^(GET|DELETE|PUT)$
        value: $.ifNull($.resource.properties.metadata.name, $.resource.name)
      - fieldName: metadata.name
        location: BODY
        methodMatch: ^(PUT|POST)$
        value: $.ifNull($.resource.properties.metadata.name, $.resource.name)
      - fieldName: Authorization
        location: HEADER
        value: >
          $.concat("Bearer ", $.googleOauth2AccessToken())
    descriptorUrl: https://$(ref.gke-cluster.endpoint)/swaggerapi/{{ endpoint }}
  metadata:
    dependsOn:
      - gke-cluster
{% endfor %}

4-. Add a k8s type such as a ConfigMap.

```
{% set K8S_CONFIGMAPS_COLLECTION = '/api/v1/namespaces/{namespace}/configmaps' %}

- name: k8s-ip-masq-agent-configmap
  type: {{ env.project }}/k8s-v1-type:{{ K8S_CONFIGMAPS_COLLECTION }}
  properties:
    apiVersion: v1
    kind: ConfigMap
    namespace: kube-system
    metadata:
      name: ip-masq-agent
      namespace: kube-system
    data:
      config: |
        nonMasqueradeCIDRs:
        - 10.20.30.40/21
        resyncInterval: 60s
  metadata:
    dependsOn:
      - k8s-v1-type
```

5-. Update the deployment with Deployment Manager, it will raise a `ERROR_EXCLUDED_IP` while trying to reach the master endpoint.

```bash
ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1540676776334-5793cc3f792b0-8f737bb6-92faa03b]: errors:
- code: ERROR_PROCESSING_REQUEST
  message: 'Error fetching URL https://172.23.0.98:443/api/v1/namespaces/default/services,
    reason: ERROR_EXCLUDED_IP'
```

## Relevant logs and/or screenshots

```bash
ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1540676776334-5793cc3f792b0-8f737bb6-92faa03b]: errors:
- code: ERROR_PROCESSING_REQUEST
  message: 'Error fetching URL https://172.23.0.98:443/api/v1/namespaces/default/services,
    reason: ERROR_EXCLUDED_IP'
```

## Workarounds

None found so far, apart from setting the cluster public. This issue has been reproduced both in GKE 1.10.6 and 1.10.7.