From 062ef1ba60451a8c5009ff4b8f207ad4e635c88b Mon Sep 17 00:00:00 2001 From: Ludo Date: Thu, 26 Oct 2023 09:56:56 +0200 Subject: [PATCH 1/3] update changelog --- CHANGELOG.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8db6afb3..735b6c7e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ All notable changes to this project will be documented in this file. ### BLUEPRINTS +- [[#1812](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1812)] Stop wrapping yamldecode with try() ([sruffilli](https://github.com/sruffilli)) +- [[#1806](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1806)] Updating network dashboard: fixing Cloud SQL problem, fixing 1 metric… ([aurelienlegrand](https://github.com/aurelienlegrand)) +- [[#1796](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1796)] Make extended shared vpc attributes optional in project factory ([ludoo](https://github.com/ludoo)) +- [[#1782](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1782)] Add upper cap to versions, update copyright notices ([sruffilli](https://github.com/sruffilli)) - [[#1765](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1765)] Add support for dual stack and multiple forwarding rules to net-lb-int module ([LucaPrete](https://github.com/LucaPrete)) - [[#1748](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1748)] Bump golang.org/x/net from 0.7.0 to 0.17.0 in /blueprints/cloud-operations/unmanaged-instances-healthcheck/function/restarter ([dependabot[bot]](https://github.com/dependabot[bot])) - [[#1747](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1747)] Bump golang.org/x/net from 0.7.0 to 0.17.0 in /blueprints/cloud-operations/unmanaged-instances-healthcheck/function/healthchecker ([dependabot[bot]](https://github.com/dependabot[bot])) @@ -15,10 +19,23 @@ All notable changes to this project will be documented in this file. ### DOCUMENTATION +- [[#1782](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1782)] Add upper cap to versions, update copyright notices ([sruffilli](https://github.com/sruffilli)) +- [[#1773](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1773)] Add service usage consumer role to IaC SAs, refactor delegated grants in FAST ([ludoo](https://github.com/ludoo)) - [[#1743](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1743)] Billing account module ([ludoo](https://github.com/ludoo)) ### FAST +- [[#1812](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1812)] Stop wrapping yamldecode with try() ([sruffilli](https://github.com/sruffilli)) +- [[#1810](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1810)] FAST: Add access transparency logs to the default sinks ([sruffilli](https://github.com/sruffilli)) +- [[#1809](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1809)] FAST: Add VPC serverless connector NAT ranges to hierarchical fw ([sruffilli](https://github.com/sruffilli)) +- [[#1811](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1811)] FAST: removed references to kms_defaults ([sruffilli](https://github.com/sruffilli)) +- [[#1802](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1802)] Less verbose project factory stage outputs ([ludoo](https://github.com/ludoo)) +- [[#1797](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1797)] Improve usage of optionals in FAST stage 2 VPN variables ([ludoo](https://github.com/ludoo)) +- [[#1788](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1788)] FAST: adds support for wif provider pubkey ([sruffilli](https://github.com/sruffilli)) +- [[#1782](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1782)] Add upper cap to versions, update copyright notices ([sruffilli](https://github.com/sruffilli)) +- [[#1780](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1780)] Add sink for workspace logs to bootstrap stage ([ludoo](https://github.com/ludoo)) +- [[#1775](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1775)] Add gcp org policy constraints file to bootstrap stage ([ludoo](https://github.com/ludoo)) +- [[#1773](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1773)] Add service usage consumer role to IaC SAs, refactor delegated grants in FAST ([ludoo](https://github.com/ludoo)) - [[#1765](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1765)] Add support for dual stack and multiple forwarding rules to net-lb-int module ([LucaPrete](https://github.com/LucaPrete)) - [[#1760](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1760)] Add support for psa peered domains to fast stages ([ludoo](https://github.com/ludoo)) - [[#1759](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1759)] Minor edits to FAST network stage READMEs ([ludoo](https://github.com/ludoo)) @@ -29,6 +46,20 @@ All notable changes to this project will be documented in this file. ### MODULES +- [[#1812](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1812)] Stop wrapping yamldecode with try() ([sruffilli](https://github.com/sruffilli)) +- [[#1750](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1750)] AI models support ([ewojtach](https://github.com/ewojtach)) +- [[#1798](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1798)] Fix Apigee add-ons configuration ([mwarm2](https://github.com/mwarm2)) +- [[#1808](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1808)] Allow setting `enable_private_nodes` in GKE nodepool pod range ([ludoo](https://github.com/ludoo)) +- [[#1805](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1805)] net-lb-ext: Add option to set IPv6 subnetwork for IPv6 external fw rules ([LucaPrete](https://github.com/LucaPrete)) +- [[#1804](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1804)] compute-vm: remove old todo ([LucaPrete](https://github.com/LucaPrete)) +- [[#1803](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1803)] use the repository format in the image_path output ([Tutuchan](https://github.com/Tutuchan)) +- [[#1801](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1801)] Fix Internal App LB serverless NEG backend example ([juliocc](https://github.com/juliocc)) +- [[#1795](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1795)] Allow users to optonally specify address names ([LucaPrete](https://github.com/LucaPrete)) +- [[#1792](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1792)] Removed unnecessary try statements from apigee module outputs ([apichick](https://github.com/apichick)) +- [[#1786](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1786)] net-lb-ext: add support for multiple forwarding rules (IPs) and dual-stack (IPv4/IPv6) ([LucaPrete](https://github.com/LucaPrete)) +- [[#1782](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1782)] Add upper cap to versions, update copyright notices ([sruffilli](https://github.com/sruffilli)) +- [[#1774](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1774)] Added ProtectedApplication feature to GKE Backup ([luigi-bitonti](https://github.com/luigi-bitonti)) +- [[#1775](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1775)] Add gcp org policy constraints file to bootstrap stage ([ludoo](https://github.com/ludoo)) - [[#1771](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1771)] Fix resource manager tag bindings in compute-vm module ([ludoo](https://github.com/ludoo)) - [[#1769](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1769)] Remove incompatible balancing_mode ([wiktorn](https://github.com/wiktorn)) - [[#1765](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1765)] Add support for dual stack and multiple forwarding rules to net-lb-int module ([LucaPrete](https://github.com/LucaPrete)) @@ -49,6 +80,8 @@ All notable changes to this project will be documented in this file. ### TOOLS +- [[#1782](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1782)] Add upper cap to versions, update copyright notices ([sruffilli](https://github.com/sruffilli)) +- [[#1751](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1751)] End-to-end tests for terraform modules ([wiktorn](https://github.com/wiktorn)) - [[#1737](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1737)] Enforce mandatory types in all variables ([juliocc](https://github.com/juliocc)) - [[#1734](https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/pull/1734)] Update to lint.sh and wording to some tf ([bluPhy](https://github.com/bluPhy)) From 30d7126b835bd266ee0a3268a073cfcfd93a10e5 Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Thu, 26 Oct 2023 16:09:03 +0200 Subject: [PATCH 2/3] Allow specifying arbitrary project roles for service accounts in project factory (#1814) * allow specifying arbitrary project roles for service accounts in project factory * tfdoc --- blueprints/factories/project-factory/README.md | 18 +++++++++++------- .../factories/project-factory/factory.tf | 7 ++++--- blueprints/factories/project-factory/main.tf | 18 ++++++------------ .../factories/project-factory/variables.tf | 9 ++++++--- 4 files changed, 27 insertions(+), 25 deletions(-) diff --git a/blueprints/factories/project-factory/README.md b/blueprints/factories/project-factory/README.md index 3a1219b2..d2d07c43 100644 --- a/blueprints/factories/project-factory/README.md +++ b/blueprints/factories/project-factory/README.md @@ -59,7 +59,7 @@ module "project-factory" { data_path = "data" } } -# tftest modules=6 resources=15 files=prj-app-1,prj-app-2 +# tftest modules=6 resources=17 files=prj-app-1,prj-app-2 ``` ```yaml @@ -74,8 +74,12 @@ service_encryption_key_ids: services: - storage.googleapis.com service_accounts: - app-1-be: {} - app-1-fe: {} + app-1-be: + iam_project_roles: + - roles/logging.logWriter + - roles/monitoring.metricWriter + app-1-fe: + display_name: "Test app 1 frontend." # tftest-file id=prj-app-1 path=data/prj-app-1.yaml ``` @@ -104,10 +108,10 @@ shared_vpc_service_config: | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [factory_data](variables.tf#L85) | Project data from either YAML files or externally parsed data. | object({…}) | ✓ | | -| [data_defaults](variables.tf#L17) | Optional default values used when corresponding project data from files are missing. | object({…}) | | {} | -| [data_merges](variables.tf#L45) | Optional values that will be merged with corresponding data from files. Combines with `data_defaults`, file data, and `data_overrides`. | object({…}) | | {} | -| [data_overrides](variables.tf#L64) | Optional values that override corresponding data from files. Takes precedence over file data and `data_defaults`. | object({…}) | | {} | +| [factory_data](variables.tf#L88) | Project data from either YAML files or externally parsed data. | object({…}) | ✓ | | +| [data_defaults](variables.tf#L17) | Optional default values used when corresponding project data from files are missing. | object({…}) | | {} | +| [data_merges](variables.tf#L46) | Optional values that will be merged with corresponding data from files. Combines with `data_defaults`, file data, and `data_overrides`. | object({…}) | | {} | +| [data_overrides](variables.tf#L66) | Optional values that override corresponding data from files. Takes precedence over file data and `data_defaults`. | object({…}) | | {} | ## Outputs diff --git a/blueprints/factories/project-factory/factory.tf b/blueprints/factories/project-factory/factory.tf index d966d6d8..e0351a0a 100644 --- a/blueprints/factories/project-factory/factory.tf +++ b/blueprints/factories/project-factory/factory.tf @@ -101,9 +101,10 @@ locals { service_accounts = flatten([ for k, v in local.projects : [ for name, opts in v.service_accounts : { - project = k - name = name - options = opts + project = k + name = name + display_name = try(opts.display_name, "Terraform-managed.") + iam_project_roles = try(opts.iam_project_roles, null) } ] ]) diff --git a/blueprints/factories/project-factory/main.tf b/blueprints/factories/project-factory/main.tf index eb8833a4..81f1d316 100644 --- a/blueprints/factories/project-factory/main.tf +++ b/blueprints/factories/project-factory/main.tf @@ -69,16 +69,10 @@ module "service-accounts" { for_each = { for k in local.service_accounts : "${k.project}-${k.name}" => k } - name = each.value.name - project_id = module.projects[each.value.project].project_id - iam_project_roles = ( - try(each.value.options.default_roles, null) == null - ? {} - : { - (module.projects[each.value.project].project_id) = [ - "roles/logging.logWriter", - "roles/monitoring.metricWriter" - ] - } - ) + project_id = module.projects[each.value.project].project_id + name = each.value.name + display_name = each.value.display_name + iam_project_roles = each.value.iam_project_roles == null ? {} : { + (module.projects[each.value.project].project_id) = each.value.iam_project_roles + } } diff --git a/blueprints/factories/project-factory/variables.tf b/blueprints/factories/project-factory/variables.tf index d7176474..55578562 100644 --- a/blueprints/factories/project-factory/variables.tf +++ b/blueprints/factories/project-factory/variables.tf @@ -35,7 +35,8 @@ variable "data_defaults" { tag_bindings = optional(map(string), {}) # non-project resources service_accounts = optional(map(object({ - default_roles = optional(bool, true) + display_name = optional(string, "Terraform-managed.") + iam_project_roles = optional(list(string)) })), {}) }) nullable = false @@ -54,7 +55,8 @@ variable "data_merges" { tag_bindings = optional(map(string), {}) # non-project resources service_accounts = optional(map(object({ - default_roles = optional(bool, true) + display_name = optional(string, "Terraform-managed.") + iam_project_roles = optional(list(string)) })), {}) }) nullable = false @@ -75,7 +77,8 @@ variable "data_overrides" { services = optional(list(string)) # non-project resources service_accounts = optional(map(object({ - default_roles = optional(bool, true) + display_name = optional(string, "Terraform-managed.") + iam_project_roles = optional(list(string)) }))) }) nullable = false From d0b1ced28053fe7546eb3b7d726b51f1bd8e0938 Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Thu, 26 Oct 2023 17:25:36 +0200 Subject: [PATCH 3/3] fix logic for default source range in firewall ingress rules (#1815) --- modules/net-vpc-firewall/README.md | 13 +++++++++++++ modules/net-vpc-firewall/main.tf | 2 +- .../modules/net_vpc_firewall/examples/factory.yaml | 2 -- 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/modules/net-vpc-firewall/README.md b/modules/net-vpc-firewall/README.md index 235f1ebc..8198b100 100644 --- a/modules/net-vpc-firewall/README.md +++ b/modules/net-vpc-firewall/README.md @@ -7,6 +7,19 @@ This module allows creation and management of different types of firewall rules The predefined rules are enabled by default and set to the ranges of the GCP health checkers for HTTP/HTTPS, and the IAP forwarders for SSH. See the relevant section below on how to configure or disable them. + +- [Examples](#examples) + - [Minimal open firewall](#minimal-open-firewall) + - [Custom rules](#custom-rules) + - [Controlling or turning off default rules](#controlling-or-turning-off-default-rules) + - [Overriding default tags and ranges](#overriding-default-tags-and-ranges) + - [Disabling predefined rules](#disabling-predefined-rules) + - [Including source & destination ranges](#including-source-destination-ranges) + - [Rules Factory](#rules-factory) +- [Variables](#variables) +- [Outputs](#outputs) + + ## Examples ### Minimal open firewall diff --git a/modules/net-vpc-firewall/main.tf b/modules/net-vpc-firewall/main.tf index 5f7a95b5..f3faac9f 100644 --- a/modules/net-vpc-firewall/main.tf +++ b/modules/net-vpc-firewall/main.tf @@ -97,7 +97,7 @@ resource "google_compute_firewall" "custom-rules" { source_ranges = ( each.value.direction == "INGRESS" ? ( - each.value.source_ranges == null + each.value.source_ranges == null && each.value.sources == null ? ["0.0.0.0/0"] : each.value.source_ranges ) diff --git a/tests/modules/net_vpc_firewall/examples/factory.yaml b/tests/modules/net_vpc_firewall/examples/factory.yaml index 389fb52a..73a095dd 100644 --- a/tests/modules/net_vpc_firewall/examples/factory.yaml +++ b/tests/modules/net_vpc_firewall/examples/factory.yaml @@ -53,8 +53,6 @@ values: network: my-network priority: 1000 project: my-project - source_ranges: - - 0.0.0.0/0 source_service_accounts: - service-1@my-project.iam.gserviceaccount.com source_tags: null