Skip to content

Commit afcb54a

Browse files
modular-magicianmodular-magician
authored
add serverTLSpolicy to google_compute_region_target_https_proxy (#9105) (#7280)
[upstream:a9430683005fe7908171c8e537eb929985964f48] Signed-off-by: Modular Magician <[email protected]>
1 parent 0dc9aa9 commit afcb54a

File tree

3 files changed

+291
-2
lines changed

3 files changed

+291
-2
lines changed

‎google-beta/services/compute/resource_compute_region_target_https_proxy.go‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,21 @@ Accepted format is '//certificatemanager.googleapis.com/projects/{project}/locat
101101
DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
102102
Description: `The Region in which the created target https proxy should reside.
103103
If it is not provided, the provider region is used.`,
104+
},
105+
"server_tls_policy": {
106+
Type: schema.TypeString,
107+
Optional: true,
108+
ForceNew: true,
109+
DiffSuppressFunc: tpgresource.CompareSelfLinkOrResourceName,
110+
Description: `A URL referring to a networksecurity.ServerTlsPolicy
111+
resource that describes how the proxy should authenticate inbound
112+
traffic. serverTlsPolicy only applies to a global TargetHttpsProxy
113+
attached to globalForwardingRules with the loadBalancingScheme
114+
set to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.
115+
For details which ServerTlsPolicy resources are accepted with
116+
INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
117+
loadBalancingScheme consult ServerTlsPolicy documentation.
118+
If left blank, communications are not encrypted.`,
104119
},
105120
"ssl_certificates": {
106121
Type: schema.TypeList,
@@ -192,6 +207,12 @@ func resourceComputeRegionTargetHttpsProxyCreate(d *schema.ResourceData, meta in
192207
} else if v, ok := d.GetOkExists("url_map"); !tpgresource.IsEmptyValue(reflect.ValueOf(urlMapProp)) && (ok || !reflect.DeepEqual(v, urlMapProp)) {
193208
obj["urlMap"] = urlMapProp
194209
}
210+
serverTlsPolicyProp, err := expandComputeRegionTargetHttpsProxyServerTlsPolicy(d.Get("server_tls_policy"), d, config)
211+
if err != nil {
212+
return err
213+
} else if v, ok := d.GetOkExists("server_tls_policy"); !tpgresource.IsEmptyValue(reflect.ValueOf(serverTlsPolicyProp)) && (ok || !reflect.DeepEqual(v, serverTlsPolicyProp)) {
214+
obj["serverTlsPolicy"] = serverTlsPolicyProp
215+
}
195216
regionProp, err := expandComputeRegionTargetHttpsProxyRegion(d.Get("region"), d, config)
196217
if err != nil {
197218
return err
@@ -338,6 +359,9 @@ func resourceComputeRegionTargetHttpsProxyRead(d *schema.ResourceData, meta inte
338359
if err := d.Set("url_map", flattenComputeRegionTargetHttpsProxyUrlMap(res["urlMap"], d, config)); err != nil {
339360
return fmt.Errorf("Error reading RegionTargetHttpsProxy: %s", err)
340361
}
362+
if err := d.Set("server_tls_policy", flattenComputeRegionTargetHttpsProxyServerTlsPolicy(res["serverTlsPolicy"], d, config)); err != nil {
363+
return fmt.Errorf("Error reading RegionTargetHttpsProxy: %s", err)
364+
}
341365
if err := d.Set("region", flattenComputeRegionTargetHttpsProxyRegion(res["region"], d, config)); err != nil {
342366
return fmt.Errorf("Error reading RegionTargetHttpsProxy: %s", err)
343367
}
@@ -608,6 +632,13 @@ func flattenComputeRegionTargetHttpsProxyUrlMap(v interface{}, d *schema.Resourc
608632
return tpgresource.ConvertSelfLinkToV1(v.(string))
609633
}
610634

635+
func flattenComputeRegionTargetHttpsProxyServerTlsPolicy(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
636+
if v == nil {
637+
return v
638+
}
639+
return tpgresource.ConvertSelfLinkToV1(v.(string))
640+
}
641+
611642
func flattenComputeRegionTargetHttpsProxyRegion(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
612643
if v == nil {
613644
return v
@@ -680,6 +711,10 @@ func expandComputeRegionTargetHttpsProxyUrlMap(v interface{}, d tpgresource.Terr
680711
return f.RelativeLink(), nil
681712
}
682713

714+
func expandComputeRegionTargetHttpsProxyServerTlsPolicy(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
715+
return v, nil
716+
}
717+
683718
func expandComputeRegionTargetHttpsProxyRegion(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
684719
f, err := tpgresource.ParseGlobalFieldValue("regions", v.(string), "project", d, config, true)
685720
if err != nil {

‎google-beta/services/compute/resource_compute_region_target_https_proxy_generated_test.go‎

Lines changed: 133 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func TestAccComputeRegionTargetHttpsProxy_regionTargetHttpsProxyBasicExample(t *
4949
ResourceName: "google_compute_region_target_https_proxy.default",
5050
ImportState: true,
5151
ImportStateVerify: true,
52-
ImportStateVerifyIgnore: []string{"ssl_policy", "url_map", "region"},
52+
ImportStateVerifyIgnore: []string{"ssl_policy", "url_map", "server_tls_policy", "region"},
5353
},
5454
},
5555
})
@@ -114,6 +114,137 @@ resource "google_compute_region_health_check" "default" {
114114
`, context)
115115
}
116116

117+
func TestAccComputeRegionTargetHttpsProxy_regionTargetHttpsProxyMtlsExample(t *testing.T) {
118+
t.Parallel()
119+
120+
context := map[string]interface{}{
121+
"random_suffix": acctest.RandString(t, 10),
122+
}
123+
124+
acctest.VcrTest(t, resource.TestCase{
125+
PreCheck: func() { acctest.AccTestPreCheck(t) },
126+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
127+
CheckDestroy: testAccCheckComputeRegionTargetHttpsProxyDestroyProducer(t),
128+
Steps: []resource.TestStep{
129+
{
130+
Config: testAccComputeRegionTargetHttpsProxy_regionTargetHttpsProxyMtlsExample(context),
131+
},
132+
{
133+
ResourceName: "google_compute_region_target_https_proxy.default",
134+
ImportState: true,
135+
ImportStateVerify: true,
136+
ImportStateVerifyIgnore: []string{"ssl_policy", "url_map", "server_tls_policy", "region"},
137+
},
138+
},
139+
})
140+
}
141+
142+
func testAccComputeRegionTargetHttpsProxy_regionTargetHttpsProxyMtlsExample(context map[string]interface{}) string {
143+
return acctest.Nprintf(`
144+
data "google_project" "project" {
145+
provider = google-beta
146+
}
147+
148+
resource "google_compute_region_target_https_proxy" "default" {
149+
provider = google-beta
150+
region = "us-central1"
151+
name = "tf-test-test-mtls-proxy%{random_suffix}"
152+
url_map = google_compute_region_url_map.default.id
153+
ssl_certificates = [google_compute_region_ssl_certificate.default.id]
154+
server_tls_policy = google_network_security_server_tls_policy.default.id
155+
}
156+
157+
resource "google_certificate_manager_trust_config" "default" {
158+
provider = google-beta
159+
location = "us-central1"
160+
name = "tf-test-my-trust-config%{random_suffix}"
161+
description = "sample description for trust config"
162+
163+
trust_stores {
164+
trust_anchors {
165+
pem_certificate = file("test-fixtures/ca_cert.pem")
166+
}
167+
intermediate_cas {
168+
pem_certificate = file("test-fixtures/ca_cert.pem")
169+
}
170+
}
171+
172+
labels = {
173+
foo = "bar"
174+
}
175+
}
176+
177+
resource "google_network_security_server_tls_policy" "default" {
178+
provider = google-beta
179+
location = "us-central1"
180+
name = "tf-test-my-tls-policy%{random_suffix}"
181+
description = "my description"
182+
allow_open = "false"
183+
mtls_policy {
184+
client_validation_mode = "REJECT_INVALID"
185+
client_validation_trust_config = "projects/${data.google_project.project.number}/locations/us-central1/trustConfigs/${google_certificate_manager_trust_config.default.name}"
186+
}
187+
}
188+
189+
resource "google_compute_region_ssl_certificate" "default" {
190+
provider = google-beta
191+
region = "us-central1"
192+
name = "tf-test-my-certificate%{random_suffix}"
193+
private_key = file("test-fixtures/test.key")
194+
certificate = file("test-fixtures/test.crt")
195+
}
196+
197+
resource "google_compute_region_url_map" "default" {
198+
provider = google-beta
199+
region = "us-central1"
200+
name = "tf-test-url-map%{random_suffix}"
201+
description = "a description"
202+
203+
default_service = google_compute_region_backend_service.default.id
204+
205+
host_rule {
206+
hosts = ["mysite.com"]
207+
path_matcher = "allpaths"
208+
}
209+
210+
path_matcher {
211+
name = "allpaths"
212+
default_service = google_compute_region_backend_service.default.id
213+
214+
path_rule {
215+
paths = ["/*"]
216+
service = google_compute_region_backend_service.default.id
217+
}
218+
}
219+
}
220+
221+
resource "google_compute_region_backend_service" "default" {
222+
provider = google-beta
223+
region = "us-central1"
224+
name = "tf-test-backend-service%{random_suffix}"
225+
port_name = "http"
226+
protocol = "HTTP"
227+
timeout_sec = 10
228+
229+
load_balancing_scheme = "INTERNAL_MANAGED"
230+
231+
health_checks = [google_compute_region_health_check.default.id]
232+
}
233+
234+
resource "google_compute_region_health_check" "default" {
235+
provider = google-beta
236+
region = "us-central1"
237+
name = "tf-test-http-health-check%{random_suffix}"
238+
check_interval_sec = 1
239+
timeout_sec = 1
240+
241+
http_health_check {
242+
port = 80
243+
}
244+
}
245+
`, context)
246+
}
247+
117248
func TestAccComputeRegionTargetHttpsProxy_regionTargetHttpsProxyCertificateManagerCertificateExample(t *testing.T) {
118249
t.Parallel()
119250

@@ -133,7 +264,7 @@ func TestAccComputeRegionTargetHttpsProxy_regionTargetHttpsProxyCertificateManag
133264
ResourceName: "google_compute_region_target_https_proxy.default",
134265
ImportState: true,
135266
ImportStateVerify: true,
136-
ImportStateVerifyIgnore: []string{"ssl_policy", "url_map", "region"},
267+
ImportStateVerifyIgnore: []string{"ssl_policy", "url_map", "server_tls_policy", "region"},
137268
},
138269
},
139270
})

‎website/docs/r/compute_region_target_https_proxy.html.markdown‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,117 @@ resource "google_compute_region_health_check" "default" {
9494
}
9595
}
9696
```
97+
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
98+
<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=region_target_https_proxy_mtls&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
99+
<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
100+
</a>
101+
</div>
102+
## Example Usage - Region Target Https Proxy Mtls
103+
104+
105+
```hcl
106+
data "google_project" "project" {
107+
provider = google-beta
108+
}
109+
110+
resource "google_compute_region_target_https_proxy" "default" {
111+
provider = google-beta
112+
region = "us-central1"
113+
name = "test-mtls-proxy"
114+
url_map = google_compute_region_url_map.default.id
115+
ssl_certificates = [google_compute_region_ssl_certificate.default.id]
116+
server_tls_policy = google_network_security_server_tls_policy.default.id
117+
}
118+
119+
resource "google_certificate_manager_trust_config" "default" {
120+
provider = google-beta
121+
location = "us-central1"
122+
name = "my-trust-config"
123+
description = "sample description for trust config"
124+
125+
trust_stores {
126+
trust_anchors {
127+
pem_certificate = file("test-fixtures/ca_cert.pem")
128+
}
129+
intermediate_cas {
130+
pem_certificate = file("test-fixtures/ca_cert.pem")
131+
}
132+
}
133+
134+
labels = {
135+
foo = "bar"
136+
}
137+
}
138+
139+
resource "google_network_security_server_tls_policy" "default" {
140+
provider = google-beta
141+
location = "us-central1"
142+
name = "my-tls-policy"
143+
description = "my description"
144+
allow_open = "false"
145+
mtls_policy {
146+
client_validation_mode = "REJECT_INVALID"
147+
client_validation_trust_config = "projects/${data.google_project.project.number}/locations/us-central1/trustConfigs/${google_certificate_manager_trust_config.default.name}"
148+
}
149+
}
150+
151+
resource "google_compute_region_ssl_certificate" "default" {
152+
provider = google-beta
153+
region = "us-central1"
154+
name = "my-certificate"
155+
private_key = file("path/to/private.key")
156+
certificate = file("path/to/certificate.crt")
157+
}
158+
159+
resource "google_compute_region_url_map" "default" {
160+
provider = google-beta
161+
region = "us-central1"
162+
name = "url-map"
163+
description = "a description"
164+
165+
default_service = google_compute_region_backend_service.default.id
166+
167+
host_rule {
168+
hosts = ["mysite.com"]
169+
path_matcher = "allpaths"
170+
}
171+
172+
path_matcher {
173+
name = "allpaths"
174+
default_service = google_compute_region_backend_service.default.id
175+
176+
path_rule {
177+
paths = ["/*"]
178+
service = google_compute_region_backend_service.default.id
179+
}
180+
}
181+
}
182+
183+
resource "google_compute_region_backend_service" "default" {
184+
provider = google-beta
185+
region = "us-central1"
186+
name = "backend-service"
187+
port_name = "http"
188+
protocol = "HTTP"
189+
timeout_sec = 10
190+
191+
load_balancing_scheme = "INTERNAL_MANAGED"
192+
193+
health_checks = [google_compute_region_health_check.default.id]
194+
}
195+
196+
resource "google_compute_region_health_check" "default" {
197+
provider = google-beta
198+
region = "us-central1"
199+
name = "http-health-check"
200+
check_interval_sec = 1
201+
timeout_sec = 1
202+
203+
http_health_check {
204+
port = 80
205+
}
206+
}
207+
```
97208
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
98209
<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=region_target_https_proxy_certificate_manager_certificate&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
99210
<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
@@ -180,6 +291,18 @@ The following arguments are supported:
180291
the TargetHttpsProxy resource. If not set, the TargetHttpsProxy
181292
resource will not have any SSL policy configured.
182293

294+
* `server_tls_policy` -
295+
(Optional)
296+
A URL referring to a networksecurity.ServerTlsPolicy
297+
resource that describes how the proxy should authenticate inbound
298+
traffic. serverTlsPolicy only applies to a global TargetHttpsProxy
299+
attached to globalForwardingRules with the loadBalancingScheme
300+
set to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.
301+
For details which ServerTlsPolicy resources are accepted with
302+
INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
303+
loadBalancingScheme consult ServerTlsPolicy documentation.
304+
If left blank, communications are not encrypted.
305+
183306
* `region` -
184307
(Optional)
185308
The Region in which the created target https proxy should reside.

0 commit comments

Comments
 (0)