Skip to content

Commit 350936a

Browse files
modular-magicianmodular-magician
authored
Update example of usage of Authz Policy (#12724) (#20876)
[upstream:38b66824452ad607339253f2f1f1d714567d6b17] Signed-off-by: Modular Magician <[email protected]>
1 parent 695f452 commit 350936a

File tree

3 files changed

+207
-0
lines changed

3 files changed

+207
-0
lines changed

‎.changelog/12724.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note: none
2+
3+
```

‎google/services/networksecurity/resource_network_security_authz_policy_generated_test.go

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,78 @@ resource "google_compute_subnetwork" "proxy_only" {
8383
network = google_compute_network.default.id
8484
}
8585
86+
resource "google_compute_instance" "callouts_instance" {
87+
name = "tf-test-l7-ilb-callouts-ins%{random_suffix}"
88+
zone = "us-west1-a"
89+
machine_type = "e2-small"
90+
tags = ["allow-ssh","load-balanced-backend"]
91+
deletion_protection = false
92+
93+
labels = {
94+
"container-vm" = "cos-stable-109-17800-147-54"
95+
}
96+
97+
network_interface {
98+
network = google_compute_network.default.id
99+
subnetwork = google_compute_subnetwork.default.id
100+
access_config {
101+
# add external ip to fetch packages
102+
}
103+
104+
}
105+
106+
boot_disk {
107+
auto_delete = true
108+
initialize_params {
109+
type = "pd-standard"
110+
size = 10
111+
image = "https://www.googleapis.com/compute/v1/projects/cos-cloud/global/images/cos-stable-109-17800-147-54"
112+
}
113+
}
114+
115+
metadata = {
116+
gce-container-declaration = "# DISCLAIMER:\n# This container declaration format is not a public API and may change without\n# notice. Please use gcloud command-line tool or Google Cloud Console to run\n# Containers on Google Compute Engine.\n\nspec:\n containers:\n - image: us-docker.pkg.dev/service-extensions/ext-proc/service-callout-basic-example-python:latest\n name: callouts-vm\n securityContext:\n privileged: false\n stdin: false\n tty: false\n volumeMounts: []\n restartPolicy: Always\n volumes: []\n"
117+
google-logging-enabled = "true"
118+
}
119+
120+
lifecycle {
121+
create_before_destroy = true
122+
}
123+
}
124+
125+
resource "google_compute_instance_group" "callouts_instance_group" {
126+
name = "tf-test-l7-ilb-callouts-ins-group%{random_suffix}"
127+
description = "Terraform test instance group"
128+
zone = "us-west1-a"
129+
130+
instances = [
131+
google_compute_instance.callouts_instance.id,
132+
]
133+
134+
named_port {
135+
name = "http"
136+
port = "80"
137+
}
138+
139+
named_port {
140+
name = "grpc"
141+
port = "443"
142+
}
143+
}
144+
145+
resource "google_compute_region_health_check" "callouts_health_check" {
146+
name = "tf-test-l7-ilb-callouts-healthcheck%{random_suffix}"
147+
region = "us-west1"
148+
149+
http_health_check {
150+
port = 80
151+
}
152+
153+
depends_on = [
154+
google_compute_region_health_check.default
155+
]
156+
}
157+
86158
resource "google_compute_address" "default" {
87159
name = "tf-test-l7-ilb-ip-address%{random_suffix}"
88160
project = "%{project}"
@@ -148,6 +220,13 @@ resource "google_compute_region_backend_service" "authz_extension" {
148220
protocol = "HTTP2"
149221
load_balancing_scheme = "INTERNAL_MANAGED"
150222
port_name = "grpc"
223+
224+
health_checks = [google_compute_region_health_check.callouts_health_check.id]
225+
backend {
226+
group = google_compute_instance_group.callouts_instance_group.id
227+
balancing_mode = "UTILIZATION"
228+
capacity_scaler = 1.0
229+
}
151230
}
152231
153232
resource "google_network_services_authz_extension" "default" {
@@ -181,6 +260,29 @@ resource "google_network_security_authz_policy" "default" {
181260
resources = [ google_network_services_authz_extension.default.id ]
182261
}
183262
}
263+
264+
http_rules {
265+
from {
266+
not_sources {
267+
principals {
268+
exact = "dummy-principal"
269+
}
270+
}
271+
}
272+
to {
273+
operations {
274+
header_set {
275+
headers {
276+
name = "test-header"
277+
value {
278+
exact = "test-value"
279+
ignore_case = true
280+
}
281+
}
282+
}
283+
}
284+
}
285+
}
184286
}
185287
`, context)
186288
}

‎website/docs/r/network_security_authz_policy.html.markdown

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,78 @@ resource "google_compute_subnetwork" "proxy_only" {
5454
network = google_compute_network.default.id
5555
}
5656
57+
resource "google_compute_instance" "callouts_instance" {
58+
name = "l7-ilb-callouts-ins"
59+
zone = "us-west1-a"
60+
machine_type = "e2-small"
61+
tags = ["allow-ssh","load-balanced-backend"]
62+
deletion_protection = false
63+
64+
labels = {
65+
"container-vm" = "cos-stable-109-17800-147-54"
66+
}
67+
68+
network_interface {
69+
network = google_compute_network.default.id
70+
subnetwork = google_compute_subnetwork.default.id
71+
access_config {
72+
# add external ip to fetch packages
73+
}
74+
75+
}
76+
77+
boot_disk {
78+
auto_delete = true
79+
initialize_params {
80+
type = "pd-standard"
81+
size = 10
82+
image = "https://www.googleapis.com/compute/v1/projects/cos-cloud/global/images/cos-stable-109-17800-147-54"
83+
}
84+
}
85+
86+
metadata = {
87+
gce-container-declaration = "# DISCLAIMER:\n# This container declaration format is not a public API and may change without\n# notice. Please use gcloud command-line tool or Google Cloud Console to run\n# Containers on Google Compute Engine.\n\nspec:\n containers:\n - image: us-docker.pkg.dev/service-extensions/ext-proc/service-callout-basic-example-python:latest\n name: callouts-vm\n securityContext:\n privileged: false\n stdin: false\n tty: false\n volumeMounts: []\n restartPolicy: Always\n volumes: []\n"
88+
google-logging-enabled = "true"
89+
}
90+
91+
lifecycle {
92+
create_before_destroy = true
93+
}
94+
}
95+
96+
resource "google_compute_instance_group" "callouts_instance_group" {
97+
name = "l7-ilb-callouts-ins-group"
98+
description = "Terraform test instance group"
99+
zone = "us-west1-a"
100+
101+
instances = [
102+
google_compute_instance.callouts_instance.id,
103+
]
104+
105+
named_port {
106+
name = "http"
107+
port = "80"
108+
}
109+
110+
named_port {
111+
name = "grpc"
112+
port = "443"
113+
}
114+
}
115+
116+
resource "google_compute_region_health_check" "callouts_health_check" {
117+
name = "l7-ilb-callouts-healthcheck"
118+
region = "us-west1"
119+
120+
http_health_check {
121+
port = 80
122+
}
123+
124+
depends_on = [
125+
google_compute_region_health_check.default
126+
]
127+
}
128+
57129
resource "google_compute_address" "default" {
58130
name = "l7-ilb-ip-address"
59131
project = "my-project-name"
@@ -119,6 +191,13 @@ resource "google_compute_region_backend_service" "authz_extension" {
119191
protocol = "HTTP2"
120192
load_balancing_scheme = "INTERNAL_MANAGED"
121193
port_name = "grpc"
194+
195+
health_checks = [google_compute_region_health_check.callouts_health_check.id]
196+
backend {
197+
group = google_compute_instance_group.callouts_instance_group.id
198+
balancing_mode = "UTILIZATION"
199+
capacity_scaler = 1.0
200+
}
122201
}
123202
124203
resource "google_network_services_authz_extension" "default" {
@@ -152,6 +231,29 @@ resource "google_network_security_authz_policy" "default" {
152231
resources = [ google_network_services_authz_extension.default.id ]
153232
}
154233
}
234+
235+
http_rules {
236+
from {
237+
not_sources {
238+
principals {
239+
exact = "dummy-principal"
240+
}
241+
}
242+
}
243+
to {
244+
operations {
245+
header_set {
246+
headers {
247+
name = "test-header"
248+
value {
249+
exact = "test-value"
250+
ignore_case = true
251+
}
252+
}
253+
}
254+
}
255+
}
256+
}
155257
}
156258
```
157259

0 commit comments

Comments
 (0)