Skip to content

Commit 630ca9b

Browse files
graysidegrayside
authored
Merge branch 'main' into notebook_instance
2 parents 9adc0ce + ed73a79 commit 630ca9b

File tree

12 files changed

+321
-18
lines changed

12 files changed

+321
-18
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
/build/ @terraform-google-modules/terraform-samples-git-admins @terraform-google-modules/cft-admins @terraform-google-modules/cloud-samples-infra
88

99
/bigquery/ @terraform-google-modules/bigquery-terraform-swe @terraform-google-modules/terraform-samples-reviewers
10-
/cloud_sql/ @terraform-google-modules/terraform-samples-reviewers
10+
/cloud_sql/ @terraform-google-modules/cloudsql-connectivity @terraform-google-modules/terraform-samples-reviewers
1111
/cloudvpn/ @terraform-google-modules/dee-infra @terraform-google-modules/terraform-samples-reviewers
1212
/composer/ @terraform-google-modules/cloud-dpes-composer @terraform-google-modules/terraform-samples-reviewers
1313
/compute/ @terraform-google-modules/dee-infra @terraform-google-modules/terraform-samples-reviewers

‎cloud_sql/mysql_instance_psa_psc/main.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,3 +91,28 @@ resource "google_compute_forwarding_rule" "default" {
9191

9292
# [END cloud_sql_mysql_instance_psa_psc_parent_tag]
9393

94+
// Configure a Cloud SQL MySQL instance with Private Service Connect disabled.
95+
# [START cloud_sql_mysql_instance_disable_psc_instance]
96+
resource "google_sql_database_instance" "disable_psc_example" {
97+
name = "mysql-disable-psc-example"
98+
region = "us-central1"
99+
database_version = "MYSQL_8_0"
100+
101+
depends_on = [google_service_networking_connection.default]
102+
103+
settings {
104+
tier = "db-f1-micro"
105+
ip_configuration {
106+
psc_config {
107+
psc_enabled = false
108+
allowed_consumer_projects = [] # clear consumer projects
109+
}
110+
ipv4_enabled = false
111+
private_network = google_compute_network.peering_network.id
112+
}
113+
}
114+
# set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
115+
# use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
116+
deletion_protection = false
117+
}
118+
# [END cloud_sql_mysql_instance_disable_psc_instance]

‎cloud_sql/postgres_instance_psa_psc/main.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,33 @@ resource "google_compute_forwarding_rule" "default" {
9494
}
9595

9696
# [END cloud_sql_postgres_instance_psa_psc_parent_tag]
97+
98+
// Configure a Cloud SQL Postgres instance with Private Service Connect disabled.
99+
# [START cloud_sql_postgres_instance_disable_psc_instance]
100+
resource "google_sql_database_instance" "disable_psc_example" {
101+
name = "postgres-disable-psc-example"
102+
region = "us-central1"
103+
database_version = "POSTGRES_17"
104+
105+
depends_on = [google_service_networking_connection.default]
106+
107+
settings {
108+
tier = "db-custom-2-7680"
109+
availability_type = "REGIONAL"
110+
backup_configuration {
111+
enabled = true
112+
}
113+
ip_configuration {
114+
psc_config {
115+
psc_enabled = false
116+
allowed_consumer_projects = [] # clear consumer projects
117+
}
118+
ipv4_enabled = false
119+
private_network = google_compute_network.peering_network.id
120+
}
121+
}
122+
# set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
123+
# use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
124+
deletion_protection = false # Set to "true" to prevent destruction of the resource
125+
}
126+
# [END cloud_sql_postgres_instance_disable_psc_instance]

‎cloud_sql/sqlserver_instance_psa_psc/main.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,3 +92,29 @@ resource "google_compute_forwarding_rule" "default" {
9292

9393
# [END cloud_sql_sqlserver_instance_psa_psc_parent_tag]
9494

95+
// Configure a Cloud SQL SQL server instance with Private Service Connect disabled.
96+
# [START cloud_sql_sqlserver_instance_disable_psc_instance]
97+
resource "google_sql_database_instance" "disable_psc_example" {
98+
name = "sqlserver-disable-psc-example"
99+
region = "us-central1"
100+
database_version = "SQLSERVER_2019_STANDARD"
101+
root_password = "INSERT-PASSWORD-HERE"
102+
103+
depends_on = [google_service_networking_connection.default]
104+
105+
settings {
106+
tier = "db-custom-2-7680"
107+
ip_configuration {
108+
psc_config {
109+
psc_enabled = false
110+
allowed_consumer_projects = [] # clear consumer projects
111+
}
112+
ipv4_enabled = false
113+
private_network = google_compute_network.peering_network.id
114+
}
115+
}
116+
# set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
117+
# use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
118+
deletion_protection = false
119+
}
120+
# [END cloud_sql_sqlserver_instance_disable_psc_instance]

‎gke/standard/regional/hpa-logs/main.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
# [START gke_standard_regional_hpa_logs]
18+
resource "google_container_cluster" "default" {
19+
name = "gke-standard-hpa-logs"
20+
location = "us-central1"
21+
initial_node_count = 1
22+
23+
logging_config {
24+
enable_components = ["SYSTEM_COMPONENTS", "KCP_HPA"]
25+
}
26+
27+
# Set `deletion_protection` to `true` will ensure that one cannot
28+
# accidentally delete this instance by use of Terraform.
29+
deletion_protection = false
30+
}
31+
# [END gke_standard_regional_hpa_logs]

‎network_security/intercept/basic/consumer/main.tf‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,23 @@
1414
* limitations under the License.
1515
*/
1616

17+
data "google_project" "default" {
18+
provider = google-beta
19+
}
20+
21+
# In case the project is in a folder, extract the organization ID from it.
22+
data "google_folder" "default" {
23+
provider = google-beta
24+
count = data.google_project.default.folder_id != "" ? 1 : 0
25+
folder = data.google_project.default.folder_id
26+
lookup_organization = true
27+
}
28+
29+
data "google_organization" "default" {
30+
provider = google-beta
31+
organization = data.google_project.default.org_id != "" ? data.google_project.default.org_id : data.google_folder.default[0].organization
32+
}
33+
1734
# [START networksecurity_intercept_basic_consumer]
1835
# [START networksecurity_intercept_create_producer_network_tf]
1936
resource "google_compute_network" "producer_network" {
@@ -31,6 +48,16 @@ resource "google_compute_network" "consumer_network" {
3148
}
3249
# [END networksecurity_intercept_create_consumer_network_tf]
3350

51+
# [START networksecurity_intercept_create_consumer_subnetwork_tf]
52+
resource "google_compute_subnetwork" "consumer_subnet" {
53+
provider = google-beta
54+
name = "consumer-subnet"
55+
region = "us-central1"
56+
ip_cidr_range = "10.10.0.0/16"
57+
network = google_compute_network.consumer_network.name
58+
}
59+
# [END networksecurity_intercept_create_consumer_subnetwork_tf]
60+
3461
# [START networksecurity_intercept_create_producer_deployment_group_tf]
3562
resource "google_network_security_intercept_deployment_group" "default" {
3663
provider = google-beta
@@ -58,4 +85,63 @@ resource "google_network_security_intercept_endpoint_group_association" "default
5885
intercept_endpoint_group = google_network_security_intercept_endpoint_group.default.id
5986
}
6087
# [END networksecurity_intercept_create_endpoint_group_association_tf]
88+
89+
# [START networksecurity_intercept_create_security_profile_tf]
90+
resource "google_network_security_security_profile" "default" {
91+
provider = google-beta
92+
name = "security-profile"
93+
type = "CUSTOM_INTERCEPT"
94+
parent = "organizations/${data.google_organization.default.org_id}"
95+
location = "global"
96+
97+
custom_intercept_profile {
98+
intercept_endpoint_group = google_network_security_intercept_endpoint_group.default.id
99+
}
100+
}
101+
# [END networksecurity_intercept_create_security_profile_tf]
102+
103+
# [START networksecurity_intercept_create_security_profile_group_tf]
104+
resource "google_network_security_security_profile_group" "default" {
105+
provider = google-beta
106+
name = "security-profile-group"
107+
parent = "organizations/${data.google_organization.default.org_id}"
108+
location = "global"
109+
custom_intercept_profile = google_network_security_security_profile.default.id
110+
}
111+
# [END networksecurity_intercept_create_security_profile_group_tf]
112+
113+
# [START networksecurity_intercept_create_firewall_policy_tf]
114+
resource "google_compute_network_firewall_policy" "default" {
115+
provider = google-beta
116+
name = "firewall-policy"
117+
}
118+
# [END networksecurity_intercept_create_firewall_policy_tf]
119+
120+
# [START networksecurity_intercept_create_firewall_policy_rule_tf]
121+
resource "google_compute_network_firewall_policy_rule" "default" {
122+
provider = google-beta
123+
firewall_policy = google_compute_network_firewall_policy.default.name
124+
priority = 1000
125+
action = "apply_security_profile_group"
126+
direction = "INGRESS"
127+
security_profile_group = google_network_security_security_profile_group.default.id
128+
129+
match {
130+
layer4_configs {
131+
ip_protocol = "tcp"
132+
ports = ["80"]
133+
}
134+
src_ip_ranges = ["10.10.0.0/16"]
135+
}
136+
}
137+
# [END networksecurity_intercept_create_firewall_policy_rule_tf]
138+
139+
# [START networksecurity_intercept_create_firewall_policy_association_tf]
140+
resource "google_compute_network_firewall_policy_association" "default" {
141+
provider = google-beta
142+
name = "firewall-policy-assoc"
143+
attachment_target = google_compute_network.consumer_network.id
144+
firewall_policy = google_compute_network_firewall_policy.default.name
145+
}
146+
# [END networksecurity_intercept_create_firewall_policy_association_tf]
61147
# [END networksecurity_intercept_basic_consumer]

‎network_security/intercept/basic/consumer/test.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: blueprints.cloud.google.com/v1alpha1
16+
kind: BlueprintTest
17+
metadata:
18+
name: network_security_intercept_basic_consumer
19+
spec:
20+
skip: true

‎network_security/mirroring/basic/consumer/main.tf‎

Lines changed: 77 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,26 +14,45 @@
1414
* limitations under the License.
1515
*/
1616

17+
data "google_project" "default" {}
18+
19+
# In case the project is in a folder, extract the organization ID from it.
20+
data "google_folder" "default" {
21+
count = data.google_project.default.folder_id != "" ? 1 : 0
22+
folder = data.google_project.default.folder_id
23+
lookup_organization = true
24+
}
25+
26+
data "google_organization" "default" {
27+
organization = data.google_project.default.org_id != "" ? data.google_project.default.org_id : data.google_folder.default[0].organization
28+
}
29+
1730
# [START networksecurity_mirroring_basic_consumer]
1831
# [START networksecurity_mirroring_create_producer_network_tf]
1932
resource "google_compute_network" "producer_network" {
20-
provider = google-beta
2133
name = "producer-network"
2234
auto_create_subnetworks = false
2335
}
2436
# [END networksecurity_mirroring_create_producer_network_tf]
2537

2638
# [START networksecurity_mirroring_create_consumer_network_tf]
2739
resource "google_compute_network" "consumer_network" {
28-
provider = google-beta
2940
name = "consumer-network"
3041
auto_create_subnetworks = false
3142
}
3243
# [END networksecurity_mirroring_create_consumer_network_tf]
3344

45+
# [START networksecurity_mirroring_create_consumer_subnetwork_tf]
46+
resource "google_compute_subnetwork" "consumer_subnet" {
47+
name = "consumer-subnet"
48+
region = "us-central1"
49+
ip_cidr_range = "10.10.0.0/16"
50+
network = google_compute_network.consumer_network.name
51+
}
52+
# [END networksecurity_mirroring_create_consumer_subnetwork_tf]
53+
3454
# [START networksecurity_mirroring_create_producer_deployment_group_tf]
3555
resource "google_network_security_mirroring_deployment_group" "default" {
36-
provider = google-beta
3756
mirroring_deployment_group_id = "mirroring-deployment-group"
3857
location = "global"
3958
network = google_compute_network.producer_network.id
@@ -42,7 +61,6 @@ resource "google_network_security_mirroring_deployment_group" "default" {
4261

4362
# [START networksecurity_mirroring_create_endpoint_group_tf]
4463
resource "google_network_security_mirroring_endpoint_group" "default" {
45-
provider = google-beta
4664
mirroring_endpoint_group_id = "mirroring-endpoint-group"
4765
location = "global"
4866
mirroring_deployment_group = google_network_security_mirroring_deployment_group.default.id
@@ -51,11 +69,65 @@ resource "google_network_security_mirroring_endpoint_group" "default" {
5169

5270
# [START networksecurity_mirroring_create_endpoint_group_association_tf]
5371
resource "google_network_security_mirroring_endpoint_group_association" "default" {
54-
provider = google-beta
5572
mirroring_endpoint_group_association_id = "mirroring-endpoint-group-association"
5673
location = "global"
5774
network = google_compute_network.consumer_network.id
5875
mirroring_endpoint_group = google_network_security_mirroring_endpoint_group.default.id
5976
}
6077
# [END networksecurity_mirroring_create_endpoint_group_association_tf]
78+
79+
# [START networksecurity_mirroring_create_security_profile_tf]
80+
resource "google_network_security_security_profile" "default" {
81+
name = "security-profile"
82+
type = "CUSTOM_MIRRORING"
83+
parent = "organizations/${data.google_organization.default.org_id}"
84+
location = "global"
85+
86+
custom_mirroring_profile {
87+
mirroring_endpoint_group = google_network_security_mirroring_endpoint_group.default.id
88+
}
89+
}
90+
# [END networksecurity_mirroring_create_security_profile_tf]
91+
92+
# [START networksecurity_mirroring_create_security_profile_group_tf]
93+
resource "google_network_security_security_profile_group" "default" {
94+
name = "security-profile-group"
95+
parent = "organizations/${data.google_organization.default.org_id}"
96+
location = "global"
97+
custom_mirroring_profile = google_network_security_security_profile.default.id
98+
}
99+
# [END networksecurity_mirroring_create_security_profile_group_tf]
100+
101+
# [START networksecurity_mirroring_create_firewall_policy_tf]
102+
resource "google_compute_network_firewall_policy" "default" {
103+
name = "firewall-policy"
104+
}
105+
# [END networksecurity_mirroring_create_firewall_policy_tf]
106+
107+
# [START networksecurity_mirroring_create_firewall_policy_rule_tf]
108+
resource "google_compute_network_firewall_policy_packet_mirroring_rule" "default" {
109+
provider = google-beta
110+
firewall_policy = google_compute_network_firewall_policy.default.name
111+
priority = 1000
112+
action = "mirror"
113+
direction = "INGRESS"
114+
security_profile_group = google_network_security_security_profile_group.default.id
115+
116+
match {
117+
layer4_configs {
118+
ip_protocol = "tcp"
119+
ports = ["80"]
120+
}
121+
src_ip_ranges = ["10.10.0.0/16"]
122+
}
123+
}
124+
# [END networksecurity_mirroring_create_firewall_policy_rule_tf]
125+
126+
# [START networksecurity_mirroring_create_firewall_policy_association_tf]
127+
resource "google_compute_network_firewall_policy_association" "default" {
128+
name = "firewall-policy-assoc"
129+
attachment_target = google_compute_network.consumer_network.id
130+
firewall_policy = google_compute_network_firewall_policy.default.name
131+
}
132+
# [END networksecurity_mirroring_create_firewall_policy_association_tf]
61133
# [END networksecurity_mirroring_basic_consumer]

0 commit comments

Comments
 (0)