Skip to content

Commit f2469c1

Browse files
Samir-Citdaniel-cit
Samir-Cit
and
daniel-cit
authored
feat: Change old firewall to new network-firewall (#1041)
Co-authored-by: Daniel Andrade <[email protected]>
1 parent 79b217e commit f2469c1

File tree

25 files changed

+604
-712
lines changed

25 files changed

+604
-712
lines changed

‎0-bootstrap/modules/jenkins-agent/main.tf‎

Lines changed: 48 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ locals {
1818
cicd_project_name = format("%s-%s", var.project_prefix, "b-cicd")
1919
impersonation_enabled_count = var.sa_enable_impersonation ? 1 : 0
2020
activate_apis = distinct(concat(var.activate_apis, ["billingbudgets.googleapis.com"]))
21-
jenkins_gce_fw_tags = ["ssh-jenkins-agent"]
2221
}
2322

2423
resource "random_id" "suffix" {
@@ -70,7 +69,11 @@ resource "google_compute_instance" "jenkins_agent_gce_instance" {
7069
machine_type = var.jenkins_agent_gce_machine_type
7170
zone = "${var.default_region}-a"
7271

73-
tags = local.jenkins_gce_fw_tags
72+
params {
73+
resource_manager_tags = {
74+
"tagKeys/${google_tags_tag_key.jenkins_agents.name}" = "tagValues/${google_tags_tag_value.jenkins_agents.name}"
75+
}
76+
}
7477

7578
boot_disk {
7679
initialize_params {
@@ -105,26 +108,52 @@ resource "google_compute_instance" "jenkins_agent_gce_instance" {
105108
}
106109

107110
/******************************************
108-
Jenkins Agent GCE Network and Firewall rules
111+
Jenkins Agent GCE Network, Resource Manager Tags and Firewall rules
109112
*******************************************/
110-
111-
resource "google_compute_firewall" "fw_allow_ssh_into_jenkins_agent" {
112-
project = module.cicd_project.project_id
113-
name = "fw-${google_compute_network.jenkins_agents.name}-1000-i-a-all-all-tcp-22"
114-
description = "Allow the Jenkins Controller (Client) to connect to the Jenkins Agents (Servers) using SSH."
115-
network = google_compute_network.jenkins_agents.name
116-
source_ranges = var.jenkins_controller_subnetwork_cidr_range
117-
target_tags = local.jenkins_gce_fw_tags
118-
priority = 1000
119-
120-
log_config {
121-
metadata = "INCLUDE_ALL_METADATA"
113+
resource "google_tags_tag_key" "jenkins_agents" {
114+
description = "Tag Key to control the connection between Jenkins Controller (Client) and the Jenkins Agents (Servers) using SSH."
115+
parent = "organizations/${var.org_id}"
116+
purpose = "GCE_FIREWALL"
117+
short_name = "ssh-jenkins-agent"
118+
purpose_data = {
119+
network = "${module.cicd_project.project_id}/${google_compute_network.jenkins_agents.name}"
122120
}
121+
}
123122

124-
allow {
125-
protocol = "tcp"
126-
ports = ["22"]
127-
}
123+
resource "google_tags_tag_value" "jenkins_agents" {
124+
description = "Allow the connection."
125+
parent = "tagKeys/${google_tags_tag_key.jenkins_agents.name}"
126+
short_name = "allow"
127+
}
128+
129+
module "jenkins_firewall_rules" {
130+
source = "terraform-google-modules/network/google//modules/network-firewall-policy"
131+
version = "~> 8.0"
132+
project_id = module.cicd_project.project_id
133+
policy_name = "fp-${google_compute_network.jenkins_agents.name}-jenkins-firewall"
134+
description = "Jenkins Agent GCE network firewall rules."
135+
target_vpcs = [google_compute_network.jenkins_agents.name]
136+
137+
rules = [
138+
{
139+
priority = "1000"
140+
direction = "INGRESS"
141+
action = "allow"
142+
rule_name = "fw-${google_compute_network.jenkins_agents.name}-1000-i-a-all-all-tcp-22"
143+
description = "Allow the Jenkins Controller (Client) to connect to the Jenkins Agents (Servers) using SSH."
144+
enable_logging = true
145+
target_secure_tags = ["tagValues/${google_tags_tag_value.jenkins_agents.name}"]
146+
match = {
147+
dest_ip_ranges = var.jenkins_controller_subnetwork_cidr_range
148+
layer4_configs = [
149+
{
150+
ip_protocol = "tcp"
151+
ports = ["22"]
152+
},
153+
]
154+
}
155+
}
156+
]
128157
}
129158

130159
resource "google_compute_network" "jenkins_agents" {

‎3-networks-dual-svpc/modules/base_env/main.tf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,6 @@ module "restricted_shared_vpc" {
241241
secondary_ranges = {
242242
"sb-${var.environment_code}-shared-restricted-${var.default_region1}" = var.restricted_subnet_secondary_ranges[var.default_region1]
243243
}
244-
allow_all_ingress_ranges = null
245-
allow_all_egress_ranges = null
246244
}
247245

248246
/******************************************
@@ -312,6 +310,4 @@ module "base_shared_vpc" {
312310
secondary_ranges = {
313311
"sb-${var.environment_code}-shared-base-${var.default_region1}" = var.base_subnet_secondary_ranges[var.default_region1]
314312
}
315-
allow_all_ingress_ranges = null
316-
allow_all_egress_ranges = null
317313
}

‎3-networks-dual-svpc/modules/base_shared_vpc/README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,14 @@
33

44
| Name | Description | Type | Default | Required |
55
|------|-------------|------|---------|:--------:|
6-
| allow\_all\_egress\_ranges | List of network ranges to which all egress traffic will be allowed | `any` | `null` | no |
7-
| allow\_all\_ingress\_ranges | List of network ranges from which all ingress traffic will be allowed | `any` | `null` | no |
86
| bgp\_asn\_subnet | BGP ASN for Subnets cloud routers. | `number` | n/a | yes |
97
| default\_region1 | Default region 1 for subnets and Cloud Routers | `string` | n/a | yes |
108
| default\_region2 | Default region 2 for subnets and Cloud Routers | `string` | n/a | yes |
119
| dns\_enable\_inbound\_forwarding | Toggle inbound query forwarding for VPC DNS. | `bool` | `true` | no |
1210
| dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
1311
| dns\_hub\_project\_id | The DNS hub project ID | `string` | n/a | yes |
1412
| domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
13+
| enable\_all\_vpc\_internal\_traffic | Enable firewall policy rule to allow internal traffic (ingress and egress). | `bool` | `false` | no |
1514
| environment\_code | A short form of the folder level resources (environment) within the Google Cloud organization. | `string` | n/a | yes |
1615
| firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
1716
| nat\_bgp\_asn | BGP ASN for first NAT cloud routes. | `number` | `64514` | no |

‎3-networks-dual-svpc/modules/base_shared_vpc/firewall.tf‎

Lines changed: 82 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -15,108 +15,87 @@
1515
*/
1616

1717
/******************************************
18-
Mandatory firewall rules
18+
Mandatory and optional firewall rules
1919
*****************************************/
20-
21-
resource "google_compute_firewall" "deny_all_egress" {
22-
name = "fw-${var.environment_code}-shared-base-65530-e-d-all-all-all"
23-
network = module.main.network_name
24-
project = var.project_id
25-
direction = "EGRESS"
26-
priority = 65530
27-
28-
dynamic "log_config" {
29-
for_each = var.firewall_enable_logging == true ? [{
30-
metadata = "INCLUDE_ALL_METADATA"
31-
}] : []
32-
33-
content {
34-
metadata = log_config.value.metadata
35-
}
36-
}
37-
38-
deny {
39-
protocol = "all"
40-
}
41-
42-
destination_ranges = ["0.0.0.0/0"]
43-
}
44-
45-
46-
resource "google_compute_firewall" "allow_private_api_egress" {
47-
name = "fw-${var.environment_code}-shared-base-65430-e-a-allow-google-apis-all-tcp-443"
48-
network = module.main.network_name
49-
project = var.project_id
50-
direction = "EGRESS"
51-
priority = 65430
52-
53-
dynamic "log_config" {
54-
for_each = var.firewall_enable_logging == true ? [{
55-
metadata = "INCLUDE_ALL_METADATA"
56-
}] : []
57-
58-
content {
59-
metadata = log_config.value.metadata
60-
}
61-
}
62-
63-
allow {
64-
protocol = "tcp"
65-
ports = ["443"]
66-
}
67-
68-
destination_ranges = [local.private_googleapis_cidr]
69-
70-
target_tags = ["allow-google-apis"]
71-
}
72-
73-
74-
resource "google_compute_firewall" "allow_all_egress" {
75-
count = var.allow_all_egress_ranges != null ? 1 : 0
76-
name = "fw-${var.environment_code}-shared-base-1000-e-a-all-all-all"
77-
network = module.main.network_name
78-
project = var.project_id
79-
direction = "EGRESS"
80-
priority = 1000
81-
82-
dynamic "log_config" {
83-
for_each = var.firewall_enable_logging == true ? [{
84-
metadata = "INCLUDE_ALL_METADATA"
85-
}] : []
86-
87-
content {
88-
metadata = log_config.value.metadata
89-
}
90-
}
91-
92-
allow {
93-
protocol = "all"
94-
}
95-
96-
destination_ranges = var.allow_all_egress_ranges
97-
}
98-
99-
resource "google_compute_firewall" "allow_all_ingress" {
100-
count = var.allow_all_ingress_ranges != null ? 1 : 0
101-
name = "fw-${var.environment_code}-shared-base-1000-i-a-all"
102-
network = module.main.network_name
103-
project = var.project_id
104-
direction = "INGRESS"
105-
priority = 1000
106-
107-
dynamic "log_config" {
108-
for_each = var.firewall_enable_logging == true ? [{
109-
metadata = "INCLUDE_ALL_METADATA"
110-
}] : []
111-
112-
content {
113-
metadata = log_config.value.metadata
114-
}
115-
}
116-
117-
allow {
118-
protocol = "all"
119-
}
120-
121-
source_ranges = var.allow_all_ingress_ranges
20+
module "firewall_rules" {
21+
source = "terraform-google-modules/network/google//modules/network-firewall-policy"
22+
version = "~> 8.0"
23+
project_id = var.project_id
24+
policy_name = "fp-${var.environment_code}-dual-svpc-base-firewalls"
25+
description = "Firewall rules for base dual shared vpc: ${module.main.network_name}."
26+
target_vpcs = ["projects/${var.project_id}/global/networks/${module.main.network_name}"]
27+
28+
rules = concat(
29+
[
30+
{
31+
priority = "65530"
32+
direction = "EGRESS"
33+
action = "deny"
34+
rule_name = "fw-${var.environment_code}-shared-base-65530-e-d-all-all-all"
35+
description = "Lower priority rule to deny all egress traffic."
36+
enable_logging = var.firewall_enable_logging
37+
match = {
38+
dest_ip_ranges = ["0.0.0.0/0"]
39+
layer4_configs = [
40+
{
41+
ip_protocol = "all"
42+
},
43+
]
44+
}
45+
},
46+
{
47+
priority = "1000"
48+
direction = "EGRESS"
49+
action = "allow"
50+
rule_name = "fw-${var.environment_code}-shared-base-1000-e-a-allow-google-apis-all-tcp-443"
51+
description = "Lower priority rule to allow private google apis on TCP port 443."
52+
enable_logging = var.firewall_enable_logging
53+
match = {
54+
dest_ip_ranges = [local.private_googleapis_cidr]
55+
layer4_configs = [
56+
{
57+
ip_protocol = "tcp"
58+
ports = ["443"]
59+
},
60+
]
61+
}
62+
}
63+
],
64+
!var.enable_all_vpc_internal_traffic ? [] : [
65+
{
66+
priority = "10000"
67+
direction = "EGRESS"
68+
action = "allow"
69+
rule_name = "fw-${var.environment_code}-shared-base-10000-e-a-all-all-all"
70+
description = "Allow all egress to the provided IP range."
71+
enable_logging = var.firewall_enable_logging
72+
match = {
73+
dest_ip_ranges = module.main.subnets_ips
74+
layer4_configs = [
75+
{
76+
ip_protocol = "all"
77+
},
78+
]
79+
}
80+
}
81+
],
82+
!var.enable_all_vpc_internal_traffic ? [] : [
83+
{
84+
priority = "10001"
85+
direction = "INGRESS"
86+
action = "allow"
87+
rule_name = "fw-${var.environment_code}-shared-base-10001-i-a-all"
88+
description = "Allow all ingress to the provided IP range."
89+
enable_logging = var.firewall_enable_logging
90+
match = {
91+
src_ip_ranges = module.main.subnets_ips
92+
layer4_configs = [
93+
{
94+
ip_protocol = "all"
95+
},
96+
]
97+
}
98+
}
99+
]
100+
)
122101
}

‎3-networks-dual-svpc/modules/base_shared_vpc/variables.tf‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -137,12 +137,8 @@ variable "windows_activation_enabled" {
137137
default = false
138138
}
139139

140-
variable "allow_all_egress_ranges" {
141-
description = "List of network ranges to which all egress traffic will be allowed"
142-
default = null
143-
}
144-
145-
variable "allow_all_ingress_ranges" {
146-
description = "List of network ranges from which all ingress traffic will be allowed"
147-
default = null
140+
variable "enable_all_vpc_internal_traffic" {
141+
type = bool
142+
description = "Enable firewall policy rule to allow internal traffic (ingress and egress)."
143+
default = false
148144
}

‎3-networks-dual-svpc/modules/restricted_shared_vpc/README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@
44
| Name | Description | Type | Default | Required |
55
|------|-------------|------|---------|:--------:|
66
| access\_context\_manager\_policy\_id | The id of the default Access Context Manager policy. Can be obtained by running `gcloud access-context-manager policies list --organization YOUR_ORGANIZATION_ID --format="value(name)"`. | `number` | n/a | yes |
7-
| allow\_all\_egress\_ranges | List of network ranges to which all egress traffic will be allowed | `any` | `null` | no |
8-
| allow\_all\_ingress\_ranges | List of network ranges from which all ingress traffic will be allowed | `any` | `null` | no |
97
| bgp\_asn\_subnet | BGP ASN for Subnets cloud routers. | `number` | n/a | yes |
108
| default\_region1 | First subnet region. The shared vpc modules only configures two regions. | `string` | n/a | yes |
119
| default\_region2 | Second subnet region. The shared vpc modules only configures two regions. | `string` | n/a | yes |
@@ -14,6 +12,7 @@
1412
| dns\_hub\_project\_id | The DNS hub project ID | `string` | n/a | yes |
1513
| domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
1614
| egress\_policies | A list of all [egress policies](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#egress-rules-reference), each list object has a `from` and `to` value that describes egress\_from and egress\_to.<br><br>Example: `[{ from={ identities=[], identity_type="ID_TYPE" }, to={ resources=[], operations={ "SRV_NAME"={ OP_TYPE=[] }}}}]`<br><br>Valid Values:<br>`ID_TYPE` = `null` or `IDENTITY_TYPE_UNSPECIFIED` (only allow indentities from list); `ANY_IDENTITY`; `ANY_USER_ACCOUNT`; `ANY_SERVICE_ACCOUNT`<br>`SRV_NAME` = "`*`" (allow all services) or [Specific Services](https://cloud.google.com/vpc-service-controls/docs/supported-products#supported_products)<br>`OP_TYPE` = [methods](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) or [permissions](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) | <pre>list(object({<br> from = any<br> to = any<br> }))</pre> | `[]` | no |
15+
| enable\_all\_vpc\_internal\_traffic | Enable firewall policy rule to allow internal traffic (ingress and egress). | `bool` | `false` | no |
1716
| environment\_code | A short form of the folder level resources (environment) within the Google Cloud organization. | `string` | n/a | yes |
1817
| firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
1918
| ingress\_policies | A list of all [ingress policies](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#ingress-rules-reference), each list object has a `from` and `to` value that describes ingress\_from and ingress\_to.<br><br>Example: `[{ from={ sources={ resources=[], access_levels=[] }, identities=[], identity_type="ID_TYPE" }, to={ resources=[], operations={ "SRV_NAME"={ OP_TYPE=[] }}}}]`<br><br>Valid Values:<br>`ID_TYPE` = `null` or `IDENTITY_TYPE_UNSPECIFIED` (only allow indentities from list); `ANY_IDENTITY`; `ANY_USER_ACCOUNT`; `ANY_SERVICE_ACCOUNT`<br>`SRV_NAME` = "`*`" (allow all services) or [Specific Services](https://cloud.google.com/vpc-service-controls/docs/supported-products#supported_products)<br>`OP_TYPE` = [methods](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) or [permissions](https://cloud.google.com/vpc-service-controls/docs/supported-method-restrictions) | <pre>list(object({<br> from = any<br> to = any<br> }))</pre> | `[]` | no |

0 commit comments

Comments
 (0)