Skip to content

Commit 6064816

Browse files
imrannayerimrannayer
authored
feat: add web_server_network_access_control (#102)
1 parent 025de1d commit 6064816

File tree

5 files changed

+73
-40
lines changed

5 files changed

+73
-40
lines changed

‎build/int.cloudbuild.yaml‎

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -28,48 +28,11 @@ steps:
2828
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
2929
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create']
3030

31-
# ----- SUITE airflow-connection-local
32-
33-
- id: converge airflow-connection-local
34-
waitFor:
35-
- create all
36-
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
37-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge airflow-connection-local']
38-
- id: verify airflow-connection-local
39-
waitFor:
40-
- converge airflow-connection-local
41-
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
42-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify airflow-connection-local']
43-
# - id: destroy airflow-connection-local
44-
# waitFor:
45-
# - verify airflow-connection-local
46-
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
47-
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy airflow-connection-local']
48-
49-
50-
# ----- SUITE airflow-pool-local
51-
52-
- id: converge airflow-pool-local
53-
waitFor:
54-
- create all
55-
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
56-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge airflow-pool-local']
57-
- id: verify airflow-pool-local
58-
waitFor:
59-
- converge airflow-pool-local
60-
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
61-
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify airflow-pool-local']
62-
# - id: destroy airflow-pool-local
63-
# waitFor:
64-
# - verify airflow-pool-local
65-
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
66-
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy airflow-pool-local']
67-
68-
# ----- SUITE simple-composer-env-v2-local
31+
# ----- SUITE simple-composer-env-v2
6932

7033
- id: init-simple-composer-env-v2
7134
waitFor:
72-
- verify airflow-pool-local
35+
- create all
7336
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
7437
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV2Module --stage init --verbose']
7538
- id: apply-simple-composer-env-v2
@@ -88,6 +51,7 @@ steps:
8851
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
8952
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV2Module --stage destroy --verbose']
9053

54+
9155
# ----- SUITE composer-v2-sharedvpc-prereq-local
9256

9357
- id: init-composer-v2-sharedvpc-prereq
@@ -115,7 +79,7 @@ steps:
11579

11680
- id: init-simple-composer-env-v1
11781
waitFor:
118-
- destroy-composer-v2-sharedvpc-prereq
82+
- destroy-simple-composer-env-v2
11983
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
12084
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV1Module --stage init --verbose']
12185
- id: apply-simple-composer-env-v1
@@ -133,6 +97,42 @@ steps:
13397
- verify-simple-composer-env-v1
13498
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
13599
args: ['/bin/bash', '-c', 'cft test run TestSimpleComposerEnvV1Module --stage destroy --verbose']
100+
# ----- SUITE airflow-connection-local
101+
102+
- id: converge airflow-connection-local
103+
waitFor:
104+
- destroy-simple-composer-env-v1
105+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
106+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge airflow-connection-local']
107+
- id: verify airflow-connection-local
108+
waitFor:
109+
- converge airflow-connection-local
110+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
111+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify airflow-connection-local']
112+
# - id: destroy airflow-connection-local
113+
# waitFor:
114+
# - verify airflow-connection-local
115+
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
116+
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy airflow-connection-local']
117+
118+
119+
# ----- SUITE airflow-pool-local
120+
121+
- id: converge airflow-pool-local
122+
waitFor:
123+
- destroy-simple-composer-env-v1
124+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
125+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do converge airflow-pool-local']
126+
- id: verify airflow-pool-local
127+
waitFor:
128+
- converge airflow-pool-local
129+
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
130+
args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do verify airflow-pool-local']
131+
# - id: destroy airflow-pool-local
132+
# waitFor:
133+
# - verify airflow-pool-local
134+
# name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
135+
# args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do destroy airflow-pool-local']
136136
tags:
137137
- 'ci'
138138
- 'integration'

‎examples/simple_composer_env_v2/main.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,4 +94,14 @@ module "simple-composer-environment" {
9494
depends_on = [
9595
google_storage_bucket_iam_member.object_admin,
9696
]
97+
web_server_network_access_control = [
98+
{
99+
allowed_ip_range = "192.0.2.0/24"
100+
description = "office net 1"
101+
},
102+
{
103+
allowed_ip_range = "192.0.4.0/24"
104+
description = "office net 2"
105+
},
106+
]
97107
}

‎modules/create_environment_v2/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ module "simple-composer-environment" {
9292
| triggerer | Configuration for resources used by Airflow triggerer | <pre>object({<br> cpu = string<br> memory_gb = number<br> count = number<br> })</pre> | `null` | no |
9393
| use\_private\_environment | Create a private environment. | `bool` | `false` | no |
9494
| web\_server | Configuration for resources used by Airflow web server. | <pre>object({<br> cpu = string<br> memory_gb = number<br> storage_gb = number<br> })</pre> | <pre>{<br> "cpu": 2,<br> "memory_gb": 7.5,<br> "storage_gb": 5<br>}</pre> | no |
95+
| web\_server\_network\_access\_control | The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions are applied | <pre>list(object({<br> allowed_ip_range = string<br> description = string<br> }))</pre> | `null` | no |
9596
| worker | Configuration for resources used by Airflow workers. | <pre>object({<br> cpu = string<br> memory_gb = number<br> storage_gb = number<br> min_count = number<br> max_count = number<br> })</pre> | <pre>{<br> "cpu": 2,<br> "max_count": 6,<br> "memory_gb": 7.5,<br> "min_count": 2,<br> "storage_gb": 5<br>}</pre> | no |
9697

9798
## Outputs

‎modules/create_environment_v2/main.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,19 @@ resource "google_composer_environment" "composer_env" {
186186
}
187187
}
188188

189+
dynamic "web_server_network_access_control" {
190+
for_each = var.web_server_network_access_control == null ? [] : ["web_server_network_access_control"]
191+
content {
192+
dynamic "allowed_ip_range" {
193+
for_each = { for x in var.web_server_network_access_control : x.allowed_ip_range => x }
194+
content {
195+
value = allowed_ip_range.value["allowed_ip_range"]
196+
description = allowed_ip_range.value["description"]
197+
}
198+
}
199+
}
200+
}
201+
189202
}
190203

191204
depends_on = [google_project_iam_member.composer_agent_service_account]

‎modules/create_environment_v2/variables.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,3 +273,12 @@ variable "cloud_data_lineage_integration" {
273273
type = bool
274274
default = false
275275
}
276+
277+
variable "web_server_network_access_control" {
278+
type = list(object({
279+
allowed_ip_range = string
280+
description = string
281+
}))
282+
default = null
283+
description = "The network-level access control policy for the Airflow web server. If unspecified, no network-level access restrictions are applied"
284+
}

0 commit comments

Comments
 (0)