Skip to content

Commit 227ae1a

Browse files
mscifomscifo
authored
feat: Support setting var.disk_encryption_key for instance templates to enable encryption on all disks (#181)
1 parent cb91eb6 commit 227ae1a

File tree

8 files changed

+197
-2
lines changed

8 files changed

+197
-2
lines changed

‎examples/instance_template/encrypted_disks/README.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# instance-template-additional-disks
2+
3+
This example demonstrates how to use the instance_template module to create
4+
instance templates with encrypted persistent disks.
5+
6+
7+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8+
## Inputs
9+
10+
| Name | Description | Type | Default | Required |
11+
|------|-------------|------|---------|:--------:|
12+
| project\_id | The GCP project to use for integration tests | `string` | n/a | yes |
13+
| region | The GCP region to create and test resources in | `string` | `"us-central1"` | no |
14+
| service\_account | Service account to attach to the instance. See https://www.terraform.io/docs/providers/google/r/compute_instance_template.html#service_account. | <pre>object({<br> email = string<br> scopes = set(string)<br> })</pre> | `null` | no |
15+
| subnetwork | The name of the subnetwork create this instance in. | `string` | `""` | no |
16+
17+
## Outputs
18+
19+
| Name | Description |
20+
|------|-------------|
21+
| name | Name of the instance templates |
22+
| self\_link | Self-link to the instance template |
23+
24+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/instance_template/encrypted_disks/main.tf‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
provider "google" {
18+
19+
project = var.project_id
20+
region = var.region
21+
version = "~> 3.0"
22+
}
23+
24+
resource "google_kms_key_ring" "keyring" {
25+
name = "keyring-example"
26+
location = "global"
27+
}
28+
29+
resource "google_kms_crypto_key" "example-key" {
30+
name = "crypto-key-example"
31+
key_ring = google_kms_key_ring.keyring.id
32+
rotation_period = "100000s"
33+
34+
lifecycle {
35+
prevent_destroy = true
36+
}
37+
}
38+
39+
module "instance_template" {
40+
source = "../../../modules/instance_template"
41+
project_id = var.project_id
42+
subnetwork = var.subnetwork
43+
service_account = var.service_account
44+
name_prefix = "additional-disks"
45+
46+
disk_encryption_key = google_kms_crypto_key.example-key.self_link
47+
48+
additional_disks = [
49+
{
50+
disk_name = "disk-0"
51+
device_name = "disk-0"
52+
disk_size_gb = 10
53+
disk_type = "pd-standard"
54+
auto_delete = "true"
55+
boot = "false"
56+
disk_labels = {}
57+
},
58+
{
59+
disk_name = "disk-1"
60+
device_name = "disk-1"
61+
disk_size_gb = 10
62+
disk_type = "pd-standard"
63+
auto_delete = "true"
64+
boot = "false"
65+
disk_labels = { "foo" : "bar" }
66+
},
67+
{
68+
disk_name = "disk-2"
69+
device_name = "disk-2"
70+
disk_size_gb = 10
71+
disk_type = "pd-standard"
72+
auto_delete = "true"
73+
boot = "false"
74+
disk_labels = { "foo" : "bar" }
75+
},
76+
]
77+
}

‎examples/instance_template/encrypted_disks/outputs.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "self_link" {
18+
description = "Self-link to the instance template"
19+
value = module.instance_template.self_link
20+
}
21+
22+
output "name" {
23+
description = "Name of the instance templates"
24+
value = module.instance_template.name
25+
}
26+

‎examples/instance_template/encrypted_disks/variables.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* Copyright 2019 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
18+
variable "project_id" {
19+
description = "The GCP project to use for integration tests"
20+
type = string
21+
}
22+
23+
variable "region" {
24+
description = "The GCP region to create and test resources in"
25+
type = string
26+
default = "us-central1"
27+
}
28+
29+
variable "subnetwork" {
30+
description = "The name of the subnetwork create this instance in."
31+
default = ""
32+
}
33+
34+
variable "service_account" {
35+
default = null
36+
type = object({
37+
email = string
38+
scopes = set(string)
39+
})
40+
description = "Service account to attach to the instance. See https://www.terraform.io/docs/providers/google/r/compute_instance_template.html#service_account."
41+
}
42+

‎examples/instance_template/encrypted_disks/versions.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
/**
2+
* Copyright 2018 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
terraform {
18+
required_version = ">=0.12.6"
19+
}

‎modules/instance_template/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ See the [simple](../../examples/instance_template/simple) for a usage example.
1717
| additional\_disks | List of maps of additional disks. See https://www.terraform.io/docs/providers/google/r/compute_instance_template.html#disk_name | <pre>list(object({<br> disk_name = string<br> device_name = string<br> auto_delete = bool<br> boot = bool<br> disk_size_gb = number<br> disk_type = string<br> disk_labels = map(string)<br> }))</pre> | `[]` | no |
1818
| auto\_delete | Whether or not the boot disk should be auto-deleted | `string` | `"true"` | no |
1919
| can\_ip\_forward | Enable IP forwarding, for NAT instances for example | `string` | `"false"` | no |
20+
| disk\_encryption\_key | The self link of the encryption key that is stored in Google Cloud KMS to use to encrypt all the disks on this instance | `string` | `null` | no |
2021
| disk\_labels | Labels to be assigned to boot disk, provided as a map | `map(string)` | `{}` | no |
2122
| disk\_size\_gb | Boot disk size in GB | `string` | `"100"` | no |
2223
| disk\_type | Boot disk type, can be either pd-ssd, local-ssd, or pd-standard | `string` | `"pd-standard"` | no |

‎modules/instance_template/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,9 +91,9 @@ resource "google_compute_instance_template" "tpl" {
9191
labels = lookup(disk.value, "disk_labels", null)
9292

9393
dynamic "disk_encryption_key" {
94-
for_each = lookup(disk.value, "disk_encryption_key", [])
94+
for_each = compact([var.disk_encryption_key == null ? null : 1])
9595
content {
96-
kms_key_self_link = lookup(disk_encryption_key.value, "kms_key_self_link", null)
96+
kms_key_self_link = var.disk_encryption_key
9797
}
9898
}
9999
}

‎modules/instance_template/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,12 @@ variable "disk_labels" {
105105
default = {}
106106
}
107107

108+
variable "disk_encryption_key" {
109+
description = "The self link of the encryption key that is stored in Google Cloud KMS to use to encrypt all the disks on this instance"
110+
type = string
111+
default = null
112+
}
113+
108114
variable "auto_delete" {
109115
description = "Whether or not the boot disk should be auto-deleted"
110116
default = "true"

0 commit comments

Comments
 (0)