You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+13Lines changed: 13 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,3 +1,16 @@
1
+
## 0.3.0 (January 23, 2026)
2
+
FEATURES:
3
+
* Official support for Cloud Connector Auto Scaling on GCP - (Requires new Marketplace Compute Image: zs-cc-ga-02042026 or greater )
4
+
- add: module terraform-zscc-cloud-function-gcp for Cloud Run Function and dependency resources
5
+
- update: module terraform-zscc-ccvm-gcp for autoscaling_enabled conditions including: dynamically removing stateful disk and internal_ip attributes and the addition of google_compute_autoscaler.cc_asg resource
6
+
- update: module terraform-zscc-iam-service-account-gcp to include Monitoring Metric Writer role for CC SA when autoscaling is enabled
7
+
- add: zsec script support for ASG greenfield and brownfield deployments
8
+
9
+
ENHANCEMENTS:
10
+
* add: variable marketplace_image for all deployment templates defaulting to the latest available image "zs-cc-ga-02042026" upgraded to ZscalerOS 42 and supporting autoscaling
11
+
* add: ssh_config creations to deployment templates outputs.tf for improvement UX
12
+
* add: variable tags applied to google_compute_instance_template.cc_instance_template resource
13
+
1
14
## 0.2.1 (February 25, 2025)
2
15
BUG FIXES:
3
16
* fix: add missing lb_vip attribute back to ilb based template userdata file generation
base_1cc: Creates 1 new "Management" VPC with 1 CC-Mgmt subnet and 1 bastion subnet; 1 "Service" VPC with 1 CC-Service subnet and 1 workload subnet; 1 Cloud Router + NAT Gateway per VPC; 1 Ubuntu client workload with a tagged default route next-hop to Cloud Connector service network instance; 1 Bastion Host assigned a dynamic public IP; generates local key pair .pem file for ssh access to all VMs; 1 Cloud Connector compute instance template + zonal managed instance group to deploy a single Cloud Connector appliance with a dedicated service account associated for accessing Secret Manager; tagged route table pointing workload default route next-hop to the CC Instance.
51
51
base_1cc_zpa: Everything from base_1cc + creates Google Cloud DNS forward zones intended for ZPA App Segment DNS redirection.
52
52
base_cc_ilb: Everything from base_1cc + option to deploy multiple Cloud Connectors across multiple zonal managed instance groups behind an Internal Load Balancer (ILB) including new: backend service, forwarding rule, health check, and firewall rules needed to front all cloud connector instances for highly available/resilient workload traffic forwarding; tagged route table pointing workload default route next-hop to the ILB front end IP.
53
53
base_cc_ilb_zpa: Everything from base_cc_ilb + creates Google Cloud DNS forward zones intended for ZPA App Segment DNS redirection.
54
+
base_cc_asg: Everything from base_cc_ilb except the number of Cloud Connectors is determined based on min/max size variables for autoscaling group configuration. The configured Instance Group(s) will be associated with an autoscaler policy. Cloud Run Functions will also be created for VM health monitoring and resource synchronization.
55
+
base_cc_asg_zpa: Everything from base_cc_asg + creates Google Cloud DNS forward zones intended for ZPA App Segment DNS redirection.
56
+
54
57
```
55
58
56
59
**2. Prod/Brownfield Deployments**
@@ -73,8 +76,9 @@ Optional: Edit the terraform.tfvars file under your desired deployment type (ie:
73
76
**Prod/Brownfield Deployment Types**
74
77
75
78
```
76
-
Deployment Type: (cc_ilb):
79
+
Deployment Type: (cc_ilb | cc_asg):
77
80
cc_ilb: Creates 1 new "Management" VPC with 1 CC-Mgmt subnet; 1 "Service" VPC with 1 CC-Service subnet; 1 Cloud Router + NAT Gateway per VPC; generates local key pair .pem file for ssh access to all VMs. All network infrastructure resource have conditional "byo" variables, that can be inputted if they already exist (like VPC, subnet, Cloud Router, and Cloud NAT); creates 1 Cloud Connector compute instance template with option to deploy multiple Cloud Connectors across multiple zonal managed instance groups behind an Internal Load Balancer (ILB) including new: backend service, forwarding rule, health check, and firewall rules needed to front all cloud connector instances for highly available/resilient workload traffic forwarding; and optional capability to create Google Cloud DNS forward zones intended for ZPA App Segment DNS redirection.
81
+
cc_asg: All options from cc_ilb with the addition of autoscaling dependencies including autoscaler policies and Cloud Run Functions
@@ -109,6 +110,7 @@ From base_1cc directory execute:
109
110
| <aname="input_instance_group_name"></a> [instance\_group\_name](#input\_instance\_group\_name)| The name of the Instance Group Manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens |`list(string)`| <pre>[<br> ""<br>]</pre> | no |
110
111
| <aname="input_instance_template_name"></a> [instance\_template\_name](#input\_instance\_template\_name)| The name of the instance template. Conflicts with variable instance\_template\_name\_prefix |`string`|`""`| no |
111
112
| <aname="input_instance_template_name_prefix"></a> [instance\_template\_name\_prefix](#input\_instance\_template\_name\_prefix)| Creates a unique Instance Template name beginning with the specified prefix. Conflicts with variable instance\_template\_name |`string`|`""`| no |
113
+
| <aname="input_marketplace_image"></a> [marketplace\_image](#input\_marketplace\_image)| Available marketplace image name to deploy. Zscaler recommends always deploying new instances with the latest image |`string`|`"zs-cc-ga-02042026"`| no |
112
114
| <aname="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix)| The name prefix for all your resources |`string`|`"zscc"`| no |
113
115
| <aname="input_project"></a> [project](#input\_project)| Google Cloud project name |`string`| n/a | yes |
114
116
| <aname="input_project_host"></a> [project\_host](#input\_project\_host)| Google Cloud Host Project name. Defaults to null. This variable is intended for environments where different resources might exist in separate host and service projects |`string`|`null`| no |
Copy file name to clipboardExpand all lines: examples/base_1cc/outputs.tf
+78-13Lines changed: 78 additions & 13 deletions
Original file line number
Diff line number
Diff line change
@@ -4,29 +4,52 @@ locals {
4
4
By default, these templates store two critical files to the "examples" directory. DO NOT delete/lose these files:
5
5
1. Terraform State file (terraform.tfstate) - Terraform must store state about your managed infrastructure and configuration.
6
6
This state is used by Terraform to map real world resources to your configuration, keep track of metadata, and to improve performance for large infrastructures.
7
+
7
8
Terraform uses state to determine which changes to make to your infrastructure.
8
9
Prior to any operation, Terraform does a refresh to update the state with the real infrastructure.
10
+
9
11
If this file is missing, you will NOT be able to make incremental changes to the environment resources without first importing state back to terraform manually.
12
+
10
13
2. SSH Private Key (.pem) file - Zscaler templates will attempt to create a new local private/public key pair for VM access (if a pre-existing one is not specified).
11
14
You (and subsequently Zscaler) will NOT be able to remotely access these VMs once deployed without valid SSH access.
Copy file name to clipboardExpand all lines: examples/base_1cc/variables.tf
+6Lines changed: 6 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -155,6 +155,12 @@ variable "image_name" {
155
155
default=""
156
156
}
157
157
158
+
variable"marketplace_image" {
159
+
type=string
160
+
description="Available marketplace image name to deploy. Zscaler recommends always deploying new instances with the latest image"
161
+
default="zs-cc-ga-02042026"
162
+
}
163
+
158
164
variable"support_access_enabled" {
159
165
type=bool
160
166
description="Enable a specific outbound firewall rule for Cloud Connector to be able to establish connectivity for Zscaler support access. Default is true"
@@ -111,6 +112,7 @@ From base_1cc_zpa directory execute:
111
112
| <aname="input_instance_group_name"></a> [instance\_group\_name](#input\_instance\_group\_name)| The name of the Instance Group Manager. Must be 1-63 characters long and comply with RFC1035. Supported characters include lowercase letters, numbers, and hyphens |`list(string)`| <pre>[<br> ""<br>]</pre> | no |
112
113
| <aname="input_instance_template_name"></a> [instance\_template\_name](#input\_instance\_template\_name)| The name of the instance template. Conflicts with variable instance\_template\_name\_prefix |`string`|`""`| no |
113
114
| <aname="input_instance_template_name_prefix"></a> [instance\_template\_name\_prefix](#input\_instance\_template\_name\_prefix)| Creates a unique Instance Template name beginning with the specified prefix. Conflicts with variable instance\_template\_name |`string`|`""`| no |
115
+
| <aname="input_marketplace_image"></a> [marketplace\_image](#input\_marketplace\_image)| Available marketplace image name to deploy. Zscaler recommends always deploying new instances with the latest image |`string`|`"zs-cc-ga-02042026"`| no |
114
116
| <aname="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix)| The name prefix for all your resources |`string`|`"zscc"`| no |
115
117
| <aname="input_project"></a> [project](#input\_project)| Google Cloud project name |`string`| n/a | yes |
116
118
| <aname="input_project_host"></a> [project\_host](#input\_project\_host)| Google Cloud Host Project name. Defaults to null. This variable is intended for environments where different resources might exist in separate host and service projects |`string`|`null`| no |
Copy file name to clipboardExpand all lines: examples/base_1cc_zpa/outputs.tf
+78-13Lines changed: 78 additions & 13 deletions
Original file line number
Diff line number
Diff line change
@@ -4,29 +4,52 @@ locals {
4
4
By default, these templates store two critical files to the "examples" directory. DO NOT delete/lose these files:
5
5
1. Terraform State file (terraform.tfstate) - Terraform must store state about your managed infrastructure and configuration.
6
6
This state is used by Terraform to map real world resources to your configuration, keep track of metadata, and to improve performance for large infrastructures.
7
+
7
8
Terraform uses state to determine which changes to make to your infrastructure.
8
9
Prior to any operation, Terraform does a refresh to update the state with the real infrastructure.
10
+
9
11
If this file is missing, you will NOT be able to make incremental changes to the environment resources without first importing state back to terraform manually.
12
+
10
13
2. SSH Private Key (.pem) file - Zscaler templates will attempt to create a new local private/public key pair for VM access (if a pre-existing one is not specified).
11
14
You (and subsequently Zscaler) will NOT be able to remotely access these VMs once deployed without valid SSH access.
0 commit comments