Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

promote security policy args to ga #6258

Merged
merged 5 commits into from
Jul 13, 2022
Merged

promote security policy args to ga #6258

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3bcdd85
promote sec policy args to ga
DrFaust92 Jul 13, 2022
036c90e
update `adaptive_protection_config`
DrFaust92 Jul 13, 2022
e96dfd2
add enum to `type`
DrFaust92 Jul 13, 2022
65bab8b
enum enforce_on_key
DrFaust92 Jul 13, 2022
4a99253
redundent
DrFaust92 Jul 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 7 additions & 28 deletions mmv1/third_party/terraform/resources/resource_compute_security_policy.go.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ func resourceComputeSecurityPolicy() *schema.Resource {
Optional: true,
Computed: true,
Description: `The type indicates the intended use of the security policy. CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services. They filter requests before they hit the origin servers. CLOUD_ARMOR_EDGE - Cloud Armor edge security policies can be configured to filter incoming HTTP requests targeting backend services (including Cloud CDN-enabled) as well as backend buckets (Cloud Storage). They filter requests before the request is served from Google's cache.`,
ValidateFunc: validation.StringInSlice([]string{"CLOUD_ARMOR", "CLOUD_ARMOR_EDGE", "CLOUD_ARMOR_INTERNAL_SERVICE"}, false),
},

"rule": {
Expand Down Expand Up @@ -163,7 +164,6 @@ func resourceComputeSecurityPolicy() *schema.Resource {
Description: `When set to true, the action specified above is not enforced. Stackdriver logs for requests that trigger a preview action are annotated as such.`,
},

<% unless version == 'ga' -%>
"rate_limit_options": {
Type: schema.TypeList,
Optional: true,
Expand Down Expand Up @@ -212,6 +212,7 @@ func resourceComputeSecurityPolicy() *schema.Resource {
Optional: true,
Default: "ALL",
Description: `Determines the key to enforce the rateLimitThreshold on`,
ValidateFunc: validation.StringInSlice([]string{"ALL", "IP", "HTTP_HEADER", "XFF_IP", "HTTP_COOKIE"}, false),
},

"enforce_on_key_name": {
Expand Down Expand Up @@ -296,7 +297,6 @@ func resourceComputeSecurityPolicy() *schema.Resource {
},
Description: `Parameters defining the redirect action. Cannot be specified for any other actions.`,
},
<% end -%>
},
},
Description: `The set of rules that belong to this policy. There must always be a default rule (rule with priority 2147483647 and match "*"). If no rules are provided when creating a security policy, a default rule with action "allow" will be added.`,
Expand Down Expand Up @@ -340,7 +340,6 @@ func resourceComputeSecurityPolicy() *schema.Resource {
},
},

<%- unless version == 'ga' -%>
"adaptive_protection_config": {
Type: schema.TypeList,
Optional: true,
Expand Down Expand Up @@ -373,7 +372,6 @@ func resourceComputeSecurityPolicy() *schema.Resource {
},
},
},
<% end -%>
},

UseJSONNumber: true,
Expand Down Expand Up @@ -426,19 +424,13 @@ func resourceComputeSecurityPolicyCreate(d *schema.ResourceData, meta interface{
securityPolicy.AdvancedOptionsConfig = expandSecurityPolicyAdvancedOptionsConfig(v.([]interface{}))
}

<% unless version == 'ga' -%>
if v, ok := d.GetOk("adaptive_protection_config"); ok{
securityPolicy.AdaptiveProtectionConfig = expandSecurityPolicyAdaptiveProtectionConfig(v.([]interface{}))
}
<% end -%>

log.Printf("[DEBUG] SecurityPolicy insert request: %#v", securityPolicy)

<% if version == 'ga' -%>
client := config.NewComputeClient(userAgent)
<% else -%>
client := config.NewComputeClient(userAgent)
<% end -%>

op, err := client.SecurityPolicies.Insert(project, securityPolicy).Do()

Expand Down Expand Up @@ -474,11 +466,7 @@ func resourceComputeSecurityPolicyRead(d *schema.ResourceData, meta interface{})

sp := d.Get("name").(string)

<% if version == 'ga' -%>
client := config.NewComputeClient(userAgent)
<% else -%>
client := config.NewComputeClient(userAgent)
<% end -%>

securityPolicy, err := client.SecurityPolicies.Get(project, sp).Do()
if err != nil {
Expand Down Expand Up @@ -510,11 +498,9 @@ func resourceComputeSecurityPolicyRead(d *schema.ResourceData, meta interface{})
return fmt.Errorf("Error setting advanced_options_config: %s", err)
}

<% unless version == 'ga' -%>
if err := d.Set("adaptive_protection_config", flattenSecurityPolicyAdaptiveProtectionConfig(securityPolicy.AdaptiveProtectionConfig)); err != nil {
return fmt.Errorf("Error setting adaptive_protection_config: %s", err)
}
<% end -%>

return nil
}
Expand Down Expand Up @@ -553,6 +539,11 @@ func resourceComputeSecurityPolicyUpdate(d *schema.ResourceData, meta interface{
securityPolicy.ForceSendFields = append(securityPolicy.ForceSendFields, "AdvancedOptionsConfig", "advancedOptionsConfig.jsonParsing", "advancedOptionsConfig.logLevel")
}

if d.HasChange("adaptive_protection_config") {
securityPolicy.AdaptiveProtectionConfig = expandSecurityPolicyAdaptiveProtectionConfig(d.Get("adaptive_protection_config").([]interface{}))
securityPolicy.ForceSendFields = append(securityPolicy.ForceSendFields, "AdaptiveProtectionConfig", "adaptiveProtectionConfig.layer7DdosDefenseConfig.enable", "adaptiveProtectionConfig.layer7DdosDefenseConfig.ruleVisibility")
}

if len(securityPolicy.ForceSendFields) > 0 {
client := config.NewComputeClient(userAgent)

Expand Down Expand Up @@ -661,11 +652,7 @@ func resourceComputeSecurityPolicyDelete(d *schema.ResourceData, meta interface{
return err
}

<% if version == 'ga' -%>
client := config.NewComputeClient(userAgent)
<% else -%>
client := config.NewComputeClient(userAgent)
<% end -%>

// Delete the SecurityPolicy
op, err := client.SecurityPolicies.Delete(project, d.Get("name").(string)).Do()
Expand Down Expand Up @@ -698,10 +685,8 @@ func expandSecurityPolicyRule(raw interface{}) *compute.SecurityPolicyRule {
Action: data["action"].(string),
Preview: data["preview"].(bool),
Match: expandSecurityPolicyMatch(data["match"].([]interface{})),
<% unless version == 'ga' -%>
RateLimitOptions: expandSecurityPolicyRuleRateLimitOptions(data["rate_limit_options"].([]interface{})),
RedirectOptions: expandSecurityPolicyRuleRedirectOptions(data["redirect_options"].([]interface{})),
<% end -%>
ForceSendFields: []string{"Description", "Preview"},
}
}
Expand Down Expand Up @@ -754,10 +739,8 @@ func flattenSecurityPolicyRules(rules []*compute.SecurityPolicyRule) []map[strin
"action": rule.Action,
"preview": rule.Preview,
"match": flattenMatch(rule.Match),
<% unless version == 'ga' -%>
"rate_limit_options": flattenSecurityPolicyRuleRateLimitOptions(rule.RateLimitOptions),
"redirect_options": flattenSecurityPolicyRedirectOptions(rule.RedirectOptions),
<% end -%>
}

rulesSchema = append(rulesSchema, data)
Expand Down Expand Up @@ -832,7 +815,6 @@ func flattenSecurityPolicyAdvancedOptionsConfig(conf *compute.SecurityPolicyAdva
return []map[string]interface{}{data}
}

<% unless version == 'ga' -%>
func expandSecurityPolicyAdaptiveProtectionConfig(configured []interface{}) *compute.SecurityPolicyAdaptiveProtectionConfig {
if len(configured) == 0 || configured[0] == nil {
return nil
Expand Down Expand Up @@ -880,9 +862,7 @@ func flattenLayer7DdosDefenseConfig(conf *compute.SecurityPolicyAdaptiveProtecti

return []map[string]interface{}{data}
}
<% end -%>

<% unless version == 'ga' -%>
func expandSecurityPolicyRuleRateLimitOptions(configured []interface{}) *compute.SecurityPolicyRuleRateLimitOptions {
if len(configured) == 0 || configured[0] == nil {
return nil
Expand Down Expand Up @@ -969,7 +949,6 @@ func flattenSecurityPolicyRedirectOptions(conf *compute.SecurityPolicyRuleRedire

return []map[string]interface{}{data}
}
<% end -%>

func resourceSecurityPolicyStateImporter(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
config := meta.(*Config)
Expand Down
14 changes: 0 additions & 14 deletions mmv1/third_party/terraform/tests/resource_compute_security_policy_test.go.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,6 @@ func TestAccComputeSecurityPolicy_withRule(t *testing.T) {
})
}

<% unless version == 'ga' -%>
func TestAccComputeSecurityPolicy_withRuleExpr(t *testing.T) {
t.Parallel()

Expand All @@ -76,7 +75,6 @@ func TestAccComputeSecurityPolicy_withRuleExpr(t *testing.T) {
},
})
}
<% end -%>

func TestAccComputeSecurityPolicy_update(t *testing.T) {
t.Parallel()
Expand Down Expand Up @@ -162,7 +160,6 @@ func TestAccComputeSecurityPolicy_withAdvancedOptionsConfig(t *testing.T) {
})
}

<% unless version == 'ga' -%>
func TestAccComputeSecurityPolicy_withAdaptiveProtection(t *testing.T) {
t.Parallel()

Expand All @@ -184,9 +181,7 @@ func TestAccComputeSecurityPolicy_withAdaptiveProtection(t *testing.T) {
},
})
}
<% end -%>

<% unless version == 'ga' -%>
func TestAccComputeSecurityPolicy_withRateLimitOptions(t *testing.T) {
t.Parallel()

Expand Down Expand Up @@ -230,7 +225,6 @@ func TestAccComputeSecurityPolicy_withRateLimitWithRedirectOptions(t *testing.T)
},
})
}
<% end -%>

func testAccCheckComputeSecurityPolicyDestroyProducer(t *testing.T) func(s *terraform.State) error {
return func(s *terraform.State) error {
Expand Down Expand Up @@ -389,7 +383,6 @@ resource "google_compute_security_policy" "policy" {
`, spName)
}

<% unless version == 'ga' -%>
func testAccComputeSecurityPolicy_withRuleExpr(spName string) string {
return fmt.Sprintf(`
resource "google_compute_security_policy" "policy" {
Expand Down Expand Up @@ -423,7 +416,6 @@ resource "google_compute_security_policy" "policy" {
}
`, spName)
}
<% end -%>

func testAccComputeSecurityPolicy_withAdvancedOptionsConfig(spName string) string {
return fmt.Sprintf(`
Expand All @@ -439,7 +431,6 @@ resource "google_compute_security_policy" "policy" {
`, spName)
}

<% unless version == 'ga' -%>
func testAccComputeSecurityPolicy_withAdaptiveProtection(spName string) string {
return fmt.Sprintf(`
resource "google_compute_security_policy" "policy" {
Expand All @@ -455,9 +446,7 @@ resource "google_compute_security_policy" "policy" {
}
`, spName)
}
<% end -%>

<% unless version == 'ga' -%>
func testAccComputeSecurityPolicy_withRateLimitOptions(spName string) string {
return fmt.Sprintf(`
resource "google_compute_security_policy" "policy" {
Expand Down Expand Up @@ -548,9 +537,7 @@ resource "google_compute_security_policy" "policy" {
`, spName)
}

<% end -%>

<% unless version == 'ga' -%>
func TestAccComputeSecurityPolicy_withRedirectOptionsRecaptcha(t *testing.T) {
t.Parallel()

Expand Down Expand Up @@ -671,4 +658,3 @@ resource "google_compute_security_policy" "policy" {
}
`, spName)
}
<% end -%>
12 changes: 6 additions & 6 deletions mmv1/third_party/terraform/website/docs/r/compute_security_policy.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ The following arguments are supported:
* NORMAL - Normal log level.
* VERBOSE - Verbose log level.

* `adaptive_protection_config` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) Configuration for [Google Cloud Armor Adaptive Protection](https://cloud.google.com/armor/docs/adaptive-protection-overview?hl=en). Structure is [documented below](#nested_adaptive_protection_config).
* `adaptive_protection_config` - (Optional) Configuration for [Google Cloud Armor Adaptive Protection](https://cloud.google.com/armor/docs/adaptive-protection-overview?hl=en). Structure is [documented below](#nested_adaptive_protection_config).

* `type` - The type indicates the intended use of the security policy.
* CLOUD_ARMOR - Cloud Armor backend security policies can be configured to filter incoming HTTP requests targeting backend services.
Expand Down Expand Up @@ -105,10 +105,10 @@ The following arguments are supported:
* `preview` - (Optional) When set to true, the `action` specified above is not enforced.
Stackdriver logs for requests that trigger a preview action are annotated as such.

* `rate_limit_options` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html))
* `rate_limit_options` - (Optional)
Must be specified if the `action` is "rate_based_bad" or "throttle". Cannot be specified for other actions. Structure is [documented below](#nested_rate_limit_options).

* `redirect_options` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html))
* `redirect_options` - (Optional)
Can be specified if the `action` is "redirect". Cannot be specified for other actions. Structure is [documented below](#nested_redirect_options).

<a name="nested_match"></a>The `match` block supports:
Expand Down Expand Up @@ -179,13 +179,13 @@ The following arguments are supported:

<a name="nested_adaptive_protection_config"></a>The `adaptive_protection_config` block supports:

* `layer_7_ddos_defense_config` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) Configuration for [Google Cloud Armor Adaptive Protection Layer 7 DDoS Defense](https://cloud.google.com/armor/docs/adaptive-protection-overview?hl=en). Structure is [documented below](#nested_layer_7_ddos_defense_config).
* `layer_7_ddos_defense_config` - (Optional) Configuration for [Google Cloud Armor Adaptive Protection Layer 7 DDoS Defense](https://cloud.google.com/armor/docs/adaptive-protection-overview?hl=en). Structure is [documented below](#nested_layer_7_ddos_defense_config).

<a name="nested_layer_7_ddos_defense_config"></a>The `layer_7_ddos_defense_config` block supports:

* `enable` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) If set to true, enables CAAP for L7 DDoS detection.
* `enable` - (Optional) If set to true, enables CAAP for L7 DDoS detection.

* `rule_visibility` - (Optional, [Beta](https://terraform.io/docs/providers/google/guides/provider_versions.html)) Rule visibility can be one of the following: STANDARD - opaque rules. (default) PREMIUM - transparent rules.
* `rule_visibility` - (Optional) Rule visibility can be one of the following: STANDARD - opaque rules. (default) PREMIUM - transparent rules.

## Attributes Reference

Expand Down