Add post-quantum key exchange to compute ssl policy resources

mmv1/products/compute/RegionSslPolicy.yaml

@@ -43,6 +43,15 @@ custom_code:
   constants: 'templates/terraform/constants/region_ssl_policy.tmpl'
 custom_diff:
   - 'regionSslPolicyCustomizeDiff'
+examples:
+  - name: 'region_ssl_policy_basic'
+    primary_resource_id: 'region-ssl-policy'
+    vars:
+      region_ssl_policy_name: 'region-ssl-policy'
+  - name: 'region_ssl_policy_post_quantum'
+    primary_resource_id: 'post-quantum-region-ssl-policy'
+    vars:
+      post_quantum_region_ssl_policy_name: 'post-quantum-region-ssl-policy'
 parameters:
   - name: 'region'
     type: ResourceRef
@@ -129,6 +138,22 @@ properties:
     send_empty_value: true
     item_type:
       type: String
+  - name: 'postQuantumKeyExchange'
+    type: Enum
+    description: |
+      One of `DEFAULT`, `ENABLED`, or `DEFERRED`. Controls whether the load balancer negotiates
+      X25519MLKEM768 key exchange when clients advertise support for it.
+      When set to `DEFAULT`, or if no SSL Policy is attached to
+      the target proxy, the load balancer disallows X25519MLKEM768 key
+      exchange before October 2026, and allows it afterward. When set to
+      `ENABLED`, the load balancer allows X25519MLKEM768 key
+      exchange. When set to `DEFERRED`, the load balancer
+      disallows X25519MLKEM768 key exchange until October 2027, and allows
+      it afterward.
+    enum_values:
+      - 'DEFAULT'
+      - 'ENABLED'
+      - 'DEFERRED'
   - name: 'fingerprint'
     type: Fingerprint
     description: |

mmv1/products/compute/SslPolicy.yaml

@@ -50,6 +50,10 @@ examples:
       production_ssl_policy_name: 'production-ssl-policy'
       nonprod_ssl_policy_name: 'nonprod-ssl-policy'
       custom_ssl_policy_name: 'custom-ssl-policy'
+  - name: 'ssl_policy_post_quantum'
+    primary_resource_id: 'post-quantum-ssl-policy'
+    vars:
+      post_quantum_ssl_policy_name: 'post-quantum-ssl-policy'
 parameters:
 properties:
   - name: 'creationTimestamp'
@@ -128,6 +132,22 @@ properties:
     is_set: true
     item_type:
       type: String
+  - name: 'postQuantumKeyExchange'
+    type: Enum
+    description: |
+      One of `DEFAULT`, `ENABLED`, or `DEFERRED`. Controls whether the load balancer
+      negotiates X25519MLKEM768 key exchange when clients advertise support for it.
+      When set to `DEFAULT`, or if no SSL Policy is attached to
+      the target proxy, the load balancer disallows X25519MLKEM768 key
+      exchange before October 2026, and allows it afterward. When set to
+      `ENABLED`, the load balancer allows X25519MLKEM768 key
+      exchange. When set to `DEFERRED`, the load balancer
+      disallows X25519MLKEM768 key exchange until October 2027, and allows
+      it afterward.
+    enum_values:
+      - 'DEFAULT'
+      - 'ENABLED'
+      - 'DEFERRED'
   - name: 'fingerprint'
     type: String
     description: |

mmv1/templates/terraform/examples/region_ssl_policy_basic.tf.tmpl

@@ -0,0 +1,5 @@
+resource "google_compute_region_ssl_policy" "region-ssl-policy" {
+  name    = "{{index $.Vars "region_ssl_policy_name"}}"
+  region  = "us-central1"
+  profile = "MODERN"
+}

mmv1/templates/terraform/examples/region_ssl_policy_post_quantum.tf.tmpl

@@ -0,0 +1,7 @@
+resource "google_compute_region_ssl_policy" "post-quantum-region-ssl-policy" {
+  name                         = "{{index $.Vars "post_quantum_region_ssl_policy_name"}}"
+  region                       = "us-central1"
+  profile                      = "MODERN"
+  min_tls_version              = "TLS_1_2"
+  post_quantum_key_exchange    = "ENABLED"
+}

mmv1/templates/terraform/examples/ssl_policy_post_quantum.tf.tmpl

@@ -0,0 +1,6 @@
+resource "google_compute_ssl_policy" "post-quantum-ssl-policy" {
+  name                         = "{{index $.Vars "post_quantum_ssl_policy_name"}}"
+  profile                      = "MODERN"
+  min_tls_version              = "TLS_1_2"
+  post_quantum_key_exchange    = "ENABLED"
+}

mmv1/third_party/terraform/services/compute/resource_compute_region_ssl_policy_test.go

@@ -14,7 +14,7 @@ import (
 func TestAccComputeRegionSslPolicy_regionInherit(t *testing.T) {
 	t.Parallel()
 
-	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -45,7 +45,7 @@ func TestAccComputeRegionSslPolicy_update(t *testing.T) {
 	t.Parallel()
 
 	var sslPolicy map[string]interface{}
-	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -124,7 +124,7 @@ func TestAccComputeRegionSslPolicy_update_to_custom(t *testing.T) {
 	t.Parallel()
 
 	var sslPolicy map[string]interface{}
-	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -171,7 +171,7 @@ func TestAccComputeRegionSslPolicy_update_from_custom(t *testing.T) {
 	t.Parallel()
 
 	var sslPolicy map[string]interface{}
-	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -214,6 +214,81 @@ func TestAccComputeRegionSslPolicy_update_from_custom(t *testing.T) {
 	})
 }
 
+func TestAccComputeRegionSslPolicy_postQuantumKeyExchange(t *testing.T) {
+	t.Parallel()
+
+	var sslPolicy map[string]interface{}
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeSslPolicyDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeRegionSslPostQuantum(sslPolicyName, ""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeRegionSslPolicyExists(
+						t, "google_compute_region_ssl_policy.post_quantum_key_exchange", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum_key_exchange", "profile", "MODERN"),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum_key_exchange", "min_tls_version", "TLS_1_2"),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum_key_exchange", "post_quantum_key_exchange", ""),
+				),
+			},
+			{
+				ResourceName:      "google_compute_region_ssl_policy.post_quantum_key_exchange",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRegionSslPostQuantum(sslPolicyName, "ENABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeRegionSslPolicyExists(
+						t, "google_compute_region_ssl_policy.post_quantum_key_exchange", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum_key_exchange", "post_quantum_key_exchange", "ENABLED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_region_ssl_policy.post_quantum_key_exchange",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRegionSslPostQuantum(sslPolicyName, "DEFERRED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeRegionSslPolicyExists(
+						t, "google_compute_region_ssl_policy.post_quantum_key_exchange", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum_key_exchange", "post_quantum_key_exchange", "DEFERRED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_region_ssl_policy.post_quantum_key_exchange",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRegionSslPostQuantum(sslPolicyName, "DEFAULT"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeRegionSslPolicyExists(
+						t, "google_compute_region_ssl_policy.post_quantum_key_exchange", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum_key_exchange", "post_quantum_key_exchange", "DEFAULT"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_region_ssl_policy.post_quantum_key_exchange",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckComputeRegionSslPolicyExists(t *testing.T, n string, sslPolicy *map[string]interface{}) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -338,3 +413,15 @@ resource "google_compute_region_ssl_policy" "foobar" {
 }
 `, resourceName)
 }
+
+func testAccComputeRegionSslPostQuantum(resourceName string, pqke string) string {
+	return fmt.Sprintf(`
+resource "google_compute_region_ssl_policy" "post_quantum_key_exchange" {
+  name                         = "%s"
+  profile                      = "MODERN"
+  min_tls_version              = "TLS_1_2"
+  region                       = "us-central1"
+  post_quantum_key_exchange    = "%s"
+}
+`, resourceName, pqke)
+}

mmv1/third_party/terraform/services/compute/resource_compute_ssl_policy_test.go

@@ -15,7 +15,7 @@ func TestAccComputeSslPolicy_update(t *testing.T) {
 	t.Parallel()
 
 	var sslPolicy map[string]interface{}
-	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -31,6 +31,8 @@ func TestAccComputeSslPolicy_update(t *testing.T) {
 						"google_compute_ssl_policy.update", "profile", "MODERN"),
 					resource.TestCheckResourceAttr(
 						"google_compute_ssl_policy.update", "min_tls_version", "TLS_1_0"),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.update", "post_quantum_key_exchange", ""),
 				),
 			},
 			{
@@ -47,6 +49,8 @@ func TestAccComputeSslPolicy_update(t *testing.T) {
 						"google_compute_ssl_policy.update", "profile", "RESTRICTED"),
 					resource.TestCheckResourceAttr(
 						"google_compute_ssl_policy.update", "min_tls_version", "TLS_1_2"),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.update", "post_quantum_key_exchange", ""),
 				),
 			},
 			{
@@ -63,6 +67,8 @@ func TestAccComputeSslPolicy_update(t *testing.T) {
 						"google_compute_ssl_policy.update", "profile", "FIPS_202205"),
 					resource.TestCheckResourceAttr(
 						"google_compute_ssl_policy.update", "min_tls_version", "TLS_1_2"),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.update", "post_quantum_key_exchange", ""),
 				),
 			},
 			{
@@ -79,6 +85,8 @@ func TestAccComputeSslPolicy_update(t *testing.T) {
 						"google_compute_ssl_policy.update", "profile", "RESTRICTED"),
 					resource.TestCheckResourceAttr(
 						"google_compute_ssl_policy.update", "min_tls_version", "TLS_1_3"),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.update", "post_quantum_key_exchange", ""),
 				),
 			},
 			{
@@ -94,7 +102,7 @@ func TestAccComputeSslPolicy_update_to_custom(t *testing.T) {
 	t.Parallel()
 
 	var sslPolicy map[string]interface{}
-	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -141,7 +149,7 @@ func TestAccComputeSslPolicy_update_from_custom(t *testing.T) {
 	t.Parallel()
 
 	var sslPolicy map[string]interface{}
-	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
 
 	acctest.VcrTest(t, resource.TestCase{
 		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
@@ -184,6 +192,81 @@ func TestAccComputeSslPolicy_update_from_custom(t *testing.T) {
 	})
 }
 
+func TestAccComputeSslPolicy_postQuantumKeyExchange(t *testing.T) {
+	t.Parallel()
+
+	var sslPolicy map[string]interface{}
+	sslPolicyName := fmt.Sprintf("tf-test-ssl-policy-%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeSslPolicyDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeSslPostQuantum(sslPolicyName, ""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeSslPolicyExists(
+						t, "google_compute_ssl_policy.post_quantum_key_exchange", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum_key_exchange", "profile", "MODERN"),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum_key_exchange", "min_tls_version", "TLS_1_2"),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum_key_exchange", "post_quantum_key_exchange", ""),
+				),
+			},
+			{
+				ResourceName:      "google_compute_ssl_policy.post_quantum_key_exchange",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeSslPostQuantum(sslPolicyName, "DEFAULT"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeSslPolicyExists(
+						t, "google_compute_ssl_policy.post_quantum_key_exchange", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum_key_exchange", "post_quantum_key_exchange", "DEFAULT"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_ssl_policy.post_quantum_key_exchange",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeSslPostQuantum(sslPolicyName, "ENABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeSslPolicyExists(
+						t, "google_compute_ssl_policy.post_quantum_key_exchange", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum_key_exchange", "post_quantum_key_exchange", "ENABLED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_ssl_policy.post_quantum_key_exchange",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeSslPostQuantum(sslPolicyName, "DEFERRED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeSslPolicyExists(
+						t, "google_compute_ssl_policy.post_quantum_key_exchange", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum_key_exchange", "post_quantum_key_exchange", "DEFERRED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_ssl_policy.post_quantum_key_exchange",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckComputeSslPolicyExists(t *testing.T, n string, sslPolicy *map[string]interface{}) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -281,3 +364,14 @@ resource "google_compute_ssl_policy" "update" {
 }
 `, resourceName)
 }
+
+func testAccComputeSslPostQuantum(resourceName, pqke string) string {
+	return fmt.Sprintf(`
+resource "google_compute_ssl_policy" "post_quantum_key_exchange" {
+  name                         = "%s"
+  profile                      = "MODERN"
+  min_tls_version              = "TLS_1_2"
+  post_quantum_key_exchange    = "%s"
+}
+`, resourceName, pqke)
+}