fix(gcp/security): handle full resource path in cluster subnetwork lookup

.github/workflows/tofu-test.yml

@@ -25,7 +25,7 @@ jobs:
   test-gcp-modules:
     uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main
     with:
-      modules: '["infrastructure/gcp/artifact-registry", "infrastructure/gcp/cloud-dns", "infrastructure/gcp/cloud-nat", "infrastructure/gcp/iam", "infrastructure/gcp/vpc"]'
+      modules: '["infrastructure/gcp/artifact-registry", "infrastructure/gcp/cloud-dns", "infrastructure/gcp/cloud-nat", "infrastructure/gcp/iam", "infrastructure/gcp/security", "infrastructure/gcp/vpc"]'
 
   test-nullplatform-modules:
     uses: nullplatform/actions-nullplatform/.github/workflows/tofu-test.yml@main

infrastructure/gcp/security/main.tf

@@ -36,10 +36,23 @@ data "google_container_cluster" "this" {
   }
 }
 
+locals {
+  # google_container_cluster.subnetwork is documented as the subnetwork name,
+  # but in practice it echoes back whatever format the cluster was created
+  # with — a bare name, or (e.g. when created via a module that passes a full
+  # reference, such as terraform-google-modules/kubernetes-engine) the full
+  # "projects/.../regions/.../subnetworks/NAME" path. google_compute_subnetwork
+  # only accepts a bare name, so take the last path segment either way.
+  cluster_subnetwork_name = var.cluster_name != "" ? element(
+    split("/", data.google_container_cluster.this[0].subnetwork),
+    length(split("/", data.google_container_cluster.this[0].subnetwork)) - 1
+  ) : ""
+}
+
 # Get subnetwork info to derive CIDR
 data "google_compute_subnetwork" "this" {
   count   = var.cluster_name != "" ? 1 : 0
-  name    = data.google_container_cluster.this[0].subnetwork
+  name    = local.cluster_subnetwork_name
   region  = var.gcp_region
   project = var.gcp_project_id
 }

infrastructure/gcp/security/tests/security.tftest.hcl

@@ -0,0 +1,68 @@
+mock_provider "google" {}
+
+variables {
+  cluster_name   = "myorg-cluster"
+  gcp_project_id = "myorg-project"
+  gcp_region     = "us-central1"
+}
+
+run "subnetwork_name_extracted_from_full_resource_path" {
+  command = plan
+
+  override_data {
+    target = data.google_container_cluster.this
+    values = {
+      subnetwork = "projects/myorg-project/regions/us-central1/subnetworks/subnet-gke"
+      network    = "myorg-vpc"
+    }
+  }
+
+  assert {
+    condition     = local.cluster_subnetwork_name == "subnet-gke"
+    error_message = "Should extract the bare subnetwork name when the cluster's subnetwork attribute is a full resource path"
+  }
+}
+
+run "subnetwork_name_passthrough_when_already_bare" {
+  command = plan
+
+  override_data {
+    target = data.google_container_cluster.this
+    values = {
+      subnetwork = "subnet-gke"
+      network    = "myorg-vpc"
+    }
+  }
+
+  assert {
+    condition     = local.cluster_subnetwork_name == "subnet-gke"
+    error_message = "Should pass through an already-bare subnetwork name unchanged"
+  }
+}
+
+run "firewall_rules_created_for_both_gateways" {
+  command = plan
+
+  override_data {
+    target = data.google_container_cluster.this
+    values = {
+      subnetwork = "projects/myorg-project/regions/us-central1/subnetworks/subnet-gke"
+      network    = "myorg-vpc"
+    }
+  }
+
+  variables {
+    gateways_enabled         = true
+    gateway_internal_enabled = true
+  }
+
+  assert {
+    condition     = length(google_compute_firewall.public_gateway_https) == 1
+    error_message = "Public HTTPS firewall rule should be created when gateways_enabled is true"
+  }
+
+  assert {
+    condition     = length(google_compute_firewall.private_gateway_https) == 1
+    error_message = "Private HTTPS firewall rule should be created when gateway_internal_enabled is true"
+  }
+}