Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(VPCSC): enable dryrun mode #1210

Merged
merged 37 commits into from
Jul 4, 2024
Merged

fix(VPCSC): enable dryrun mode #1210

Changes from 2 commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
af5cef1
Enable dry run mode on the VPCSC perimeter to fix issue 1209
eeaton Apr 29, 2024
d24cc4a
Merge branch 'master' into fix-1209-vpcsc-dryrun
eeaton Apr 29, 2024
4746b9c
Update 3-networks-dual-svpc/modules/restricted_shared_vpc/service_con…
eeaton Apr 30, 2024
671e049
all the changes in 3-networks-dual-svpc to add *_dry_run variables an…
eeaton May 3, 2024
dc9a217
make changes to 4-projects so that projects for restricted vpc are au…
eeaton May 3, 2024
a81fdff
regenerate variables for readme docs. `make docker_generate_docs`
eeaton May 3, 2024
4555f73
Transfer dry-run related changes from 3-networks-dual-svpc to 3-netwo…
eeaton May 3, 2024
f6d87af
Merge branch 'master' into fix-1209-vpcsc-dryrun
eeaton May 30, 2024
046effe
add variable definitions to stage 4 modules
eeaton May 30, 2024
4bf1e1e
Merge branch 'fix-1209-vpcsc-dryrun' of https://github.com/eeaton/ter…
eeaton May 30, 2024
3de7bec
addressed remaining LINT issues for variable definitions across modules
eeaton May 30, 2024
1daa305
add dry_run parameters to net-hub
eeaton May 30, 2024
a20a6d9
fix logic to define restricted_services_dry_run
eeaton May 31, 2024
6811e81
Add dryrun spec to hubspoke perimeter bridges
eeaton May 31, 2024
fc6693f
fix variable to manage explicit_dry_run_spec
eeaton May 31, 2024
03ec2e6
add directions to readme for using enforce_vpcsc
eeaton May 31, 2024
facb284
fix failing tests caused by inconsistent variable name
eeaton Jun 3, 2024
3b0b22e
Merge branch 'terraform-google-modules:master' into fix-1209-vpcsc-dr…
eeaton Jun 24, 2024
3efcabd
update network_tests.go to check details of the dryrun service perimeter
eeaton Jun 24, 2024
8504fb4
update logic in hub-and-spoke perimeter bridge to avoid error when pr…
eeaton Jun 24, 2024
a1603aa
Apply suggestions from code review
eeaton Jun 25, 2024
cbe8d0d
Update 3-networks-hub-and-spoke/modules/restricted_shared_vpc/variabl…
eeaton Jun 25, 2024
08933f7
fixed gcloud syntax for describing dry-run perimeter in tests
eeaton Jun 25, 2024
a8d84a4
Merge branch 'fix-1209-vpcsc-dryrun' of https://github.com/eeaton/ter…
eeaton Jun 25, 2024
40f50df
Update test/integration/networks/networks_test.go
eeaton Jun 26, 2024
e0609e8
adjust syntax of networks_test.go
eeaton Jun 26, 2024
fbb649a
rewrite logic for network_tests with non-json format
eeaton Jun 27, 2024
600ce9e
update list of supported services to all GA support services. Result…
eeaton Jun 27, 2024
d657363
Revert "update list of supported services to all GA support services.…
eeaton Jun 28, 2024
4d6ff8e
remove unused variable operationService
eeaton Jun 28, 2024
d4aca63
Merge branch 'master' into fix-1209-vpcsc-dryrun
eeaton Jun 28, 2024
f514337
fix unrelated error in CI tests, CI tests suddenly return different v…
eeaton Jul 1, 2024
52d7b5e
`terraform` fmt to pass lint tests
eeaton Jul 1, 2024
84ef72a
Apply suggestions from code review
eeaton Jul 1, 2024
8af849a
update logic in projects_test.go to check against dry run perimeter, …
eeaton Jul 1, 2024
545808e
Update test/integration/projects/projects_test.go
eeaton Jul 2, 2024
0974b31
Merge branch 'master' into fix-1209-vpcsc-dryrun
apeabody Jul 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions 3-networks-dual-svpc/modules/restricted_shared_vpc/service_control.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,14 +66,22 @@ module "regular_service_perimeter" {
policy = var.access_context_manager_policy_id
perimeter_name = local.perimeter_name
description = "Default VPC Service Controls perimeter"
resources = [var.project_number]
access_levels = [module.access_level_members.name]

restricted_services = var.restricted_services
vpc_accessible_services = ["RESTRICTED-SERVICES"]
# configurations for a perimeter in dry run mode.
resources_dry_run = [var.project_number]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the way the projects are added to the perimeter in step 4-projects also needs to be updated.

  vpc_service_control_attach_enabled = var.vpc_service_control_attach_enabled
  vpc_service_control_perimeter_name = var.vpc_service_control_perimeter_name
  vpc_service_control_sleep_duration = var.vpc_service_control_sleep_duration

https://github.com/terraform-google-modules/terraform-example-foundation/blob/master/4-projects/modules/single_project/main.tf#L62C1-L64C78

This cloud be a new flag like how it is coded in the project factory module

https://github.com/terraform-google-modules/terraform-google-project-factory/blob/master/modules/core_project_factory/main.tf#L347C1-L365C2

Copy link
Contributor

@amandakarina amandakarina Apr 29, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hey Eliot, just wondering if this change could be done with a flag instead of comment/uncomment the code, export in outputs to be read by other steps, like 4-projects as Daniel mentioned. It would also be less tricky for others blueprints that have documentation of how to deploy on top of foundation.

access_levels_dry_run = [module.access_level_members.name]
restricted_services_dry_run = var.restricted_services
vpc_accessible_services_dry_run = ["RESTRICTED-SERVICES"]
ingress_policies_dry_run = var.ingress_policies
egress_policies_dry_run = var.egress_policies

ingress_policies = var.ingress_policies
egress_policies = var.egress_policies
# configurations for a perimeter in enforced mode. Uncomment these when you are ready to enforce VPCSC.
# resources = [var.project_number]
# access_levels = [module.access_level_members.name]
# restricted_services = var.restricted_services
# vpc_accessible_services = ["RESTRICTED-SERVICES"]
# ingress_policies = var.ingress_policies
# egress_policies = var.egress_policies
eeaton marked this conversation as resolved.
Show resolved Hide resolved

depends_on = [
time_sleep.wait_vpc_sc_propagation
Expand Down