Skip to content

Commit 29fcf77

Browse files
mihhaljmihhalj
committed
Add new compute-network-firewall-policy-with-rules resource
1 parent 8a8e61c commit 29fcf77

9 files changed

+1133
-1
lines changed

‎mmv1/products/compute/NetworkFirewallPolicyWithRules.yaml

+563
Large diffs are not rendered by default.

‎mmv1/templates/terraform/constants/firewall.erb

+1-1
Original file line numberDiff line numberDiff line change
@@ -111,4 +111,4 @@ func diffSuppressSourceRanges(k, old, new string, d *schema.ResourceData) bool {
111111
}
112112
// For any other source_ranges value diff, don't suppress
113113
return false
114-
}
114+
}

‎mmv1/templates/terraform/constants/resource_compute_network_firewall_policy_with_rules.go.erb

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
func networkFirewallPolicyWithRulesConvertPriorityToInt(v interface {}) (int64, error) {
2+
if strVal, ok := v.(string); ok {
3+
if intVal, err := tpgresource.StringToFixed64(strVal); err == nil {
4+
return intVal, nil
5+
}
6+
}
7+
8+
if intVal, ok := v.(int64); ok {
9+
return intVal, nil
10+
}
11+
12+
if floatVal, ok := v.(float64); ok {
13+
intVal := int64(floatVal)
14+
return intVal, nil
15+
}
16+
17+
return 0, fmt.Errorf("Incorrect rule priority: %s. Priority must be a number", v)
18+
}
19+
20+
func networkFirewallPolicyWithRulesIsPredefinedRule(rule map[string]interface{}) (bool, error) {
21+
// Priorities from 2147483548 to 2147483647 are reserved and cannot be modified by the user.
22+
const ReservedPriorityStart = 2147483548
23+
24+
priority := rule["priority"]
25+
priorityInt, err := networkFirewallPolicyWithRulesConvertPriorityToInt(priority)
26+
27+
if err != nil {
28+
return false, err
29+
}
30+
31+
return priorityInt >= ReservedPriorityStart, nil
32+
33+
}
34+
35+
func networkFirewallPolicyWithRulesSplitPredefinedRules(allRules []interface{}) ([]interface{}, []interface{}, error) {
36+
predefinedRules := make([]interface{}, 0)
37+
rules := make([]interface{}, 0)
38+
39+
for _, rule := range allRules {
40+
isPredefined, err := networkFirewallPolicyWithRulesIsPredefinedRule(rule.(map[string]interface{}))
41+
if err != nil {
42+
return nil, nil, err
43+
}
44+
45+
if isPredefined {
46+
predefinedRules = append(predefinedRules, rule)
47+
} else {
48+
rules = append(rules, rule)
49+
}
50+
}
51+
52+
return rules, predefinedRules, nil
53+
}
54+

‎mmv1/templates/terraform/decoders/resource_compute_network_firewall_policy_with_rules.go.erb

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
rules, predefinedRules, err := networkFirewallPolicyWithRulesSplitPredefinedRules(res["rules"].([]interface{}))
2+
3+
if err != nil {
4+
return nil, fmt.Errorf("Error occurred while splitting pre-defined rules: %s", err)
5+
}
6+
7+
res["rules"] = rules
8+
res["predefinedRules"] = predefinedRules
9+
10+
config := meta.(*transport_tpg.Config)
11+
12+
if err := d.Set("predefined_rules", flattenComputeNetworkFirewallPolicyWithRulesPredefinedRules(predefinedRules, d, config)); err != nil {
13+
return nil, fmt.Errorf("Error occurred while setting pre-defined rules: %s", err)
14+
}
15+
16+
return res, nil

‎mmv1/templates/terraform/encoders/resource_compute_network_firewall_policy_with_rules.go.erb

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
delete(obj, "rules") // Rules are not supported in the create API
2+
return obj, nil
3+

‎mmv1/templates/terraform/examples/compute_network_firewall_policy_with_rules_full.tf.erb

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
data "google_project" "project" {
2+
provider = google-beta
3+
}
4+
5+
resource "google_compute_network_firewall_policy_with_rules" "<%= ctx[:primary_resource_id] %>" {
6+
name = "<%= ctx[:vars]['policy_name'] %>"
7+
description = "Terraform test"
8+
provider = google-beta
9+
10+
rule {
11+
description = "tcp rule"
12+
priority = 1000
13+
enable_logging = true
14+
action = "allow"
15+
direction = "EGRESS"
16+
match {
17+
layer4_config {
18+
ip_protocol = "tcp"
19+
ports = [8080, 7070]
20+
}
21+
dest_ip_ranges = ["11.100.0.1/32"]
22+
dest_fqdns = ["www.yyy.com", "www.zzz.com"]
23+
dest_region_codes = ["HK", "IN"]
24+
dest_threat_intelligences = ["iplist-search-engines-crawlers", "iplist-tor-exit-nodes"]
25+
dest_address_groups = [google_network_security_address_group.address_group_1.id]
26+
}
27+
target_secure_tag {
28+
name = "tagValues/${google_tags_tag_value.secure_tag_value_1.name}"
29+
}
30+
}
31+
rule {
32+
description = "udp rule"
33+
priority = 2000
34+
enable_logging = false
35+
action = "deny"
36+
direction = "INGRESS"
37+
match {
38+
layer4_config {
39+
ip_protocol = "udp"
40+
}
41+
src_ip_ranges = ["0.0.0.0/0"]
42+
src_fqdns = ["www.abc.com", "www.def.com"]
43+
src_region_codes = ["US", "CA"]
44+
src_threat_intelligences = ["iplist-known-malicious-ips", "iplist-public-clouds"]
45+
src_address_groups = [google_network_security_address_group.address_group_1.id]
46+
src_secure_tag {
47+
name = "tagValues/${google_tags_tag_value.secure_tag_value_1.name}"
48+
}
49+
}
50+
disabled = true
51+
}
52+
rule {
53+
description = "default egress rule"
54+
priority = 2147483644
55+
enable_logging = false
56+
action = "goto_next"
57+
direction = "EGRESS"
58+
match {
59+
layer4_config {
60+
ip_protocol = "all"
61+
}
62+
dest_ip_ranges = ["::/0"]
63+
}
64+
}
65+
rule {
66+
description = "default ingress rule"
67+
priority = 2147483645
68+
enable_logging = false
69+
action = "goto_next"
70+
direction = "INGRESS"
71+
match {
72+
layer4_config {
73+
ip_protocol = "all"
74+
}
75+
src_ip_ranges = ["::/0"]
76+
}
77+
}
78+
rule {
79+
description = "default egress rule"
80+
priority = 2147483646
81+
enable_logging = false
82+
action = "goto_next"
83+
direction = "EGRESS"
84+
match {
85+
layer4_config {
86+
ip_protocol = "all"
87+
}
88+
dest_ip_ranges = ["0.0.0.0/0"]
89+
}
90+
}
91+
rule {
92+
description = "default ingress rule"
93+
priority = 2147483647
94+
enable_logging = false
95+
action = "goto_next"
96+
direction = "INGRESS"
97+
match {
98+
layer4_config {
99+
ip_protocol = "all"
100+
}
101+
src_ip_ranges = ["0.0.0.0/0"]
102+
}
103+
}
104+
}
105+
106+
resource "google_network_security_address_group" "address_group_1" {
107+
provider = google-beta
108+
name = "address-group-1"
109+
parent = "projects/${data.google_project.project.name}"
110+
description = "Global address group"
111+
location = "global"
112+
items = ["208.80.154.224/32"]
113+
type = "IPV4"
114+
capacity = 100
115+
}
116+
117+
resource "google_tags_tag_key" "secure_tag_key_1" {
118+
provider = google-beta
119+
description = "Tag key"
120+
parent = "projects/${data.google_project.project.name}"
121+
purpose = "GCE_FIREWALL"
122+
short_name = "tag-key"
123+
purpose_data = {
124+
network = "${data.google_project.project.name}/default"
125+
}
126+
}
127+
128+
resource "google_tags_tag_value" "secure_tag_value_1" {
129+
provider = google-beta
130+
description = "Tag value"
131+
parent = "tagKeys/${google_tags_tag_key.secure_tag_key_1.name}"
132+
short_name = "tag-value"
133+
}
134+

‎mmv1/templates/terraform/post_create/resource_compute_network_firewall_policy_with_rules.go.erb

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
log.Printf("[DEBUG] Post-create for NetworkFirewallPolicyWithRules %q", d.Id())
2+
3+
url, err = tpgresource.ReplaceVarsForId(d, config, "{{ComputeBasePath}}projects/{{project}}/global/firewallPolicies/{{name}}")
4+
if err != nil {
5+
return err
6+
}
7+
8+
headers = make(http.Header)
9+
res, err = transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
10+
Config: config,
11+
Method: "GET",
12+
Project: billingProject,
13+
RawURL: url,
14+
UserAgent: userAgent,
15+
Headers: headers,
16+
})
17+
if err != nil {
18+
return transport_tpg.HandleNotFoundError(err, d, fmt.Sprintf("ComputeNetworkFirewallPolicyWithRules %q", d.Id()))
19+
}
20+
21+
if err := d.Set("fingerprint", flattenComputeNetworkFirewallPolicyWithRulesFingerprint(res["fingerprint"], d, config)); err != nil {
22+
return fmt.Errorf("Error reading NetworkFirewallPolicyWithRules: %s", err)
23+
}
24+
25+
res, err = resourceComputeNetworkFirewallPolicyWithRulesDecoder(d, meta, res)
26+
if err != nil {
27+
return err
28+
}
29+
30+
log.Printf("[DEBUG] Updating NetworkFirewallPolicyWithRules %q", d.Id())
31+
return resourceComputeNetworkFirewallPolicyWithRulesUpdate(d, meta)

‎mmv1/templates/terraform/update_encoder/resource_compute_network_firewall_policy_with_rules.go.erb

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
config := meta.(*transport_tpg.Config)
2+
3+
predefinedRulesProp, err := expandComputeNetworkFirewallPolicyWithRulesRule(d.Get("predefined_rules"), d, config)
4+
if err != nil {
5+
return nil, err
6+
}
7+
8+
rules := obj["rules"].([]interface{})
9+
obj["rules"] = append(rules, predefinedRulesProp)
10+
11+
return obj, nil
12+
13+
14+
15+

0 commit comments

Comments
 (0)