Skip to content

Commit bd9a48c

Browse files
gservatGonzalo Servat
gservat
authored and
Gonzalo Servat
committed
Add support for updating server TLS policy via PATCH
1 parent df9fe58 commit bd9a48c

File tree

2 files changed

+249
-2
lines changed

2 files changed

+249
-2
lines changed

‎mmv1/products/compute/RegionTargetHttpsProxy.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -204,3 +204,8 @@ properties:
204204
INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
205205
loadBalancingScheme consult ServerTlsPolicy documentation.
206206
If left blank, communications are not encrypted.
207+
update_id: 'serverTlsPolicy'
208+
fingerprint_name: 'fingerprint'
209+
update_verb: :PATCH
210+
update_url:
211+
'projects/{{project}}/regions/{{region}}/targetHttpsProxies/{{name}}'

‎mmv1/third_party/terraform/services/compute/resource_compute_region_target_https_proxy_test.go.erb

+244-2
Original file line numberDiff line numberDiff line change
@@ -387,6 +387,9 @@ func TestAccComputeRegionTargetHttpsProxy_addSslPolicy_withForwardingRule(t *tes
387387
func testAccComputeRegionTargetHttpsProxy_withForwardingRule(context map[string]interface{}) string {
388388
return acctest.Nprintf(`
389389
resource "google_compute_forwarding_rule" "default-https" {
390+
<% unless version == 'ga' -%>
391+
provider = google-beta
392+
<% end -%>
390393
project = "%{project_id}"
391394
region = "us-central1"
392395
name = "https-frwd-rule-%{resource_suffix}"
@@ -402,6 +405,9 @@ resource "google_compute_forwarding_rule" "default-https" {
402405
}
403406

404407
resource "google_compute_region_backend_service" "default" {
408+
<% unless version == 'ga' -%>
409+
provider = google-beta
410+
<% end -%>
405411
project = "%{project_id}"
406412
region = "us-central1"
407413
name = "backend-service-%{resource_suffix}"
@@ -412,7 +418,7 @@ resource "google_compute_region_backend_service" "default" {
412418
health_checks = [google_compute_region_health_check.default.self_link]
413419
locality_lb_policy = "RING_HASH"
414420

415-
# webscoket handling: https://stackoverflow.com/questions/63822612/websocket-connection-being-closed-on-google-compute-engine
421+
# websocket handling: https://stackoverflow.com/questions/63822612/websocket-connection-being-closed-on-google-compute-engine
416422
timeout_sec = 600
417423

418424
consistent_hash {
@@ -436,6 +442,9 @@ resource "google_compute_region_backend_service" "default" {
436442
}
437443

438444
resource "google_compute_region_health_check" "default" {
445+
<% unless version == 'ga' -%>
446+
provider = google-beta
447+
<% end -%>
439448
project = "%{project_id}"
440449
region = "us-central1"
441450
name = "hc-%{resource_suffix}"
@@ -451,6 +460,9 @@ resource "google_compute_region_health_check" "default" {
451460
}
452461

453462
resource "google_compute_region_target_https_proxy" "default-https" {
463+
<% unless version == 'ga' -%>
464+
provider = google-beta
465+
<% end -%>
454466
project = "%{project_id}"
455467
region = "us-central1"
456468
name = "https-proxy-%{resource_suffix}"
@@ -459,32 +471,47 @@ resource "google_compute_region_target_https_proxy" "default-https" {
459471
}
460472

461473
resource "google_compute_region_url_map" "default-https" {
474+
<% unless version == 'ga' -%>
475+
provider = google-beta
476+
<% end -%>
462477
project = "%{project_id}"
463478
region = "us-central1"
464479
name = "lb-%{resource_suffix}"
465480
default_service = google_compute_region_backend_service.default.id
466481
}
467482

468483
resource "google_compute_region_ssl_certificate" "foobar0" {
484+
<% unless version == 'ga' -%>
485+
provider = google-beta
486+
<% end -%>
469487
name = "httpsproxy-test-cert0-%{resource_suffix}"
470488
description = "very descriptive"
471489
private_key = file("test-fixtures/test.key")
472490
certificate = file("test-fixtures/test.crt")
473491
}
474492

475493
resource "google_compute_network" "ilb_network" {
494+
<% unless version == 'ga' -%>
495+
provider = google-beta
496+
<% end -%>
476497
name = "tf-test-l4-ilb-network-%{resource_suffix}"
477498
auto_create_subnetworks = false
478499
}
479500

480501
resource "google_compute_subnetwork" "ilb_subnet" {
502+
<% unless version == 'ga' -%>
503+
provider = google-beta
504+
<% end -%>
481505
name = "tf-test-l4-ilb-subnet-%{resource_suffix}"
482506
ip_cidr_range = "10.0.1.0/24"
483507
region = "us-central1"
484508
network = google_compute_network.ilb_network.id
485509
}
486510

487511
resource "google_compute_subnetwork" "ilb_subnet2" {
512+
<% unless version == 'ga' -%>
513+
provider = google-beta
514+
<% end -%>
488515
name = "tf-test-l4-ilb-subnet2-%{resource_suffix}"
489516
ip_cidr_range = "10.142.0.0/20"
490517
region = "us-central1"
@@ -494,6 +521,9 @@ resource "google_compute_subnetwork" "ilb_subnet2" {
494521
}
495522

496523
resource "google_compute_address" "consumer_address" {
524+
<% unless version == 'ga' -%>
525+
provider = google-beta
526+
<% end -%>
497527
name = "tf-test-website-ip-%{resource_suffix}-1"
498528
region = "us-central1"
499529
subnetwork = google_compute_subnetwork.ilb_subnet.id
@@ -530,7 +560,7 @@ resource "google_compute_region_backend_service" "default" {
530560
health_checks = [google_compute_region_health_check.default.self_link]
531561
locality_lb_policy = "RING_HASH"
532562

533-
# webscoket handling: https://stackoverflow.com/questions/63822612/websocket-connection-being-closed-on-google-compute-engine
563+
# websocket handling: https://stackoverflow.com/questions/63822612/websocket-connection-being-closed-on-google-compute-engine
534564
timeout_sec = 600
535565

536566
consistent_hash {
@@ -629,3 +659,215 @@ resource "google_compute_address" "consumer_address" {
629659
}
630660
`, context)
631661
}
662+
663+
<% unless version == 'ga' -%>
664+
665+
func TestAccComputeRegionTargetHttpsProxy_addServerTlsPolicy_withForwardingRule(t *testing.T) {
666+
t.Parallel()
667+
668+
context := map[string]interface{}{
669+
"resource_suffix": acctest.RandString(t, 10),
670+
"project_id": envvar.GetTestProjectFromEnv(),
671+
}
672+
673+
acctest.VcrTest(t, resource.TestCase{
674+
PreCheck: func() { acctest.AccTestPreCheck(t) },
675+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderBetaFactories(t),
676+
CheckDestroy: testAccCheckComputeTargetHttpsProxyDestroyProducer(t),
677+
Steps: []resource.TestStep{
678+
{
679+
Config: testAccComputeRegionTargetHttpsProxy_withForwardingRule(context),
680+
},
681+
{
682+
ResourceName: "google_compute_region_target_https_proxy.default-https",
683+
ImportState: true,
684+
ImportStateVerify: true,
685+
},
686+
{
687+
Config: testAccComputeRegionTargetHttpsProxy_withForwardingRule_withServerTlsPolicy(context),
688+
},
689+
{
690+
ResourceName: "google_compute_region_target_https_proxy.default-https",
691+
ImportState: true,
692+
ImportStateVerify: true,
693+
},
694+
},
695+
})
696+
}
697+
698+
func testAccComputeRegionTargetHttpsProxy_withForwardingRule_withServerTlsPolicy(context map[string]interface{}) string {
699+
return acctest.Nprintf(`
700+
701+
data "google_project" "project" {
702+
provider = google-beta
703+
project_id = "%{project_id}"
704+
}
705+
706+
resource "google_compute_forwarding_rule" "default-https" {
707+
provider = google-beta
708+
709+
project = "%{project_id}"
710+
region = "us-central1"
711+
name = "https-frwd-rule-%{resource_suffix}"
712+
load_balancing_scheme = "INTERNAL_MANAGED"
713+
target = google_compute_region_target_https_proxy.default-https.self_link
714+
network = google_compute_network.ilb_network.name
715+
subnetwork = google_compute_subnetwork.ilb_subnet.name
716+
ip_address = google_compute_address.consumer_address.id
717+
ip_protocol = "TCP"
718+
port_range = "443"
719+
allow_global_access = "true"
720+
depends_on = [google_compute_subnetwork.ilb_subnet2]
721+
}
722+
723+
resource "google_compute_region_backend_service" "default" {
724+
provider = google-beta
725+
726+
project = "%{project_id}"
727+
region = "us-central1"
728+
name = "backend-service-%{resource_suffix}"
729+
protocol = "HTTPS"
730+
port_name = "https-server"
731+
load_balancing_scheme = "INTERNAL_MANAGED"
732+
session_affinity = "HTTP_COOKIE"
733+
health_checks = [google_compute_region_health_check.default.self_link]
734+
locality_lb_policy = "RING_HASH"
735+
736+
# websocket handling: https://stackoverflow.com/questions/63822612/websocket-connection-being-closed-on-google-compute-engine
737+
timeout_sec = 600
738+
739+
consistent_hash {
740+
http_cookie {
741+
ttl {
742+
# 24hr cookie ttl
743+
seconds = 86400
744+
nanos = null
745+
}
746+
name = "X-CLIENT-SESSION"
747+
path = null
748+
}
749+
http_header_name = null
750+
minimum_ring_size = 1024
751+
}
752+
753+
log_config {
754+
enable = true
755+
sample_rate = 1.0
756+
}
757+
}
758+
759+
resource "google_compute_region_health_check" "default" {
760+
provider = google-beta
761+
762+
project = "%{project_id}"
763+
region = "us-central1"
764+
name = "hc-%{resource_suffix}"
765+
timeout_sec = 5
766+
check_interval_sec = 30
767+
healthy_threshold = 3
768+
unhealthy_threshold = 3
769+
770+
https_health_check {
771+
port = 443
772+
request_path = "/health"
773+
}
774+
}
775+
776+
resource "google_compute_region_target_https_proxy" "default-https" {
777+
provider = google-beta
778+
779+
project = "%{project_id}"
780+
region = "us-central1"
781+
name = "https-proxy-%{resource_suffix}"
782+
url_map = google_compute_region_url_map.default-https.self_link
783+
ssl_certificates = [google_compute_region_ssl_certificate.foobar0.self_link]
784+
server_tls_policy = google_network_security_server_tls_policy.default.id
785+
}
786+
787+
resource "google_certificate_manager_trust_config" "default" {
788+
provider = google-beta
789+
790+
project = "%{project_id}"
791+
location = "us-central1"
792+
name = "trust-config-%{resource_suffix}"
793+
794+
trust_stores {
795+
trust_anchors {
796+
pem_certificate = file("test-fixtures/ca_cert.pem")
797+
}
798+
intermediate_cas {
799+
pem_certificate = file("test-fixtures/ca_cert.pem")
800+
}
801+
}
802+
}
803+
804+
resource "google_network_security_server_tls_policy" "default" {
805+
provider = google-beta
806+
807+
project = "%{project_id}"
808+
location = "us-central1"
809+
name = "tls-policy-%{resource_suffix}"
810+
allow_open = "false"
811+
mtls_policy {
812+
client_validation_mode = "REJECT_INVALID"
813+
client_validation_trust_config = "projects/${data.google_project.project.number}/locations/us-central1/trustConfigs/${google_certificate_manager_trust_config.default.name}"
814+
}
815+
}
816+
817+
resource "google_compute_region_url_map" "default-https" {
818+
provider = google-beta
819+
820+
project = "%{project_id}"
821+
region = "us-central1"
822+
name = "lb-%{resource_suffix}"
823+
default_service = google_compute_region_backend_service.default.id
824+
}
825+
826+
resource "google_compute_region_ssl_certificate" "foobar0" {
827+
provider = google-beta
828+
829+
name = "httpsproxy-test-cert0-%{resource_suffix}"
830+
description = "very descriptive"
831+
private_key = file("test-fixtures/test.key")
832+
certificate = file("test-fixtures/test.crt")
833+
}
834+
835+
resource "google_compute_network" "ilb_network" {
836+
provider = google-beta
837+
838+
name = "tf-test-l4-ilb-network-%{resource_suffix}"
839+
auto_create_subnetworks = false
840+
}
841+
842+
resource "google_compute_subnetwork" "ilb_subnet" {
843+
provider = google-beta
844+
845+
name = "tf-test-l4-ilb-subnet-%{resource_suffix}"
846+
ip_cidr_range = "10.0.1.0/24"
847+
region = "us-central1"
848+
network = google_compute_network.ilb_network.id
849+
}
850+
851+
resource "google_compute_subnetwork" "ilb_subnet2" {
852+
provider = google-beta
853+
854+
name = "tf-test-l4-ilb-subnet2-%{resource_suffix}"
855+
ip_cidr_range = "10.142.0.0/20"
856+
region = "us-central1"
857+
purpose = "REGIONAL_MANAGED_PROXY"
858+
role = "ACTIVE"
859+
network = google_compute_network.ilb_network.id
860+
}
861+
862+
resource "google_compute_address" "consumer_address" {
863+
provider = google-beta
864+
865+
name = "tf-test-website-ip-%{resource_suffix}-1"
866+
region = "us-central1"
867+
subnetwork = google_compute_subnetwork.ilb_subnet.id
868+
address_type = "INTERNAL"
869+
}
870+
`, context)
871+
}
872+
873+
<% end -%>

0 commit comments

Comments
 (0)