Skip to content

Add SSLPolicy resource and support for it in TargetHttpsProxy. Enable only in Terraform #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
May 9, 2018
Merged

Add SSLPolicy resource and support for it in TargetHttpsProxy. Enable only in Terraform #151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0043f45
Add SSLPolicy resource and support for it in TargetHttpsProxy
rosbo May 3, 2018
acd2e1e
Fix non standard update url
rosbo May 3, 2018
d4e3be9
Add empty example files for chef and puppet
rosbo May 3, 2018
f225c37
Exclude SslPolicy for all tools except Terraform
rosbo May 9, 2018
1653748
Remove examples
rosbo May 9, 2018
f15c0d6
Links to bug to enable SslPolicy for C/P/A
rosbo May 9, 2018
e80ad21
Merge f15c0d6dddbf17c194bf2d3d5100d1a8d741f7ad into 33a5cd51b83fb7c6a…
rosbo May 9, 2018
c880808
Update tracked submodules -> HEAD on Wed May 9 22:57:45 UTC 2018
modular-magician May 9, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build/puppet/compute
Open in desktop
Submodule compute updated 6 files
+8 −8 README.md
+1 −1 lib/puppet/type/gcompute_backend_bucket.rb
+3 −2 lib/puppet/type/gcompute_forwarding_rule.rb
+3 −2 lib/puppet/type/gcompute_global_forwarding_rule.rb
+5 −1 spec/copyright.rb
+2 −1 spec/copyright_spec.rb
2 changes: 1 addition & 1 deletion build/puppet/sql
Open in desktop
Submodule sql updated 2 files
+5 −1 spec/copyright.rb
+2 −1 spec/copyright_spec.rb
2 changes: 1 addition & 1 deletion build/terraform
Open in desktop
Submodule terraform updated from 9c5f5f to da0b6f
111 changes: 111 additions & 0 deletions products/compute/api.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2504,6 +2504,104 @@ objects:
name: 'privateKey'
description: 'The private key in PEM format.'
input: true
- !ruby/object:Api::Resource
name: 'SslPolicy'
# TODO(https://github.com/GoogleCloudPlatform/magic-modules/issues/173): Enable
exclude: true
kind: 'compute#sslPolicy'
base_url: projects/{project}/global/sslPolicies
exports:
- !ruby/object:Api::Type::SelfLink
name: 'selfLink'
description: |
Represents a SSL policy. SSL policies give you the ability to control the
features of SSL that your SSL proxy or HTTPS load balancer negotiates.
references: !ruby/object:Api::Resource::ReferenceLinks
guides:
'Using SSL Policies': 'https://cloud.google.com/compute/docs/load-balancing/ssl-policies'
api: 'https://cloud.google.com/compute/docs/reference/rest/v1/sslPolicies'
<%= indent(compile_file({}, 'templates/global_async.yaml.erb'), 4) %>
properties:
- !ruby/object:Api::Type::Time
name: 'creationTimestamp'
description: 'Creation timestamp in RFC3339 text format.'
output: true
- !ruby/object:Api::Type::String
name: 'description'
description: 'An optional description of this resource.'
- !ruby/object:Api::Type::Integer
name: 'id'
description: 'The unique identifier for the resource.'
output: true
- !ruby/object:Api::Type::String
name: 'name'
description: |
Name of the resource. Provided by the client when the resource is
created. The name must be 1-63 characters long, and comply with
RFC1035. Specifically, the name must be 1-63 characters long and match
the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the
first character must be a lowercase letter, and all following
characters must be a dash, lowercase letter, or digit, except the last
character, which cannot be a dash.
required: true
# TODO: profile, minTlsVersion, enabledFeatures, customFeatures, fingerprint, warnings, kind
- !ruby/object:Api::Type::Enum
name: 'profile'
description: |
Profile specifies the set of SSL features that can be used by the
load balancer when negotiating SSL with clients. This can be one of
COMPATIBLE, MODERN, RESTRICTED, or CUSTOM. If using CUSTOM, the set
of SSL features to enable must be specified in the customFeatures
field.
values:
- :COMPATIBLE
- :MODERN
- :RESTRICTED
- :CUSTOM
- !ruby/object:Api::Type::Enum
name: 'minTlsVersion'
description: |
The minimum version of SSL protocol that can be used by the clients
to establish a connection with the load balancer. This can be one of
TLS_1_0, TLS_1_1, TLS_1_2.
values:
- :TLS_1_0
- :TLS_1_1
- :TLS_1_2
- !ruby/object:Api::Type::Array
name: 'enabledFeatures'
description: 'The list of features enabled in the SSL policy.'
output: true
item_type: Api::Type::String
- !ruby/object:Api::Type::Array
name: 'customFeatures'
description: |
A list of features enabled when the selected profile is CUSTOM. The
method returns the set of features that can be specified in this
list. This field must be empty if the profile is not CUSTOM.
item_type: Api::Type::String
- !ruby/object:Api::Type::String
name: 'fingerprint'
description: |
Fingerprint of this resource. A hash of the contents stored in this
object. This field is used in optimistic locking.
output: true
- !ruby/object:Api::Type::Array
name: 'warnings'
description: |
If potential misconfigurations are detected for this SSL policy, this
field will be populated with warning messages.
output: true
item_type: !ruby/object:Api::Type::NestedObject
properties:
- !ruby/object:Api::Type::String
name: 'code'
description: 'A warning code, if applicable.'
output: true
- !ruby/object:Api::Type::String
name: 'message'
description: 'A human-readable description of the warning code.'
output: true
- !ruby/object:Api::Resource
name: 'Subnetwork'
kind: 'compute#subnetwork'
Expand Down Expand Up @@ -2723,6 +2821,19 @@ objects:
required: true
update_verb: :POST
update_url: 'projects/{{project}}/targetHttpsProxies/{{name}}/setUrlMap'
- !ruby/object:Api::Type::ResourceRef
name: 'sslPolicy'
# TODO(https://github.com/GoogleCloudPlatform/magic-modules/issues/173): Enable
exclude: true
resource: 'SslPolicy'
imports: 'selfLink'
description: |
A reference to the SslPolicy resource that will be associated with
the TargetHttpsProxy resource. If not set, the TargetHttpsProxy
resource will not have any SSL policy configured.
update_verb: :POST
update_url:
'projects/{{project}}/global/targetHttpsProxies/{{name}}/setSslPolicy'
- !ruby/object:Api::Resource
name: 'TargetPool'
kind: 'compute#targetPool'
Expand Down
2 changes: 2 additions & 0 deletions products/compute/terraform.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,6 +317,8 @@ overrides: !ruby/object:Provider::ResourceOverrides
properties:
id: !ruby/object:Provider::Terraform::PropertyOverride
name: proxyId
sslPolicy: !ruby/object:Provider::Terraform::PropertyOverride
exclude: false
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like the reverse exclude, but you should check with @nelsonjr - we're having a similar argument about whether that's appropriate on a different PR.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like it too. If we find it brings confusion in the future, we can reevaluate and ban the practice. I personally find it more elegant. I added TODO linking to the bug to enable it in C/P/A.

Additionally, for this particular case, a validation happens before the overrides are applied which would cause the ResourceRef check to fail.

TargetPool: !ruby/object:Provider::Terraform::ResourceOverride
exclude: true
TargetSslProxy: !ruby/object:Provider::Terraform::ResourceOverride
Expand Down
19 changes: 17 additions & 2 deletions templates/terraform/tests/resource_compute_target_https_proxy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,7 @@ resource "google_compute_target_https_proxy" "foobar" {
name = "httpsproxy-test-%s"
url_map = "${google_compute_url_map.foobar.self_link}"
ssl_certificates = ["${google_compute_ssl_certificate.foobar1.self_link}"]
ssl_policy = "${google_compute_ssl_policy.foobar.self_link}"
}

resource "google_compute_backend_service" "foobar" {
Expand Down Expand Up @@ -192,6 +193,13 @@ resource "google_compute_url_map" "foobar" {
}
}

resource "google_compute_ssl_policy" "foobar" {
name = "sslproxy-test-%s"
description = "my-description"
min_tls_version = "TLS_1_2"
profile = "MODERN"
}

resource "google_compute_ssl_certificate" "foobar1" {
name = "httpsproxy-test-cert1-%s"
description = "very descriptive"
Expand All @@ -205,7 +213,7 @@ resource "google_compute_ssl_certificate" "foobar2" {
private_key = "${file("test-fixtures/ssl_cert/test.key")}"
certificate = "${file("test-fixtures/ssl_cert/test.crt")}"
}
`, id, id, id, id, id, id)
`, id, id, id, id, id, id, id)
}

func testAccComputeTargetHttpsProxy_basic2(id string) string {
Expand Down Expand Up @@ -254,6 +262,13 @@ resource "google_compute_url_map" "foobar" {
}
}

resource "google_compute_ssl_policy" "foobar" {
name = "sslproxy-test-%s"
description = "my-description"
min_tls_version = "TLS_1_2"
profile = "MODERN"
}

resource "google_compute_ssl_certificate" "foobar1" {
name = "httpsproxy-test-cert1-%s"
description = "very descriptive"
Expand All @@ -267,5 +282,5 @@ resource "google_compute_ssl_certificate" "foobar2" {
private_key = "${file("test-fixtures/ssl_cert/test.key")}"
certificate = "${file("test-fixtures/ssl_cert/test.crt")}"
}
`, id, id, id, id, id, id)
`, id, id, id, id, id, id, id)
}