Add support for routing_mode to google_network_services_gateway

.changelog/11840.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+networkservices: added `routing_mode` field to `google_network_services_gateway` resource
+```

google-beta/services/networkservices/resource_network_services_gateway.go

@@ -251,6 +251,12 @@ The default value is 'global'.`,
 For example: 'projects/*/global/networks/network-1'.
 Currently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY'.`,
 			},
+			"routing_mode": {
+				Type:         schema.TypeString,
+				Optional:     true,
+				ValidateFunc: verify.ValidateEnum([]string{"NEXT_HOP_ROUTING_MODE", ""}),
+				Description:  `The routing mode of the Gateway. This field is configurable only for gateways of type SECURE_WEB_GATEWAY. This field is required for gateways of type SECURE_WEB_GATEWAY. Possible values: ["NEXT_HOP_ROUTING_MODE"]`,
+			},
 			"scope": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -388,6 +394,12 @@ func resourceNetworkServicesGatewayCreate(d *schema.ResourceData, meta interface
 	} else if v, ok := d.GetOkExists("certificate_urls"); !tpgresource.IsEmptyValue(reflect.ValueOf(certificateUrlsProp)) && (ok || !reflect.DeepEqual(v, certificateUrlsProp)) {
 		obj["certificateUrls"] = certificateUrlsProp
 	}
+	routingModeProp, err := expandNetworkServicesGatewayRoutingMode(d.Get("routing_mode"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("routing_mode"); !tpgresource.IsEmptyValue(reflect.ValueOf(routingModeProp)) && (ok || !reflect.DeepEqual(v, routingModeProp)) {
+		obj["routingMode"] = routingModeProp
+	}
 	labelsProp, err := expandNetworkServicesGatewayEffectiveLabels(d.Get("effective_labels"), d, config)
 	if err != nil {
 		return err
@@ -541,6 +553,9 @@ func resourceNetworkServicesGatewayRead(d *schema.ResourceData, meta interface{}
 	if err := d.Set("certificate_urls", flattenNetworkServicesGatewayCertificateUrls(res["certificateUrls"], d, config)); err != nil {
 		return fmt.Errorf("Error reading Gateway: %s", err)
 	}
+	if err := d.Set("routing_mode", flattenNetworkServicesGatewayRoutingMode(res["routingMode"], d, config)); err != nil {
+		return fmt.Errorf("Error reading Gateway: %s", err)
+	}
 	if err := d.Set("terraform_labels", flattenNetworkServicesGatewayTerraformLabels(res["labels"], d, config)); err != nil {
 		return fmt.Errorf("Error reading Gateway: %s", err)
 	}
@@ -591,6 +606,12 @@ func resourceNetworkServicesGatewayUpdate(d *schema.ResourceData, meta interface
 	} else if v, ok := d.GetOkExists("certificate_urls"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, certificateUrlsProp)) {
 		obj["certificateUrls"] = certificateUrlsProp
 	}
+	routingModeProp, err := expandNetworkServicesGatewayRoutingMode(d.Get("routing_mode"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("routing_mode"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, routingModeProp)) {
+		obj["routingMode"] = routingModeProp
+	}
 	labelsProp, err := expandNetworkServicesGatewayEffectiveLabels(d.Get("effective_labels"), d, config)
 	if err != nil {
 		return err
@@ -623,6 +644,10 @@ func resourceNetworkServicesGatewayUpdate(d *schema.ResourceData, meta interface
 		updateMask = append(updateMask, "certificateUrls")
 	}
 
+	if d.HasChange("routing_mode") {
+		updateMask = append(updateMask, "routingMode")
+	}
+
 	if d.HasChange("effective_labels") {
 		updateMask = append(updateMask, "labels")
 	}
@@ -635,6 +660,7 @@ func resourceNetworkServicesGatewayUpdate(d *schema.ResourceData, meta interface
 	if d.Get("type") == "SECURE_WEB_GATEWAY" {
 		obj["name"] = d.Get("name")
 		obj["type"] = d.Get("type")
+		obj["routingMode"] = d.Get("routingMode")
 	}
 
 	// err == nil indicates that the billing_project value was found
@@ -836,6 +862,10 @@ func flattenNetworkServicesGatewayCertificateUrls(v interface{}, d *schema.Resou
 	return v
 }
 
+func flattenNetworkServicesGatewayRoutingMode(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
 func flattenNetworkServicesGatewayTerraformLabels(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
 	if v == nil {
 		return v
@@ -895,6 +925,10 @@ func expandNetworkServicesGatewayCertificateUrls(v interface{}, d tpgresource.Te
 	return v, nil
 }
 
+func expandNetworkServicesGatewayRoutingMode(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
 func expandNetworkServicesGatewayEffectiveLabels(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (map[string]string, error) {
 	if v == nil {
 		return map[string]string{}, nil

google-beta/services/networkservices/resource_network_services_gateway_test.go

@@ -171,7 +171,7 @@ resource "google_network_services_gateway" "default" {
 	return config
 }
 
-func TestAccNetworkServicesGateway_updateSwp(t *testing.T) {
+func TestAccNetworkServicesGateway_swpUpdate(t *testing.T) {
 	cmName := fmt.Sprintf("tf-test-gateway-swp-cm-%s", acctest.RandString(t, 10))
 	netName := fmt.Sprintf("tf-test-gateway-swp-net-%s", acctest.RandString(t, 10))
 	subnetName := fmt.Sprintf("tf-test-gateway-swp-subnet-%s", acctest.RandString(t, 10))
@@ -916,3 +916,218 @@ resource "google_network_services_gateway" "foobar" {
 }
 `, netName, subnetName, pSubnetName, policyName, ruleName, gatewayName)
 }
+
+func TestAccNetworkServicesGateway_swpAsNextHop(t *testing.T) {
+	context := map[string]interface{}{
+		"region":        "us-east1",
+		"random_suffix": fmt.Sprintf("-%s", acctest.RandString(t, 10)),
+		"name_prefix":   "tf-test-gateway-",
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckNetworkServicesGatewayDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccNetworkServicesGateway_swpAsNextHop(context),
+			},
+			{
+				ResourceName:            "google_network_services_gateway.default",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"name", "location", "delete_swg_autogen_router_on_destroy"},
+			},
+		},
+	})
+}
+
+func testAccNetworkServicesGateway_swpAsNextHop(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_compute_network" "default" {
+  name                    = "%{name_prefix}network%{random_suffix}"
+  routing_mode            = "REGIONAL"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "proxyonlysubnet" {
+  name          = "%{name_prefix}proxysubnet%{random_suffix}"
+  purpose       = "REGIONAL_MANAGED_PROXY"
+  ip_cidr_range = "192.168.0.0/23"
+  region        = "%{region}"
+  network       = google_compute_network.default.id
+  role          = "ACTIVE"
+}
+
+resource "google_compute_subnetwork" "default" {
+  name          = "%{name_prefix}subnet%{random_suffix}"
+  purpose       = "PRIVATE"
+  ip_cidr_range = "10.128.0.0/20"
+  region        = "%{region}"
+  network       = google_compute_network.default.id
+  role          = "ACTIVE"
+}
+
+resource "google_privateca_ca_pool" "default" {
+  name     = "%{name_prefix}ca-pool%{random_suffix}"
+  location = "%{region}"
+  tier     = "DEVOPS"
+
+  publishing_options {
+    publish_ca_cert = false
+    publish_crl     = false
+  }
+
+  issuance_policy {
+    maximum_lifetime = "1209600s"
+    baseline_values {
+      ca_options {
+        is_ca = false
+      }
+      key_usage {
+        base_key_usage {}
+        extended_key_usage {
+          server_auth = true
+        }
+      }
+    }
+  }
+}
+
+resource "google_privateca_certificate_authority" "default" {
+  pool                                   = google_privateca_ca_pool.default.name
+  certificate_authority_id               = "%{name_prefix}certificate-authority%{random_suffix}"
+  location                               = "%{region}"
+  lifetime                               = "86400s"
+  type                                   = "SELF_SIGNED"
+  deletion_protection                    = false
+  skip_grace_period                      = true
+  ignore_active_certificates_on_deletion = true
+
+  config {
+    subject_config {
+      subject {
+        organization = "Test LLC"
+        common_name  = "private-certificate-authority"
+      }
+    }
+    x509_config {
+      ca_options {
+        is_ca = true
+      }
+      key_usage {
+        base_key_usage {
+          cert_sign = true
+          crl_sign  = true
+        }
+        extended_key_usage {
+          server_auth = false
+        }
+      }
+    }
+  }
+
+  key_spec {
+    algorithm = "RSA_PKCS1_4096_SHA256"
+  }
+}
+
+resource "google_certificate_manager_certificate" "default" {
+  name     = "%{name_prefix}certificate%{random_suffix}"
+  location = "%{region}"
+
+  self_managed {
+    pem_certificate = file("test-fixtures/cert.pem")
+    pem_private_key = file("test-fixtures/private-key.pem")
+  }
+}
+
+resource "google_network_security_tls_inspection_policy" "default" {
+  name     = "%{name_prefix}tls-insp-policy%{random_suffix}"
+  location = "%{region}"
+  ca_pool  = google_privateca_ca_pool.default.id
+
+  depends_on = [
+    google_privateca_ca_pool.default,
+    google_privateca_certificate_authority.default
+  ]
+}
+
+resource "google_network_security_gateway_security_policy" "default" {
+  name                  = "%{name_prefix}sec-policy%{random_suffix}"
+  location              = "%{region}"
+  description           = "my description"
+  tls_inspection_policy = google_network_security_tls_inspection_policy.default.id
+
+  depends_on = [
+    google_network_security_tls_inspection_policy.default
+  ]
+}
+
+resource "google_network_security_gateway_security_policy_rule" "default" {
+  name                    = "%{name_prefix}sec-policy-rule%{random_suffix}"
+  location                = "%{region}"
+  gateway_security_policy = google_network_security_gateway_security_policy.default.name
+  enabled                 = true
+  description             = "my description"
+  priority                = 0
+  session_matcher         = "host() == 'example.com'"
+  application_matcher     = "request.method == 'POST'"
+  tls_inspection_enabled  = true
+  basic_profile           = "ALLOW"
+}
+
+resource "google_network_services_gateway" "default" {
+  name                                 = "%{name_prefix}swp%{random_suffix}"
+  location                             = "%{region}"
+  addresses                            = ["10.128.0.99"]
+  type                                 = "SECURE_WEB_GATEWAY"
+  routing_mode                         = "NEXT_HOP_ROUTING_MODE"
+  ports                                = [443]
+  description                          = "my description"
+  scope                                = "%s"
+  certificate_urls                     = [google_certificate_manager_certificate.default.id]
+  gateway_security_policy              = google_network_security_gateway_security_policy.default.id
+  network                              = google_compute_network.default.id
+  subnetwork                           = google_compute_subnetwork.default.id
+  delete_swg_autogen_router_on_destroy = true
+  depends_on                           = [google_compute_subnetwork.proxyonlysubnet]
+}
+
+resource "google_compute_route" "default" {
+  name        = "%{name_prefix}route%{random_suffix}"
+  dest_range  = "15.0.0.0/24"
+  network     = google_compute_network.default.name
+  next_hop_ip = google_network_services_gateway.default.addresses[0]
+  priority    = 100
+}
+
+resource "google_network_connectivity_policy_based_route" "swproute" {
+  name            = "%{name_prefix}policy-based-swp-route%{random_suffix}"
+  description     = "My routing policy"
+  network         = google_compute_network.default.id
+  next_hop_ilb_ip = google_network_services_gateway.default.addresses[0]
+  priority        = 2
+
+  filter {
+    protocol_version = "IPV4"
+    src_range        = "10.0.0.0/24"
+    dest_range       = "15.0.0.0/24"
+  }
+}
+
+resource "google_network_connectivity_policy_based_route" "default" {
+  name                  = "%{name_prefix}policy-based-route%{random_suffix}"
+  description           = "My routing policy"
+  network               = google_compute_network.default.id
+  next_hop_other_routes = "DEFAULT_ROUTING"
+  priority              = 1
+
+  filter {
+    protocol_version = "IPV4"
+    src_range        = "10.0.0.0/24"
+    dest_range       = "15.0.0.0/24"
+  }
+}
+	`, context)
+}

website/docs/r/network_services_gateway.html.markdown

@@ -300,6 +300,11 @@ The following arguments are supported:
   A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection.
   This feature only applies to gateways of type 'SECURE_WEB_GATEWAY'.
 
+* `routing_mode` -
+  (Optional)
+  The routing mode of the Gateway. This field is configurable only for gateways of type SECURE_WEB_GATEWAY. This field is required for gateways of type SECURE_WEB_GATEWAY.
+  Possible values are: `NEXT_HOP_ROUTING_MODE`.
+
 * `location` -
   (Optional)
   The location of the gateway.