From a7df477cb0f5510ef3c55d272968df6a8f2d545a Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Wed, 12 Apr 2023 13:58:49 +0200 Subject: [PATCH] Add inventories to net-vpc-firewall tests --- modules/net-vpc-firewall/README.md | 14 +- .../net_vpc_firewall/examples/basic.yaml | 98 ++++++++++++++ .../examples/custom-rules.yaml | 127 ++++++++++++++++++ .../examples/custom-ssh-default-rule.yaml | 40 ++++++ .../net_vpc_firewall/examples/factory.yaml | 87 ++++++++++++ .../examples/local-ranges.yaml | 62 +++++++++ .../examples/no-default-rules.yaml | 19 +++ .../examples/no-ssh-default-rules.yaml | 20 +++ 8 files changed, 460 insertions(+), 7 deletions(-) create mode 100644 tests/modules/net_vpc_firewall/examples/basic.yaml create mode 100644 tests/modules/net_vpc_firewall/examples/custom-rules.yaml create mode 100644 tests/modules/net_vpc_firewall/examples/custom-ssh-default-rule.yaml create mode 100644 tests/modules/net_vpc_firewall/examples/factory.yaml create mode 100644 tests/modules/net_vpc_firewall/examples/local-ranges.yaml create mode 100644 tests/modules/net_vpc_firewall/examples/no-default-rules.yaml create mode 100644 tests/modules/net_vpc_firewall/examples/no-ssh-default-rules.yaml diff --git a/modules/net-vpc-firewall/README.md b/modules/net-vpc-firewall/README.md index af04343f39..47a696de3e 100644 --- a/modules/net-vpc-firewall/README.md +++ b/modules/net-vpc-firewall/README.md @@ -22,7 +22,7 @@ module "firewall" { admin_ranges = ["10.0.0.0/8"] } } -# tftest modules=1 resources=4 +# tftest modules=1 resources=4 inventory=basic.yaml ``` ### Custom rules @@ -77,7 +77,7 @@ module "firewall" { } } } -# tftest modules=1 resources=9 +# tftest modules=1 resources=9 inventory=custom-rules.yaml ``` ### Controlling or turning off default rules @@ -103,7 +103,7 @@ module "firewall" { ssh_tags = ["ssh-default"] } } -# tftest modules=1 resources=3 +# tftest modules=1 resources=3 inventory=custom-ssh-default-rule.yaml ``` #### Disabling predefined rules @@ -119,7 +119,7 @@ module "firewall" { ssh_ranges = [] } } -# tftest modules=1 resources=2 +# tftest modules=1 resources=2 inventory=no-ssh-default-rules.yaml ``` Or the entire set of rules can be disabled via the `disabled` attribute: @@ -133,7 +133,7 @@ module "firewall" { disabled = true } } -# tftest modules=0 resources=0 +# tftest modules=0 resources=0 inventory=no-default-rules.yaml ``` ### Including source & destination ranges @@ -163,7 +163,7 @@ module "firewall" { } } } -# tftest modules=1 resources=2 +# tftest modules=1 resources=2 inventory=local-ranges.yaml ``` ### Rules Factory @@ -181,7 +181,7 @@ module "firewall" { } default_rules_config = { disabled = true } } -# tftest modules=1 resources=3 files=lbs,cidrs +# tftest modules=1 resources=3 files=lbs,cidrs inventory=factory.yaml ``` ```yaml diff --git a/tests/modules/net_vpc_firewall/examples/basic.yaml b/tests/modules/net_vpc_firewall/examples/basic.yaml new file mode 100644 index 0000000000..38aae194aa --- /dev/null +++ b/tests/modules/net_vpc_firewall/examples/basic.yaml @@ -0,0 +1,98 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.firewall.google_compute_firewall.allow-admins[0]: + allow: + - ports: [] + protocol: all + deny: [] + disabled: null + log_config: [] + name: my-network-ingress-admins + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 10.0.0.0/8 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: null + module.firewall.google_compute_firewall.allow-tag-http[0]: + allow: + - ports: + - '80' + protocol: tcp + deny: [] + disabled: null + log_config: [] + name: my-network-ingress-tag-http + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 130.211.0.0/22 + - 209.85.152.0/22 + - 209.85.204.0/22 + - 35.191.0.0/16 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: + - http-server + module.firewall.google_compute_firewall.allow-tag-https[0]: + allow: + - ports: + - '443' + protocol: tcp + deny: [] + disabled: null + log_config: [] + name: my-network-ingress-tag-https + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 130.211.0.0/22 + - 209.85.152.0/22 + - 209.85.204.0/22 + - 35.191.0.0/16 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: + - https-server + module.firewall.google_compute_firewall.allow-tag-ssh[0]: + allow: + - ports: + - '22' + protocol: tcp + deny: [] + disabled: null + log_config: [] + name: my-network-ingress-tag-ssh + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 35.235.240.0/20 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: + - ssh + +counts: + google_compute_firewall: 4 diff --git a/tests/modules/net_vpc_firewall/examples/custom-rules.yaml b/tests/modules/net_vpc_firewall/examples/custom-rules.yaml new file mode 100644 index 0000000000..920ee750ec --- /dev/null +++ b/tests/modules/net_vpc_firewall/examples/custom-rules.yaml @@ -0,0 +1,127 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + # the following 4 rules are already tested by simple.yaml + module.firewall.google_compute_firewall.allow-admins[0]: {} + module.firewall.google_compute_firewall.allow-tag-http[0]: {} + module.firewall.google_compute_firewall.allow-tag-https[0]: {} + module.firewall.google_compute_firewall.allow-tag-ssh[0]: {} + module.firewall.google_compute_firewall.custom-rules["allow-egress-rfc1918"]: + allow: + - ports: [] + protocol: all + deny: [] + description: Allow egress to RFC 1918 ranges. + destination_ranges: + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + direction: EGRESS + disabled: false + log_config: [] + name: allow-egress-rfc1918 + network: my-network + priority: 1000 + project: my-project + source_ranges: null + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: null + module.firewall.google_compute_firewall.custom-rules["allow-egress-tag"]: + allow: + - ports: [] + protocol: all + deny: [] + description: Allow egress from a specific tag to 0/0. + destination_ranges: + - 0.0.0.0/0 + direction: EGRESS + disabled: false + log_config: [] + name: allow-egress-tag + network: my-network + priority: 1000 + project: my-project + source_ranges: null + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: + - target-tag + module.firewall.google_compute_firewall.custom-rules["allow-ingress-ntp"]: + allow: + - ports: + - '123' + protocol: udp + deny: [] + description: Allow NTP service based on tag. + direction: INGRESS + disabled: false + log_config: [] + name: allow-ingress-ntp + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 0.0.0.0/0 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: + - ntp-svc + module.firewall.google_compute_firewall.custom-rules["allow-ingress-tag"]: + allow: + - ports: [] + protocol: all + deny: [] + description: Allow ingress from a specific tag. + direction: INGRESS + disabled: false + log_config: [] + name: allow-ingress-tag + network: my-network + priority: 1000 + project: my-project + source_ranges: null + source_service_accounts: null + source_tags: + - client-tag + target_service_accounts: null + target_tags: + - target-tag + module.firewall.google_compute_firewall.custom-rules["deny-egress-all"]: + allow: [] + deny: + - ports: [] + protocol: all + description: Block egress. + destination_ranges: + - 0.0.0.0/0 + direction: EGRESS + disabled: false + log_config: [] + name: deny-egress-all + network: my-network + priority: 1000 + project: my-project + source_ranges: null + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: null + +counts: + google_compute_firewall: 9 diff --git a/tests/modules/net_vpc_firewall/examples/custom-ssh-default-rule.yaml b/tests/modules/net_vpc_firewall/examples/custom-ssh-default-rule.yaml new file mode 100644 index 0000000000..1e3d3b0401 --- /dev/null +++ b/tests/modules/net_vpc_firewall/examples/custom-ssh-default-rule.yaml @@ -0,0 +1,40 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.firewall.google_compute_firewall.allow-tag-http[0]: {} + module.firewall.google_compute_firewall.allow-tag-https[0]: {} + module.firewall.google_compute_firewall.allow-tag-ssh[0]: + allow: + - ports: + - '22' + protocol: tcp + deny: [] + description: Allow SSH to machines with matching tags. + disabled: null + log_config: [] + name: my-network-ingress-tag-ssh + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 10.0.0.0/8 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: + - ssh-default + +counts: + google_compute_firewall: 3 diff --git a/tests/modules/net_vpc_firewall/examples/factory.yaml b/tests/modules/net_vpc_firewall/examples/factory.yaml new file mode 100644 index 0000000000..389fb52a25 --- /dev/null +++ b/tests/modules/net_vpc_firewall/examples/factory.yaml @@ -0,0 +1,87 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.firewall.google_compute_firewall.custom-rules["allow-healthchecks"]: + allow: + - ports: + - '80' + - '443' + protocol: tcp + deny: [] + description: Allow ingress from healthchecks. + direction: INGRESS + disabled: false + log_config: [] + name: allow-healthchecks + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 130.211.0.0/22 + - 209.85.152.0/22 + - 209.85.204.0/22 + - 35.191.0.0/16 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: + - lb-backends + module.firewall.google_compute_firewall.custom-rules["allow-service-1-to-service-2"]: + allow: + - ports: + - '80' + - '443' + protocol: tcp + deny: [] + description: Allow ingress from service-1 SA + direction: INGRESS + disabled: false + log_config: [] + name: allow-service-1-to-service-2 + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 0.0.0.0/0 + source_service_accounts: + - service-1@my-project.iam.gserviceaccount.com + source_tags: null + target_service_accounts: + - service-2 + target_tags: null + module.firewall.google_compute_firewall.custom-rules["block-telnet"]: + allow: [] + deny: + - ports: + - '23' + protocol: tcp + description: block outbound telnet + destination_ranges: + - 0.0.0.0/0 + direction: EGRESS + disabled: false + log_config: [] + name: block-telnet + network: my-network + priority: 1000 + project: my-project + source_ranges: null + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: null + +counts: + google_compute_firewall: 3 diff --git a/tests/modules/net_vpc_firewall/examples/local-ranges.yaml b/tests/modules/net_vpc_firewall/examples/local-ranges.yaml new file mode 100644 index 0000000000..df83717cec --- /dev/null +++ b/tests/modules/net_vpc_firewall/examples/local-ranges.yaml @@ -0,0 +1,62 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.firewall.google_compute_firewall.custom-rules["allow-ingress-source-destination-ranges"]: + allow: + - ports: [] + protocol: all + deny: [] + description: Allow ingress using source and destination ranges + destination_ranges: + - 10.132.0.0/20 + - 10.138.0.0/20 + direction: INGRESS + disabled: false + log_config: [] + name: allow-ingress-source-destination-ranges + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 172.16.0.0/12 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: null + module.firewall.google_compute_firewall.custom-rules["deny-egress-source-destination-ranges"]: + allow: [] + deny: + - ports: [] + protocol: all + description: Deny egress using source and destination ranges + destination_ranges: + - 172.16.0.0/12 + direction: EGRESS + disabled: false + log_config: [] + name: deny-egress-source-destination-ranges + network: my-network + priority: 1000 + project: my-project + source_ranges: + - 10.132.0.0/20 + - 10.138.0.0/20 + source_service_accounts: null + source_tags: null + target_service_accounts: null + target_tags: null + +counts: + google_compute_firewall: 2 diff --git a/tests/modules/net_vpc_firewall/examples/no-default-rules.yaml b/tests/modules/net_vpc_firewall/examples/no-default-rules.yaml new file mode 100644 index 0000000000..f3454066c4 --- /dev/null +++ b/tests/modules/net_vpc_firewall/examples/no-default-rules.yaml @@ -0,0 +1,19 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: {} + +counts: + modules: 0 + resources: 0 diff --git a/tests/modules/net_vpc_firewall/examples/no-ssh-default-rules.yaml b/tests/modules/net_vpc_firewall/examples/no-ssh-default-rules.yaml new file mode 100644 index 0000000000..46b1d04d5f --- /dev/null +++ b/tests/modules/net_vpc_firewall/examples/no-ssh-default-rules.yaml @@ -0,0 +1,20 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.firewall.google_compute_firewall.allow-tag-http[0]: {} + module.firewall.google_compute_firewall.allow-tag-https[0]: {} + +counts: + google_compute_firewall: 2