inspec · russellseymour · Mar 20, 2019 · Mar 1, 2019 · Mar 1, 2019 · Mar 1, 2019
diff --git a/.rubocop.yml b/.rubocop.yml
@@ -31,7 +31,7 @@ Metrics/CyclomaticComplexity:
 Metrics/PerceivedComplexity:
   Max: 11
 Metrics/AbcSize:
-  Max: 50
+  Max: 55
 Metrics/CyclomaticComplexity:
   Max: 15
 Metrics/PerceivedComplexity:

diff --git a/docs/resources/google_bigquery_dataset.md b/docs/resources/google_bigquery_dataset.md
@@ -14,6 +14,7 @@ describe google_bigquery_dataset(project: 'chef-gcp-inspec', name: 'inspec_gcp_d
   its('friendly_name') { should eq 'A BigQuery dataset test' }
   its('location') { should eq 'EU' }
   its('description') { should eq 'Test BigQuery dataset description' }
+  its('name') { should eq 'inspec_gcp_dataset' }
   its('default_table_expiration_ms') { should cmp '3600000' }
 end
 
@@ -34,8 +35,6 @@ end
 ## Properties
 Properties that can be accessed from the `google_bigquery_dataset` resource:
 
-  * `name`: Dataset name
-
   * `access`: Access controls on the bucket.
 
     * `domain`: A domain to grant access to. Any users signed in with the domain specified will be granted the specified access

diff --git a/docs/resources/google_compute_disk.md b/docs/resources/google_compute_disk.md
@@ -56,6 +56,8 @@ Properties that can be accessed from the `google_compute_disk` resource:
 
   * `users`: Links to the users of the disk (attached instances) in form: project/zones/zone/instances/instance
 
+  * `physical_block_size_bytes`: Physical block size of the persistent disk, in bytes. If not present in a request, a default value is used. Currently supported sizes are 4096 and 16384, other sizes may be added in the future. If an unsupported value is requested, the error message will list the supported values for the caller's project.
+
   * `type`: URL of the disk type resource describing which disk type to use to create the disk. Provide this when creating the disk.
 
   * `source_image`: The source image used to create this disk. If the source image is deleted, this field will not be set.  To create a disk with one of the public operating system images, specify the image by its family name. For example, specify family/debian-8 to use the latest Debian 8 image:  projects/debian-cloud/global/images/family/debian-8  Alternatively, use a specific version of a public operating system image:  projects/debian-cloud/global/images/debian-8-jessie-vYYYYMMDD  To create a disk with a private image that you created, specify the image name in the following format:  global/images/my-private-image  You can also specify a private image by its image family, which returns the latest version of the image in that family. Replace the image name with family/family-name:  global/images/family/my-private-family

diff --git a/docs/resources/google_compute_disks.md b/docs/resources/google_compute_disks.md
@@ -31,6 +31,7 @@ See [google_compute_disk.md](google_compute_disk.md) for more detailed informati
   * `names`: an array of `google_compute_disk` name
   * `size_gbs`: an array of `google_compute_disk` size_gb
   * `users`: an array of `google_compute_disk` users
+  * `physical_block_size_bytes`: an array of `google_compute_disk` physical_block_size_bytes
   * `types`: an array of `google_compute_disk` type
   * `source_images`: an array of `google_compute_disk` source_image
   * `zones`: an array of `google_compute_disk` zone

diff --git a/docs/resources/google_compute_region.md b/docs/resources/google_compute_region.md
@@ -1,77 +1,106 @@
 ---
-title: About the google_compute_region Resource
+title: About the google_compute_region resource
 platform: gcp
 ---
 
-# google\_compute\_region
-
-Use the `google_compute_region` InSpec audit resource to test properties of a single GCP compute region.
-
-<br>
-
 ## Syntax
+A `google_compute_region` is used to test a Google Region resource
 
-A `google_compute_region` resource block declares the tests for a single GCP region by project and name.
-
-    describe google_compute_region(project: 'chef-inspec-gcp',  region: 'us-east1') do
-      its('name') { should match 'us-east1' }
+## Examples
+```
+describe google_compute_region(project: 'chef-gcp-inspec', name: 'europe-west2') do
+  it { should exist }
+  it { should be_up }
+  its('zone_names') { should include "#{gcp_location}-a" }
+end
+
+describe google_compute_region(project: 'chef-gcp-inspec', name: 'notthere') do
+  it { should_not exist }
+end
+
+```
+  ### Test that a GCP compute region exists
+```
+  describe google_compute_region(project: 'chef-inspec-gcp',  region: 'europe-west2') do
+    it { should exist }
+  end
+```
+  ### Test that a GCP compute region is in the expected state
+```
+  describe google_compute_region(project: 'chef-inspec-gcp',  region: 'europe-west2') do
+    its('status') { should eq 'UP' }
+    # or equivalently
+    it { should be_up }
+  end
+```
+  ### Test a GCP compute region identifier
+```
+  describe google_compute_region(project: 'chef-inspec-gcp',  region: "asia-east1") do
+    its('id') { should eq "1220" }
+  end
+```
+  ### Check that a region is associated with the expected zone fully qualified name
+```
+  describe google_compute_region(project: 'chef-inspec-gcp',  region: "asia-east1") do
+    its('zones') { should include "https://www.googleapis.com/compute/v1/projects/spaterson-project/zones/asia-east1-a" }
+  end
+```
+  ### Check that a region is associated with the expected zone short name
+```
+  describe google_compute_region(project: 'chef-inspec-gcp',  region: "asia-east1") do
+    its('zone_names') { should include "asia-east1-a" }
+  end
+```
+
+  The `zone_names` property is also useful for subsequently looping over associated `google_compute_zone` resources.  For example:
+```
+  google_compute_region(project: 'chef-inspec-gcp',  region: "asia-east1").zone_names.each do |zone_name|
+    describe google_compute_zone(project: 'chef-inspec-gcp', name: zone_name) do
+      it { should be_up }
     end
+  end
 
-<br>
+```
 
-## Examples
+## Properties
+Properties that can be accessed from the `google_compute_region` resource:
 
-The following examples show how to use this InSpec audit resource.
+  * `creation_timestamp`: Creation timestamp in RFC3339 text format.
 
-### Test that a GCP compute region exists
+  * `deprecated`: The deprecation state of this resource.
 
-    describe google_compute_region(project: 'chef-inspec-gcp',  region: 'europe-west2') do
-      it { should exist }
-    end
+    * `deleted`: An optional RFC3339 timestamp on or after which the deprecation state of this resource will be changed to DELETED.
 
-### Test that a GCP compute region is in the expected state
+    * `deprecated`: An optional RFC3339 timestamp on or after which the deprecation state of this resource will be changed to DEPRECATED.
 
-    describe google_compute_region(project: 'chef-inspec-gcp',  region: 'europe-west2') do
-      its('status') { should eq 'UP' }
-      # or equivalently
-      it { should be_up }
-    end
+    * `obsolete`: An optional RFC3339 timestamp on or after which the deprecation state of this resource will be changed to OBSOLETE.
 
-### Test a GCP compute region identifier
+    * `replacement`: The URL of the suggested replacement for a deprecated resource. The suggested replacement resource must be the same kind of resource as the deprecated resource.
 
-    describe google_compute_region(project: 'chef-inspec-gcp',  region: "asia-east1") do
-      its('id') { should eq 1220 }
-    end
+    * `state`: The deprecation state of this resource. This can be DEPRECATED, OBSOLETE, or DELETED. Operations which create a new resource using a DEPRECATED resource will return successfully, but with a warning indicating the deprecated resource and recommending its replacement. Operations which use OBSOLETE or DELETED resources will be rejected and result in an error.
 
-### Check that a region is associated with the expected zone fully qualified name 
+  * `description`: An optional description of this resource.
 
-    describe google_compute_region(project: 'chef-inspec-gcp',  region: "asia-east1") do
-      its('zones') { should include "https://www.googleapis.com/compute/v1/projects/spaterson-project/zones/asia-east1-a" }
-    end
-
-### Check that a region is associated with the expected zone short name
+  * `id`: The unique identifier for the resource.
 
-    describe google_compute_region(project: 'chef-inspec-gcp',  region: "asia-east1") do
-      its('zone_names') { should include "asia-east1-a" }
-    end    
+  * `name`: Name of the resource.
 
-The `zone_names` property is also useful for subsequently looping over associated `google_compute_zone` resources.  For example:
+  * `quotas`: Quotas assigned to this region.
 
-    google_compute_region(project: 'chef-inspec-gcp',  region: "asia-east1").zone_names.each do |zone_name|
-      describe google_compute_zone(project: 'chef-inspec-gcp', name: zone_name) do
-        it { should be_up }
-      end
-    end  
+    * `metric`: Name of the quota metric.
 
-<br>
+    * `limit`: Quota limit for this metric.
 
-## Properties
+    * `usage`: Current usage of this metric.
+
+    * `owner`: Owning resource. This is the resource on which this quota is applied.
+
+  * `status`: Status of the region, either UP or DOWN.
 
-*  `creation_timestamp`, `description`, `id`, `kind`, `name`, `quotas`, `status`, `zones`, `zone_names`
+  * `zones`: List of zones within the region
 
-<br>
 
 
 ## GCP Permissions
 
-Ensure the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com/) is enabled for the project where the resource is located.
+Ensure the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com/) is enabled for the current project.
diff --git a/docs/resources/google_compute_regions.md b/docs/resources/google_compute_regions.md
@@ -1,77 +1,76 @@
 ---
-title: About the google_compute_regions Resource
+title: About the google_compute_regions resource
 platform: gcp
 ---
 
-# google\_compute\_regions
-
-Use the `google_compute_regions` InSpec audit resource to test properties of all, or a filtered group of, GCP compute regions for a project.
-
-<br>
-
 ## Syntax
-
-A `google_compute_regions` resource block collects GCP regions by project then tests that group.
-
-    describe google_compute_regions(project: 'chef-inspec-gcp') do
-      it { should exist }
-    end
-
-Use this InSpec resource to enumerate IDs then test in-depth using `google_compute_region`.
-
-    google_compute_regions(project: 'chef-inspec-gcp').region_names.each do |region_name|
-      describe google_compute_region(project: 'chef-inspec-gcp',  region: region_name) do
-        it { should be_up }
-      end
-    end
-
-<br>
+A `google_compute_regions` is used to test a Google Region resource
 
 ## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test that there are more than a specified number of regions available for the project
-
-    describe google_compute_regions(project: 'chef-inspec-gcp') do
-      its('count') { should be >= 10}
+```
+describe google_compute_regions(project: 'chef-gcp-inspec') do
+  its('count') { should be >= 1 }
+  its('region_names') { should include "#{gcp_location}" }
+  its('region_statuses') { should_not include "DOWN" }
+  its('region_ids') { should include gcp_region_id }
+end
+
+```
+  ### Use this InSpec resource to enumerate IDs then test in-depth using `google_compute_region`
+```
+  google_compute_regions(project: 'chef-inspec-gcp').region_names.each do |region_name|
+    describe google_compute_region(project: 'chef-inspec-gcp',  region: region_name) do
+      it { should be_up }
     end
-
-### Test that an expected region is available for the project
-
-    describe google_compute_regions(project: 'chef-inspec-gcp') do
-      its('region_names') { should include 'europe-west2' }
+  end
+```
+
+  ### Test that there are more than a specified number of regions available for the project
+```
+  describe google_compute_regions(project: 'chef-inspec-gcp') do
+    its('count') { should be >= 10}
+  end
+```
+  ### Test that an expected region is available for the project
+```
+  describe google_compute_regions(project: 'chef-inspec-gcp') do
+    its('region_names') { should include 'europe-west2' }
+  end
+```
+  ### Test whether any regions are in status "DOWN"
+```
+  describe google_compute_regions(project: 'chef-inspec-gcp') do
+    its('region_statuses') { should_not include "DOWN" }
+  end
+```
+
+  ### Test that a subset of all regions matching "europe*" are "UP"
+```
+  google_compute_regions(project: gcp_project_id).where(region_name: /^europe/).region_names.each do |region_name|
+    describe google_compute_region(project: 'chef-inspec-gcp',  region: region_name) do
+      it { should be_up }
     end
+  end
 
-### Test whether any regions are in status "DOWN"
-
-    describe google_compute_regions(project: 'chef-inspec-gcp') do
-      its('region_statuses') { should_not include "DOWN" }
-    end
-
-### Test that a subset of all regions matching "europe*" are "UP"
-
-    describe google_compute_regions(project: gcp_project_id).where(region_name: /^europe/).region_names.each do |region_name|
-      describe google_compute_region(project: 'chef-inspec-gcp',  region: region_name) do
-        it { should be_up }
-      end
-    end
-
-<br>
-
-## Filter Criteria
-
-This resource supports the following filter criteria:  `region_id`; `region_name` and `region_status`. Any of these may be used with `where`, as a block or as a method.
+```
 
 ## Properties
+Properties that can be accessed from the `google_compute_regions` resource:
+
+See [google_compute_region.md](google_compute_region.md) for more detailed information
+  * `creation_timestamps`: an array of `google_compute_region` creation_timestamp
+  * `deprecateds`: an array of `google_compute_region` deprecated
+  * `descriptions`: an array of `google_compute_region` description
+  * `region_ids`: an array of `google_compute_region` id
+  * `region_names`: an array of `google_compute_region` name
+  * `quotas`: an array of `google_compute_region` quotas
+  * `region_statuses`: an array of `google_compute_region` status
+  * `zones`: an array of `google_compute_region` zones
 
-*  `region_ids` - an array of google_compute_region identifier integers
-*  `region_names` - an array of google_compute_region name strings
-*  `region_statuses`- an array of google_compute_region statuses
-
-<br>
-
+## Filter Criteria
+This resource supports all of the above properties as filter criteria, which can be used
+with `where` as a block or a method.
 
 ## GCP Permissions
 
-Ensure the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com/) is enabled for the project.
+Ensure the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com/) is enabled for the current project.
diff --git a/docs/resources/google_container_regional_cluster.md b/docs/resources/google_container_regional_cluster.md
@@ -68,6 +68,18 @@ Properties that can be accessed from the `google_container_regional_cluster` res
 
   * `network`: The name of the Google Compute Engine network to which the cluster is connected. If left unspecified, the default network will be used.
 
+  * `private_cluster_config`: Configuration for a private cluster.
+
+    * `enablePrivateNodes`: Whether nodes have internal IP addresses only. If enabled, all nodes are given only RFC 1918 private addresses and communicate with the master via private networking.
+
+    * `enablePrivateEndpoint`: Whether the master's internal IP address is used as the cluster endpoint.
+
+    * `masterIpv4CidrBlock`: The IP range in CIDR notation to use for the hosted master network. This range will be used for assigning internal IP addresses to the master or set of masters, as well as the ILB VIP. This range must not overlap with any other ranges in use within the cluster's network.
+
+    * `privateEndpoint`: The internal IP address of this cluster's master endpoint.
+
+    * `publicEndpoint`: The external IP address of this cluster's master endpoint.
+
   * `cluster_ipv4_cidr`: The IP address range of the container pods in this cluster, in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8.
 
   * `addons_config`: Configurations for the various addons available to run in the cluster.

diff --git a/docs/resources/google_container_regional_clusters.md b/docs/resources/google_container_regional_clusters.md
@@ -27,6 +27,7 @@ See [google_container_regional_cluster.md](google_container_regional_cluster.md)
   * `logging_services`: an array of `google_container_regional_cluster` logging_service
   * `monitoring_services`: an array of `google_container_regional_cluster` monitoring_service
   * `networks`: an array of `google_container_regional_cluster` network
+  * `private_cluster_configs`: an array of `google_container_regional_cluster` private_cluster_config
   * `cluster_ipv4_cidrs`: an array of `google_container_regional_cluster` cluster_ipv4_cidr
   * `addons_configs`: an array of `google_container_regional_cluster` addons_config
   * `subnetworks`: an array of `google_container_regional_cluster` subnetwork

diff --git a/docs/resources/google_pubsub_subscription.md b/docs/resources/google_pubsub_subscription.md
@@ -34,6 +34,10 @@ Properties that can be accessed from the `google_pubsub_subscription` resource:
 
   * `ack_deadline_seconds`: This value is the maximum time after a subscriber receives a message before the subscriber should acknowledge the message. After message delivery but before the ack deadline expires and before the message is acknowledged, it is an outstanding message and will not be delivered again during that time (on a best-effort basis).  For pull subscriptions, this value is used as the initial value for the ack deadline. To override this value for a given message, call subscriptions.modifyAckDeadline with the corresponding ackId if using pull. The minimum custom deadline you can specify is 10 seconds. The maximum custom deadline you can specify is 600 seconds (10 minutes). If this parameter is 0, a default value of 10 seconds is used.  For push delivery, this value is also used to set the request timeout for the call to the push endpoint.  If the subscriber never acknowledges the message, the Pub/Sub system will eventually redeliver the message.
 
+  * `message_retention_duration`: How long to retain unacknowledged messages in the subscription's backlog, from the moment a message is published. If retainAckedMessages is true, then this also configures the retention of acknowledged messages, and thus configures how far back in time a subscriptions.seek can be done. Defaults to 7 days. Cannot be more than 7 days (`"604800s"`) or less than 10 minutes (`"600s"`).  A duration in seconds with up to nine fractional digits, terminated by 's'. Example: `"600.5s"`.
+
+  * `retain_acked_messages`: Indicates whether to retain acknowledged messages. If `true`, then messages are not expunged from the subscription's backlog, even if they are acknowledged, until they fall out of the messageRetentionDuration window.
+
 
 
 ## GCP Permissions

diff --git a/docs/resources/google_pubsub_subscriptions.md b/docs/resources/google_pubsub_subscriptions.md
@@ -28,6 +28,8 @@ See [google_pubsub_subscription.md](google_pubsub_subscription.md) for more deta
   * `labels`: an array of `google_pubsub_subscription` labels
   * `push_configs`: an array of `google_pubsub_subscription` push_config
   * `ack_deadline_seconds`: an array of `google_pubsub_subscription` ack_deadline_seconds
+  * `message_retention_durations`: an array of `google_pubsub_subscription` message_retention_duration
+  * `retain_acked_messages`: an array of `google_pubsub_subscription` retain_acked_messages
 
 ## Filter Criteria
 This resource supports all of the above properties as filter criteria, which can be used