inspec · skpaterson · Apr 6, 2020 · Dec 12, 2019 · Dec 12, 2019 · Dec 12, 2019
diff --git a/.changelog/3013.txt b/.changelog/3013.txt
@@ -0,0 +1,3 @@
+```release-note:REPLACEME
+
+```
diff --git a/.changelog/3021.txt b/.changelog/3021.txt
@@ -0,0 +1,3 @@
+```release-note:REPLACEME
+
+```
diff --git a/.changelog/3022.txt b/.changelog/3022.txt
@@ -0,0 +1,3 @@
+```release-note:REPLACEME
+
+```
diff --git a/.changelog/3026.txt b/.changelog/3026.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+dns: `google_dns_managed_zone` added support for Non-RFC1918 fields for reverse lookup and fowarding paths.
+```
diff --git a/.changelog/3029.txt b/.changelog/3029.txt
@@ -0,0 +1,3 @@
+```release-note:REPLACEME
+
+```
diff --git a/.changelog/3031.txt b/.changelog/3031.txt
diff --git a/.changelog/3033.txt b/.changelog/3033.txt
@@ -0,0 +1,9 @@
+```release-note:breakingchange
+compute: Added conditional requirement of `google_compute_**region**_backend_service` `backend.capacity_scaler` to no longer accept the API default if not INTERNAL. Non-INTERNAL backend services must now specify `capacity_scaler` explicitly and have a total capacity greater than 0. In addition, API default of 1.0 must now be explicitly set and will be treated as nil or zero if not set in config.
+```
+```release-note:bug
+compute: Fixed `google_compute_**region**_backend_service` so it no longer has a permadiff if `backend.capacity_scaler` is unset in config by requiring capacity scaler. 
+```
+```release-note:bug
+compute: Fixed `backend.capacity_scaler` to actually set zero (0.0) value.
+```
diff --git a/.rubocop.yml b/.rubocop.yml
@@ -54,14 +54,13 @@ Style/ClassAndModuleChildren:
   Enabled: false
 Style/ConditionalAssignment:
   Enabled: false
-Style/BracesAroundHashParameters:
-  Enabled: false
 Style/AndOr:
   Enabled: false
 Style/Not:
   Enabled: false
 Naming/FileName:
-  Enabled: false
+  Enabled: true
+  Regex: !ruby/regexp '/^.{3,100}$/'
 Style/TrailingCommaInArrayLiteral:
   EnforcedStyleForMultiline: comma
 Style/TrailingCommaInHashLiteral:

diff --git a/Gemfile b/Gemfile
@@ -7,7 +7,7 @@ gem 'google-cloud'
 gem 'googleauth'
 gem 'inifile'
 gem 'inspec-bin', '4.16.0'
-gem 'rubocop'
+gem 'rubocop', '>= 0.77.0'
 
 group :development do
   gem 'github_changelog_generator'

diff --git a/README.md b/README.md
@@ -392,6 +392,10 @@ Changed Quota:
 
 Sometimes there can be occasional errors when performing the cleanup rake task. This happens when resources are already deleted and can be ignored.
 
+## Upgrading to version 1.0
+
+A guide on upgrading to version 1.0 can be found [here](docs/version_1_upgrade.md)
+
 ## Support
 
 The InSpec GCP resources are community supported. For bugs and features, please open a github issue and label it appropriately.

diff --git a/Rakefile b/Rakefile
@@ -47,16 +47,12 @@ namespace :test do
     sh(cmd)
   end
 
-  task :generate_integration_test_variables do
+  task :plan_integration_tests, [:seed] do |t, args|
     puts "----> Generating terraform and inspec variable files"
-    #p GCPInspecConfig.config[:gcp_project_id]
-    GCPInspecConfig.store_json(variable_file_name)
-    GCPInspecConfig.store_yaml(profile_attributes)
-  end
-
-  task :plan_integration_tests do
-
-    Rake::Task["test:generate_integration_test_variables"].execute
+    puts "Seeding random suffixes with: #{args.seed}" unless args.seed.nil?
+    config = GCPInspecConfig::Config.new(args.seed)
+    config.store_json(variable_file_name)
+    config.store_yaml(profile_attributes)
 
     puts "----> Setup"
     # Create the plan that can be applied to GCP

diff --git a/docs/resources/google_access_context_manager_service_perimeter.md b/docs/resources/google_access_context_manager_service_perimeter.md
@@ -42,6 +42,12 @@ Properties that can be accessed from the `google_access_context_manager_service_
 
     * `restricted_services`: GCP services that are subject to the Service Perimeter restrictions. Must contain a list of services. For example, if `storage.googleapis.com` is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions.
 
+    * `vpc_accessible_services`: Specifies how APIs are allowed to communicate within the Service Perimeter.
+
+      * `enable_restriction`: Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'.
+
+      * `allowed_services`: The list of APIs usable within the Service Perimeter. Must be empty unless `enableRestriction` is True.
+
   * `parent`: The AccessPolicy this ServicePerimeter lives in. Format: accessPolicies/{policy_id}
 
   * `name`: Resource name for the ServicePerimeter. The short_name component must begin with a letter and only include alphanumeric and '_'. Format: accessPolicies/{policy_id}/servicePerimeters/{short_name}

diff --git a/docs/resources/google_cloud_scheduler_job.md b/docs/resources/google_cloud_scheduler_job.md
@@ -31,6 +31,8 @@ Properties that can be accessed from the `google_cloud_scheduler_job` resource:
 
   * `time_zone`: Specifies the time zone to be used in interpreting schedule. The value of this field must be a time zone name from the tz database.
 
+  * `attempt_deadline`: The deadline for job attempts. If the request handler does not respond by this deadline then the request is cancelled and the attempt is marked as a DEADLINE_EXCEEDED failure. The failed attempt can be viewed in execution logs. Cloud Scheduler will retry the job according to the RetryConfig. The allowed duration for this deadline is: * For HTTP targets, between 15 seconds and 30 minutes. * For App Engine HTTP targets, between 15 seconds and 24 hours. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s"
+
   * `retry_config`: By default, if a job does not complete successfully,  meaning that an acknowledgement is not received from the handler,  then it will be retried with exponential backoff according to the settings
 
     * `retry_count`: The number of attempts that the system will make to run a  job using the exponential backoff procedure described by maxDoublings. Values greater than 5 and negative values are not allowed.
@@ -45,7 +47,7 @@ Properties that can be accessed from the `google_cloud_scheduler_job` resource:
 
   * `pubsub_target`: Pub/Sub target If the job providers a Pub/Sub target the cron will publish a message to the provided topic
 
-    * `topic_name`: The name of the Cloud Pub/Sub topic to which messages will be published when a job is delivered.  The topic name must be in the same format as required by PubSub's PublishRequest.name,  for example projects/PROJECT_ID/topics/TOPIC_ID.
+    * `topic_name`: The full resource name for the Cloud Pub/Sub topic to which messages will be published when a job is delivered. ~>**NOTE**: The topic name must be in the same format as required by PubSub's PublishRequest.name, e.g. `projects/my-project/topics/my-topic`.
 
     * `data`: The message payload for PubsubMessage. Pubsub message must contain either non-empty data, or at least one attribute.
 

diff --git a/docs/resources/google_cloud_scheduler_jobs.md b/docs/resources/google_cloud_scheduler_jobs.md
@@ -29,6 +29,7 @@ See [google_cloud_scheduler_job.md](google_cloud_scheduler_job.md) for more deta
   * `descriptions`: an array of `google_cloud_scheduler_job` description
   * `schedules`: an array of `google_cloud_scheduler_job` schedule
   * `time_zones`: an array of `google_cloud_scheduler_job` time_zone
+  * `attempt_deadlines`: an array of `google_cloud_scheduler_job` attempt_deadline
   * `retry_configs`: an array of `google_cloud_scheduler_job` retry_config
   * `pubsub_targets`: an array of `google_cloud_scheduler_job` pubsub_target
   * `app_engine_http_targets`: an array of `google_cloud_scheduler_job` app_engine_http_target

diff --git a/docs/resources/google_cloudbuild_trigger.md b/docs/resources/google_cloudbuild_trigger.md
@@ -40,9 +40,9 @@ Properties that can be accessed from the `google_cloudbuild_trigger` resource:
 
   * `filename`: Path, from the source root, to a file whose contents is used for the template. Either a filename or build template must be provided.
 
-  * `ignored_files`: ignoredFiles and includedFiles are file glob matches using http://godoc/pkg/path/filepath#Match extended with support for `**`.  If ignoredFiles and changed files are both empty, then they are not used to determine whether or not to trigger a build.  If ignoredFiles is not empty, then we ignore any files that match any of the ignored_file globs. If the change has no files that are outside of the ignoredFiles globs, then we do not trigger a build.
+  * `ignored_files`: ignoredFiles and includedFiles are file glob matches using https://golang.org/pkg/path/filepath/#Match extended with support for `**`.  If ignoredFiles and changed files are both empty, then they are not used to determine whether or not to trigger a build.  If ignoredFiles is not empty, then we ignore any files that match any of the ignored_file globs. If the change has no files that are outside of the ignoredFiles globs, then we do not trigger a build.
 
-  * `included_files`: ignoredFiles and includedFiles are file glob matches using http://godoc/pkg/path/filepath#Match extended with support for `**`.  If any of the files altered in the commit pass the ignoredFiles filter and includedFiles is empty, then as far as this filter is concerned, we should trigger the build.  If any of the files altered in the commit pass the ignoredFiles filter and includedFiles is not empty, then we make sure that at least one of those files matches a includedFiles glob. If not, then we do not trigger a build.
+  * `included_files`: ignoredFiles and includedFiles are file glob matches using https://golang.org/pkg/path/filepath/#Match extended with support for `**`.  If any of the files altered in the commit pass the ignoredFiles filter and includedFiles is empty, then as far as this filter is concerned, we should trigger the build.  If any of the files altered in the commit pass the ignoredFiles filter and includedFiles is not empty, then we make sure that at least one of those files matches a includedFiles glob. If not, then we do not trigger a build.
 
   * `trigger_template`: Template describing the types of source changes to trigger a build.  Branch and tag names in trigger templates are interpreted as regular expressions. Any branch or tag change that matches that regular expression will trigger a build.
 
@@ -58,13 +58,31 @@ Properties that can be accessed from the `google_cloudbuild_trigger` resource:
 
     * `commit_sha`: Explicit commit SHA to build. Exactly one of a branch name, tag, or commit SHA must be provided.
 
+  * `github`: (Beta only) Describes the configuration of a trigger that creates a build whenever a GitHub event is received.
+
+    * `owner`: Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
+
+    * `name`: Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
+
+    * `pull_request`: filter to match changes in pull requests.  Specify only one of pullRequest or push.
+
+      * `branch`: Regex of branches to match.
+
+      * `comment_control`: Whether to block builds on a "/gcbrun" comment from a repository owner or collaborator.
+
+    * `push`: filter to match changes in refs, like branches or tags.  Specify only one of pullRequest or push.
+
+      * `branch`: Regex of branches to match.  Specify only one of branch or tag.
+
+      * `tag`: Regex of tags to match.  Specify only one of branch or tag.
+
   * `build`: Contents of the build template. Either a filename or build template must be provided.
 
     * `tags`: Tags for annotation of a Build. These are not docker tags.
 
     * `images`: A list of images to be pushed upon the successful completion of all build steps. The images are pushed using the builder service account's credentials. The digests of the pushed images will be stored in the Build resource's results field. If any of the images fail to be pushed, the build status is marked FAILURE.
 
-    * `timeout`: Amount of time that this build should be allowed to run, to second granularity.  If this amount of time elapses, work on the build will cease and the build status will be TIMEOUT. This timeout must be equal to or greater than the sum of the timeouts for build steps within the build. The expected format is the number of seconds followed by s. Default time is ten minutes (600s).
+    * `timeout`: Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be TIMEOUT. This timeout must be equal to or greater than the sum of the timeouts for build steps within the build. The expected format is the number of seconds followed by s. Default time is ten minutes (600s).
 
     * `steps`: The operations to be performed on the workspace.
 

diff --git a/docs/resources/google_cloudbuild_triggers.md b/docs/resources/google_cloudbuild_triggers.md
@@ -36,6 +36,7 @@ See [google_cloudbuild_trigger.md](google_cloudbuild_trigger.md) for more detail
   * `ignored_files`: an array of `google_cloudbuild_trigger` ignored_files
   * `included_files`: an array of `google_cloudbuild_trigger` included_files
   * `trigger_templates`: an array of `google_cloudbuild_trigger` trigger_template
+  * `githubs`: (Beta only) an array of `google_cloudbuild_trigger` github
   * `builds`: an array of `google_cloudbuild_trigger` build
 
 ## Filter Criteria

diff --git a/docs/resources/google_compute_address.md b/docs/resources/google_compute_address.md
@@ -1,29 +1,28 @@
 ---
-title: About the google_compute_address Resource
+title: About the google_compute_address resource
 platform: gcp
 ---
 
-# google\_compute\_address
-
-Use the `google_compute_address` InSpec audit resource to test properties of a single GCP compute address.
-
-<br>
-
 ## Syntax
+A `google_compute_address` is used to test a Google Address resource
 
-A `google_compute_address` resource block declares the tests for a single GCP compute address by project, region and name.
-
-    describe google_compute_address(project: 'chef-inspec-gcp', location: 'europe-west2', name: 'compute-address') do
-      it { should exist }
-      its('name') { should eq 'compute-address' }
-      its('region') { should match 'europe-west2' }
-    end
 
-<br>
+## Beta Resource
+This resource has beta fields available. To retrieve these fields, include `beta: true` in the constructor for the resource
 
 ## Examples
-
-The following examples show how to use this InSpec audit resource.
+```
+describe google_compute_address(project: 'chef-gcp-inspec', location: 'europe-west2', name: 'inspec-gcp-global-address') do
+  it { should exist }
+  its('address') { should eq '10.2.0.3' }
+  its('address_type') { should eq 'INTERNAL' }
+  its('user_count') { should eq 0 }
+end
+
+describe google_compute_address(project: 'chef-gcp-inspec', location: 'europe-west2', name: 'nonexistent') do
+  it { should_not exist }
+end
+```
 
 ### Test that a GCP compute address IP exists
 
@@ -49,15 +48,40 @@ The following examples show how to use this InSpec audit resource.
       its('user_resource_name') { should eq "gcp_ext_vm_name" }
     end
 
-<br>
 
 ## Properties
+Properties that can be accessed from the `google_compute_address` resource:
+
+
+  * `address`: The static external IP address represented by this resource. Only IPv4 is supported. An address may only be specified for INTERNAL address types. The IP address must be inside the specified subnetwork, if any.
+
+  * `address_type`: The type of address to reserve, either INTERNAL or EXTERNAL. If unspecified, defaults to EXTERNAL.
+
+  * `creation_timestamp`: Creation timestamp in RFC3339 text format.
+
+  * `description`: An optional description of this resource.
+
+  * `id`: The unique identifier for the resource.
+
+  * `name`: Name of the resource. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
+
+  * `purpose`: The purpose of this resource, which can be one of the following values:  - GCE_ENDPOINT for addresses that are used by VM instances, alias IP ranges, internal load balancers, and similar resources.  This should only be set when using an Internal address.
+
+  * `network_tier`: The networking tier used for configuring this address. This field can take the following values: PREMIUM or STANDARD. If this field is not specified, it is assumed to be PREMIUM.
+
+  * `subnetwork`: The URL of the subnetwork in which to reserve the address. If an IP address is specified, it must be within the subnetwork's IP range. This field can only be used with INTERNAL type with GCE_ENDPOINT/DNS_RESOLVER purposes.
+
+  * `users`: The URLs of the resources that are using this address.
+
+  * `labels`: (Beta only) Labels to apply to this address.  A list of key->value pairs.
+
+  * `label_fingerprint`: (Beta only) The fingerprint used for optimistic locking of this resource.  Used internally during updates.
 
-*  `address`, `creation_timestamp`, `description`, `id`, `kind`, `name`, `region`, `status`, `users`
+  * `status`: The status of the address, which can be one of RESERVING, RESERVED, or IN_USE. An address that is RESERVING is currently in the process of being reserved. A RESERVED address is currently reserved and available to use. An IN_USE address is currently being used by another resource and is not available.
 
-<br>
+  * `region`: URL of the region where the regional address resides. This field is not applicable to global addresses.
 
 
 ## GCP Permissions
 
-Ensure the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com/) is enabled for the project where the resource is located.
+Ensure the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com/) is enabled for the current project.
diff --git a/docs/resources/google_compute_addresses.md b/docs/resources/google_compute_addresses.md
@@ -0,0 +1,46 @@
+---
+title: About the google_compute_addresses resource
+platform: gcp
+---
+
+## Syntax
+A `google_compute_addresses` is used to test a Google Address resource
+
+
+## Beta Resource
+This resource has beta fields available. To retrieve these fields, include `beta: true` in the constructor for the resource
+
+## Examples
+```
+describe google_compute_addresses(project: 'chef-gcp-inspec', location: 'europe-west2') do
+  its('addresses') { should include '10.2.0.3' }
+  its('names') { should include 'inspec-gcp-global-address' }
+end
+```
+
+## Properties
+Properties that can be accessed from the `google_compute_addresses` resource:
+
+See [google_compute_address.md](google_compute_address.md) for more detailed information
+  * `addresses`: an array of `google_compute_address` address
+  * `address_types`: an array of `google_compute_address` address_type
+  * `creation_timestamps`: an array of `google_compute_address` creation_timestamp
+  * `descriptions`: an array of `google_compute_address` description
+  * `ids`: an array of `google_compute_address` id
+  * `names`: an array of `google_compute_address` name
+  * `purposes`: an array of `google_compute_address` purpose
+  * `network_tiers`: an array of `google_compute_address` network_tier
+  * `subnetworks`: an array of `google_compute_address` subnetwork
+  * `users`: an array of `google_compute_address` users
+  * `labels`: (Beta only) an array of `google_compute_address` labels
+  * `label_fingerprints`: (Beta only) an array of `google_compute_address` label_fingerprint
+  * `statuses`: an array of `google_compute_address` status
+  * `regions`: an array of `google_compute_address` region
+
+## Filter Criteria
+This resource supports all of the above properties as filter criteria, which can be used
+with `where` as a block or a method.
+
+## GCP Permissions
+
+Ensure the [Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com/) is enabled for the current project.