diff --git a/docs/resources/google_compute_route.md b/docs/resources/google_compute_route.md new file mode 100644 index 000000000..787b385bb --- /dev/null +++ b/docs/resources/google_compute_route.md @@ -0,0 +1,48 @@ +--- +title: About the Route resource +platform: gcp +--- + + +## Syntax +A `google_compute_route` is used to test a Google Route resource + +## Examples +``` +describe google_compute_route(project: 'chef-gcp-inspec', name: 'inspec-gcp-route') do + it { should exist } + its('dest_range') { should eq '15.0.0.0/24' } + its('network') { should match /\/gcp-inspec-network$/ } + its('next_hop_ip') { should eq '10.2.0.1' } + its('priority') { should eq '100' } +end + +describe google_compute_route(project: 'chef-gcp-inspec', name: 'nonexistent') do + it { should_not exist } +end +``` + +## Properties +Properties that can be accessed from the `google_compute_route` resource: + + * `dest_range`: The destination range of outgoing packets that this route applies to. Only IPv4 is supported. + + * `description`: An optional description of this resource. Provide this property when you create the resource. + + * `name`: Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash. + + * `network`: The network that this route applies to. + + * `priority`: The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In the case of two routes with equal prefix length, the one with the lowest-numbered priority value wins. Default value is 1000. Valid range is 0 through 65535. + + * `tags`: A list of instance tags to which this route applies. + + * `next_hop_gateway`: URL to a gateway that should handle matching packets. Currently, you can only specify the internet gateway, using a full or partial valid URL: * https://www.googleapis.com/compute/v1/projects/project/ global/gateways/default-internet-gateway * projects/project/global/gateways/default-internet-gateway * global/gateways/default-internet-gateway + + * `next_hop_instance`: URL to an instance that should handle matching packets. You can specify this as a full or partial URL. For example: * https://www.googleapis.com/compute/v1/projects/project/zones/zone/ instances/instance * projects/project/zones/zone/instances/instance * zones/zone/instances/instance + + * `next_hop_ip`: Network IP address of an instance that should handle matching packets. + + * `next_hop_vpn_tunnel`: URL to a VpnTunnel that should handle matching packets. + + * `next_hop_network`: URL to a Network that should handle matching packets. diff --git a/docs/resources/google_compute_routes.md b/docs/resources/google_compute_routes.md new file mode 100644 index 000000000..d79db273c --- /dev/null +++ b/docs/resources/google_compute_routes.md @@ -0,0 +1,38 @@ +--- +title: About the Route resource +platform: gcp +--- + + +## Syntax +A `google_compute_routes` is used to test a Google Route resource + +## Examples +``` +describe google_compute_routes(project: 'chef-gcp-inspec') do + its('count') { should be >= 1 } + its('dest_ranges') { should include '15.0.0.0/24' } + its('next_hop_ips') { should include '10.2.0.1' } + its('priorities') { should include '100' } +end +``` + +## Properties +Properties that can be accessed from the `google_compute_routes` resource: + +See [google_compute_route.md](google_compute_route.md) for more detailed information + * `dest_ranges`: an array of `google_compute_route` dest_range + * `descriptions`: an array of `google_compute_route` description + * `names`: an array of `google_compute_route` name + * `networks`: an array of `google_compute_route` network + * `priorities`: an array of `google_compute_route` priority + * `tags`: an array of `google_compute_route` tags + * `next_hop_gateways`: an array of `google_compute_route` next_hop_gateway + * `next_hop_instances`: an array of `google_compute_route` next_hop_instance + * `next_hop_ips`: an array of `google_compute_route` next_hop_ip + * `next_hop_vpn_tunnels`: an array of `google_compute_route` next_hop_vpn_tunnel + * `next_hop_networks`: an array of `google_compute_route` next_hop_network + +## Filter Criteria +This resource supports all of the above properties as filter criteria, which can be used +with `where` as a block or a method. diff --git a/libraries/google_compute_route.rb b/libraries/google_compute_route.rb new file mode 100644 index 000000000..27da100a3 --- /dev/null +++ b/libraries/google_compute_route.rb @@ -0,0 +1,71 @@ +# frozen_string_literal: false + +# ---------------------------------------------------------------------------- +# +# *** AUTO GENERATED CODE *** AUTO GENERATED CODE *** +# +# ---------------------------------------------------------------------------- +# +# This file is automatically generated by Magic Modules and manual +# changes will be clobbered when the file is regenerated. +# +# Please read more about how to change this file in README.md and +# CONTRIBUTING.md located at the root of this package. +# +# ---------------------------------------------------------------------------- +require 'gcp_backend' + +# A provider to manage Google Compute Engine resources. +class Route < GcpResourceBase + name 'google_compute_route' + desc 'Route' + supports platform: 'gcp' + + attr_reader :dest_range + attr_reader :description + attr_reader :name + attr_reader :network + attr_reader :priority + attr_reader :tags + attr_reader :next_hop_gateway + attr_reader :next_hop_instance + attr_reader :next_hop_ip + attr_reader :next_hop_vpn_tunnel + attr_reader :next_hop_network + def base + 'https://www.googleapis.com/compute/v1/' + end + + def url + 'projects/{{project}}/global/routes/{{name}}' + end + + def initialize(params) + super(params.merge({ use_http_transport: true })) + @fetched = @connection.fetch(base, url, params) + parse unless @fetched.nil? + end + + def parse + @dest_range = @fetched['destRange'] + @description = @fetched['description'] + @name = @fetched['name'] + @network = @fetched['network'] + @priority = @fetched['priority'] + @tags = @fetched['tags'] + @next_hop_gateway = @fetched['nextHopGateway'] + @next_hop_instance = @fetched['nextHopInstance'] + @next_hop_ip = @fetched['nextHopIp'] + @next_hop_vpn_tunnel = @fetched['nextHopVpnTunnel'] + @next_hop_network = @fetched['nextHopNetwork'] + end + + # Handles parsing RFC3339 time string + def parse_time_string(time_string) + time_string ? Time.parse(time_string) : nil + end + + def exists? + !@fetched.nil? + end +end diff --git a/libraries/google_compute_routes.rb b/libraries/google_compute_routes.rb new file mode 100644 index 000000000..af08fcf63 --- /dev/null +++ b/libraries/google_compute_routes.rb @@ -0,0 +1,102 @@ +# frozen_string_literal: false + +# ---------------------------------------------------------------------------- +# +# *** AUTO GENERATED CODE *** AUTO GENERATED CODE *** +# +# ---------------------------------------------------------------------------- +# +# This file is automatically generated by Magic Modules and manual +# changes will be clobbered when the file is regenerated. +# +# Please read more about how to change this file in README.md and +# CONTRIBUTING.md located at the root of this package. +# +# ---------------------------------------------------------------------------- +require 'gcp_backend' +class Routes < GcpResourceBase + name 'google_compute_routes' + desc 'Route plural resource' + supports platform: 'gcp' + + attr_reader :table + + filter_table_config = FilterTable.create + + filter_table_config.add(:dest_ranges, field: :dest_range) + filter_table_config.add(:descriptions, field: :description) + filter_table_config.add(:names, field: :name) + filter_table_config.add(:networks, field: :network) + filter_table_config.add(:priorities, field: :priority) + filter_table_config.add(:tags, field: :tags) + filter_table_config.add(:next_hop_gateways, field: :next_hop_gateway) + filter_table_config.add(:next_hop_instances, field: :next_hop_instance) + filter_table_config.add(:next_hop_ips, field: :next_hop_ip) + filter_table_config.add(:next_hop_vpn_tunnels, field: :next_hop_vpn_tunnel) + filter_table_config.add(:next_hop_networks, field: :next_hop_network) + + filter_table_config.connect(self, :table) + + def base + 'https://www.googleapis.com/compute/v1/' + end + + def url + 'projects/{{project}}/global/routes' + end + + def initialize(params = {}) + super(params.merge({ use_http_transport: true })) + @params = params + @table = fetch_wrapped_resource('items') + end + + def fetch_wrapped_resource(wrap_path) + # fetch_resource returns an array of responses (to handle pagination) + result = @connection.fetch_all(base, url, @params) + return if result.nil? + + # Conversion of string -> object hash to symbol -> object hash that InSpec needs + converted = [] + result.each do |response| + next if response.nil? || !response.key?(wrap_path) + response[wrap_path].each do |hash| + hash_with_symbols = {} + hash.each_key do |key| + name, value = transform(key, hash) + hash_with_symbols[name] = value + end + converted.push(hash_with_symbols) + end + end + + converted + end + + def transform(key, value) + return transformers[key].call(value) if transformers.key?(key) + + [key.to_sym, value] + end + + def transformers + { + 'destRange' => ->(obj) { return :dest_range, obj['destRange'] }, + 'description' => ->(obj) { return :description, obj['description'] }, + 'name' => ->(obj) { return :name, obj['name'] }, + 'network' => ->(obj) { return :network, obj['network'] }, + 'priority' => ->(obj) { return :priority, obj['priority'] }, + 'tags' => ->(obj) { return :tags, obj['tags'] }, + 'nextHopGateway' => ->(obj) { return :next_hop_gateway, obj['nextHopGateway'] }, + 'nextHopInstance' => ->(obj) { return :next_hop_instance, obj['nextHopInstance'] }, + 'nextHopIp' => ->(obj) { return :next_hop_ip, obj['nextHopIp'] }, + 'nextHopVpnTunnel' => ->(obj) { return :next_hop_vpn_tunnel, obj['nextHopVpnTunnel'] }, + 'nextHopNetwork' => ->(obj) { return :next_hop_network, obj['nextHopNetwork'] }, + } + end + + # Handles parsing RFC3339 time string + def parse_time_string(time_string) + time_string ? Time.parse(time_string) : nil + end +end diff --git a/test/integration/build/gcp-mm.tf b/test/integration/build/gcp-mm.tf index f220f4fe3..5d8fb1a5a 100644 --- a/test/integration/build/gcp-mm.tf +++ b/test/integration/build/gcp-mm.tf @@ -78,6 +78,10 @@ variable "regional_cluster" { type = "map" } +variable "route" { + type = "map" +} + resource "google_compute_ssl_policy" "custom-ssl-policy" { name = "${var.ssl_policy["name"]}" min_tls_version = "${var.ssl_policy["min_tls_version"]}" @@ -319,4 +323,18 @@ resource "google_container_cluster" "gcp-inspec-regional-cluster" { name = "${var.regional_cluster["name"]}" region = "${var.regional_cluster["region"]}" initial_node_count = "${var.regional_cluster["initial_node_count"]}" +} + +resource "google_compute_route" "gcp-inspec-route" { + project = "${var.gcp_project_id}" + name = "${var.route["name"]}" + dest_range = "${var.route["dest_range"]}" + network = "${google_compute_network.inspec-gcp-network.name}" + next_hop_ip = "${var.route["next_hop_ip"]}" + priority = "${var.route["priority"]}" + # google_compute_route depends on next_hop_ip belonging to a subnetwork + # of the named network in this block. Since inspec-gcp-network does not + # automatically create subnetworks, we need to create a dependency so + # the route is not created before the subnetwork + depends_on = ["google_compute_subnetwork.inspec-gcp-subnetwork"] } \ No newline at end of file diff --git a/test/integration/configuration/mm-attributes.yml b/test/integration/configuration/mm-attributes.yml index 0cd8e33ef..374183d97 100644 --- a/test/integration/configuration/mm-attributes.yml +++ b/test/integration/configuration/mm-attributes.yml @@ -120,3 +120,9 @@ regional_cluster: name: inspec-gcp-regional-cluster region: europe-west2 initial_node_count: 1 + +route: + name: inspec-gcp-route + dest_range: 15.0.0.0/24 + next_hop_ip: 10.2.0.1 + priority: 100 diff --git a/test/integration/verify/controls/google_compute_route.rb b/test/integration/verify/controls/google_compute_route.rb new file mode 100644 index 000000000..7792f1816 --- /dev/null +++ b/test/integration/verify/controls/google_compute_route.rb @@ -0,0 +1,40 @@ +# ---------------------------------------------------------------------------- +# +# *** AUTO GENERATED CODE *** AUTO GENERATED CODE *** +# +# ---------------------------------------------------------------------------- +# +# This file is automatically generated by Magic Modules and manual +# changes will be clobbered when the file is regenerated. +# +# Please read more about how to change this file in README.md and +# CONTRIBUTING.md located at the root of this package. +# +# ---------------------------------------------------------------------------- + +title 'Test GCP google_compute_route resource.' + +gcp_project_id = attribute(:gcp_project_id, default: 'gcp_project_id', description: 'The GCP project identifier.') +route = attribute('route', default: { + "name": "inspec-gcp-route", + "dest_range": "15.0.0.0/24", + "next_hop_ip": "10.2.0.1", + "priority": 100 +}, description: 'Compute route description') +gcp_network_name = attribute(:gcp_network_name, default: 'gcp_network_name', description: 'GCP network name') +control 'google_compute_route-1.0' do + impact 1.0 + title 'google_compute_route resource test' + + describe google_compute_route(project: gcp_project_id, name: route['name']) do + it { should exist } + its('dest_range') { should eq route['dest_range'] } + its('network') { should match /\/#{gcp_network_name}$/ } + its('next_hop_ip') { should eq route['next_hop_ip'] } + its('priority') { should eq route['priority'] } + end + + describe google_compute_route(project: gcp_project_id, name: 'nonexistent') do + it { should_not exist } + end +end diff --git a/test/integration/verify/controls/google_compute_routes.rb b/test/integration/verify/controls/google_compute_routes.rb new file mode 100644 index 000000000..29ce688a0 --- /dev/null +++ b/test/integration/verify/controls/google_compute_routes.rb @@ -0,0 +1,35 @@ +# ---------------------------------------------------------------------------- +# +# *** AUTO GENERATED CODE *** AUTO GENERATED CODE *** +# +# ---------------------------------------------------------------------------- +# +# This file is automatically generated by Magic Modules and manual +# changes will be clobbered when the file is regenerated. +# +# Please read more about how to change this file in README.md and +# CONTRIBUTING.md located at the root of this package. +# +# ---------------------------------------------------------------------------- + +title 'Test GCP google_compute_routes resource.' + +gcp_project_id = attribute(:gcp_project_id, default: 'gcp_project_id', description: 'The GCP project identifier.') +route = attribute('route', default: { + "name": "inspec-gcp-route", + "dest_range": "15.0.0.0/24", + "next_hop_ip": "10.2.0.1", + "priority": 100 +}, description: 'Compute route description') +gcp_network_name = attribute(:gcp_network_name, default: 'gcp_network_name', description: 'GCP network name') +control 'google_compute_routes-1.0' do + impact 1.0 + title 'google_compute_routes resource test' + + describe google_compute_routes(project: gcp_project_id) do + its('count') { should be >= 1 } + its('dest_ranges') { should include route['dest_range'] } + its('next_hop_ips') { should include route['next_hop_ip'] } + its('priorities') { should include route['priority'] } + end +end