From ec04e25b773f8c0d79281d26085232711041765d Mon Sep 17 00:00:00 2001 From: Sam Levenick Date: Wed, 30 Jan 2019 23:40:46 +0000 Subject: [PATCH] Add InSpec support for compute routes Signed-off-by: Modular Magician --- docs/resources/google_compute_route.md | 48 +++++++++ docs/resources/google_compute_routes.md | 38 +++++++ libraries/google_compute_route.rb | 71 ++++++++++++ libraries/google_compute_routes.rb | 102 ++++++++++++++++++ test/integration/build/gcp-mm.tf | 14 +++ .../configuration/mm-attributes.yml | 6 ++ .../verify/controls/google_compute_route.rb | 40 +++++++ .../verify/controls/google_compute_routes.rb | 35 ++++++ 8 files changed, 354 insertions(+) create mode 100644 docs/resources/google_compute_route.md create mode 100644 docs/resources/google_compute_routes.md create mode 100644 libraries/google_compute_route.rb create mode 100644 libraries/google_compute_routes.rb create mode 100644 test/integration/verify/controls/google_compute_route.rb create mode 100644 test/integration/verify/controls/google_compute_routes.rb diff --git a/docs/resources/google_compute_route.md b/docs/resources/google_compute_route.md new file mode 100644 index 000000000..787b385bb --- /dev/null +++ b/docs/resources/google_compute_route.md @@ -0,0 +1,48 @@ +--- +title: About the Route resource +platform: gcp +--- + + +## Syntax +A `google_compute_route` is used to test a Google Route resource + +## Examples +``` +describe google_compute_route(project: 'chef-gcp-inspec', name: 'inspec-gcp-route') do + it { should exist } + its('dest_range') { should eq '15.0.0.0/24' } + its('network') { should match /\/gcp-inspec-network$/ } + its('next_hop_ip') { should eq '10.2.0.1' } + its('priority') { should eq '100' } +end + +describe google_compute_route(project: 'chef-gcp-inspec', name: 'nonexistent') do + it { should_not exist } +end +``` + +## Properties +Properties that can be accessed from the `google_compute_route` resource: + + * `dest_range`: The destination range of outgoing packets that this route applies to. Only IPv4 is supported. + + * `description`: An optional description of this resource. Provide this property when you create the resource. + + * `name`: Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash. + + * `network`: The network that this route applies to. + + * `priority`: The priority of this route. Priority is used to break ties in cases where there is more than one matching route of equal prefix length. In the case of two routes with equal prefix length, the one with the lowest-numbered priority value wins. Default value is 1000. Valid range is 0 through 65535. + + * `tags`: A list of instance tags to which this route applies. + + * `next_hop_gateway`: URL to a gateway that should handle matching packets. Currently, you can only specify the internet gateway, using a full or partial valid URL: * https://www.googleapis.com/compute/v1/projects/project/ global/gateways/default-internet-gateway * projects/project/global/gateways/default-internet-gateway * global/gateways/default-internet-gateway + + * `next_hop_instance`: URL to an instance that should handle matching packets. You can specify this as a full or partial URL. For example: * https://www.googleapis.com/compute/v1/projects/project/zones/zone/ instances/instance * projects/project/zones/zone/instances/instance * zones/zone/instances/instance + + * `next_hop_ip`: Network IP address of an instance that should handle matching packets. + + * `next_hop_vpn_tunnel`: URL to a VpnTunnel that should handle matching packets. + + * `next_hop_network`: URL to a Network that should handle matching packets. diff --git a/docs/resources/google_compute_routes.md b/docs/resources/google_compute_routes.md new file mode 100644 index 000000000..d79db273c --- /dev/null +++ b/docs/resources/google_compute_routes.md @@ -0,0 +1,38 @@ +--- +title: About the Route resource +platform: gcp +--- + + +## Syntax +A `google_compute_routes` is used to test a Google Route resource + +## Examples +``` +describe google_compute_routes(project: 'chef-gcp-inspec') do + its('count') { should be >= 1 } + its('dest_ranges') { should include '15.0.0.0/24' } + its('next_hop_ips') { should include '10.2.0.1' } + its('priorities') { should include '100' } +end +``` + +## Properties +Properties that can be accessed from the `google_compute_routes` resource: + +See [google_compute_route.md](google_compute_route.md) for more detailed information + * `dest_ranges`: an array of `google_compute_route` dest_range + * `descriptions`: an array of `google_compute_route` description + * `names`: an array of `google_compute_route` name + * `networks`: an array of `google_compute_route` network + * `priorities`: an array of `google_compute_route` priority + * `tags`: an array of `google_compute_route` tags + * `next_hop_gateways`: an array of `google_compute_route` next_hop_gateway + * `next_hop_instances`: an array of `google_compute_route` next_hop_instance + * `next_hop_ips`: an array of `google_compute_route` next_hop_ip + * `next_hop_vpn_tunnels`: an array of `google_compute_route` next_hop_vpn_tunnel + * `next_hop_networks`: an array of `google_compute_route` next_hop_network + +## Filter Criteria +This resource supports all of the above properties as filter criteria, which can be used +with `where` as a block or a method. diff --git a/libraries/google_compute_route.rb b/libraries/google_compute_route.rb new file mode 100644 index 000000000..27da100a3 --- /dev/null +++ b/libraries/google_compute_route.rb @@ -0,0 +1,71 @@ +# frozen_string_literal: false + +# ---------------------------------------------------------------------------- +# +# *** AUTO GENERATED CODE *** AUTO GENERATED CODE *** +# +# ---------------------------------------------------------------------------- +# +# This file is automatically generated by Magic Modules and manual +# changes will be clobbered when the file is regenerated. +# +# Please read more about how to change this file in README.md and +# CONTRIBUTING.md located at the root of this package. +# +# ---------------------------------------------------------------------------- +require 'gcp_backend' + +# A provider to manage Google Compute Engine resources. +class Route < GcpResourceBase + name 'google_compute_route' + desc 'Route' + supports platform: 'gcp' + + attr_reader :dest_range + attr_reader :description + attr_reader :name + attr_reader :network + attr_reader :priority + attr_reader :tags + attr_reader :next_hop_gateway + attr_reader :next_hop_instance + attr_reader :next_hop_ip + attr_reader :next_hop_vpn_tunnel + attr_reader :next_hop_network + def base + 'https://www.googleapis.com/compute/v1/' + end + + def url + 'projects/{{project}}/global/routes/{{name}}' + end + + def initialize(params) + super(params.merge({ use_http_transport: true })) + @fetched = @connection.fetch(base, url, params) + parse unless @fetched.nil? + end + + def parse + @dest_range = @fetched['destRange'] + @description = @fetched['description'] + @name = @fetched['name'] + @network = @fetched['network'] + @priority = @fetched['priority'] + @tags = @fetched['tags'] + @next_hop_gateway = @fetched['nextHopGateway'] + @next_hop_instance = @fetched['nextHopInstance'] + @next_hop_ip = @fetched['nextHopIp'] + @next_hop_vpn_tunnel = @fetched['nextHopVpnTunnel'] + @next_hop_network = @fetched['nextHopNetwork'] + end + + # Handles parsing RFC3339 time string + def parse_time_string(time_string) + time_string ? Time.parse(time_string) : nil + end + + def exists? + !@fetched.nil? + end +end diff --git a/libraries/google_compute_routes.rb b/libraries/google_compute_routes.rb new file mode 100644 index 000000000..af08fcf63 --- /dev/null +++ b/libraries/google_compute_routes.rb @@ -0,0 +1,102 @@ +# frozen_string_literal: false + +# ---------------------------------------------------------------------------- +# +# *** AUTO GENERATED CODE *** AUTO GENERATED CODE *** +# +# ---------------------------------------------------------------------------- +# +# This file is automatically generated by Magic Modules and manual +# changes will be clobbered when the file is regenerated. +# +# Please read more about how to change this file in README.md and +# CONTRIBUTING.md located at the root of this package. +# +# ---------------------------------------------------------------------------- +require 'gcp_backend' +class Routes < GcpResourceBase + name 'google_compute_routes' + desc 'Route plural resource' + supports platform: 'gcp' + + attr_reader :table + + filter_table_config = FilterTable.create + + filter_table_config.add(:dest_ranges, field: :dest_range) + filter_table_config.add(:descriptions, field: :description) + filter_table_config.add(:names, field: :name) + filter_table_config.add(:networks, field: :network) + filter_table_config.add(:priorities, field: :priority) + filter_table_config.add(:tags, field: :tags) + filter_table_config.add(:next_hop_gateways, field: :next_hop_gateway) + filter_table_config.add(:next_hop_instances, field: :next_hop_instance) + filter_table_config.add(:next_hop_ips, field: :next_hop_ip) + filter_table_config.add(:next_hop_vpn_tunnels, field: :next_hop_vpn_tunnel) + filter_table_config.add(:next_hop_networks, field: :next_hop_network) + + filter_table_config.connect(self, :table) + + def base + 'https://www.googleapis.com/compute/v1/' + end + + def url + 'projects/{{project}}/global/routes' + end + + def initialize(params = {}) + super(params.merge({ use_http_transport: true })) + @params = params + @table = fetch_wrapped_resource('items') + end + + def fetch_wrapped_resource(wrap_path) + # fetch_resource returns an array of responses (to handle pagination) + result = @connection.fetch_all(base, url, @params) + return if result.nil? + + # Conversion of string -> object hash to symbol -> object hash that InSpec needs + converted = [] + result.each do |response| + next if response.nil? || !response.key?(wrap_path) + response[wrap_path].each do |hash| + hash_with_symbols = {} + hash.each_key do |key| + name, value = transform(key, hash) + hash_with_symbols[name] = value + end + converted.push(hash_with_symbols) + end + end + + converted + end + + def transform(key, value) + return transformers[key].call(value) if transformers.key?(key) + + [key.to_sym, value] + end + + def transformers + { + 'destRange' => ->(obj) { return :dest_range, obj['destRange'] }, + 'description' => ->(obj) { return :description, obj['description'] }, + 'name' => ->(obj) { return :name, obj['name'] }, + 'network' => ->(obj) { return :network, obj['network'] }, + 'priority' => ->(obj) { return :priority, obj['priority'] }, + 'tags' => ->(obj) { return :tags, obj['tags'] }, + 'nextHopGateway' => ->(obj) { return :next_hop_gateway, obj['nextHopGateway'] }, + 'nextHopInstance' => ->(obj) { return :next_hop_instance, obj['nextHopInstance'] }, + 'nextHopIp' => ->(obj) { return :next_hop_ip, obj['nextHopIp'] }, + 'nextHopVpnTunnel' => ->(obj) { return :next_hop_vpn_tunnel, obj['nextHopVpnTunnel'] }, + 'nextHopNetwork' => ->(obj) { return :next_hop_network, obj['nextHopNetwork'] }, + } + end + + # Handles parsing RFC3339 time string + def parse_time_string(time_string) + time_string ? Time.parse(time_string) : nil + end +end diff --git a/test/integration/build/gcp-mm.tf b/test/integration/build/gcp-mm.tf index f220f4fe3..515866644 100644 --- a/test/integration/build/gcp-mm.tf +++ b/test/integration/build/gcp-mm.tf @@ -78,6 +78,10 @@ variable "regional_cluster" { type = "map" } +variable "route" { + type = "map" +} + resource "google_compute_ssl_policy" "custom-ssl-policy" { name = "${var.ssl_policy["name"]}" min_tls_version = "${var.ssl_policy["min_tls_version"]}" @@ -319,4 +323,14 @@ resource "google_container_cluster" "gcp-inspec-regional-cluster" { name = "${var.regional_cluster["name"]}" region = "${var.regional_cluster["region"]}" initial_node_count = "${var.regional_cluster["initial_node_count"]}" +} + +resource "google_compute_route" "gcp-inspec-route" { + project = "${var.gcp_project_id}" + name = "${var.route["name"]}" + dest_range = "${var.route["dest_range"]}" + network = "${google_compute_network.inspec-gcp-network.name}" + next_hop_ip = "${var.route["next_hop_ip"]}" + priority = "${var.route["priority"]}" + depends_on = ["google_compute_subnetwork.inspec-gcp-subnetwork"] } \ No newline at end of file diff --git a/test/integration/configuration/mm-attributes.yml b/test/integration/configuration/mm-attributes.yml index 0cd8e33ef..374183d97 100644 --- a/test/integration/configuration/mm-attributes.yml +++ b/test/integration/configuration/mm-attributes.yml @@ -120,3 +120,9 @@ regional_cluster: name: inspec-gcp-regional-cluster region: europe-west2 initial_node_count: 1 + +route: + name: inspec-gcp-route + dest_range: 15.0.0.0/24 + next_hop_ip: 10.2.0.1 + priority: 100 diff --git a/test/integration/verify/controls/google_compute_route.rb b/test/integration/verify/controls/google_compute_route.rb new file mode 100644 index 000000000..7792f1816 --- /dev/null +++ b/test/integration/verify/controls/google_compute_route.rb @@ -0,0 +1,40 @@ +# ---------------------------------------------------------------------------- +# +# *** AUTO GENERATED CODE *** AUTO GENERATED CODE *** +# +# ---------------------------------------------------------------------------- +# +# This file is automatically generated by Magic Modules and manual +# changes will be clobbered when the file is regenerated. +# +# Please read more about how to change this file in README.md and +# CONTRIBUTING.md located at the root of this package. +# +# ---------------------------------------------------------------------------- + +title 'Test GCP google_compute_route resource.' + +gcp_project_id = attribute(:gcp_project_id, default: 'gcp_project_id', description: 'The GCP project identifier.') +route = attribute('route', default: { + "name": "inspec-gcp-route", + "dest_range": "15.0.0.0/24", + "next_hop_ip": "10.2.0.1", + "priority": 100 +}, description: 'Compute route description') +gcp_network_name = attribute(:gcp_network_name, default: 'gcp_network_name', description: 'GCP network name') +control 'google_compute_route-1.0' do + impact 1.0 + title 'google_compute_route resource test' + + describe google_compute_route(project: gcp_project_id, name: route['name']) do + it { should exist } + its('dest_range') { should eq route['dest_range'] } + its('network') { should match /\/#{gcp_network_name}$/ } + its('next_hop_ip') { should eq route['next_hop_ip'] } + its('priority') { should eq route['priority'] } + end + + describe google_compute_route(project: gcp_project_id, name: 'nonexistent') do + it { should_not exist } + end +end diff --git a/test/integration/verify/controls/google_compute_routes.rb b/test/integration/verify/controls/google_compute_routes.rb new file mode 100644 index 000000000..29ce688a0 --- /dev/null +++ b/test/integration/verify/controls/google_compute_routes.rb @@ -0,0 +1,35 @@ +# ---------------------------------------------------------------------------- +# +# *** AUTO GENERATED CODE *** AUTO GENERATED CODE *** +# +# ---------------------------------------------------------------------------- +# +# This file is automatically generated by Magic Modules and manual +# changes will be clobbered when the file is regenerated. +# +# Please read more about how to change this file in README.md and +# CONTRIBUTING.md located at the root of this package. +# +# ---------------------------------------------------------------------------- + +title 'Test GCP google_compute_routes resource.' + +gcp_project_id = attribute(:gcp_project_id, default: 'gcp_project_id', description: 'The GCP project identifier.') +route = attribute('route', default: { + "name": "inspec-gcp-route", + "dest_range": "15.0.0.0/24", + "next_hop_ip": "10.2.0.1", + "priority": 100 +}, description: 'Compute route description') +gcp_network_name = attribute(:gcp_network_name, default: 'gcp_network_name', description: 'GCP network name') +control 'google_compute_routes-1.0' do + impact 1.0 + title 'google_compute_routes resource test' + + describe google_compute_routes(project: gcp_project_id) do + its('count') { should be >= 1 } + its('dest_ranges') { should include route['dest_range'] } + its('next_hop_ips') { should include route['next_hop_ip'] } + its('priorities') { should include route['priority'] } + end +end