Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Network Firewall Policy Policy Packet Mirroring Rule resource #12855

Merged

Conversation

mihhalj
Copy link
Contributor

@mihhalj mihhalj commented Jan 24, 2025

As part of the work to launch Network Security Integrations (NSI) (b/352252592) we introduce a new resource to allow users to configure Network Firewall Policy Packet Mirroring rules.

In this PR we add Terraform support for the new resource type.

`google_compute_network_firewall_policy_packet_mirroring_rule` (beta)

@modular-magician modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Jan 24, 2025
@mihhalj mihhalj force-pushed the packet-mirroring-rule-resource branch 2 times, most recently from dbdce51 to 850c9c5 Compare January 24, 2025 09:23
@mihhalj mihhalj marked this pull request as ready for review January 24, 2025 09:28
@github-actions github-actions bot requested a review from roaks3 January 24, 2025 09:29
Copy link

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

@roaks3, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

Copy link
Contributor

@roaks3 roaks3 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First pass looks good, just some minor comments, and will run tests

insert_minutes: 20
update_minutes: 20
delete_minutes: 20
async:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you mind rebasing and then removing the fields that are no longer under async supported here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

primary_resource_id: 'primary'
vars:
fw_policy: 'fw-policy'
network_name: 'network'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be something with a hyphen, like "fw-network" (we have special handling that relies on the hyphen being present)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

security_profile_group = "//networksecurity.googleapis.com/${google_network_security_security_profile_group.security_profile_group_1.id}"

target_secure_tags {
name = "tagValues/${google_tags_tag_value.secure_tag_value_1.name}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: spacing, especially since this will show up on the docs page

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

project = "%{project_name}"
}

resource "google_compute_network_firewall_policy_packet_mirroring_rule" "primary" {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you omit the optional fields from either the _basic or _update config, to confirm they can be properly omitted?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done - I removed description, rule_name, disabled which are optional

@modular-magician modular-magician removed the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Jan 27, 2025
@mihhalj mihhalj changed the title in progress Add Network Firewall Policy Policy Packet Mirroring Rule resource Jan 28, 2025
@github-actions github-actions bot requested a review from roaks3 January 28, 2025 11:41
@mihhalj mihhalj force-pushed the packet-mirroring-rule-resource branch from f852817 to 2f6ab4a Compare January 28, 2025 11:45
@modular-magician modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Jan 28, 2025
Copy link

@roaks3 This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

@modular-magician modular-magician added service/network-security-distributed-firewall and removed awaiting-approval Pull requests that need reviewer's approval to run presubmit tests labels Jan 31, 2025
@modular-magician
Copy link
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 2 files changed, 293 insertions(+))
google-beta provider: Diff ( 6 files changed, 1611 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 266 insertions(+))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_compute_network_firewall_policy_packet_mirroring_rule (3 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_compute_network_firewall_policy_packet_mirroring_rule" "primary" {
  match {
    dest_ip_ranges = # value needed
    layer4_configs {
      ports = # value needed
    }
  }
  tls_inspect = # value needed
}

@modular-magician
Copy link
Collaborator

Tests analytics

Total tests: 1099
Passed tests: 1022
Skipped tests: 75
Affected tests: 2

Click here to see the affected service packages
  • compute

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
  • TestAccComputeNetworkFirewallPolicyPacketMirroringRule_computeNetworkFirewallPolicyPacketMirroringRuleExample
  • TestAccComputeNetworkFirewallPolicyPacketMirroringRule_update

Get to know how VCR tests work

@modular-magician
Copy link
Collaborator

🟢 Tests passed during RECORDING mode:
TestAccComputeNetworkFirewallPolicyPacketMirroringRule_computeNetworkFirewallPolicyPacketMirroringRuleExample [Debug log]
TestAccComputeNetworkFirewallPolicyPacketMirroringRule_update [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.


🟢 All tests passed!

View the build log or the debug log for each test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants