feat: enable Post-Quantum Cryptography (PQC) SSL Policy for Load Balancer

[a-custodio]

Description

This pull request introduces the capability to enable Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer. This enhancement improves the security posture of our Cloud Run services by leveraging advanced cryptographic algorithms that are resistant to quantum computer attacks.

Specifically, the following changes were made:

• Introduced ssl variable: A new boolean variable ssl has been added to the main module's README.md and metadata.yaml. When set to true, this enables the PQC SSL Policy.
• Introduced ssl_policy variable: A new boolean variable ssl_policy has been added to modules/secure-cloud-run-core/README.md.
• Load Balancer Configuration Update: The modules/secure-cloud-run-core/loadbalancer.tf file has been updated to conditionally apply the google_compute_ssl_policy.main when the ssl_policy variable is enabled. This requires TLS 1.3 to be active for the PQC policy to take effect.

This change allows users to easily opt-in to PQC protection for their Cloud Run services, aligning with best practices for future-proofing security.

Related Issues/PRs

• N/A

Type of Change

• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (README.md, metadata.yaml)
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

How Has This Been Tested?

This feature has been tested by deploying a Cloud Run service with the ssl and ssl_policy variables set to true. Verification included:

• Confirming the successful deployment of the Cloud Run service.
• Checking the Google Cloud Load Balancer configuration to ensure the PQC SSL policy is applied.
• Verifying that TLS 1.3 is enforced.

Important Notes

• Enabling the PQC SSL policy requires TLS 1.3. Ensure your client applications support TLS 1.3 to avoid connectivity issues.
• The PQC SSL policy utilizes advanced cryptographic algorithms which might have performance implications; however, these are generally negligible for most use cases.

[amandakarina]

/gcbrun

[amandakarina]

/gcbrun