diff --git a/Makefile b/Makefile index 9f71d742..25ea4222 100644 --- a/Makefile +++ b/Makefile @@ -29,7 +29,7 @@ docker_test_lint: -e ENABLE_BPMETADATA \ -e ENABLE_PARALLEL=1 \ -e DISABLE_TFLINT=1 \ - -v $(CURDIR):/workspace \ + -v "$(CURDIR)":/workspace \ $(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \ /usr/local/bin/test_lint.sh @@ -38,7 +38,7 @@ docker_test_lint: docker_generate_docs: docker run --rm -it \ -e ENABLE_BPMETADATA=1 \ - -v $(CURDIR):/workspace \ + -v "$(CURDIR)":/workspace \ $(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \ /bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs --per-module-requirements' diff --git a/metadata.yaml b/metadata.yaml index 447f9d30..f6fc2cbb 100644 --- a/metadata.yaml +++ b/metadata.yaml @@ -323,13 +323,13 @@ spec: roles: - level: Project roles: + - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - - roles/serviceusage.serviceUsageViewer services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run-core/README.md b/modules/secure-cloud-run-core/README.md index 7f0db181..62ce2310 100644 --- a/modules/secure-cloud-run-core/README.md +++ b/modules/secure-cloud-run-core/README.md @@ -66,6 +66,7 @@ module "cloud_run_core" { | service\_labels | A set of key/value label pairs to assign to the service. | `map(string)` | `{}` | no | | service\_name | The name of the Cloud Run service to create. | `string` | n/a | yes | | ssl\_certificates | A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer. | 
object({
    ssl_certificates_self_links       = list(string)
    generate_certificates_for_domains = list(string)
  })
| n/a | yes | +| ssl\_policy | Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | template\_labels | A set of key/value label pairs to assign to the container metadata. | `map(string)` | `{}` | no | | timeout\_seconds | Timeout for each request. | `number` | `120` | no | | traffic\_split | Managing traffic routing to the service. | 
list(object({
    latest_revision = bool
    percent         = number
    revision_name   = string
    tag             = string
  }))
| 
[
  {
    "latest_revision": true,
    "percent": 100,
    "revision_name": "v1-0-0",
    "tag": null
  }
]
| no | diff --git a/modules/secure-cloud-run-core/loadbalancer.tf b/modules/secure-cloud-run-core/loadbalancer.tf index a7ba3544..fae6c5d0 100644 --- a/modules/secure-cloud-run-core/loadbalancer.tf +++ b/modules/secure-cloud-run-core/loadbalancer.tf @@ -25,6 +25,7 @@ module "lb-http" { name = var.lb_name project = var.project_id ssl = true + ssl_policy = var.ssl_policy ? google_compute_ssl_policy.main[0].id : null managed_ssl_certificate_domains = var.ssl_certificates.generate_certificates_for_domains ssl_certificates = var.ssl_certificates.ssl_certificates_self_links https_redirect = false diff --git a/modules/secure-cloud-run-core/metadata.yaml b/modules/secure-cloud-run-core/metadata.yaml index c66d7052..c86cfe40 100644 --- a/modules/secure-cloud-run-core/metadata.yaml +++ b/modules/secure-cloud-run-core/metadata.yaml @@ -287,6 +287,10 @@ spec: generate_certificates_for_domains = list(string) }) required: true + - name: ssl_policy + description: Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). + varType: bool + defaultValue: false outputs: - name: domain_map_id description: Unique Identifier for the created domain map. @@ -306,13 +310,13 @@ spec: roles: - level: Project roles: + - roles/serviceusage.serviceUsageViewer + - roles/cloudkms.admin + - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - - roles/serviceusage.serviceUsageViewer - - roles/cloudkms.admin - - roles/resourcemanager.projectIamAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run-core/ssl.tf b/modules/secure-cloud-run-core/ssl.tf new file mode 100644 index 00000000..7a9da790 --- /dev/null +++ b/modules/secure-cloud-run-core/ssl.tf @@ -0,0 +1,24 @@ +/** + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +resource "google_compute_ssl_policy" "main" { + count = var.ssl_policy ? 1 : 0 + project = var.project_id + name = "${var.lb_name}-ssl-policy" + profile = "RESTRICTED" + post_quantum_key_exchange = "ENABLED" + min_tls_version = "TLS_1_3" +} diff --git a/modules/secure-cloud-run-core/variables.tf b/modules/secure-cloud-run-core/variables.tf index d80fe4e5..75258c26 100644 --- a/modules/secure-cloud-run-core/variables.tf +++ b/modules/secure-cloud-run-core/variables.tf @@ -328,3 +328,9 @@ variable "ssl_certificates" { } description = "A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer." } + +variable "ssl_policy" { + description = "Enables the SSL Policy for the Load Balancer (Requires TLS 1.3)." + type = bool + default = false +} diff --git a/modules/secure-cloud-run-security/metadata.yaml b/modules/secure-cloud-run-security/metadata.yaml index be40d0ec..37d1fed1 100644 --- a/modules/secure-cloud-run-security/metadata.yaml +++ b/modules/secure-cloud-run-security/metadata.yaml @@ -133,13 +133,13 @@ spec: roles: - level: Project roles: - - roles/cloudkms.admin - - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer + - roles/cloudkms.admin + - roles/resourcemanager.projectIamAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run/README.md b/modules/secure-cloud-run/README.md index 5158b49b..34da3ae8 100644 --- a/modules/secure-cloud-run/README.md +++ b/modules/secure-cloud-run/README.md @@ -110,6 +110,7 @@ module "secure_cloud_run" { | service\_name | Shared VPC name. | `string` | n/a | yes | | shared\_vpc\_name | Shared VPC name which is going to be re-used to create Serverless Connector. | `string` | n/a | yes | | ssl\_certificates | A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer. | 
object({
    ssl_certificates_self_links       = list(string)
    generate_certificates_for_domains = list(string)
  })
| n/a | yes | +| ssl\_policy | Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | subnet\_name | Subnet name to be re-used to create Serverless Connector. | `string` | `null` | no | | verified\_domain\_name | List of Custom Domain Name | `list(string)` | `[]` | no | | volumes | [Beta] Volumes needed for environment variables (when using secret). | 
list(object({
    name = string
    secret = set(object({
      secret_name = string
      items       = map(string)
    }))
  }))
| `[]` | no | diff --git a/modules/secure-cloud-run/main.tf b/modules/secure-cloud-run/main.tf index 9d3a75e3..84a87347 100644 --- a/modules/secure-cloud-run/main.tf +++ b/modules/secure-cloud-run/main.tf @@ -145,6 +145,7 @@ module "cloud_run_core" { max_scale_instances = var.max_scale_instances volumes = var.volumes ssl_certificates = var.ssl_certificates + ssl_policy = var.ssl_policy depends_on = [ module.serverless_project_apis, diff --git a/modules/secure-cloud-run/metadata.yaml b/modules/secure-cloud-run/metadata.yaml index f648489e..86ced444 100644 --- a/modules/secure-cloud-run/metadata.yaml +++ b/modules/secure-cloud-run/metadata.yaml @@ -219,6 +219,10 @@ spec: generate_certificates_for_domains = list(string) }) required: true + - name: ssl_policy + description: Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). + varType: bool + defaultValue: false outputs: - name: cloud_services_sa description: Service Account for Cloud Run Service. diff --git a/modules/secure-cloud-run/variables.tf b/modules/secure-cloud-run/variables.tf index 406fe31e..e91dfdfb 100644 --- a/modules/secure-cloud-run/variables.tf +++ b/modules/secure-cloud-run/variables.tf @@ -254,3 +254,9 @@ variable "ssl_certificates" { } description = "A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer." } + +variable "ssl_policy" { + description = "Enables the SSL Policy for the Load Balancer (Requires TLS 1.3)." + type = bool + default = false +} diff --git a/modules/secure-serverless-harness/metadata.yaml b/modules/secure-serverless-harness/metadata.yaml index ed037f3a..7345417f 100644 --- a/modules/secure-serverless-harness/metadata.yaml +++ b/modules/secure-serverless-harness/metadata.yaml @@ -282,13 +282,13 @@ spec: roles: - level: Project roles: + - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - - roles/cloudkms.admin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-serverless-net/metadata.yaml b/modules/secure-serverless-net/metadata.yaml index 1eda0bdd..2c9f2a17 100644 --- a/modules/secure-serverless-net/metadata.yaml +++ b/modules/secure-serverless-net/metadata.yaml @@ -120,13 +120,13 @@ spec: roles: - level: Project roles: - - roles/iam.serviceAccountUser - - roles/serviceusage.serviceUsageViewer - - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin + - roles/iam.serviceAccountUser + - roles/serviceusage.serviceUsageViewer + - roles/cloudkms.admin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/v2/metadata.yaml b/modules/v2/metadata.yaml index 408f64d7..e0914118 100644 --- a/modules/v2/metadata.yaml +++ b/modules/v2/metadata.yaml @@ -704,14 +704,14 @@ spec: roles: - level: Project roles: - - roles/compute.viewer - - roles/iap.admin - - roles/artifactregistry.reader - roles/run.admin - roles/iam.serviceAccountAdmin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/resourcemanager.projectIamAdmin + - roles/compute.viewer + - roles/iap.admin + - roles/artifactregistry.reader services: - cloudresourcemanager.googleapis.com - compute.googleapis.com diff --git a/variables.tf b/variables.tf index d6f3f758..3de9618c 100644 --- a/variables.tf +++ b/variables.tf @@ -285,3 +285,4 @@ variable "members" { description = "Users/SAs to be given invoker access to the service" default = [] } +