From 632e521e7b387bc2d5c15e4b467390af30841747 Mon Sep 17 00:00:00 2001 From: acustodio Date: Thu, 25 Jun 2026 11:42:55 -0300 Subject: [PATCH 1/3] feat: add post-quantum ssl_policy for load balancer --- Makefile | 4 +-- README.md | 1 + metadata.yaml | 10 ++++--- modules/job-exec/metadata.yaml | 4 +-- modules/secure-cloud-run-core/README.md | 2 ++ modules/secure-cloud-run-core/loadbalancer.tf | 1 + modules/secure-cloud-run-core/metadata.yaml | 8 +++++- modules/secure-cloud-run-core/outputs.tf | 5 ++++ modules/secure-cloud-run-core/ssl.tf | 26 +++++++++++++++++++ modules/secure-cloud-run-core/variables.tf | 6 +++++ modules/secure-cloud-run/README.md | 1 + modules/secure-cloud-run/metadata.yaml | 6 ++++- modules/secure-cloud-run/variables.tf | 6 +++++ .../secure-serverless-harness/metadata.yaml | 2 +- modules/secure-serverless-net/metadata.yaml | 2 +- variables.tf | 6 +++++ 16 files changed, 79 insertions(+), 11 deletions(-) create mode 100644 modules/secure-cloud-run-core/ssl.tf diff --git a/Makefile b/Makefile index 9f71d742a..25ea42222 100644 --- a/Makefile +++ b/Makefile @@ -29,7 +29,7 @@ docker_test_lint: -e ENABLE_BPMETADATA \ -e ENABLE_PARALLEL=1 \ -e DISABLE_TFLINT=1 \ - -v $(CURDIR):/workspace \ + -v "$(CURDIR)":/workspace \ $(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \ /usr/local/bin/test_lint.sh @@ -38,7 +38,7 @@ docker_test_lint: docker_generate_docs: docker run --rm -it \ -e ENABLE_BPMETADATA=1 \ - -v $(CURDIR):/workspace \ + -v "$(CURDIR)":/workspace \ $(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \ /bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs --per-module-requirements' diff --git a/README.md b/README.md index 1011851d4..98649d807 100644 --- a/README.md +++ b/README.md @@ -74,6 +74,7 @@ module "cloud_run" { | service\_annotations | Annotations to the service. Acceptable values all, internal, internal-and-cloud-load-balancing | `map(string)` | 
{
  "run.googleapis.com/ingress": "all"
}
| no | | service\_labels | A set of key/value label pairs to assign to the service | `map(string)` | `{}` | no | | service\_name | The name of the Cloud Run service to create | `string` | n/a | yes | +| ssl | Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | startup\_probe | Startup probe of application within the container.
All other probes are disabled if a startup probe is provided, until it succeeds.
Container will not be added to service endpoints if the probe fails.
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes | 
object({
    failure_threshold     = optional(number, null)
    initial_delay_seconds = optional(number, null)
    timeout_seconds       = optional(number, null)
    period_seconds        = optional(number, null)
    http_get = optional(object({
      path = optional(string)
      http_headers = optional(list(object({
        name  = string
        value = string
      })), null)
    }), null)
    tcp_socket = optional(object({
      port = optional(number)
    }), null)
    grpc = optional(object({
      port    = optional(number)
      service = optional(string)
    }), null)
  })
| `null` | no | | template\_annotations | Annotations to the container metadata including VPC Connector and SQL. See [more details](https://cloud.google.com/run/docs/reference/rpc/google.cloud.run.v1#revisiontemplate) | `map(string)` | 
{
  "autoscaling.knative.dev/maxScale": 2,
  "autoscaling.knative.dev/minScale": 1,
  "generated-by": "terraform",
  "run.googleapis.com/client-name": "terraform"
}
| no | | template\_labels | A set of key/value label pairs to assign to the container metadata | `map(string)` | `{}` | no | diff --git a/metadata.yaml b/metadata.yaml index 447f9d305..a475d308c 100644 --- a/metadata.yaml +++ b/metadata.yaml @@ -276,6 +276,10 @@ spec: description: Users/SAs to be given invoker access to the service varType: list(string) defaultValue: [] + - name: ssl + description: Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). + varType: bool + defaultValue: false outputs: - name: apphub_service_uri description: Service URI in CAIS style to be used by Apphub. @@ -323,13 +327,13 @@ spec: roles: - level: Project roles: - - roles/cloudkms.admin - - roles/resourcemanager.projectIamAdmin - - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer + - roles/cloudkms.admin + - roles/resourcemanager.projectIamAdmin + - roles/run.admin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/job-exec/metadata.yaml b/modules/job-exec/metadata.yaml index 4df1fe92a..ebe4468c1 100644 --- a/modules/job-exec/metadata.yaml +++ b/modules/job-exec/metadata.yaml @@ -317,13 +317,13 @@ spec: roles: - level: Project roles: - - roles/run.admin - - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin + - roles/run.admin + - roles/iam.serviceAccountAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run-core/README.md b/modules/secure-cloud-run-core/README.md index 7f0db1818..714ee9fae 100644 --- a/modules/secure-cloud-run-core/README.md +++ b/modules/secure-cloud-run-core/README.md @@ -65,6 +65,7 @@ module "cloud_run_core" { | requests | Resource requests to the container. | `map(string)` | `{}` | no | | service\_labels | A set of key/value label pairs to assign to the service. | `map(string)` | `{}` | no | | service\_name | The name of the Cloud Run service to create. | `string` | n/a | yes | +| ssl | Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | ssl\_certificates | A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer. | 
object({
    ssl_certificates_self_links       = list(string)
    generate_certificates_for_domains = list(string)
  })
| n/a | yes | | template\_labels | A set of key/value label pairs to assign to the container metadata. | `map(string)` | `{}` | no | | timeout\_seconds | Timeout for each request. | `number` | `120` | no | @@ -86,6 +87,7 @@ module "cloud_run_core" { | service\_id | Unique Identifier for the created service. | | service\_status | Status of the created service. | | service\_url | The URL on which the deployed service is available. | +| ssl\_policy\_id | The ID of the created Post-Quantum SSL Policy, if enabled. | diff --git a/modules/secure-cloud-run-core/loadbalancer.tf b/modules/secure-cloud-run-core/loadbalancer.tf index a7ba35449..548c952e2 100644 --- a/modules/secure-cloud-run-core/loadbalancer.tf +++ b/modules/secure-cloud-run-core/loadbalancer.tf @@ -25,6 +25,7 @@ module "lb-http" { name = var.lb_name project = var.project_id ssl = true + ssl_policy = var.ssl ? google_compute_ssl_policy.main[0].id : null managed_ssl_certificate_domains = var.ssl_certificates.generate_certificates_for_domains ssl_certificates = var.ssl_certificates.ssl_certificates_self_links https_redirect = false diff --git a/modules/secure-cloud-run-core/metadata.yaml b/modules/secure-cloud-run-core/metadata.yaml index c66d70525..4a50f1721 100644 --- a/modules/secure-cloud-run-core/metadata.yaml +++ b/modules/secure-cloud-run-core/metadata.yaml @@ -287,6 +287,10 @@ spec: generate_certificates_for_domains = list(string) }) required: true + - name: ssl + description: Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). + varType: bool + defaultValue: false outputs: - name: domain_map_id description: Unique Identifier for the created domain map. @@ -302,17 +306,19 @@ spec: description: Status of the created service. - name: service_url description: The URL on which the deployed service is available. + - name: ssl_policy_id + description: The ID of the created Post-Quantum SSL Policy, if enabled. requirements: roles: - level: Project roles: - - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin + - roles/run.admin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run-core/outputs.tf b/modules/secure-cloud-run-core/outputs.tf index cc459d773..7ad1e00c4 100644 --- a/modules/secure-cloud-run-core/outputs.tf +++ b/modules/secure-cloud-run-core/outputs.tf @@ -48,3 +48,8 @@ output "domain_map_status" { value = module.cloud_run.domain_map_status description = "Status of Domain mapping." } + +output "ssl_policy_id" { + value = try(google_compute_ssl_policy.main[0].id, null) + description = "The ID of the created Post-Quantum SSL Policy, if enabled." +} diff --git a/modules/secure-cloud-run-core/ssl.tf b/modules/secure-cloud-run-core/ssl.tf new file mode 100644 index 000000000..d3f4527ca --- /dev/null +++ b/modules/secure-cloud-run-core/ssl.tf @@ -0,0 +1,26 @@ +/** + * Copyright 2026 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + + + +resource "google_compute_ssl_policy" "main" { + count = var.ssl ? 1 : 0 + project = var.project_id + name = "$${var.lb_name}-pqc-policy" + profile = "RESTRICTED" + post_quantum_key_exchange = "ENABLED" + min_tls_version = "TLS_1_3" +} diff --git a/modules/secure-cloud-run-core/variables.tf b/modules/secure-cloud-run-core/variables.tf index d80fe4e5f..56f509640 100644 --- a/modules/secure-cloud-run-core/variables.tf +++ b/modules/secure-cloud-run-core/variables.tf @@ -328,3 +328,9 @@ variable "ssl_certificates" { } description = "A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer." } + +variable "ssl" { + description = "Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3)." + type = bool + default = false +} diff --git a/modules/secure-cloud-run/README.md b/modules/secure-cloud-run/README.md index 5158b49b7..e13ee9c69 100644 --- a/modules/secure-cloud-run/README.md +++ b/modules/secure-cloud-run/README.md @@ -109,6 +109,7 @@ module "secure_cloud_run" { | serverless\_project\_id | The project to deploy the cloud run service. | `string` | n/a | yes | | service\_name | Shared VPC name. | `string` | n/a | yes | | shared\_vpc\_name | Shared VPC name which is going to be re-used to create Serverless Connector. | `string` | n/a | yes | +| ssl | Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | ssl\_certificates | A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer. | 
object({
    ssl_certificates_self_links       = list(string)
    generate_certificates_for_domains = list(string)
  })
| n/a | yes | | subnet\_name | Subnet name to be re-used to create Serverless Connector. | `string` | `null` | no | | verified\_domain\_name | List of Custom Domain Name | `list(string)` | `[]` | no | diff --git a/modules/secure-cloud-run/metadata.yaml b/modules/secure-cloud-run/metadata.yaml index f648489eb..8c5e3f3f1 100644 --- a/modules/secure-cloud-run/metadata.yaml +++ b/modules/secure-cloud-run/metadata.yaml @@ -219,6 +219,10 @@ spec: generate_certificates_for_domains = list(string) }) required: true + - name: ssl + description: Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). + varType: bool + defaultValue: false outputs: - name: cloud_services_sa description: Service Account for Cloud Run Service. @@ -250,13 +254,13 @@ spec: roles: - level: Project roles: - - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin - roles/run.admin + - roles/iam.serviceAccountAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run/variables.tf b/modules/secure-cloud-run/variables.tf index 406fe31e2..2dc7ceeda 100644 --- a/modules/secure-cloud-run/variables.tf +++ b/modules/secure-cloud-run/variables.tf @@ -254,3 +254,9 @@ variable "ssl_certificates" { } description = "A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer." } + +variable "ssl" { + description = "Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3)." + type = bool + default = false +} diff --git a/modules/secure-serverless-harness/metadata.yaml b/modules/secure-serverless-harness/metadata.yaml index ed037f3ac..2d375a776 100644 --- a/modules/secure-serverless-harness/metadata.yaml +++ b/modules/secure-serverless-harness/metadata.yaml @@ -282,13 +282,13 @@ spec: roles: - level: Project roles: - - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin + - roles/resourcemanager.projectIamAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-serverless-net/metadata.yaml b/modules/secure-serverless-net/metadata.yaml index 1eda0bdde..829dba90c 100644 --- a/modules/secure-serverless-net/metadata.yaml +++ b/modules/secure-serverless-net/metadata.yaml @@ -120,13 +120,13 @@ spec: roles: - level: Project roles: + - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - - roles/artifactregistry.admin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/variables.tf b/variables.tf index d6f3f7582..c2a78364d 100644 --- a/variables.tf +++ b/variables.tf @@ -285,3 +285,9 @@ variable "members" { description = "Users/SAs to be given invoker access to the service" default = [] } + +variable "ssl" { + description = "Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3)." + type = bool + default = false +} From d88c3593c22332e93e0acb1fcf85911bab3e50d9 Mon Sep 17 00:00:00 2001 From: acustodio Date: Fri, 26 Jun 2026 13:50:59 -0300 Subject: [PATCH 2/3] fix: review fixes --- modules/job-exec/metadata.yaml | 6 +++--- modules/secure-cloud-run-core/README.md | 3 +-- modules/secure-cloud-run-core/loadbalancer.tf | 2 +- modules/secure-cloud-run-core/metadata.yaml | 6 ++---- modules/secure-cloud-run-core/outputs.tf | 5 ----- modules/secure-cloud-run-core/ssl.tf | 6 ++---- modules/secure-cloud-run-core/variables.tf | 4 ++-- modules/secure-cloud-run/README.md | 2 +- modules/secure-cloud-run/main.tf | 1 + modules/secure-cloud-run/metadata.yaml | 4 ++-- modules/secure-cloud-run/variables.tf | 4 ++-- 11 files changed, 17 insertions(+), 26 deletions(-) diff --git a/modules/job-exec/metadata.yaml b/modules/job-exec/metadata.yaml index ebe4468c1..0c5ff7a22 100644 --- a/modules/job-exec/metadata.yaml +++ b/modules/job-exec/metadata.yaml @@ -318,12 +318,12 @@ spec: - level: Project roles: - roles/artifactregistry.admin - - roles/iam.serviceAccountUser - - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin + - roles/iam.serviceAccountAdmin + - roles/iam.serviceAccountUser - roles/resourcemanager.projectIamAdmin - roles/run.admin - - roles/iam.serviceAccountAdmin + - roles/serviceusage.serviceUsageViewer services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run-core/README.md b/modules/secure-cloud-run-core/README.md index 714ee9fae..62ce23102 100644 --- a/modules/secure-cloud-run-core/README.md +++ b/modules/secure-cloud-run-core/README.md @@ -65,8 +65,8 @@ module "cloud_run_core" { | requests | Resource requests to the container. | `map(string)` | `{}` | no | | service\_labels | A set of key/value label pairs to assign to the service. | `map(string)` | `{}` | no | | service\_name | The name of the Cloud Run service to create. | `string` | n/a | yes | -| ssl | Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | ssl\_certificates | A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer. | 
object({
    ssl_certificates_self_links       = list(string)
    generate_certificates_for_domains = list(string)
  })
| n/a | yes | +| ssl\_policy | Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | template\_labels | A set of key/value label pairs to assign to the container metadata. | `map(string)` | `{}` | no | | timeout\_seconds | Timeout for each request. | `number` | `120` | no | | traffic\_split | Managing traffic routing to the service. | 
list(object({
    latest_revision = bool
    percent         = number
    revision_name   = string
    tag             = string
  }))
| 
[
  {
    "latest_revision": true,
    "percent": 100,
    "revision_name": "v1-0-0",
    "tag": null
  }
]
| no | @@ -87,7 +87,6 @@ module "cloud_run_core" { | service\_id | Unique Identifier for the created service. | | service\_status | Status of the created service. | | service\_url | The URL on which the deployed service is available. | -| ssl\_policy\_id | The ID of the created Post-Quantum SSL Policy, if enabled. | diff --git a/modules/secure-cloud-run-core/loadbalancer.tf b/modules/secure-cloud-run-core/loadbalancer.tf index 548c952e2..fae6c5d05 100644 --- a/modules/secure-cloud-run-core/loadbalancer.tf +++ b/modules/secure-cloud-run-core/loadbalancer.tf @@ -25,7 +25,7 @@ module "lb-http" { name = var.lb_name project = var.project_id ssl = true - ssl_policy = var.ssl ? google_compute_ssl_policy.main[0].id : null + ssl_policy = var.ssl_policy ? google_compute_ssl_policy.main[0].id : null managed_ssl_certificate_domains = var.ssl_certificates.generate_certificates_for_domains ssl_certificates = var.ssl_certificates.ssl_certificates_self_links https_redirect = false diff --git a/modules/secure-cloud-run-core/metadata.yaml b/modules/secure-cloud-run-core/metadata.yaml index 4a50f1721..cf04b771a 100644 --- a/modules/secure-cloud-run-core/metadata.yaml +++ b/modules/secure-cloud-run-core/metadata.yaml @@ -287,8 +287,8 @@ spec: generate_certificates_for_domains = list(string) }) required: true - - name: ssl - description: Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). + - name: ssl_policy + description: Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). varType: bool defaultValue: false outputs: @@ -306,8 +306,6 @@ spec: description: Status of the created service. - name: service_url description: The URL on which the deployed service is available. - - name: ssl_policy_id - description: The ID of the created Post-Quantum SSL Policy, if enabled. requirements: roles: - level: Project diff --git a/modules/secure-cloud-run-core/outputs.tf b/modules/secure-cloud-run-core/outputs.tf index 7ad1e00c4..cc459d773 100644 --- a/modules/secure-cloud-run-core/outputs.tf +++ b/modules/secure-cloud-run-core/outputs.tf @@ -48,8 +48,3 @@ output "domain_map_status" { value = module.cloud_run.domain_map_status description = "Status of Domain mapping." } - -output "ssl_policy_id" { - value = try(google_compute_ssl_policy.main[0].id, null) - description = "The ID of the created Post-Quantum SSL Policy, if enabled." -} diff --git a/modules/secure-cloud-run-core/ssl.tf b/modules/secure-cloud-run-core/ssl.tf index d3f4527ca..7a9da790a 100644 --- a/modules/secure-cloud-run-core/ssl.tf +++ b/modules/secure-cloud-run-core/ssl.tf @@ -14,12 +14,10 @@ * limitations under the License. */ - - resource "google_compute_ssl_policy" "main" { - count = var.ssl ? 1 : 0 + count = var.ssl_policy ? 1 : 0 project = var.project_id - name = "$${var.lb_name}-pqc-policy" + name = "${var.lb_name}-ssl-policy" profile = "RESTRICTED" post_quantum_key_exchange = "ENABLED" min_tls_version = "TLS_1_3" diff --git a/modules/secure-cloud-run-core/variables.tf b/modules/secure-cloud-run-core/variables.tf index 56f509640..75258c266 100644 --- a/modules/secure-cloud-run-core/variables.tf +++ b/modules/secure-cloud-run-core/variables.tf @@ -329,8 +329,8 @@ variable "ssl_certificates" { description = "A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer." } -variable "ssl" { - description = "Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3)." +variable "ssl_policy" { + description = "Enables the SSL Policy for the Load Balancer (Requires TLS 1.3)." type = bool default = false } diff --git a/modules/secure-cloud-run/README.md b/modules/secure-cloud-run/README.md index e13ee9c69..34da3ae82 100644 --- a/modules/secure-cloud-run/README.md +++ b/modules/secure-cloud-run/README.md @@ -109,8 +109,8 @@ module "secure_cloud_run" { | serverless\_project\_id | The project to deploy the cloud run service. | `string` | n/a | yes | | service\_name | Shared VPC name. | `string` | n/a | yes | | shared\_vpc\_name | Shared VPC name which is going to be re-used to create Serverless Connector. | `string` | n/a | yes | -| ssl | Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | ssl\_certificates | A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer. | 
object({
    ssl_certificates_self_links       = list(string)
    generate_certificates_for_domains = list(string)
  })
| n/a | yes | +| ssl\_policy | Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | subnet\_name | Subnet name to be re-used to create Serverless Connector. | `string` | `null` | no | | verified\_domain\_name | List of Custom Domain Name | `list(string)` | `[]` | no | | volumes | [Beta] Volumes needed for environment variables (when using secret). | 
list(object({
    name = string
    secret = set(object({
      secret_name = string
      items       = map(string)
    }))
  }))
| `[]` | no | diff --git a/modules/secure-cloud-run/main.tf b/modules/secure-cloud-run/main.tf index 9d3a75e3b..84a87347d 100644 --- a/modules/secure-cloud-run/main.tf +++ b/modules/secure-cloud-run/main.tf @@ -145,6 +145,7 @@ module "cloud_run_core" { max_scale_instances = var.max_scale_instances volumes = var.volumes ssl_certificates = var.ssl_certificates + ssl_policy = var.ssl_policy depends_on = [ module.serverless_project_apis, diff --git a/modules/secure-cloud-run/metadata.yaml b/modules/secure-cloud-run/metadata.yaml index 8c5e3f3f1..064bbf688 100644 --- a/modules/secure-cloud-run/metadata.yaml +++ b/modules/secure-cloud-run/metadata.yaml @@ -219,8 +219,8 @@ spec: generate_certificates_for_domains = list(string) }) required: true - - name: ssl - description: Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). + - name: ssl_policy + description: Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). varType: bool defaultValue: false outputs: diff --git a/modules/secure-cloud-run/variables.tf b/modules/secure-cloud-run/variables.tf index 2dc7ceeda..e91dfdfb5 100644 --- a/modules/secure-cloud-run/variables.tf +++ b/modules/secure-cloud-run/variables.tf @@ -255,8 +255,8 @@ variable "ssl_certificates" { description = "A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects//global/sslCertificates/` to be used by Load Balancer." } -variable "ssl" { - description = "Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3)." +variable "ssl_policy" { + description = "Enables the SSL Policy for the Load Balancer (Requires TLS 1.3)." type = bool default = false } From ab5f835205b7ffc5527c9da42f458e44e48620ef Mon Sep 17 00:00:00 2001 From: acustodio Date: Mon, 20 Jul 2026 11:09:13 -0300 Subject: [PATCH 3/3] linter: lint fixes --- README.md | 1 - metadata.yaml | 10 +++------- modules/job-exec/metadata.yaml | 8 ++++---- modules/secure-cloud-run-core/metadata.yaml | 6 +++--- modules/secure-cloud-run-security/metadata.yaml | 4 ++-- modules/secure-cloud-run/metadata.yaml | 2 +- modules/secure-serverless-harness/metadata.yaml | 4 ++-- modules/secure-serverless-net/metadata.yaml | 6 +++--- modules/v2/metadata.yaml | 6 +++--- variables.tf | 5 ----- 10 files changed, 21 insertions(+), 31 deletions(-) diff --git a/README.md b/README.md index 98649d807..1011851d4 100644 --- a/README.md +++ b/README.md @@ -74,7 +74,6 @@ module "cloud_run" { | service\_annotations | Annotations to the service. Acceptable values all, internal, internal-and-cloud-load-balancing | `map(string)` | 
{
  "run.googleapis.com/ingress": "all"
}
| no | | service\_labels | A set of key/value label pairs to assign to the service | `map(string)` | `{}` | no | | service\_name | The name of the Cloud Run service to create | `string` | n/a | yes | -| ssl | Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no | | startup\_probe | Startup probe of application within the container.
All other probes are disabled if a startup probe is provided, until it succeeds.
Container will not be added to service endpoints if the probe fails.
More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes | 
object({
    failure_threshold     = optional(number, null)
    initial_delay_seconds = optional(number, null)
    timeout_seconds       = optional(number, null)
    period_seconds        = optional(number, null)
    http_get = optional(object({
      path = optional(string)
      http_headers = optional(list(object({
        name  = string
        value = string
      })), null)
    }), null)
    tcp_socket = optional(object({
      port = optional(number)
    }), null)
    grpc = optional(object({
      port    = optional(number)
      service = optional(string)
    }), null)
  })
| `null` | no | | template\_annotations | Annotations to the container metadata including VPC Connector and SQL. See [more details](https://cloud.google.com/run/docs/reference/rpc/google.cloud.run.v1#revisiontemplate) | `map(string)` | 
{
  "autoscaling.knative.dev/maxScale": 2,
  "autoscaling.knative.dev/minScale": 1,
  "generated-by": "terraform",
  "run.googleapis.com/client-name": "terraform"
}
| no | | template\_labels | A set of key/value label pairs to assign to the container metadata | `map(string)` | `{}` | no | diff --git a/metadata.yaml b/metadata.yaml index a475d308c..f6fc2cbb9 100644 --- a/metadata.yaml +++ b/metadata.yaml @@ -276,10 +276,6 @@ spec: description: Users/SAs to be given invoker access to the service varType: list(string) defaultValue: [] - - name: ssl - description: Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3). - varType: bool - defaultValue: false outputs: - name: apphub_service_uri description: Service URI in CAIS style to be used by Apphub. @@ -327,13 +323,13 @@ spec: roles: - level: Project roles: - - roles/iam.serviceAccountAdmin - - roles/artifactregistry.admin - - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin - roles/run.admin + - roles/iam.serviceAccountAdmin + - roles/artifactregistry.admin + - roles/iam.serviceAccountUser services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/job-exec/metadata.yaml b/modules/job-exec/metadata.yaml index 0c5ff7a22..4df1fe92a 100644 --- a/modules/job-exec/metadata.yaml +++ b/modules/job-exec/metadata.yaml @@ -317,13 +317,13 @@ spec: roles: - level: Project roles: - - roles/artifactregistry.admin - - roles/cloudkms.admin + - roles/run.admin - roles/iam.serviceAccountAdmin + - roles/artifactregistry.admin - roles/iam.serviceAccountUser - - roles/resourcemanager.projectIamAdmin - - roles/run.admin - roles/serviceusage.serviceUsageViewer + - roles/cloudkms.admin + - roles/resourcemanager.projectIamAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run-core/metadata.yaml b/modules/secure-cloud-run-core/metadata.yaml index cf04b771a..c86cfe40f 100644 --- a/modules/secure-cloud-run-core/metadata.yaml +++ b/modules/secure-cloud-run-core/metadata.yaml @@ -310,13 +310,13 @@ spec: roles: - level: Project roles: - - roles/iam.serviceAccountAdmin - - roles/artifactregistry.admin - - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin - roles/run.admin + - roles/iam.serviceAccountAdmin + - roles/artifactregistry.admin + - roles/iam.serviceAccountUser services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run-security/metadata.yaml b/modules/secure-cloud-run-security/metadata.yaml index be40d0ec4..37d1fed1b 100644 --- a/modules/secure-cloud-run-security/metadata.yaml +++ b/modules/secure-cloud-run-security/metadata.yaml @@ -133,13 +133,13 @@ spec: roles: - level: Project roles: - - roles/cloudkms.admin - - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer + - roles/cloudkms.admin + - roles/resourcemanager.projectIamAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-cloud-run/metadata.yaml b/modules/secure-cloud-run/metadata.yaml index 064bbf688..86ced4441 100644 --- a/modules/secure-cloud-run/metadata.yaml +++ b/modules/secure-cloud-run/metadata.yaml @@ -254,13 +254,13 @@ spec: roles: - level: Project roles: + - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - roles/resourcemanager.projectIamAdmin - roles/run.admin - - roles/iam.serviceAccountAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-serverless-harness/metadata.yaml b/modules/secure-serverless-harness/metadata.yaml index 2d375a776..7345417f2 100644 --- a/modules/secure-serverless-harness/metadata.yaml +++ b/modules/secure-serverless-harness/metadata.yaml @@ -282,13 +282,13 @@ spec: roles: - level: Project roles: + - roles/cloudkms.admin + - roles/resourcemanager.projectIamAdmin - roles/run.admin - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - - roles/cloudkms.admin - - roles/resourcemanager.projectIamAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/secure-serverless-net/metadata.yaml b/modules/secure-serverless-net/metadata.yaml index 829dba90c..2c9f2a174 100644 --- a/modules/secure-serverless-net/metadata.yaml +++ b/modules/secure-serverless-net/metadata.yaml @@ -120,13 +120,13 @@ spec: roles: - level: Project roles: + - roles/resourcemanager.projectIamAdmin + - roles/run.admin + - roles/iam.serviceAccountAdmin - roles/artifactregistry.admin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/cloudkms.admin - - roles/resourcemanager.projectIamAdmin - - roles/run.admin - - roles/iam.serviceAccountAdmin services: - accesscontextmanager.googleapis.com - cloudbilling.googleapis.com diff --git a/modules/v2/metadata.yaml b/modules/v2/metadata.yaml index 408f64d7e..e0914118b 100644 --- a/modules/v2/metadata.yaml +++ b/modules/v2/metadata.yaml @@ -704,14 +704,14 @@ spec: roles: - level: Project roles: - - roles/compute.viewer - - roles/iap.admin - - roles/artifactregistry.reader - roles/run.admin - roles/iam.serviceAccountAdmin - roles/iam.serviceAccountUser - roles/serviceusage.serviceUsageViewer - roles/resourcemanager.projectIamAdmin + - roles/compute.viewer + - roles/iap.admin + - roles/artifactregistry.reader services: - cloudresourcemanager.googleapis.com - compute.googleapis.com diff --git a/variables.tf b/variables.tf index c2a78364d..3de9618ce 100644 --- a/variables.tf +++ b/variables.tf @@ -286,8 +286,3 @@ variable "members" { default = [] } -variable "ssl" { - description = "Enables the Post-Quantum Cryptography (PQC) SSL Policy for the Load Balancer (Requires TLS 1.3)." - type = bool - default = false -}