feat: enable Post-Quantum Cryptography (PQC) SSL Policy for Load Balancer

Makefile

@@ -29,7 +29,7 @@ docker_test_lint:
 		-e ENABLE_BPMETADATA \
 		-e ENABLE_PARALLEL=1 \
         -e DISABLE_TFLINT=1 \
-		-v $(CURDIR):/workspace \
+		-v "$(CURDIR)":/workspace \
 		$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
 		/usr/local/bin/test_lint.sh
 
@@ -38,7 +38,7 @@ docker_test_lint:
 docker_generate_docs:
 	docker run --rm -it \
 		-e ENABLE_BPMETADATA=1 \
-		-v $(CURDIR):/workspace \
+		-v "$(CURDIR)":/workspace \
 		$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
 		/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs --per-module-requirements'
 

metadata.yaml

@@ -323,13 +323,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/serviceusage.serviceUsageViewer
           - roles/cloudkms.admin
           - roles/resourcemanager.projectIamAdmin
           - roles/run.admin
           - roles/iam.serviceAccountAdmin
           - roles/artifactregistry.admin
           - roles/iam.serviceAccountUser
-          - roles/serviceusage.serviceUsageViewer
     services:
       - accesscontextmanager.googleapis.com
       - cloudbilling.googleapis.com

modules/secure-cloud-run-core/README.md

@@ -66,6 +66,7 @@ module "cloud_run_core" {
 | service\_labels | A set of key/value label pairs to assign to the service. | `map(string)` | `{}` | no |
 | service\_name | The name of the Cloud Run service to create. | `string` | n/a | yes |
 | ssl\_certificates | A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects/<PROJECT-ID>/global/sslCertificates/<CERT-NAME>` to be used by Load Balancer. | <pre>object({<br>    ssl_certificates_self_links       = list(string)<br>    generate_certificates_for_domains = list(string)<br>  })</pre> | n/a | yes |
+| ssl\_policy | Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no |
 | template\_labels | A set of key/value label pairs to assign to the container metadata. | `map(string)` | `{}` | no |
 | timeout\_seconds | Timeout for each request. | `number` | `120` | no |
 | traffic\_split | Managing traffic routing to the service. | <pre>list(object({<br>    latest_revision = bool<br>    percent         = number<br>    revision_name   = string<br>    tag             = string<br>  }))</pre> | <pre>[<br>  {<br>    "latest_revision": true,<br>    "percent": 100,<br>    "revision_name": "v1-0-0",<br>    "tag": null<br>  }<br>]</pre> | no |

modules/secure-cloud-run-core/loadbalancer.tf

@@ -25,6 +25,7 @@ module "lb-http" {
   name                            = var.lb_name
   project                         = var.project_id
   ssl                             = true
+  ssl_policy                      = var.ssl_policy ? google_compute_ssl_policy.main[0].id : null
   managed_ssl_certificate_domains = var.ssl_certificates.generate_certificates_for_domains
   ssl_certificates                = var.ssl_certificates.ssl_certificates_self_links
   https_redirect                  = false

modules/secure-cloud-run-core/metadata.yaml

@@ -287,6 +287,10 @@ spec:
               generate_certificates_for_domains = list(string)
             })
         required: true
+      - name: ssl_policy
+        description: Enables the SSL Policy for the Load Balancer (Requires TLS 1.3).
+        varType: bool
+        defaultValue: false
     outputs:
       - name: domain_map_id
         description: Unique Identifier for the created domain map.
@@ -306,13 +310,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/serviceusage.serviceUsageViewer
+          - roles/cloudkms.admin
+          - roles/resourcemanager.projectIamAdmin
           - roles/run.admin
           - roles/iam.serviceAccountAdmin
           - roles/artifactregistry.admin
           - roles/iam.serviceAccountUser
-          - roles/serviceusage.serviceUsageViewer
-          - roles/cloudkms.admin
-          - roles/resourcemanager.projectIamAdmin
     services:
       - accesscontextmanager.googleapis.com
       - cloudbilling.googleapis.com

modules/secure-cloud-run-core/ssl.tf

@@ -0,0 +1,24 @@
+/**
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+resource "google_compute_ssl_policy" "main" {
+  count                     = var.ssl_policy ? 1 : 0
+  project                   = var.project_id
+  name                      = "${var.lb_name}-ssl-policy"
+  profile                   = "RESTRICTED"
+  post_quantum_key_exchange = "ENABLED"
+  min_tls_version           = "TLS_1_3"
+}

modules/secure-cloud-run-core/variables.tf

@@ -328,3 +328,9 @@ variable "ssl_certificates" {
   }
   description = "A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects/<PROJECT-ID>/global/sslCertificates/<CERT-NAME>` to be used by Load Balancer."
 }
+
+variable "ssl_policy" {
+  description = "Enables the SSL Policy for the Load Balancer (Requires TLS 1.3)."
+  type        = bool
+  default     = false
+}

modules/secure-cloud-run-security/metadata.yaml

@@ -133,13 +133,13 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/cloudkms.admin
-          - roles/resourcemanager.projectIamAdmin
           - roles/run.admin
           - roles/iam.serviceAccountAdmin
           - roles/artifactregistry.admin
           - roles/iam.serviceAccountUser
           - roles/serviceusage.serviceUsageViewer
+          - roles/cloudkms.admin
+          - roles/resourcemanager.projectIamAdmin
     services:
       - accesscontextmanager.googleapis.com
       - cloudbilling.googleapis.com

modules/secure-cloud-run/README.md

@@ -110,6 +110,7 @@ module "secure_cloud_run" {
 | service\_name | Shared VPC name. | `string` | n/a | yes |
 | shared\_vpc\_name | Shared VPC name which is going to be re-used to create Serverless Connector. | `string` | n/a | yes |
 | ssl\_certificates | A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects/<PROJECT-ID>/global/sslCertificates/<CERT-NAME>` to be used by Load Balancer. | <pre>object({<br>    ssl_certificates_self_links       = list(string)<br>    generate_certificates_for_domains = list(string)<br>  })</pre> | n/a | yes |
+| ssl\_policy | Enables the SSL Policy for the Load Balancer (Requires TLS 1.3). | `bool` | `false` | no |
 | subnet\_name | Subnet name to be re-used to create Serverless Connector. | `string` | `null` | no |
 | verified\_domain\_name | List of Custom Domain Name | `list(string)` | `[]` | no |
 | volumes | [Beta] Volumes needed for environment variables (when using secret). | <pre>list(object({<br>    name = string<br>    secret = set(object({<br>      secret_name = string<br>      items       = map(string)<br>    }))<br>  }))</pre> | `[]` | no |

modules/secure-cloud-run/main.tf

@@ -145,6 +145,7 @@ module "cloud_run_core" {
   max_scale_instances         = var.max_scale_instances
   volumes                     = var.volumes
   ssl_certificates            = var.ssl_certificates
+  ssl_policy                  = var.ssl_policy
 
   depends_on = [
     module.serverless_project_apis,

modules/secure-cloud-run/metadata.yaml

@@ -219,6 +219,10 @@ spec:
               generate_certificates_for_domains = list(string)
             })
         required: true
+      - name: ssl_policy
+        description: Enables the SSL Policy for the Load Balancer (Requires TLS 1.3).
+        varType: bool
+        defaultValue: false
     outputs:
       - name: cloud_services_sa
         description: Service Account for Cloud Run Service.

modules/secure-cloud-run/variables.tf

@@ -254,3 +254,9 @@ variable "ssl_certificates" {
   }
   description = "A object with a list of domains to auto-generate SSL certificates or a list of SSL Certificates self-links in the pattern `projects/<PROJECT-ID>/global/sslCertificates/<CERT-NAME>` to be used by Load Balancer."
 }
+
+variable "ssl_policy" {
+  description = "Enables the SSL Policy for the Load Balancer (Requires TLS 1.3)."
+  type        = bool
+  default     = false
+}

modules/secure-serverless-harness/metadata.yaml

@@ -282,13 +282,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/cloudkms.admin
           - roles/resourcemanager.projectIamAdmin
           - roles/run.admin
           - roles/iam.serviceAccountAdmin
           - roles/artifactregistry.admin
           - roles/iam.serviceAccountUser
           - roles/serviceusage.serviceUsageViewer
-          - roles/cloudkms.admin
     services:
       - accesscontextmanager.googleapis.com
       - cloudbilling.googleapis.com

modules/secure-serverless-net/metadata.yaml

@@ -120,13 +120,13 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/iam.serviceAccountUser
-          - roles/serviceusage.serviceUsageViewer
-          - roles/cloudkms.admin
           - roles/resourcemanager.projectIamAdmin
           - roles/run.admin
           - roles/iam.serviceAccountAdmin
           - roles/artifactregistry.admin
+          - roles/iam.serviceAccountUser
+          - roles/serviceusage.serviceUsageViewer
+          - roles/cloudkms.admin
     services:
       - accesscontextmanager.googleapis.com
       - cloudbilling.googleapis.com

modules/v2/metadata.yaml

@@ -704,14 +704,14 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/compute.viewer
-          - roles/iap.admin
-          - roles/artifactregistry.reader
           - roles/run.admin
           - roles/iam.serviceAccountAdmin
           - roles/iam.serviceAccountUser
           - roles/serviceusage.serviceUsageViewer
           - roles/resourcemanager.projectIamAdmin
+          - roles/compute.viewer
+          - roles/iap.admin
+          - roles/artifactregistry.reader
     services:
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com

variables.tf

@@ -285,3 +285,4 @@ variable "members" {
   description = "Users/SAs to be given invoker access to the service"
   default     = []
 }
+