sync upstream (#3)

* chore(deps): update go and dev-tools (terraform-google-modules#139) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore: update examples to use registry (terraform-google-modules#142) * chore(deps): Update module github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test to v0.10.3 (terraform-google-modules#140) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore: update .github/workflows/lint.yaml * chore(deps): Update module github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test to v0.11.1 (terraform-google-modules#144) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore: update .github/workflows/stale.yml * chore: update .github/workflows/stale.yml * chore: update CODEOWNERS * chore: update .github/workflows/lint.yaml * chore(deps): Update go modules and/or dev-tools (terraform-google-modules#149) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): Update module github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test to v0.13.2 (terraform-google-modules#151) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): Update go modules and dev-tools (terraform-google-modules#153) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix: mark secret outputs sensitive for classic vpn Ref: terraform-google-modules#158 (terraform-google-modules#159) * chore(deps): Update go modules and dev-tools (terraform-google-modules#156) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): Update Terraform terraform-google-modules/project-factory/google to v15 (terraform-google-modules#157) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(master): release 4.0.1 (terraform-google-modules#161) Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> * chore(deps): Update go modules and dev-tools (terraform-google-modules#162) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * feat(deps): Update Terraform Google Provider to v6 (major) (terraform-google-modules#166) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(master): release 4.1.0 (terraform-google-modules#167) Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> * chore(deps): Update go modules and/or dev-tools (terraform-google-modules#163) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): Update Terraform terraform-google-modules/project-factory/google to v17 (terraform-google-modules#168) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * feat: Making IPSEC PSK length configurable (terraform-google-modules#171) * chore(master): release 4.2.0 (terraform-google-modules#172) Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> * chore: update .github/conventional-commit-lint.yaml * chore: update .github/workflows/stale.yml * chore: update .github/trusted-contribution.yml * chore: update .github/renovate.json * chore: update CODEOWNERS * chore: update .github/workflows/lint.yaml * chore: update .github/trusted-contribution.yml * chore: update .github/workflows/lint.yaml * chore: update .github/workflows/stale.yml * chore: update CODEOWNERS * chore: update .github/conventional-commit-lint.yaml --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Bharath KKB <[email protected]> Co-authored-by: CFT Bot <[email protected]> Co-authored-by: qbaze <[email protected]> Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com> Co-authored-by: Shivam Verma <[email protected]>
fairmoney · Jan 20, 2025 · 4853e46 · 4853e46
1 parent e4bfbe8
commit 4853e46
Show file tree

Hide file tree

Showing 30 changed files with 200 additions and 102 deletions.
diff --git a/.github/conventional-commit-lint.yaml b/.github/conventional-commit-lint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2022-2023 Google LLC
+# Copyright 2022-2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # NOTE: This file is automatically generated from:
-# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/master/infra/terraform/test-org/github
+# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/main/infra/terraform/test-org/github
 
 enabled: true
 always_check_pr_title: true
diff --git a/.github/trusted-contribution.yml b/.github/trusted-contribution.yml
@@ -1,4 +1,4 @@
-# Copyright 2023 Google LLC
+# Copyright 2023-2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # NOTE: This file is automatically generated from:
-# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/master/infra/terraform/test-org/github
+# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/main/infra/terraform/test-org/github
 
 annotations:
   - type: comment

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -1,4 +1,4 @@
-# Copyright 2023 Google LLC
+# Copyright 2023-2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,14 +13,15 @@
 # limitations under the License.
 
 # NOTE: This file is automatically generated from values at:
-# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/master/infra/terraform/test-org/org/locals.tf
+# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/main/infra/terraform/test-org/org/locals.tf
 
 name: 'lint'
 
 on:
+  workflow_dispatch:
   pull_request:
     branches:
-      - master
+      - main
 
 concurrency:
   group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
@@ -43,4 +44,5 @@ jobs:
             REGISTRY=$(grep "REGISTRY_URL := " $MAKEFILE | cut -d\  -f3)
             echo dev-tools=${REGISTRY}/${IMAGE}:${VERSION} >> "$GITHUB_OUTPUT"
           fi
+      - run: docker run --rm -v ${{ github.workspace }}:/workspace ${{ steps.variables.outputs.dev-tools }} module-swapper
       - run: docker run --rm -v ${{ github.workspace }}:/workspace ${{ steps.variables.outputs.dev-tools }} /usr/local/bin/test_lint.sh
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -1,4 +1,4 @@
-# Copyright 2022-2023 Google LLC
+# Copyright 2022-2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # NOTE: This file is automatically generated from:
-# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/master/infra/terraform/test-org/github
+# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/main/infra/terraform/test-org/github
 
 name: "Close stale issues"
 on:
@@ -25,9 +25,10 @@ jobs:
     if: github.repository_owner == 'GoogleCloudPlatform' || github.repository_owner == 'terraform-google-modules'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/stale@v8
+    - uses: actions/stale@v9
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days'
         stale-pr-message: 'This PR is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days'
-        exempt-issue-labels: triaged,dependencies
+        exempt-issue-labels: 'triaged'
+        exempt-pr-labels: 'dependencies,autorelease: pending'
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,27 @@
 All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.2.0](https://github.com/terraform-google-modules/terraform-google-vpn/compare/v4.1.0...v4.2.0) (2024-11-12)
+
+
+### Features
+
+* Making IPSEC PSK length configurable ([#171](https://github.com/terraform-google-modules/terraform-google-vpn/issues/171)) ([0621d9c](https://github.com/terraform-google-modules/terraform-google-vpn/commit/0621d9c87bfd53680bebaa4d9863a735c2f99e26))
+
+## [4.1.0](https://github.com/terraform-google-modules/terraform-google-vpn/compare/v4.0.1...v4.1.0) (2024-09-11)
+
+
+### Features
+
+* **deps:** Update Terraform Google Provider to v6 (major) ([#166](https://github.com/terraform-google-modules/terraform-google-vpn/issues/166)) ([badb0d5](https://github.com/terraform-google-modules/terraform-google-vpn/commit/badb0d593a6d982806a3107581e309fc4a2936dc))
+
+## [4.0.1](https://github.com/terraform-google-modules/terraform-google-vpn/compare/v4.0.0...v4.0.1) (2024-07-25)
+
+
+### Bug Fixes
+
+* mark secret outputs sensitive for classic vpn Ref: [#158](https://github.com/terraform-google-modules/terraform-google-vpn/issues/158) ([#159](https://github.com/terraform-google-modules/terraform-google-vpn/issues/159)) ([c3c7812](https://github.com/terraform-google-modules/terraform-google-vpn/commit/c3c78122c572017e34231c813d56eb45534ddfd3))
+
 ## [4.0.0](https://github.com/terraform-google-modules/terraform-google-vpn/compare/v3.1.1...v4.0.0) (2023-11-21)
 
 

diff --git a/CODEOWNERS b/CODEOWNERS
@@ -1,4 +1,12 @@
 # NOTE: This file is automatically generated from values at:
-# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/master/infra/terraform/test-org/org/locals.tf
+# https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/main/infra/terraform/test-org/org/locals.tf
 
 * @terraform-google-modules/cft-admins @imrannayer
+
+# NOTE: GitHub CODEOWNERS locations:
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-and-branch-protection
+
+CODEOWNERS @terraform-google-modules/cft-admins
+.github/CODEOWNERS @terraform-google-modules/cft-admins
+docs/CODEOWNERS @terraform-google-modules/cft-admins
+
diff --git a/Makefile b/Makefile
@@ -18,7 +18,7 @@
 # Make will use bash instead of sh
 SHELL := /usr/bin/env bash
 
-DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.17
+DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.22
 DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
 REGISTRY_URL := gcr.io/cloud-foundation-cicd
 

diff --git a/README.md b/README.md
@@ -97,6 +97,7 @@ References the variable descriptions below to determine the right configuration.
 | cr\_name | The name of cloud router for BGP routing | `string` | `""` | no |
 | gateway\_name | The name of VPN gateway | `string` | `"test-vpn"` | no |
 | ike\_version | Please enter the IKE version used by this tunnel (default is IKEv2) | `number` | `2` | no |
+| ipsec\_secret\_length | The lnegth the of shared secret for VPN tunnels | `number` | `8` | no |
 | local\_traffic\_selector | Local traffic selector to use when establishing the VPN tunnel with peer VPN gateway.<br>Value should be list of CIDR formatted strings and ranges should be disjoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
 | network | The name of VPC being created | `string` | n/a | yes |
 | peer\_asn | Please enter the ASN of the BGP peer that cloud router will use | `list(string)` | <pre>[<br>  "65101"<br>]</pre> | no |

diff --git a/build/int.cloudbuild.yaml b/build/int.cloudbuild.yaml
@@ -14,6 +14,9 @@
 
 timeout: 3600s
 steps:
+- id: swap-module-refs
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['module-swapper']
 - id: prepare
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && prepare_environment']
@@ -64,4 +67,4 @@ tags:
 - 'integration'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.17'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.22'
diff --git a/build/lint.cloudbuild.yaml b/build/lint.cloudbuild.yaml
@@ -21,4 +21,4 @@ tags:
 - 'lint'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.17'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.22'
diff --git a/examples/multi_external_vpn_gateways/prod.tf b/examples/multi_external_vpn_gateways/prod.tf
@@ -46,7 +46,9 @@ resource "google_compute_external_vpn_gateway" "external_gateway2" {
 # VPN by this below tunnels configuration.
 
 module "vpn-ha-to-onprem" {
-  source     = "../../modules/vpn_ha"
+  source  = "terraform-google-modules/vpn/google//modules/vpn_ha"
+  version = "~> 4.0"
+
   project_id = var.prod_project_id
   region     = var.region
   network    = var.prod_network_self_link

diff --git a/examples/multi_tunnels/mgmt.tf b/examples/multi_tunnels/mgmt.tf
@@ -38,7 +38,9 @@ resource "google_compute_router" "cr-uscentral1-to-prod-vpc-02" {
 }
 
 module "vpn-gw-us-ce1-mgt-prd-internal-01" {
-  source             = "../../"
+  source  = "terraform-google-modules/vpn/google"
+  version = "~> 4.0"
+
   project_id         = var.mgt_project_id
   network            = var.mgt_network
   region             = "us-central1"
@@ -56,7 +58,9 @@ module "vpn-gw-us-ce1-mgt-prd-internal-01" {
 }
 
 module "vpn-gw-us-ce1-mgt-prd-internal-02" {
-  source             = "../../"
+  source  = "terraform-google-modules/vpn/google"
+  version = "~> 4.0"
+
   project_id         = var.mgt_project_id
   network            = var.mgt_network
   region             = "us-central1"
@@ -74,7 +78,9 @@ module "vpn-gw-us-ce1-mgt-prd-internal-02" {
 }
 
 module "vpn-gw-us-we1-mgt-prd-internal" {
-  source             = "../../"
+  source  = "terraform-google-modules/vpn/google"
+  version = "~> 4.0"
+
   project_id         = var.mgt_project_id
   network            = var.mgt_network
   region             = "us-west1"

diff --git a/examples/multi_tunnels/prod.tf b/examples/multi_tunnels/prod.tf
@@ -38,7 +38,9 @@ resource "google_compute_router" "cr-uscentral1-to-mgt-vpc-02" {
 }
 
 module "vpn-gw-us-ce1-prd-mgt-internal-01" {
-  source             = "../../"
+  source  = "terraform-google-modules/vpn/google"
+  version = "~> 4.0"
+
   project_id         = var.prod_project_id
   network            = var.prod_network
   region             = "us-central1"
@@ -56,7 +58,9 @@ module "vpn-gw-us-ce1-prd-mgt-internal-01" {
 }
 
 module "vpn-gw-us-ce1-prd-mgt-internal-02" {
-  source             = "../../"
+  source  = "terraform-google-modules/vpn/google"
+  version = "~> 4.0"
+
   project_id         = var.prod_project_id
   network            = var.prod_network
   region             = "us-central1"
@@ -74,7 +78,9 @@ module "vpn-gw-us-ce1-prd-mgt-internal-02" {
 }
 
 module "vpn-gw-us-we1-prd-mgt-internal" {
-  source             = "../../"
+  source  = "terraform-google-modules/vpn/google"
+  version = "~> 4.0"
+
   project_id         = var.prod_project_id
   network            = var.prod_network
   region             = "us-west1"

diff --git a/examples/single_tunnels/mgmt.tf b/examples/single_tunnels/mgmt.tf
@@ -15,7 +15,9 @@
  */
 
 module "vpn-gw-us-we1-mgt-prd-internal" {
-  source             = "../../"
+  source  = "terraform-google-modules/vpn/google"
+  version = "~> 4.0"
+
   project_id         = var.mgt_project_id
   network            = var.mgt_network
   region             = "us-west1"

diff --git a/examples/single_tunnels/prod.tf b/examples/single_tunnels/prod.tf
@@ -15,7 +15,9 @@
  */
 
 module "vpn-gw-us-we1-prd-mgt-internal" {
-  source             = "../../"
+  source  = "terraform-google-modules/vpn/google"
+  version = "~> 4.0"
+
   project_id         = var.prod_project_id
   network            = var.prod_network
   region             = "us-west1"

diff --git a/examples/vpn_ha/mgmt.tf b/examples/vpn_ha/mgmt.tf
@@ -16,7 +16,9 @@
 
 ##To Prod VPC
 module "vpn-ha-to-prod" {
-  source           = "../../modules/vpn_ha"
+  source  = "terraform-google-modules/vpn/google//modules/vpn_ha"
+  version = "~> 4.0"
+
   project_id       = var.mgt_project_id
   region           = var.region
   network          = var.mgt_network_self_link

diff --git a/examples/vpn_ha/prod.tf b/examples/vpn_ha/prod.tf
@@ -16,7 +16,9 @@
 
 ##To MGMT VPC
 module "vpn-ha-to-mgmt" {
-  source           = "../../modules/vpn_ha"
+  source  = "terraform-google-modules/vpn/google//modules/vpn_ha"
+  version = "~> 4.0"
+
   project_id       = var.prod_project_id
   region           = var.region
   network          = var.prod_network_self_link

diff --git a/metadata.yaml b/metadata.yaml
@@ -23,7 +23,7 @@ spec:
   source:
     repo: https://github.com/terraform-google-modules/terraform-google-vpn
     sourceType: git
-  version: 4.0.0
+  version: 4.2.0
   actuationTool:
     type: Terraform
     version: '>=0.13.0'

diff --git a/modules/vpn_ha/README.md b/modules/vpn_ha/README.md
@@ -268,6 +268,7 @@ module "vpn_ha" {
 |------|-------------|------|---------|:--------:|
 | create\_vpn\_gateway | create a VPN gateway | `bool` | `true` | no |
 | external\_vpn\_gateway\_description | An optional description of external VPN Gateway | `string` | `"Terraform managed external VPN gateway"` | no |
+| ipsec\_secret\_length | The lnegth the of shared secret for VPN tunnels | `number` | `8` | no |
 | keepalive\_interval | The interval in seconds between BGP keepalive messages that are sent to the peer. | `number` | `20` | no |
 | labels | Labels for vpn components | `map(string)` | `{}` | no |
 | name | VPN gateway name, and prefix used for dependent resources. | `string` | n/a | yes |

diff --git a/modules/vpn_ha/main.tf b/modules/vpn_ha/main.tf
@@ -167,5 +167,5 @@ resource "google_compute_vpn_tunnel" "tunnels" {
 }
 
 resource "random_id" "secret" {
-  byte_length = 8
+  byte_length = var.ipsec_secret_length
 }
diff --git a/modules/vpn_ha/metadata.yaml b/modules/vpn_ha/metadata.yaml
@@ -23,7 +23,7 @@ spec:
   source:
     repo: https://github.com/terraform-google-modules/terraform-google-vpn
     sourceType: git
-  version: 4.0.0
+  version: 4.2.0
   actuationTool:
     type: Terraform
     version: '>=0.13.0'

diff --git a/modules/vpn_ha/variables.tf b/modules/vpn_ha/variables.tf
@@ -141,3 +141,9 @@ variable "external_vpn_gateway_description" {
   type        = string
   default     = "Terraform managed external VPN gateway"
 }
+
+variable "ipsec_secret_length" {
+  type        = number
+  description = "The lnegth the of shared secret for VPN tunnels"
+  default     = 8
+}
diff --git a/modules/vpn_ha/versions.tf b/modules/vpn_ha/versions.tf
@@ -19,11 +19,11 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 5.7, < 6"
+      version = ">= 5.7, < 7"
     }
     google-beta = {
       source  = "hashicorp/google-beta"
-      version = ">= 5.7, < 6"
+      version = ">= 5.7, < 7"
     }
     random = {
       source  = "hashicorp/random"
@@ -32,9 +32,9 @@ terraform {
   }
 
   provider_meta "google" {
-    module_name = "blueprints/terraform/terraform-google-vpn/v4.0.0"
+    module_name = "blueprints/terraform/terraform-google-vpn/v4.2.0"
   }
   provider_meta "google-beta" {
-    module_name = "blueprints/terraform/terraform-google-vpn/v4.0.0"
+    module_name = "blueprints/terraform/terraform-google-vpn/v4.2.0"
   }
 }
diff --git a/outputs.tf b/outputs.tf
@@ -52,6 +52,7 @@ output "vpn_tunnels_self_link-static" {
 output "ipsec_secret-static" {
   description = "The secret"
   value       = google_compute_vpn_tunnel.tunnel-static[*].shared_secret
+  sensitive   = true
 }
 
 output "vpn_tunnels_names-dynamic" {
@@ -67,4 +68,5 @@ output "vpn_tunnels_self_link-dynamic" {
 output "ipsec_secret-dynamic" {
   description = "The secret"
   value       = google_compute_vpn_tunnel.tunnel-dynamic[*].shared_secret
+  sensitive   = true
 }