Add support for external LBs for fulcio and TSA

Add a sigstore_global module that deploys common resources to support
external load balancers for Fulcio and TSA. If deployed in a
single region, individual modules call their respective "global" modules
to deploy universal resources like Cloud Armor policies or IP addresses.
If deployed in multi-region, the individual modules defer to the
sigstore_global module to deploy these resources and additional load
balancer resources so they are only managed once. The modules have the
option of not managing the DNS record to enable a smooth transition from
having the individual module manage it to managing it with the global
module.

We use DNS Authorization using CNAME records instead of raw Certificate
Manager certificates because the DNS record might, during the transition
period, be managed by another module, and the IP address may not resolve
to the new global IP address. Using DNS Authorization means we can still
provision all the SSL resources even before the DNS A record is fully
transitioned to the new global IP address.

Also move project_roles to the global module, since IAM bindings are
also global resources and can't be duplicated. Calling modules can just
set their IAM bindings in sigstore_global instead of sigstore.

Signed-off-by: Colleen Murphy <colleenmurphy@google.com>

Author: cmurphy

gcp/modules/fulcio/global/network.tf

@@ -0,0 +1,358 @@
+/**
+ * Copyright 2026 The Sigstore Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+########################### PER-SERVICE ############################
+# One per service globally, whether single region or multi-region. #
+####################################################################
+
+locals {
+  hostname = trimsuffix("fulcio.${var.dns_domain_name}", ".")
+}
+
+resource "google_dns_record_set" "A_fulcio" {
+  count = var.manage_dns_a_record ? 1 : 0
+
+  name = "fulcio.${var.dns_domain_name}"
+  type = "A"
+  ttl  = 60
+
+  project = var.project_id
+
+  managed_zone = var.dns_zone_name
+  rrdatas      = [google_compute_global_address.gce_lb_ipv4.address]
+}
+
+resource "google_certificate_manager_dns_authorization" "fulcio_auth" {
+  count = var.single_region ? 0 : 1
+
+  name   = "fulcio-dns-auth"
+  domain = local.hostname
+}
+
+resource "google_dns_record_set" "CNAME_auth_fulcio" {
+  count = var.single_region ? 0 : 1
+
+  project = var.project_id
+
+  name = google_certificate_manager_dns_authorization.fulcio_auth[count.index].dns_resource_record[0].name
+  type = google_certificate_manager_dns_authorization.fulcio_auth[count.index].dns_resource_record[0].type
+  ttl  = 60
+
+  managed_zone = var.dns_zone_name
+  rrdatas      = [google_certificate_manager_dns_authorization.fulcio_auth[count.index].dns_resource_record[0].data]
+}
+
+resource "google_compute_global_address" "gce_lb_ipv4" {
+  name         = var.lb_address_name == "" ? format("fulcio-%s-gce-ext-lb", var.cluster_name) : var.lb_address_name
+  address_type = "EXTERNAL"
+  project      = var.project_id
+}
+
+resource "google_compute_security_policy" "http_security_policy" {
+  count = var.enable_cloud_armor ? 1 : 0
+
+  name    = var.cloud_armor_policy_name
+  project = var.project_id
+  type    = "CLOUD_ARMOR"
+
+  dynamic "rule" {
+    for_each = var.cloud_armor_rules
+    content {
+      action   = rule.value.action
+      priority = rule.value.priority
+      match {
+        versioned_expr = rule.value.match.versioned_expr
+        dynamic "config" {
+          for_each = rule.value.match.config != null ? [rule.value.match.config] : []
+          content {
+            src_ip_ranges = config.value.src_ip_ranges
+          }
+        }
+        dynamic "expr" {
+          for_each = rule.value.match.expr != null ? [rule.value.match.expr] : []
+          content {
+            expression = expr.value.expression
+          }
+        }
+      }
+
+      dynamic "rate_limit_options" {
+        for_each = rule.value.rate_limit_options != null ? [rule.value.rate_limit_options] : []
+        content {
+          enforce_on_key = rate_limit_options.value.enforce_on_key
+          conform_action = rate_limit_options.value.conform_action
+          exceed_action  = rate_limit_options.value.exceed_action
+          rate_limit_threshold {
+            count        = rate_limit_options.value.qpm_rate_limit
+            interval_sec = rate_limit_options.value.interval_sec
+          }
+        }
+      }
+
+      dynamic "redirect_options" {
+        for_each = rule.value.redirect_options != null ? [rule.value.redirect_options] : []
+        content {
+          type   = redirect_options.value.type
+          target = redirect_options.value.target
+        }
+      }
+
+      description = rule.value.description
+    }
+
+  }
+
+  rule {
+    action   = "allow"
+    priority = "2147483647"
+    match {
+      versioned_expr = "SRC_IPS_V1"
+      config {
+        src_ip_ranges = ["*"]
+      }
+    }
+    description = "default rule"
+  }
+
+  advanced_options_config {
+    json_parsing = "STANDARD"
+  }
+
+  adaptive_protection_config {
+    layer_7_ddos_defense_config {
+      enable = var.enable_adaptive_protection
+    }
+  }
+}
+
+resource "google_compute_ssl_policy" "ssl_policy" {
+  count = var.enable_ssl_policy ? 1 : 0
+
+  name    = var.ssl_policy_name
+  project = var.project_id
+
+  profile         = "MODERN"
+  min_tls_version = "TLS_1_2"
+}
+
+####################### PER-SERVICE MULTIREGION ########################
+# One per service globally, only if using a multi-region configuration #
+# rather than K8s-Ingress-driven load balancing.                       #
+########################################################################
+
+resource "google_compute_health_check" "http_health_check" {
+  count = var.single_region ? 0 : 1
+
+  name    = "fulcio-http-health-check"
+  project = var.project_id
+
+  timeout_sec         = 5
+  check_interval_sec  = 5
+  healthy_threshold   = 2
+  unhealthy_threshold = 2
+
+  http_health_check {
+    request_path       = "/healthz"
+    port_specification = "USE_SERVING_PORT"
+  }
+
+  log_config {
+    enable = var.enable_healthcheck_logging
+  }
+}
+
+resource "google_compute_health_check" "grpc_health_check" {
+  count = var.single_region ? 0 : 1
+
+  name    = "fulcio-grpc-health-check"
+  project = var.project_id
+
+  timeout_sec         = 5
+  check_interval_sec  = 5
+  healthy_threshold   = 2
+  unhealthy_threshold = 2
+
+  tcp_health_check {
+    port_specification = "USE_SERVING_PORT"
+  }
+
+  log_config {
+    enable = var.enable_healthcheck_logging
+  }
+}
+
+data "google_compute_network_endpoint_group" "k8s_http_neg" {
+  for_each = toset(var.network_endpoint_group_zones)
+
+  name    = var.network_endpoint_group_name
+  project = var.project_id
+  zone    = each.key
+}
+
+data "google_compute_network_endpoint_group" "k8s_grpc_neg" {
+  for_each = toset(var.network_endpoint_group_zones)
+
+  name    = var.network_endpoint_group_name_grpc
+  project = var.project_id
+  zone    = each.key
+}
+
+resource "google_compute_backend_service" "http_backend_service" {
+  count = var.single_region ? 0 : 1
+
+  name    = "fulcio-http-backend"
+  project = var.project_id
+
+  load_balancing_scheme = "EXTERNAL_MANAGED"
+  port_name             = "http"
+  protocol              = "HTTP"
+
+  connection_draining_timeout_sec = 15
+  health_checks                   = [google_compute_health_check.http_health_check[count.index].id]
+
+  dynamic "backend" {
+    for_each = data.google_compute_network_endpoint_group.k8s_http_neg
+    iterator = neg
+    content {
+      group                 = neg.value.id
+      balancing_mode        = "RATE"
+      max_rate_per_endpoint = var.backend_service_max_rps
+    }
+  }
+
+  depends_on      = [google_compute_security_policy.http_security_policy]
+  security_policy = length(google_compute_security_policy.http_security_policy) > 0 ? google_compute_security_policy.http_security_policy[0].self_link : ""
+
+  log_config {
+    enable = var.enable_backend_service_logging
+  }
+}
+
+resource "google_compute_backend_service" "grpc_backend_service" {
+  count = var.single_region ? 0 : 1
+
+  name    = "fulcio-grpc-backend"
+  project = var.project_id
+
+  load_balancing_scheme = "EXTERNAL_MANAGED"
+  port_name             = "grpc"
+  protocol              = "HTTP2"
+
+  connection_draining_timeout_sec = 15
+  health_checks                   = [google_compute_health_check.grpc_health_check[count.index].id]
+
+  dynamic "backend" {
+    for_each = data.google_compute_network_endpoint_group.k8s_grpc_neg
+    iterator = neg
+    content {
+      group                 = neg.value.id
+      balancing_mode        = "RATE"
+      max_rate_per_endpoint = var.backend_service_max_rps
+    }
+  }
+
+  depends_on      = [google_compute_security_policy.http_security_policy]
+  security_policy = length(google_compute_security_policy.http_security_policy) > 0 ? google_compute_security_policy.http_security_policy[0].self_link : ""
+
+  log_config {
+    enable = var.enable_backend_service_logging
+  }
+}
+
+resource "google_compute_url_map" "url_map" {
+  count = var.single_region ? 0 : 1
+
+  name    = "fulcio-lb"
+  project = var.project_id
+
+  default_service = google_compute_backend_service.http_backend_service[count.index].id
+
+  host_rule {
+    hosts        = var.dns_domain_name == "" ? ["*"] : [local.hostname]
+    path_matcher = "fulcio"
+  }
+
+  path_matcher {
+    name            = "fulcio"
+    default_service = google_compute_backend_service.http_backend_service[count.index].id
+    path_rule {
+      paths   = ["/*"]
+      service = google_compute_backend_service.http_backend_service[count.index].id
+    }
+    path_rule {
+      paths   = ["/dev.sigstore.fulcio.v2.CA"]
+      service = google_compute_backend_service.grpc_backend_service[count.index].id
+    }
+    path_rule {
+      paths   = ["/dev.sigstore.fulcio.v2.CA/*"]
+      service = google_compute_backend_service.grpc_backend_service[count.index].id
+    }
+  }
+}
+
+resource "google_certificate_manager_certificate" "ssl_certificate" {
+  count = var.single_region ? 0 : 1
+
+  name    = "fulcio-ssl-cert"
+  project = var.project_id
+
+  managed {
+    domains = [local.hostname]
+    dns_authorizations = [
+      google_certificate_manager_dns_authorization.fulcio_auth[count.index].id
+    ]
+  }
+}
+
+resource "google_certificate_manager_certificate_map" "fulcio_certificate_map" {
+  count = var.single_region ? 0 : 1
+
+  name = "fulcio-cert-map"
+}
+
+resource "google_certificate_manager_certificate_map_entry" "fulcio_certificate_map_entry" {
+  count = var.single_region ? 0 : 1
+
+  name         = "fulcio-cert-map-entry"
+  map          = google_certificate_manager_certificate_map.fulcio_certificate_map[count.index].name
+  certificates = [google_certificate_manager_certificate.ssl_certificate[count.index].id]
+  hostname     = local.hostname
+}
+
+resource "google_compute_target_https_proxy" "lb_proxy" {
+  count = var.single_region ? 0 : 1
+
+  name    = "fulcio-https-proxy"
+  project = var.project_id
+
+  url_map = google_compute_url_map.url_map[count.index].id
+
+  ssl_policy      = google_compute_ssl_policy.ssl_policy[count.index].id
+  certificate_map = "//certificatemanager.googleapis.com/${google_certificate_manager_certificate_map.fulcio_certificate_map[count.index].id}"
+}
+
+resource "google_compute_global_forwarding_rule" "https_forwarding_rule" {
+  count = var.single_region ? 0 : 1
+
+  name    = "fulcio-https-forwarding-rule"
+  project = var.project_id
+
+  ip_address            = google_compute_global_address.gce_lb_ipv4.address
+  target                = google_compute_target_https_proxy.lb_proxy[count.index].id
+  port_range            = "443"
+  load_balancing_scheme = "EXTERNAL_MANAGED"
+  ip_protocol           = "TCP"
+}