Merge branch 'terraform-google-modules:master' into master

.github/workflows/lint.yaml

@@ -18,6 +18,7 @@
 name: 'lint'
 
 on:
+  workflow_dispatch:
   pull_request:
     branches:
       - master

CHANGELOG.md

@@ -7,6 +7,37 @@ The format is based on
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.1.0](https://github.com/terraform-google-modules/terraform-google-bastion-host/compare/v7.0.0...v7.1.0) (2024-09-06)
+
+
+### Features
+
+* **deps:** Update Terraform Google Provider to v6 (major) ([#205](https://github.com/terraform-google-modules/terraform-google-bastion-host/issues/205)) ([bfef016](https://github.com/terraform-google-modules/terraform-google-bastion-host/commit/bfef016667783409546ae1feaad4df01174ddb61))
+
+
+### Bug Fixes
+
+* correct access_config to block ([#209](https://github.com/terraform-google-modules/terraform-google-bastion-host/issues/209)) ([1413f7e](https://github.com/terraform-google-modules/terraform-google-bastion-host/commit/1413f7ea46f38e15956a0ae3054ee554ef70c5df))
+* set empty access_config to null ([#206](https://github.com/terraform-google-modules/terraform-google-bastion-host/issues/206)) ([c0b5acf](https://github.com/terraform-google-modules/terraform-google-bastion-host/commit/c0b5acf3ca51a4917010f0095621d6743f2b4689))
+
+## [7.0.0](https://github.com/terraform-google-modules/terraform-google-bastion-host/compare/v6.0.0...v7.0.0) (2024-08-21)
+
+
+### ⚠ BREAKING CHANGES
+
+* **deps:** Update Terraform terraform-google-modules/vm/google to v11 ([#186](https://github.com/terraform-google-modules/terraform-google-bastion-host/issues/186))
+
+### Features
+
+* support can_ip_forward ([#184](https://github.com/terraform-google-modules/terraform-google-bastion-host/issues/184)) ([a7705b0](https://github.com/terraform-google-modules/terraform-google-bastion-host/commit/a7705b015e8138b4b57a526f772ac3e5d06c8c32))
+* Support setting a static ip for the bastion ([#197](https://github.com/terraform-google-modules/terraform-google-bastion-host/issues/197)) ([b09be98](https://github.com/terraform-google-modules/terraform-google-bastion-host/commit/b09be9886946768c785b156c11081aed07f2a147))
+
+
+### Bug Fixes
+
+* **deps:** Update Terraform terraform-google-modules/vm/google to v11 ([#186](https://github.com/terraform-google-modules/terraform-google-bastion-host/issues/186)) ([0c7a342](https://github.com/terraform-google-modules/terraform-google-bastion-host/commit/0c7a34278fab3223c3965092f7614f7cf078f62c))
+* Update Debian Image to 12 ([#179](https://github.com/terraform-google-modules/terraform-google-bastion-host/issues/179)) ([ae88275](https://github.com/terraform-google-modules/terraform-google-bastion-host/commit/ae88275381a451ee5d0cc94067526b5684d78780))
+
 ## [6.0.0](https://github.com/terraform-google-modules/terraform-google-bastion-host/compare/v5.3.0...v6.0.0) (2023-10-30)
 
 

CODEOWNERS

@@ -2,3 +2,11 @@
 # https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit/blob/master/infra/terraform/test-org/org/locals.tf
 
 * @terraform-google-modules/cft-admins
+
+# NOTE: GitHub CODEOWNERS locations:
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-and-branch-protection
+
+CODEOWNERS @terraform-google-modules/cft-admins
+.github/CODEOWNERS @terraform-google-modules/cft-admins
+docs/CODEOWNERS @terraform-google-modules/cft-admins
+

Makefile

@@ -18,7 +18,7 @@
 # Make will use bash instead of sh
 SHELL := /usr/bin/env bash
 
-DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.18
+DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.22
 DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
 REGISTRY_URL := gcr.io/cloud-foundation-cicd
 

README.md

@@ -72,6 +72,7 @@ If the user does not share the same domain as the org the bastion is in, you wil
 | access\_config | Access configs for network, nat\_ip and DNS | <pre>list(object({<br>    network_tier           = string<br>    nat_ip                 = string<br>    public_ptr_domain_name = string<br>  }))</pre> | <pre>[<br>  {<br>    "nat_ip": "",<br>    "network_tier": "PREMIUM",<br>    "public_ptr_domain_name": ""<br>  }<br>]</pre> | no |
 | additional\_networks | Additional network interface details for the instance template, if any. | <pre>list(object({<br>    network            = string<br>    subnetwork         = string<br>    subnetwork_project = string<br>    network_ip         = string<br>    nic_type           = string<br>    stack_type         = string<br>    queue_count        = number<br>    access_config = list(object({<br>      nat_ip       = string<br>      network_tier = string<br>    }))<br>    ipv6_access_config = list(object({<br>      network_tier = string<br>    }))<br>    alias_ip_range = list(object({<br>      ip_cidr_range         = string<br>      subnetwork_range_name = string<br>    }))<br>  }))</pre> | `[]` | no |
 | additional\_ports | A list of additional ports/ranges to open access to on the instances from IAP. | `list(string)` | `[]` | no |
+| can\_ip\_forward | Whether the bastion should allow IP forwarding. | `bool` | `false` | no |
 | create\_firewall\_rule | If we need to create the firewall rule or not. | `bool` | `true` | no |
 | create\_instance\_from\_template | Whether to create and instance from the template or not. If false, no instance is created, but the instance template is created and usable by a MIG | `bool` | `true` | no |
 | disk\_labels | Key-value map of labels to assign to the bastion host disk | `map(any)` | `{}` | no |
@@ -81,7 +82,7 @@ If the user does not share the same domain as the org the bastion is in, you wil
 | fw\_name\_allow\_ssh\_from\_iap | Firewall rule name for allowing SSH from IAP | `string` | `"allow-ssh-from-iap-to-tunnel"` | no |
 | host\_project | The network host project ID | `string` | `""` | no |
 | image | Source image for the Bastion. If image is not specified, image\_family will be used (which is the default). | `string` | `""` | no |
-| image\_family | Source image family for the Bastion. | `string` | `"debian-11"` | no |
+| image\_family | Source image family for the Bastion. | `string` | `"debian-12"` | no |
 | image\_project | Project where the source image for the Bastion comes from | `string` | `"debian-cloud"` | no |
 | labels | Key-value map of labels to assign to the bastion host | `map(any)` | `{}` | no |
 | machine\_type | Instance type for the Bastion host | `string` | `"n1-standard-1"` | no |
@@ -90,6 +91,7 @@ If the user does not share the same domain as the org the bastion is in, you wil
 | name | Name of the Bastion instance | `string` | `"bastion-vm"` | no |
 | name\_prefix | Name prefix for instance template | `string` | `"bastion-instance-template"` | no |
 | network | Self link for the network on which the Bastion should live | `string` | n/a | yes |
+| network\_ip | Private IP address for the bastion host | `string` | `""` | no |
 | preemptible | Allow the instance to be preempted | `bool` | `false` | no |
 | project | The project ID to deploy to | `string` | n/a | yes |
 | random\_role\_id | Enables role random id generation. | `bool` | `true` | no |

build/int.cloudbuild.yaml

@@ -41,4 +41,4 @@ tags:
 - 'integration'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.18'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.22'

build/lint.cloudbuild.yaml

@@ -21,4 +21,4 @@ tags:
 - 'lint'
 substitutions:
   _DOCKER_IMAGE_DEVELOPER_TOOLS: 'cft/developer-tools'
-  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.18'
+  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '1.22'

examples/bastion_group/main.tf

@@ -16,7 +16,7 @@
 
 module "iap_bastion_group" {
   source  = "terraform-google-modules/bastion-host/google//modules/bastion-group"
-  version = "~> 6.0"
+  version = "~> 7.0"
 
   project     = var.project_id
   region      = "us-west1"

examples/iap_tunneling/main.tf

@@ -38,7 +38,7 @@ resource "google_service_account" "vm_sa" {
 # A testing VM to allow OS Login + IAP tunneling.
 module "instance_template" {
   source  = "terraform-google-modules/vm/google//modules/instance_template"
-  version = "~> 10.0"
+  version = "~> 12.0"
 
   project_id   = var.project_id
   machine_type = "n1-standard-1"
@@ -79,7 +79,7 @@ resource "google_project_iam_member" "os_login_bindings" {
 
 module "iap_tunneling" {
   source  = "terraform-google-modules/bastion-host/google//modules/iap-tunneling"
-  version = "~> 6.0"
+  version = "~> 7.0"
 
   fw_name_allow_ssh_from_iap = "test-allow-ssh-from-iap-to-tunnel"
   project                    = var.project_id

examples/simple_example/main.tf

@@ -16,7 +16,7 @@
 
 module "iap_bastion" {
   source  = "terraform-google-modules/bastion-host/google"
-  version = "~> 6.0"
+  version = "~> 7.0"
 
   project = var.project_id
   zone    = "us-west1-a"

examples/two_service_example/main.tf

@@ -19,7 +19,7 @@ provider "google" {
 
 module "iap_bastion" {
   source  = "terraform-google-modules/bastion-host/google"
-  version = "~> 6.0"
+  version = "~> 7.0"
 
   project = var.project
   subnet  = var.subnet

main.tf

@@ -44,7 +44,7 @@ resource "google_service_account" "bastion_host" {
 
 module "instance_template" {
   source  = "terraform-google-modules/vm/google//modules/instance_template"
-  version = "~> 10.0"
+  version = "~> 12.0"
 
   name_prefix         = var.name_prefix
   project_id          = var.project
@@ -67,6 +67,7 @@ module "instance_template" {
   source_image_project = var.image_project
   startup_script       = var.startup_script
   preemptible          = var.preemptible
+  can_ip_forward       = var.can_ip_forward ? "true" : "false"
 
   tags   = var.tags
   labels = var.labels
@@ -89,7 +90,16 @@ resource "google_compute_instance_from_template" "bastion_vm" {
   network_interface {
     subnetwork         = var.subnet
     subnetwork_project = var.host_project != "" ? var.host_project : var.project
-    access_config      = var.external_ip ? var.access_config : []
+    network_ip         = var.network_ip
+
+    dynamic "access_config" {
+      for_each = var.external_ip ? var.access_config : []
+      content {
+        nat_ip                 = access_config.value["nat_ip"]
+        public_ptr_domain_name = access_config.value["public_ptr_domain_name"]
+        network_tier           = access_config.value["network_tier"]
+      }
+    }
   }
 
   source_instance_template = module.instance_template.self_link

metadata.yaml

@@ -23,7 +23,7 @@ spec:
   source:
     repo: https://github.com/terraform-google-modules/terraform-google-bastion-host
     sourceType: git
-  version: 6.0.0
+  version: 7.1.0
   actuationTool:
     type: Terraform
     version: '>=0.13'
@@ -118,7 +118,7 @@ spec:
   - name: image_family
     description: Source image family for the Bastion.
     type: string
-    default: debian-11
+    default: debian-12
     required: false
   - name: image_project
     description: Project where the source image for the Bastion comes from

modules/bastion-group/README.md

@@ -78,7 +78,7 @@ provision a project with the necessary APIs enabled.
 | fw\_name\_allow\_ssh\_from\_iap | Firewall rule name for allowing SSH from IAP | `string` | `"allow-ssh-from-iap-to-bastion-group"` | no |
 | health\_check | Health check config for the mig. | <pre>object({<br>    type                = string<br>    initial_delay_sec   = number<br>    check_interval_sec  = number<br>    healthy_threshold   = number<br>    timeout_sec         = number<br>    unhealthy_threshold = number<br>    response            = string<br>    proxy_header        = string<br>    port                = number<br>    request             = string<br>    enable_logging      = bool<br><br>    # Unused fields.<br>    request_path = string<br>    host         = string<br>  })</pre> | <pre>{<br>  "check_interval_sec": 30,<br>  "enable_logging": false,<br>  "healthy_threshold": 1,<br>  "host": "",<br>  "initial_delay_sec": 30,<br>  "port": 22,<br>  "proxy_header": "NONE",<br>  "request": "",<br>  "request_path": "",<br>  "response": "",<br>  "timeout_sec": 10,<br>  "type": "tcp",<br>  "unhealthy_threshold": 5<br>}</pre> | no |
 | host\_project | The network host project ID | `string` | `""` | no |
-| image\_family | Source image family for the Bastion. | `string` | `"debian-11"` | no |
+| image\_family | Source image family for the Bastion. | `string` | `"debian-12"` | no |
 | image\_project | Project where the source image for the Bastion comes from | `string` | `"debian-cloud"` | no |
 | labels | Key-value map of labels to assign to the bastion host | `map(any)` | `{}` | no |
 | machine\_type | Instance type for the Bastion host | `string` | `"n1-standard-1"` | no |

modules/bastion-group/main.tf

@@ -44,7 +44,7 @@ module "iap_bastion" {
 
 module "mig" {
   source  = "terraform-google-modules/vm/google//modules/mig"
-  version = "~> 10.0"
+  version = "~> 12.0"
 
   project_id        = var.project
   region            = var.region

modules/bastion-group/metadata.yaml

@@ -23,7 +23,7 @@ spec:
   source:
     repo: https://github.com/terraform-google-modules/terraform-google-bastion-host
     sourceType: git
-  version: 6.0.0
+  version: 7.1.0
   actuationTool:
     type: Terraform
     version: '>=0.13'
@@ -103,7 +103,7 @@ spec:
   - name: image_family
     description: Source image family for the Bastion.
     type: string
-    default: debian-11
+    default: debian-12
     required: false
   - name: image_project
     description: Project where the source image for the Bastion comes from

modules/bastion-group/variables.tf

@@ -22,7 +22,7 @@ variable "target_size" {
 variable "image_family" {
   description = "Source image family for the Bastion."
   type        = string
-  default     = "debian-11"
+  default     = "debian-12"
 }
 
 variable "image_project" {

modules/bastion-group/versions.tf

@@ -18,17 +18,17 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 3.53, < 6"
+      version = ">= 3.53, < 7"
     }
     google-beta = {
       source  = "hashicorp/google-beta"
-      version = ">= 3.53, < 6"
+      version = ">= 3.53, < 7"
     }
     random = {
       source = "hashicorp/random"
     }
   }
   provider_meta "google" {
-    module_name = "blueprints/terraform/terraform-google-bastion-host:bastion-group/v6.0.0"
+    module_name = "blueprints/terraform/terraform-google-bastion-host:bastion-group/v7.1.0"
   }
 }

modules/iap-tunneling/metadata.yaml

@@ -23,7 +23,7 @@ spec:
   source:
     repo: https://github.com/terraform-google-modules/terraform-google-bastion-host
     sourceType: git
-  version: 6.0.0
+  version: 7.1.0
   actuationTool:
     type: Terraform
     version: '>=0.13'

modules/iap-tunneling/versions.tf

@@ -18,10 +18,10 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 3.53, < 6"
+      version = ">= 3.53, < 7"
     }
   }
   provider_meta "google" {
-    module_name = "blueprints/terraform/terraform-google-bastion-host:iap-tunneling/v6.0.0"
+    module_name = "blueprints/terraform/terraform-google-bastion-host:iap-tunneling/v7.1.0"
   }
 }

test/integration/go.mod

@@ -1,12 +1,12 @@
 module github.com/terraform-google-modules/terraform-google-bastion-host/test/integration
 
-go 1.21
+go 1.22
 
-toolchain go1.21.5
+toolchain go1.22.6
 
 require (
-	github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test v0.11.1
-	github.com/stretchr/testify v1.8.4
+	github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test v0.16.1
+	github.com/stretchr/testify v1.9.0
 )
 
 require (
@@ -16,34 +16,34 @@ require (
 	cloud.google.com/go/iam v1.1.2 // indirect
 	cloud.google.com/go/storage v1.33.0 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
+	github.com/alexflint/go-filemutex v1.3.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/aws/aws-sdk-go v1.45.5 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-errors/errors v1.5.0 // indirect
 	github.com/go-openapi/jsonpointer v0.20.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.22.4 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/uuid v1.3.1 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
-	github.com/gruntwork-io/terratest v0.46.8 // indirect
+	github.com/gruntwork-io/terratest v0.47.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-getter v1.7.2 // indirect
+	github.com/hashicorp/go-getter v1.7.5 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-safetemp v1.0.0 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
 	github.com/hashicorp/hcl v0.0.0-20170504190234-a4b07c25de5f // indirect
-	github.com/hashicorp/hcl/v2 v2.18.0 // indirect
-	github.com/hashicorp/terraform-config-inspect v0.0.0-20231204233900-a34142ec2a72 // indirect
-	github.com/hashicorp/terraform-json v0.17.1 // indirect
+	github.com/hashicorp/hcl/v2 v2.20.1 // indirect
+	github.com/hashicorp/terraform-config-inspect v0.0.0-20240701073647-9fc3669f7553 // indirect
+	github.com/hashicorp/terraform-json v0.22.1 // indirect
 	github.com/jinzhu/copier v0.4.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -53,32 +53,33 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.2-0.20210821155943-2d9075ca8770 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/tidwall/gjson v1.17.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/tidwall/gjson v1.17.1 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/tmccombs/hcl2json v0.6.0 // indirect
 	github.com/ulikunitz/xz v0.5.11 // indirect
-	github.com/zclconf/go-cty v1.14.0 // indirect
+	github.com/zclconf/go-cty v1.14.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/crypto v0.17.0 // indirect
-	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/crypto v0.21.0 // indirect
+	golang.org/x/mod v0.19.0 // indirect
+	golang.org/x/net v0.23.0 // indirect
 	golang.org/x/oauth2 v0.12.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/sync v0.4.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/tools v0.13.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/api v0.138.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
 	google.golang.org/grpc v1.58.3 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20230905202853-d090da108d2f // indirect
-	sigs.k8s.io/kustomize/kyaml v0.16.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.17.2 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )