GoogleCloudPlatform / policy-library

A library of constraint templates and sample constraints for Constraint Framework tools
Apache License 2.0
223 stars 128 forks source link

fix: update constraint for vpc flow logs to check on new field #430

Closed mauro-cit closed 2 years ago

mauro-cit commented 2 years ago

FIxes #414

This PR main idea is to consider both versions (old and new) of Flow Logs parameters on the Subnetwork definition:

If both of them are false, the validation fails. Some test data were added and tested on it's data test file validator/test/fixtures/network_enable_flow_logs/assets/data.json

Manual tests: We tried to test it manually with a subnetwork resource definition using both versions of google provider (one where it uses the old field and one that uses the new field) but we faced a problem with the old version.

When we used the validation with gcloud beta terraform vet and also terraform validator , apparently during the process to convert the Plan json file to CAI, it is always converting to the new model which have the logConfig instead. Even with the old versions with terraform-validator the it keeps converting to a CAI with logConfig.

So we weren't able to test it manually with the old parameter after all.

bharathkkb commented 2 years ago

@g-awmalik Not urgent, could you PTAL why the tests are failing? Also aren't these triggers in our CI/CD project, I don't have access to it?

g-awmalik commented 2 years ago

@bharathkkb - these test run in the config validator project which i don't have access to either. @melinath - do you have access to the int-test project?

melinath commented 2 years ago

I have access - the failure message is:

diff -r '--exclude=.git' /workspace/policies/templates/gcp_network_enable_flow_logs_v1.yaml /tmp/tmp.3GtBKekLGW/policies/templates/gcp_network_enable_flow_logs_v1.yaml
48c48
< 
---
>             
50c50
< 
---
>             
52c52
< 
---
>             
60c60
< 
---
>             
65c65
< 
---
>             
68c68
< 
---
>      
make: *** [Makefile:117: check_build] Error 1
mauro-cit commented 2 years ago

The build was fixed. @melinath @g-awmalik could you PTAL?