Allow `google_cloudbuild_worker_pool` to use Cloud NAT for egress to Public IPs

[dylan-tock]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

The provider documentation for the google_cloudbuild_worker_pool resource says setting no_external_ip to true will prevent network egress to Public IPs. We have many VMs configured without Public IPs and they use Cloud NAT for egress.

It would be highly desirable from a security perspective to avoid Cloud Build hosts having external IP address and be able to specify an existing Cloud NAT for any egress.

New or Affected Resource(s)

• google_cloudbuild_worker_pool

Potential Terraform Configuration

resource "google_cloudbuild_worker_pool" "pool" {
  name = "my-pool"
  location = "europe-west1"
  worker_config {
    disk_size_gb = 100
    machine_type = "e2-standard-4"
    no_external_ip = true
    nat_gateway = google_compute_router_nat.name
  }
}

References

• google_compute_router_nat resource documentation.
• GCP overview of Cloud NAT

[trodge]

b/280101071

[glanvl]

You can configure a VM to work as a NAT with a static IP for Cloud Build worker pools. Hopefully that works to solve your problem for now though I would also second that it would be good it I could use a standard cloud NAT for this.

https://cloud.google.com/build/docs/private-pools/use-in-private-network#running_behind_a_nat

Access external resource from a static source IP address using Cloud Build