ingress-egress policy

[google-cla[bot]]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

:memo: Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[comment-bot-dev]

Thanks for the PR! 🚀 Unfortunately it looks like some of our CI checks failed. See the Contributing Guide for details.

• ⚠️check_documentation The documentation needs to be regenerated. Please run make generate_docs.

  Checking for documentation generation
  diff -r '--exclude=.terraform' '--exclude=.kitchen' '--exclude=.git' '--exclude=autogen' '--exclude=*.tfvars' /workspace/modules/regular_service_perimeter/README.md /tmp/tmp.AtF4NmiVt1/generate_docs/workspace/modules/regular_service_perimeter/README.md
  39a40,41
  > | egress\_policies\_info | n/a | <pre>map(object({<br>    egress_from = object({<br>      identity_type = string<br>      identities    = list(string)<br>    })<br>    egress_to = object({<br>      resources = list(string)<br>      operations = list(object({<br>        service_name = string<br>        method_selectors = object({<br>        method = string })<br>        })<br>      )<br>    })<br>    })<br>  )</pre> | `{}` | no |
  > | ingress\_policies\_info | n/a | <pre>map(object({<br>    ingress_from = object({<br>      identity_type = string<br>      identities    = list(string)<br>      sources = object({<br>        access_level = string<br>        resource     = string<br>      })<br>    })<br>    ingress_to = object({<br>      resources = list(string)<br>      operations = list(object({<br>        service_name = string<br>        method_selectors = object({<br>        method = string })<br>        })<br>      )<br>    })<br>    })<br>  )</pre> | `{}` | no |
  47,84c49
  < | ingress\_policies\_info | A map of objects, it includes ingress_from and ingress_to objects |
  < map(object({
  <     ingress_from = object({
  <       identity_type = string
  <       identities    = list(string)
  <       sources = object({
  <         access_level = string
  <         resource     = string
  <       })
  <     })
  <     ingress_to = object({
  <       resources = list(string)
  <       operations = list(object({
  <         service_name = string
  <         method_selectors = object({
  <         method = string })
  <         })
  <       )
  <     })
  <     })
  <   ) | '{}' | no |
  < | egress\_policies\_info | A map of objects,it includes egress_from and egress_to objects |
  <  map(object({
  <     egress_from = object({
  <       identity_type = string
  <       identities    = list(string)
  <     })
  <     egress_to = object({
  <       resources = list(string)
  <       operations = list(object({
  <         service_name = string
  <         method_selectors = object({
  <         method = string })
  <         })
  <       )
  <     })
  <     })
  <   ) | '{}' | no |
  ---
  > 
  Error: Documentation generation has not been run, please run the
  'make docker_generate_docs' command and commit the above changes.

• ⚠️check_terraform Failed Terraform check. More details below.

  Running terraform fmt
  Running terraform validate
  terraform_validate . 
  Success!
  The configuration is valid.
  terraform_validate ./examples/automatic_folder 
  Success!
  The configuration is valid.
  terraform_validate ./examples/bq-exfil-demo 
  Warning: 
  Quoted type constraints are deprecated
  on variables.tf line 19, in variable "org_id":
  19:   type        = 
  "string"
  Terraform 0.11 and earlier required type constraints to be given in quotes,
  but that form is now deprecated and will be removed in a future version of
  Terraform. To silence this warning, remove the quotes around "string".
  (and 8 more similar warnings elsewhere)
  Success!
  The configuration is valid, but there were some validation warnings as shown above.
  terraform_validate ./examples/onprem_demo 
  Warning: 
  Interpolation-only expressions are deprecated
  on main.tf line 19, in provider "google":
  19:   credentials = 
  "${file("${var.credentials_path}")}"
  Terraform 0.11 and earlier required all non-constant expressions to be
  provided via interpolation syntax, but this pattern is now deprecated. To
  silence this warning, remove the "${ sequence from the start and the }"
  sequence from the end of this expression, leaving just the inner expression.
  Template interpolation syntax is still used to construct strings from
  expressions when the template includes multiple interpolation sequences or a
  mixture of literal strings and interpolations. This deprecation applies only
  to templates that consist entirely of a single interpolation sequence.
  (and 141 more similar warnings elsewhere)
  Warning: 
  Quoted references are deprecated
  on onprem_project/main.tf line 36, in resource "google_compute_network" "onprem-network":
  36:   depends_on                      = [
  "google_project_service.gce_service"
  ]
  In this context, references are expected literally rather than in quotes.
  Terraform 0.11 and earlier required quotes, but quoted references are now
  deprecated and will be removed in a future version of Terraform. Remove the
  quotes surrounding this reference to silence this warning.
  (and 8 more similar warnings elsewhere)
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  terraform_validate ./examples/onprem_demo/onprem_project 
  Warning: 
  Interpolation-only expressions are deprecated
  on main.tf line 19, in resource "google_project" "on_prem_network_project":
  19:   project_id          = 
  "${var.project_id}"
  Terraform 0.11 and earlier required all non-constant expressions to be
  provided via interpolation syntax, but this pattern is now deprecated. To
  silence this warning, remove the "${ sequence from the start and the }"
  sequence from the end of this expression, leaving just the inner expression.
  Template interpolation syntax is still used to construct strings from
  expressions when the template includes multiple interpolation sequences or a
  mixture of literal strings and interpolations. This deprecation applies only
  to templates that consist entirely of a single interpolation sequence.
  (and 61 more similar warnings elsewhere)
  Warning: 
  Quoted references are deprecated
  on main.tf line 36, in resource "google_compute_network" "onprem-network":
  36:   depends_on                      = [
  "google_project_service.gce_service"
  ]
  In this context, references are expected literally rather than in quotes.
  Terraform 0.11 and earlier required quotes, but quoted references are now
  deprecated and will be removed in a future version of Terraform. Remove the
  quotes surrounding this reference to silence this warning.
  (and 5 more similar warnings elsewhere)
  Success!
  The configuration is valid, but there were some validation warnings as shown above.
  terraform_validate ./examples/onprem_demo/vpc_sc_project 
  Warning: 
  Interpolation-only expressions are deprecated
  on main.tf line 19, in resource "google_project" "vpc_sc_network_project":
  19:   project_id          = 
  "${var.project_id}"
  Terraform 0.11 and earlier required all non-constant expressions to be
  provided via interpolation syntax, but this pattern is now deprecated. To
  silence this warning, remove the "${ sequence from the start and the }"
  sequence from the end of this expression, leaving just the inner expression.
  Template interpolation syntax is still used to construct strings from
  expressions when the template includes multiple interpolation sequences or a
  mixture of literal strings and interpolations. This deprecation applies only
  to templates that consist entirely of a single interpolation sequence.
  (and 62 more similar warnings elsewhere)
  Warning: 
  Quoted references are deprecated
  on main.tf line 41, in resource "google_compute_network" "test-vpc":
  41:   depends_on                      = [
  "google_project_service.gce_service"
  ]
  In this context, references are expected literally rather than in quotes.
  Terraform 0.11 and earlier required quotes, but quoted references are now
  deprecated and will be removed in a future version of Terraform. Remove the
  quotes surrounding this reference to silence this warning.
  (and 2 more similar warnings elsewhere)
  Success!
  The configuration is valid, but there were some validation warnings as shown above.
  terraform_validate ./examples/simple_example 
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  terraform_validate ./examples/simple_example_access_level 
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  terraform_validate ./examples/simple_example_access_level_dry_run 
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  terraform_validate ./examples/simple_example_bridge 
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  terraform_validate ./modules/access_level 
  Success!
  The configuration is valid.
  terraform_validate ./modules/bridge_service_perimeter 
  Success!
  The configuration is valid.
  terraform_validate ./modules/regular_service_perimeter 
  Success!
  The configuration is valid.
  terraform_validate ./test/fixtures/simple_example 
  Error: 
  Unsupported block type
  on ../../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  terraform_validate ./test/fixtures/simple_example_bridge 
  Error: 
  Unsupported block type
  on ../../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../../modules/regular_service_perimeter/main.tf line 37, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  37:     dynamic 
  "ingress_policies"
  {
  Blocks of type "ingress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  Error: 
  Unsupported block type
  on ../../../modules/regular_service_perimeter/main.tf line 66, in resource "google_access_context_manager_service_perimeter" "regular_service_perimeter":
  66:     dynamic 
  "egress_policies"
  {
  Blocks of type "egress_policies" are not expected here.
  terraform_validate ./test/setup 
  Success!
  The configuration is valid.

[Mahsamtm]

make generate_docs

[Mahsamtm]

@googlebot I signed it!

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[Mahsamtm]

@googlebot I signed it!

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[Mahsamtm]

@googlebot I fixed it.

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[Mahsamtm]

make generate_docs

[Mahsamtm]

make generate_docs

[Mahsamtm]

@googlebot I fixed it.

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[Mahsamtm]

@googlebot I fixed it.

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[Mahsamtm]

@googlebot I fixed it.

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[Mahsamtm]

@googlebot I fixed it.

[google-cla[bot]]

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for all the commit author(s) or Co-authors. If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google. In order to pass this check, please resolve this problem and then comment @googlebot I fixed it.. If the bot doesn't comment, it means it doesn't think anything has changed.

ℹ️ Googlers: Go here for more info.

[morgante]

@Mahsamtm I'm not sure if you missed it, but this is failing linting. See the comment above.

[aweberlopes]

Can be closed is already implemented.