[secure-source-manager-instance] Allow provisioning of instances with managed certificates (#3310)

2025-09-08 17:53:46 +02:00
parent eff8799303
commit 2262ab6cc1
14 changed files with 162 additions and 46 deletions
--- a/modules/secure-source-manager-instance/README.md
+++ b/modules/secure-source-manager-instance/README.md
@@ -32,7 +32,7 @@ module "ssm_instance" {
 # tftest modules=1 resources=2 inventory=public-instance.yaml
 ```

-### Public instance with CMEK 
+### Public instance with CMEK

 ```hcl
 module "ssm_instance" {
@@ -56,7 +56,9 @@ module "ssm_instance" {
  project_id  = var.project_id
  instance_id = "my-instance"
  location    = var.region
-  ca_pool     = "projects/another-project/locations/${var.region}/caPools/my-ca-pool"
+  private_configs = {
+    is_private = true
+  }
  repositories = {
    my-repository = {}
  }
@@ -64,6 +66,25 @@ module "ssm_instance" {
 # tftest modules=1 resources=2 inventory=private-instance.yaml
 ```

+You can optionally specify a Certificate Authority (CAS) pool and use your own certificate.
+
+```hcl
+module "ssm_instance" {
+  source      = "./fabric/modules/secure-source-manager-instance"
+  project_id  = var.project_id
+  instance_id = "my-instance"
+  location    = var.region
+  private_configs = {
+    is_private = true
+    ca_pool_id = "projects/another-project/locations/${var.region}/caPools/my-ca-pool"
+  }
+  repositories = {
+    my-repository = {}
+  }
+}
+# tftest modules=1 resources=2 inventory=private-instance-ca-pool.yaml
+```
+
 ### IAM

 ```hcl
@@ -179,17 +200,17 @@ module "ssm_instance" {

 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [instance_id](variables.tf#L29) | Instance ID. | <code>string</code> | ✓ |  |
-| [location](variables.tf#L46) | Location. | <code>string</code> | ✓ |  |
-| [project_id](variables.tf#L51) | Project ID. | <code>string</code> | ✓ |  |
-| [repositories](variables.tf#L56) | Repositories. | <code title="map&#40;object&#40;&#123;&#10;  description &#61; optional&#40;string&#41;&#10;  iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    role    &#61; string&#10;    members &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    role   &#61; string&#10;    member &#61; string&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  initial_config &#61; optional&#40;object&#40;&#123;&#10;    default_branch &#61; optional&#40;string&#41;&#10;    gitignores     &#61; optional&#40;string&#41;&#10;    license        &#61; optional&#40;string&#41;&#10;    readme         &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  branch_rules &#61; optional&#40;map&#40;object&#40;&#123;&#10;    disabled                  &#61; optional&#40;bool, false&#41;&#10;    include_pattern           &#61; string&#10;    require_pull_request      &#61; optional&#40;bool&#41;&#10;    minimum_approvals_count   &#61; optional&#40;number&#41;&#10;    minimum_reviews_count     &#61; optional&#40;number&#41;&#10;    require_comments_resolved &#61; optional&#40;bool&#41;&#10;    allow_stale_reviews       &#61; optional&#40;bool&#41;&#10;    require_linear_history    &#61; optional&#40;bool&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | ✓ |  |
-| [ca_pool](variables.tf#L17) | CA pool. | <code>string</code> |  | <code>null</code> |
+| [instance_id](variables.tf#L23) | Instance ID. | <code>string</code> | ✓ |  |
+| [location](variables.tf#L40) | Location. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L55) | Project ID. | <code>string</code> | ✓ |  |
+| [repositories](variables.tf#L60) | Repositories. | <code title="map&#40;object&#40;&#123;&#10;  description &#61; optional&#40;string&#41;&#10;  iam         &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10;    role    &#61; string&#10;    members &#61; list&#40;string&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10;    role   &#61; string&#10;    member &#61; string&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;  initial_config &#61; optional&#40;object&#40;&#123;&#10;    default_branch &#61; optional&#40;string&#41;&#10;    gitignores     &#61; optional&#40;string&#41;&#10;    license        &#61; optional&#40;string&#41;&#10;    readme         &#61; optional&#40;string&#41;&#10;  &#125;&#41;&#41;&#10;  branch_rules &#61; optional&#40;map&#40;object&#40;&#123;&#10;    disabled                  &#61; optional&#40;bool, false&#41;&#10;    include_pattern           &#61; string&#10;    require_pull_request      &#61; optional&#40;bool&#41;&#10;    minimum_approvals_count   &#61; optional&#40;number&#41;&#10;    minimum_reviews_count     &#61; optional&#40;number&#41;&#10;    require_comments_resolved &#61; optional&#40;bool&#41;&#10;    allow_stale_reviews       &#61; optional&#40;bool&#41;&#10;    require_linear_history    &#61; optional&#40;bool&#41;&#10;  &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | ✓ |  |
 | [iam](variables-iam.tf#L17) | IAM bindings. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [iam_bindings](variables-iam.tf#L23) | IAM bindings. | <code title="map&#40;object&#40;&#123;&#10;  role    &#61; string&#10;  members &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [iam_bindings_additive](variables-iam.tf#L32) | IAM bindings. | <code title="map&#40;object&#40;&#123;&#10;  role   &#61; string&#10;  member &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [instance_create](variables.tf#L23) | Create SSM Instance. When set to false, uses instance_id to reference existing SSM instance. | <code>bool</code> |  | <code>true</code> |
-| [kms_key](variables.tf#L34) | KMS key. | <code>string</code> |  | <code>null</code> |
-| [labels](variables.tf#L40) | Instance labels. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
+| [instance_create](variables.tf#L17) | Create SSM Instance. When set to false, uses instance_id to reference existing SSM instance. | <code>bool</code> |  | <code>true</code> |
+| [kms_key](variables.tf#L28) | KMS key. | <code>string</code> |  | <code>null</code> |
+| [labels](variables.tf#L34) | Instance labels. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
+| [private_configs](variables.tf#L45) | The configurations for SSM private instances. | <code title="object&#40;&#123;&#10;  is_private &#61; optional&#40;bool, true&#41;&#10;  ca_pool_id &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |

 ## Outputs

--- a/modules/secure-source-manager-instance/iam.tf
+++ b/modules/secure-source-manager-instance/iam.tf
@@ -1,5 +1,5 @@
 /**
- * Copyright 2024 Google LLC
+ * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
--- a/modules/secure-source-manager-instance/main.tf
+++ b/modules/secure-source-manager-instance/main.tf
@@ -1,5 +1,5 @@
 /**
- * Copyright 2024 Google LLC
+ * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -41,10 +41,10 @@ resource "google_secure_source_manager_instance" "instance" {
  labels      = var.labels
  kms_key     = var.kms_key
  dynamic "private_config" {
-    for_each = var.ca_pool == null ? [] : [""]
+    for_each = var.private_configs.is_private ? [""] : []
    content {
      is_private = true
-      ca_pool    = var.ca_pool
+      ca_pool    = var.private_configs.ca_pool_id
    }
  }
 }
@@ -81,4 +81,4 @@ resource "google_secure_source_manager_branch_rule" "branch_rules" {
  require_linear_history    = each.value.require_linear_history
  require_pull_request      = each.value.require_pull_request
  allow_stale_reviews       = each.value.allow_stale_reviews
-}
+}
--- a/modules/secure-source-manager-instance/outputs.tf
+++ b/modules/secure-source-manager-instance/outputs.tf
@@ -1,5 +1,5 @@
 /**
- * Copyright 2024 Google LLC
+ * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
--- a/modules/secure-source-manager-instance/variables-iam.tf
+++ b/modules/secure-source-manager-instance/variables-iam.tf
@@ -1,5 +1,5 @@
 /**
- * Copyright 2024 Google LLC
+ * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -36,4 +36,4 @@ variable "iam_bindings_additive" {
    member = string
  }))
  default = {}
-}
+}
--- a/modules/secure-source-manager-instance/variables.tf
+++ b/modules/secure-source-manager-instance/variables.tf
@@ -1,5 +1,5 @@
 /**
- * Copyright 2024 Google LLC
+ * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
@@ -14,12 +14,6 @@
 * limitations under the License.
 */

-variable "ca_pool" {
-  description = "CA pool."
-  type        = string
-  default     = null
-}
-
 variable "instance_create" {
  description = "Create SSM Instance. When set to false, uses instance_id to reference existing SSM instance."
  type        = bool
@@ -48,6 +42,16 @@ variable "location" {
  type        = string
 }

+variable "private_configs" {
+  description = "The configurations for SSM private instances."
+  type = object({
+    is_private = optional(bool, true)
+    ca_pool_id = optional(string)
+  })
+  nullable = false
+  default  = {}
+}
+
 variable "project_id" {
  description = "Project ID."
  type        = string