From 2863d929a546e9e2cb6fb4d9341e747fdf95b208 Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Mon, 4 Oct 2021 14:12:00 +0200 Subject: [PATCH] Remove redundant variable `admin_ranges_enabled` --- .../cmek-via-centralized-kms/main.tf | 9 +++---- .../02-resources/main.tf | 15 +++++------ .../gcs-to-bq-with-dataflow/main.tf | 9 +++---- modules/net-vpc-firewall/README.md | 27 +++++++++---------- modules/net-vpc-firewall/main.tf | 2 +- modules/net-vpc-firewall/outputs.tf | 4 +-- modules/net-vpc-firewall/variables.tf | 6 ----- networking/hub-and-spoke-peering/main.tf | 27 +++++++++---------- networking/hub-and-spoke-vpn/main.tf | 27 +++++++++---------- networking/ilb-next-hop/vpc-left.tf | 11 ++++---- networking/ilb-next-hop/vpc-right.tf | 11 ++++---- networking/onprem-google-access-dns/main.tf | 11 ++++---- networking/shared-vpc-gke/main.tf | 9 +++---- 13 files changed, 73 insertions(+), 95 deletions(-) diff --git a/data-solutions/cmek-via-centralized-kms/main.tf b/data-solutions/cmek-via-centralized-kms/main.tf index bf19d03f2..4f7e351a1 100644 --- a/data-solutions/cmek-via-centralized-kms/main.tf +++ b/data-solutions/cmek-via-centralized-kms/main.tf @@ -60,11 +60,10 @@ module "vpc" { } module "vpc-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = module.project-service.project_id - network = module.vpc.name - admin_ranges_enabled = true - admin_ranges = [var.vpc_ip_cidr_range] + source = "../../modules/net-vpc-firewall" + project_id = module.project-service.project_id + network = module.vpc.name + admin_ranges = [var.vpc_ip_cidr_range] } ############################################################################### diff --git a/data-solutions/data-platform-foundations/02-resources/main.tf b/data-solutions/data-platform-foundations/02-resources/main.tf index 9e9b1f8db..d67930d46 100644 --- a/data-solutions/data-platform-foundations/02-resources/main.tf +++ b/data-solutions/data-platform-foundations/02-resources/main.tf @@ -167,14 +167,13 @@ module "vpc-transformation" { } module "firewall" { - source = "../../../modules/net-vpc-firewall" - project_id = var.project_ids.transformation - network = module.vpc-transformation.name - admin_ranges_enabled = false - admin_ranges = [""] - http_source_ranges = [] - https_source_ranges = [] - ssh_source_ranges = [] + source = "../../../modules/net-vpc-firewall" + project_id = var.project_ids.transformation + network = module.vpc-transformation.name + admin_ranges = [] + http_source_ranges = [] + https_source_ranges = [] + ssh_source_ranges = [] custom_rules = { iap-svc = { diff --git a/data-solutions/gcs-to-bq-with-dataflow/main.tf b/data-solutions/gcs-to-bq-with-dataflow/main.tf index c2e56084e..f179f7d26 100644 --- a/data-solutions/gcs-to-bq-with-dataflow/main.tf +++ b/data-solutions/gcs-to-bq-with-dataflow/main.tf @@ -178,11 +178,10 @@ module "vpc" { } module "vpc-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = module.project-service.project_id - network = module.vpc.name - admin_ranges_enabled = true - admin_ranges = [var.vpc_ip_cidr_range] + source = "../../modules/net-vpc-firewall" + project_id = module.project-service.project_id + network = module.vpc.name + admin_ranges = [var.vpc_ip_cidr_range] } module "nat" { diff --git a/modules/net-vpc-firewall/README.md b/modules/net-vpc-firewall/README.md index 68626ee9e..83f8f7cd0 100644 --- a/modules/net-vpc-firewall/README.md +++ b/modules/net-vpc-firewall/README.md @@ -19,7 +19,6 @@ module "firewall" { source = "./modules/net-vpc-firewall" project_id = "my-project" network = "my-network" - admin_ranges_enabled = true admin_ranges = ["10.0.0.0/8"] } # tftest:modules=1:resources=4 @@ -31,11 +30,10 @@ This is an example of how to define custom rules, with a sample rule allowing op ```hcl module "firewall" { - source = "./modules/net-vpc-firewall" - project_id = "my-project" - network = "my-network" - admin_ranges_enabled = true - admin_ranges = ["10.0.0.0/8"] + source = "./modules/net-vpc-firewall" + project_id = "my-project" + network = "my-network" + admin_ranges = ["10.0.0.0/8"] custom_rules = { ntp-svc = { description = "NTP service." @@ -55,17 +53,17 @@ module "firewall" { ### No predefined rules -If you don't want any predefined rules, set `admin_ranges_enabled` to `false` and `http_source_ranges`, `https_source_ranges`, `ssh_source_ranges` to an empty list. +If you don't want any predefined rules set `admin_ranges`, `http_source_ranges`, `https_source_ranges` and `ssh_source_ranges` to an empty list. ```hcl module "firewall" { - source = "./modules/net-vpc-firewall" - project_id = "my-project" - network = "my-network" - admin_ranges_enabled = false - http_source_ranges = [] - https_source_ranges = [] - ssh_source_ranges = [] + source = "./modules/net-vpc-firewall" + project_id = "my-project" + network = "my-network" + admin_ranges = [] + http_source_ranges = [] + https_source_ranges = [] + ssh_source_ranges = [] custom_rules = { allow-https = { description = "Allow HTTPS from internal networks." @@ -91,7 +89,6 @@ module "firewall" { | network | Name of the network this set of firewall rules applies to. | string | ✓ | | | project_id | Project id of the project that holds the network. | string | ✓ | | | *admin_ranges* | IP CIDR ranges that have complete access to all subnets. | list(string) | | [] | -| *admin_ranges_enabled* | Enable admin ranges-based rules. | bool | | false | | *custom_rules* | List of custom rule definitions (refer to variables file for syntax). | map(object({...})) | | {} | | *http_source_ranges* | List of IP CIDR ranges for tag-based HTTP rule, defaults to the health checkers ranges. | list(string) | | ["35.191.0.0/16", "130.211.0.0/22", "209.85.152.0/22", "209.85.204.0/22"] | | *https_source_ranges* | List of IP CIDR ranges for tag-based HTTPS rule, defaults to the health checkers ranges. | list(string) | | ["35.191.0.0/16", "130.211.0.0/22", "209.85.152.0/22", "209.85.204.0/22"] | diff --git a/modules/net-vpc-firewall/main.tf b/modules/net-vpc-firewall/main.tf index 0798075db..c196e4705 100644 --- a/modules/net-vpc-firewall/main.tf +++ b/modules/net-vpc-firewall/main.tf @@ -34,7 +34,7 @@ locals { ############################################################################### resource "google_compute_firewall" "allow-admins" { - count = var.admin_ranges_enabled == true ? 1 : 0 + count = length(var.admin_ranges) > 0 ? 1 : 0 name = "${var.network}-ingress-admins" description = "Access from the admin subnet to all subnets" network = var.network diff --git a/modules/net-vpc-firewall/outputs.tf b/modules/net-vpc-firewall/outputs.tf index d722e2f89..5ddb56b1a 100644 --- a/modules/net-vpc-firewall/outputs.tf +++ b/modules/net-vpc-firewall/outputs.tf @@ -18,8 +18,8 @@ output "admin_ranges" { description = "Admin ranges data." value = { - enabled = var.admin_ranges_enabled - ranges = var.admin_ranges_enabled ? join(",", var.admin_ranges) : "" + enabled = length(var.admin_ranges) > 0 + ranges = join(",", var.admin_ranges) } } diff --git a/modules/net-vpc-firewall/variables.tf b/modules/net-vpc-firewall/variables.tf index 1e70c5e00..94755d2e0 100644 --- a/modules/net-vpc-firewall/variables.tf +++ b/modules/net-vpc-firewall/variables.tf @@ -20,12 +20,6 @@ variable "admin_ranges" { default = [] } -variable "admin_ranges_enabled" { - description = "Enable admin ranges-based rules." - type = bool - default = false -} - variable "custom_rules" { description = "List of custom rule definitions (refer to variables file for syntax)." type = map(object({ diff --git a/networking/hub-and-spoke-peering/main.tf b/networking/hub-and-spoke-peering/main.tf index a4800de43..6a6b3bfa8 100644 --- a/networking/hub-and-spoke-peering/main.tf +++ b/networking/hub-and-spoke-peering/main.tf @@ -74,11 +74,10 @@ module "nat-hub" { } module "vpc-hub-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = var.project_id - network = module.vpc-hub.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) + source = "../../modules/net-vpc-firewall" + project_id = var.project_id + network = module.vpc-hub.name + admin_ranges = values(var.ip_ranges) } ################################################################################ @@ -100,11 +99,10 @@ module "vpc-spoke-1" { } module "vpc-spoke-1-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = module.project.project_id - network = module.vpc-spoke-1.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) + source = "../../modules/net-vpc-firewall" + project_id = module.project.project_id + network = module.vpc-spoke-1.name + admin_ranges = values(var.ip_ranges) } module "nat-spoke-1" { @@ -146,11 +144,10 @@ module "vpc-spoke-2" { } module "vpc-spoke-2-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = module.project.project_id - network = module.vpc-spoke-2.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) + source = "../../modules/net-vpc-firewall" + project_id = module.project.project_id + network = module.vpc-spoke-2.name + admin_ranges = values(var.ip_ranges) } module "nat-spoke-2" { diff --git a/networking/hub-and-spoke-vpn/main.tf b/networking/hub-and-spoke-vpn/main.tf index f3a1dec44..e1d61bc34 100644 --- a/networking/hub-and-spoke-vpn/main.tf +++ b/networking/hub-and-spoke-vpn/main.tf @@ -48,11 +48,10 @@ module "vpc-hub" { } module "vpc-hub-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = var.project_id - network = module.vpc-hub.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) + source = "../../modules/net-vpc-firewall" + project_id = var.project_id + network = module.vpc-hub.name + admin_ranges = values(var.ip_ranges) } module "vpn-hub-a" { @@ -140,11 +139,10 @@ module "vpc-spoke-1" { } module "vpc-spoke-1-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = var.project_id - network = module.vpc-spoke-1.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) + source = "../../modules/net-vpc-firewall" + project_id = var.project_id + network = module.vpc-spoke-1.name + admin_ranges = values(var.ip_ranges) } module "vpn-spoke-1" { @@ -204,11 +202,10 @@ module "vpc-spoke-2" { } module "vpc-spoke-2-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = var.project_id - network = module.vpc-spoke-2.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) + source = "../../modules/net-vpc-firewall" + project_id = var.project_id + network = module.vpc-spoke-2.name + admin_ranges = values(var.ip_ranges) } module "vpn-spoke-2" { diff --git a/networking/ilb-next-hop/vpc-left.tf b/networking/ilb-next-hop/vpc-left.tf index aedf3a4dd..c5f8df222 100644 --- a/networking/ilb-next-hop/vpc-left.tf +++ b/networking/ilb-next-hop/vpc-left.tf @@ -38,12 +38,11 @@ module "vpc-left" { } module "firewall-left" { - source = "../../modules/net-vpc-firewall" - project_id = module.project.project_id - network = module.vpc-left.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) - ssh_source_ranges = ["35.235.240.0/20", "35.191.0.0/16", "130.211.0.0/22"] + source = "../../modules/net-vpc-firewall" + project_id = module.project.project_id + network = module.vpc-left.name + admin_ranges = values(var.ip_ranges) + ssh_source_ranges = ["35.235.240.0/20", "35.191.0.0/16", "130.211.0.0/22"] } module "nat-left" { diff --git a/networking/ilb-next-hop/vpc-right.tf b/networking/ilb-next-hop/vpc-right.tf index 661fd5d47..1bf590e93 100644 --- a/networking/ilb-next-hop/vpc-right.tf +++ b/networking/ilb-next-hop/vpc-right.tf @@ -52,12 +52,11 @@ module "vpc-right" { } module "firewall-right" { - source = "../../modules/net-vpc-firewall" - project_id = module.project.project_id - network = module.vpc-right.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) - ssh_source_ranges = ["35.235.240.0/20", "35.191.0.0/16", "130.211.0.0/22"] + source = "../../modules/net-vpc-firewall" + project_id = module.project.project_id + network = module.vpc-right.name + admin_ranges = values(var.ip_ranges) + ssh_source_ranges = ["35.235.240.0/20", "35.191.0.0/16", "130.211.0.0/22"] } module "nat-right" { diff --git a/networking/onprem-google-access-dns/main.tf b/networking/onprem-google-access-dns/main.tf index 9f39265d9..caf665630 100644 --- a/networking/onprem-google-access-dns/main.tf +++ b/networking/onprem-google-access-dns/main.tf @@ -71,12 +71,11 @@ module "vpc" { } module "vpc-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = var.project_id - network = module.vpc.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) - ssh_source_ranges = var.ssh_source_ranges + source = "../../modules/net-vpc-firewall" + project_id = var.project_id + network = module.vpc.name + admin_ranges = values(var.ip_ranges) + ssh_source_ranges = var.ssh_source_ranges } module "vpn1" { diff --git a/networking/shared-vpc-gke/main.tf b/networking/shared-vpc-gke/main.tf index da404f04e..fa11ebf4e 100644 --- a/networking/shared-vpc-gke/main.tf +++ b/networking/shared-vpc-gke/main.tf @@ -130,11 +130,10 @@ module "vpc-shared" { } module "vpc-shared-firewall" { - source = "../../modules/net-vpc-firewall" - project_id = module.project-host.project_id - network = module.vpc-shared.name - admin_ranges_enabled = true - admin_ranges = values(var.ip_ranges) + source = "../../modules/net-vpc-firewall" + project_id = module.project-host.project_id + network = module.vpc-shared.name + admin_ranges = values(var.ip_ranges) } module "nat" {