Initial commit of firewall-rules module

examples/ml-slurm.yaml

@@ -41,16 +41,51 @@ vars:
 deployment_groups:
 - group: primary
   modules:
-  - id: network1
+  - id: network
     source: modules/network/pre-existing-vpc
+
+  # this example anticipates that the VPC default network has internal traffic
+  # allowed and IAP tunneling for SSH connections
+  - id: firewall_rule
+    source: modules/network/firewall-rules
+    use:
+    - network
+    settings:
+      ingress_rules:
+      - name: $(vars.deployment_name)-allow-internal-traffic
+        description: Allow internal traffic
+        destination_ranges:
+        - $(network.subnetwork_address)
+        source_ranges:
+        - $(network.subnetwork_address)
+        allow:
+        - protocol: tcp
+          ports:
+          - 0-65535
+        - protocol: udp
+          ports:
+          - 0-65535
+        - protocol: icmp
+      - name: $(vars.deployment_name)-allow-iap-ssh
+        description: Allow IAP-tunneled SSH connections
+        destination_ranges:
+        - $(network.subnetwork_address)
+        source_ranges:
+        - 35.235.240.0/20
+        allow:
+        - protocol: tcp
+          ports:
+          - 22
+
   - id: homefs
     source: modules/file-system/filestore
     use:
-    - network1
+    - network
     settings:
       local_mount: /home
       size_gb: 2560
       filestore_tier: BASIC_SSD
+
   - id: script
     source: modules/scripts/startup-script
     settings:
@@ -129,7 +164,7 @@ deployment_groups:
     source: modules/packer/custom-image
     kind: packer
     use:
-    - network1
+    - network
     - script
     settings:
       # give VM a public IP to ensure startup script can reach public internet
@@ -208,7 +243,7 @@ deployment_groups:
     use:
     - a2_node_group
     - homefs
-    - network1
+    - network
     settings:
       partition_name: a2
       is_default: true
@@ -227,7 +262,7 @@ deployment_groups:
     use:
     - g2_node_group
     - homefs
-    - network1
+    - network
     settings:
       partition_name: g2
       enable_placement: false
@@ -236,7 +271,7 @@ deployment_groups:
   - id: slurm_controller
     source: community/modules/scheduler/schedmd-slurm-gcp-v5-controller
     use:
-    - network1
+    - network
     - a2_partition
     - g2_partition
     - homefs
@@ -249,7 +284,7 @@ deployment_groups:
     source: community/modules/scheduler/schedmd-slurm-gcp-v5-login
     use:
     - examples
-    - network1
+    - network
     - slurm_controller
     settings:
       disable_login_public_ips: false

modules/README.md

@@ -125,9 +125,12 @@ Modules that are still in development and less stable are labeled with the
   regional subnetworks and firewall rules.
 * **[pre-existing-vpc]** ![core-badge] : Used to connect newly
   built components to a pre-existing VPC network.
+* **[firewall-rules]** ![core-badge] ![experimental-badge]: Add custom firewall
+  rules to existing networks (commonly used with [pre-existing-vpc])
 
 [vpc]: network/vpc/README.md
 [pre-existing-vpc]: network/pre-existing-vpc/README.md
+[firewall-rules]: network/firewall-rules/README.md
 
 ### Packer
 

modules/network/firewall-rules/README.md

@@ -0,0 +1,107 @@
+## Description
+
+This module facilitates the creation of custom firewall rules for existing
+networks.
+
+## Example usage
+
+This module can be used by other Toolkit modules to create application-specific
+firewall rules or in conjunction with the [pre-existing-vpc] module to enable
+traffic in existing networks. The snippet below is drawn from the
+[ml-slurm.yaml] example:
+
+```yaml
+- group: primary
+  modules:
+  - id: network
+    source: modules/network/pre-existing-vpc
+
+  # this example anticipates that the VPC default network has internal traffic
+  # allowed and IAP tunneling for SSH connections
+  - id: firewall_rule
+    source: modules/network/firewall-rules
+    use:
+    - network
+    settings:
+      ingress_rules:
+      - name: $(vars.deployment_name)-allow-internal-traffic
+        description: Allow internal traffic
+        destination_ranges:
+        - $(network.subnetwork_address)
+        source_ranges:
+        - $(network.subnetwork_address)
+        allow:
+        - protocol: tcp
+          ports:
+          - 0-65535
+        - protocol: udp
+          ports:
+          - 0-65535
+        - protocol: icmp
+      - name: $(vars.deployment_name)-allow-iap-ssh
+        description: Allow IAP-tunneled SSH connections
+        destination_ranges:
+        - $(network.subnetwork_address)
+        source_ranges:
+        - 35.235.240.0/20
+        allow:
+        - protocol: tcp
+          ports:
+          - 22
+```
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+Copyright 2024 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
+| <a name="requirement_google"></a> [google](#requirement\_google) | >= 3.83 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_google"></a> [google](#provider\_google) | >= 3.83 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_firewall_rule"></a> [firewall\_rule](#module\_firewall\_rule) | terraform-google-modules/network/google//modules/firewall-rules | ~> 9.0 |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [google_compute_subnetwork.subnetwork](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/compute_subnetwork) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_egress_rules"></a> [egress\_rules](#input\_egress\_rules) | List of egress rules | <pre>list(object({<br>    name                    = string<br>    description             = optional(string, null)<br>    disabled                = optional(bool, null)<br>    priority                = optional(number, null)<br>    destination_ranges      = optional(list(string), [])<br>    source_ranges           = optional(list(string), [])<br>    source_tags             = optional(list(string))<br>    source_service_accounts = optional(list(string))<br>    target_tags             = optional(list(string))<br>    target_service_accounts = optional(list(string))<br><br>    allow = optional(list(object({<br>      protocol = string<br>      ports    = optional(list(string))<br>    })), [])<br>    deny = optional(list(object({<br>      protocol = string<br>      ports    = optional(list(string))<br>    })), [])<br>    log_config = optional(object({<br>      metadata = string<br>    }))<br>  }))</pre> | `[]` | no |
+| <a name="input_ingress_rules"></a> [ingress\_rules](#input\_ingress\_rules) | List of ingress rules | <pre>list(object({<br>    name                    = string<br>    description             = optional(string, null)<br>    disabled                = optional(bool, null)<br>    priority                = optional(number, null)<br>    destination_ranges      = optional(list(string), [])<br>    source_ranges           = optional(list(string), [])<br>    source_tags             = optional(list(string))<br>    source_service_accounts = optional(list(string))<br>    target_tags             = optional(list(string))<br>    target_service_accounts = optional(list(string))<br><br>    allow = optional(list(object({<br>      protocol = string<br>      ports    = optional(list(string))<br>    })), [])<br>    deny = optional(list(object({<br>      protocol = string<br>      ports    = optional(list(string))<br>    })), [])<br>    log_config = optional(object({<br>      metadata = string<br>    }))<br>  }))</pre> | `[]` | no |
+| <a name="input_subnetwork_self_link"></a> [subnetwork\_self\_link](#input\_subnetwork\_self\_link) | The self link of the subnetwork whose global network firewall rules will be modified. | `string` | n/a | yes |
+
+## Outputs
+
+No outputs.
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+
+[pre-existing-vpc]: ../pre-existing-vpc/README.md
+[ml-slurm.yaml]: ../../../examples/ml-slurm.yaml

modules/network/firewall-rules/main.tf

@@ -0,0 +1,31 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+# the google_compute_network data source does not allow identification by
+# self_link, which uniquely identifies subnet, project, and network
+data "google_compute_subnetwork" "subnetwork" {
+  self_link = var.subnetwork_self_link
+}
+
+module "firewall_rule" {
+  source       = "terraform-google-modules/network/google//modules/firewall-rules"
+  version      = "~> 9.0"
+  project_id   = data.google_compute_subnetwork.subnetwork.project
+  network_name = data.google_compute_subnetwork.subnetwork.network
+
+  ingress_rules = var.ingress_rules
+  egress_rules  = var.egress_rules
+}

modules/network/firewall-rules/metadata.yaml

@@ -0,0 +1,19 @@
+# Copyright 2023 "Google LLC"
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+---
+
+spec:
+  requirements:
+    services:
+    - compute.googleapis.com

modules/network/firewall-rules/variables.tf

@@ -0,0 +1,76 @@
+# Copyright 2024 "Google LLC"
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+variable "subnetwork_self_link" {
+  description = "The self link of the subnetwork whose global network firewall rules will be modified."
+  type        = string
+}
+
+variable "ingress_rules" {
+  description = "List of ingress rules"
+  default     = []
+  type = list(object({
+    name                    = string
+    description             = optional(string, null)
+    disabled                = optional(bool, null)
+    priority                = optional(number, null)
+    destination_ranges      = optional(list(string), [])
+    source_ranges           = optional(list(string), [])
+    source_tags             = optional(list(string))
+    source_service_accounts = optional(list(string))
+    target_tags             = optional(list(string))
+    target_service_accounts = optional(list(string))
+
+    allow = optional(list(object({
+      protocol = string
+      ports    = optional(list(string))
+    })), [])
+    deny = optional(list(object({
+      protocol = string
+      ports    = optional(list(string))
+    })), [])
+    log_config = optional(object({
+      metadata = string
+    }))
+  }))
+}
+
+variable "egress_rules" {
+  description = "List of egress rules"
+  default     = []
+  type = list(object({
+    name                    = string
+    description             = optional(string, null)
+    disabled                = optional(bool, null)
+    priority                = optional(number, null)
+    destination_ranges      = optional(list(string), [])
+    source_ranges           = optional(list(string), [])
+    source_tags             = optional(list(string))
+    source_service_accounts = optional(list(string))
+    target_tags             = optional(list(string))
+    target_service_accounts = optional(list(string))
+
+    allow = optional(list(object({
+      protocol = string
+      ports    = optional(list(string))
+    })), [])
+    deny = optional(list(object({
+      protocol = string
+      ports    = optional(list(string))
+    })), [])
+    log_config = optional(object({
+      metadata = string
+    }))
+  }))
+}

modules/network/firewall-rules/versions.tf

@@ -0,0 +1,29 @@
+/**
+ * Copyright 2022 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">= 3.83"
+    }
+  }
+  provider_meta "google" {
+    module_name = "blueprints/terraform/hpc-toolkit:firewall-rules/v1.27.0"
+  }
+
+  required_version = ">= 1.3"
+}