Support custom headers on backend bucket and backend service

[Sytten]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

It is now possible to set custom request and response headers on backend services and backend buckets.

New or Affected Resource(s)

• google_compute_backend_bucket
• google_compute_backend_service

Potential Terraform Configuration

resource "google_compute_backend_bucket" "image_backend" {
  name        = "image-backend-bucket"
  bucket_name = google_storage_bucket.image_bucket.name

  custom_request_header {
    name = "MyRequestHeader"
    value = "MyRequestHeaderValue"
  }

  custom_response_header {
    name = "MyResponseHeader"
    value = "MyResponseHeaderValue"
  }
}

References

• https://cloud.google.com/load-balancing/docs/custom-headers

[cagataygurturk]

@ndmckinley this issue can be closed now :)

[nat-henderson]

Ah of course, thank you. :)

[lpzdvd-packlink]

@ndmckinley @cagataygurturk I'm trying it for HSTS header and it does not seem to work.
should it be block?
not sure about implementation considering examples...

custom_response_headers {
  strict-transport-security = "max-age=63072000; includeSubDomains; preload"
}

[lpzdvd-packlink]

@ndmckinley @cagataygurturk I'm trying it for HSTS header and it does not seem to work.
should it be block?
not sure about implementation considering examples...

custom_response_headers {
  strict-transport-security = "max-age=63072000; includeSubDomains; preload"
}

In fact I also tried a dummy example like:

custom_response_headers = ["color: blue"]

and it seems to be the terraform right syntax but I've been unable to get any header working (also tried X-Frame-Options: DENY as seen in doc).

Custom headers only seems to be working using UI or gcloud command an are visible after 5-6 minutes. Opened a case in GCP and they confirmed it. BTW, it does not work in GKE ingress controllers either.

[cagataygurturk]

@lpzdvd-packlink You are right. Terraform succeeds but the setting is not persisted.

@ndmckinley do you think it is a Terraform issue?

[nat-henderson]

I think that's unlikely - I am not sure how the tests passed if the values are not persisted, let me ask this week's onduty to look into that. @c2thorn, any guesses?

[lpzdvd-packlink]

Just to clarify,

I've been looking for an answer last weeks because we're passing trough an audit process and it requires custom response headers. It started in GKE ingress controllers (implements HTTP(s) LB) and we realized there are no BackedConfig spec but you can manually patch ingress (using gcloud CLI or UI). It works but is erased after some minutes. Btw, this feature is not in the product roadmap.

The we tried pure L7 LBs outside GKE scope. We patched using UI and gcloud and got header exactly 6 minutes after it has been applied but there was no terraform support and then I landed in this issue. Btw, it worked for dummy thing like color: blue but got problems in real headers (maybe not so RFC compliant).

Hope it helps.

[c2thorn]

Looks like customResponseHeaders is available in the beta API but not v1. Since the google-beta provider uses the beta API, that seems to be working and those tests are passing. @lpzdvd-packlink @cagataygurturk can you confirm if using the google-beta provider solves this for you? I'll remove the field from the GA provider.

[cagataygurturk]

@c2thorn Correct, with the beta provider the property is properly applied and persisted. Thanks for fixing and apologies for the bug I have created!

P.S.: Cloud Console does not specify this feature as beta, that's why its beta status did not catch my attention.

[lpzdvd-packlink]

It will be nice if examples are updated as it's not clear if custom headers is a block or list(string).

[lpzdvd-packlink]

@c2thorn it works as expected.
Just one question, how do we know it is promoted again to GA?

[c2thorn]

@lpzdvd-packlink We can promote to GA after the API promotes the field to GA, and I am not sure when that would be. The google provider changelog will have an entry for when it is promoted to GA, and the field documentation will no longer have the Beta tag.

[cagataygurturk]

It will be nice if examples are updated as it's not clear if custom headers is a block or list(string).

@lpzdvd-packlink The example usage is here and it is as same as custom request headers: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_backend_service#example-usage---backend-service-network-endpoint

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!