github GoogleCloudPlatform/cloud-foundation-fabric v60.0.0
on GitHub

6 hours ago

Breaking Changes

  • modules/cloud-function-v1: function_config.runtime now defaults to python312 instead of EOL python310. [#4368]
  • Minimum supported google/google-beta provider version is now 8.10.0. [#4364]
  • modules/cloud-function-v2: function_config.runtime now defaults to python313 instead of EOL python310. [#4360]
  • modules/net-cloud-armor: project_id is replaced by parent_id = { project_id = ... }. [#4286]
  • modules/geap-agent-gateway: domain: and allAuthenticatedUsers principals in access_policies rules are no longer converted to IAM v3 URIs, as the former produced an invalid principalSet://goog/cloudIdentityCustomerId/ identifier and the latter has no IAM v3 equivalent (it was mapped to principalSet://goog/public:all, which also covers unauthenticated callers). Replace domain: with principalSet://goog/cloudIdentityCustomerId/CUSTOMER_ID and remove allAuthenticatedUsers. [#4333]
  • modules/secret-manager: versions.*.data is now an object with value, path and wo_version; data_config has been removed and is_base64 moved to versions.*.is_base64. [#4329]
  • modules/organization: client_secret in workforce_identity_pools providers (identity_provider.oidc, oauth2_client_config.extra_attributes, oauth2_client_config.extended_attributes) is now an object with value, path and wo_version; the FAST 0-org-setup organization schema follows. [#4329]
  • fast/project-templates/data-mongodb: database_users.*.password is now an object with value, path and wo_version; password_wo and password_wo_version have been removed. [#4329]
  • modules/net-cloudnat: config_port_allocation.enable_dynamic_port_allocation now defaults to true when type = "PRIVATE" (matching the Compute Engine API default). Existing PRIVATE NAT configurations that only set enable_endpoint_independent_mapping = false and want to keep static port allocation must explicitly set enable_dynamic_port_allocation = false. [#4325]
  • fast/stages/2-security: ca_pools in outputs.tf and 2-security.auto.tfvars.json is now a flat map(string) of pool IDs (pool => pool_id) instead of a map of objects ({ id, ca_ids, location }), accompanied by flat ca_ids and ca_chains maps ("${pool}-${ca}" => value). Subordinate CA pools now use the module.cas-subordinate address. [#4306]
  • fast/addons/2-networking-ngfw and fast/addons/2-networking-swp: certificate_authority_pools has been replaced by flat ca_pools and ca_ids map(string) variables, and certificate_authorities / certificate_authority have been aligned with modules/certificate-authority-service (is_self_signed replacing type, enterprise_tier and publishing_options replacing tier in ca_pool_config.create_pool). Subordinate CA pools in 2-networking-ngfw now use the module.cas-subordinate address. [#4306]
  • fast/stages/0-org-setup: the hardened dataset now enforces additional organization policies and custom constraints by default (ainotebooks.disableTerminal, ainotebooks.requireAutoUpgradeSchedule, compute.disableSshInBrowser, compute.requireOsConfig, firestore.managed.disableEnhancedTextSearch, pubsub.managed.disableSubscriptionMessageTransforms, pubsub.managed.disableTopicMessageTransforms, run.managed.disableEphemeralDisk, run.managed.disableJobsEphemeralDisk, run.managed.disableWorkerPoolsEphemeralDisk, custom.apikeysRequireApiTargetRestrictions, custom.cloudsqlDisablePostgreSQLLogHostnameFlag, custom.cloudsqlDisablePostgreSQLLogParserStatsFlag, custom.cloudsqlDisablePostgreSQLLogPlannerStatsFlag, custom.cloudsqlDisablePostgreSQLLogStatementStatsFlag, custom.cloudsqlRequirePostgreSQLLogDurationFlag, custom.cloudsqlRequirePostgreSQLLogTempFilesFlag, custom.discoveryengineDisableNonGcpDataStores, custom.gkeRequireSecurityPosture, custom.storageRequireRetentionOrSoftDelete, custom.vertexaiRuntimeTemplateDisableInternetAccess, custom.vertexaiRuntimeTemplateRequireIdleShutdown, custom.vertexaiRuntimeTemplateRequireSecureBoot, custom.vertexaiWorkbenchDisableDefaultServiceAccount, custom.vertexaiWorkbenchRequireAutoUpgrade, custom.vertexaiWorkbenchRequireDeleteToTrash, custom.vertexaiWorkbenchRequireIntegrityMonitoring, custom.vertexaiWorkbenchRequireSecureBoot, and custom.vertexaiWorkbenchRequireVtpm), and defines 15 additional custom constraints and 20 organization policies as commented-out opt-in examples across organization/org-policies/*.yaml. [#4302]
  • fast/stages/0-org-setup: the hardened dataset now enforces ainotebooks.accessMode (service-account), custom.cloudkmsAllowedPurpose, custom.dataprocAllowedImageVersions, and five custom.alloydb* constraints by default, and defines four additional opt-in custom.storage* constraints. [#4292]
  • modules/vpc-sc: vpc_accessible_services.allow_all_restricted_services now defaults to true, automatically including "RESTRICTED-SERVICES" in allowed_services unless explicitly set to false. [#4273]

What's Changed

  • Add backup restore plans, channels, context, agent sandbox and OpenTelemetry to GKE modules by @ludoo in #4260
  • Add service pattern support to vpc-sc accessible services by @ludoo in #4273
  • Quote cloud-init octal permissions and harden cloud-config-container modules by @aghassemlouei in #4271
  • Add lien_reason, log_scopes, and logging_exclusions to project factory schema by @ludoo in #4274
  • Add AI and agent services to FAST VPC-SC restricted services by @zhhuta in #4275
  • Fix documentation checker, tftest formatter, and tfdoc parser bugs by @aghassemlouei in #4279
  • Add distinct instance outputs in modules/alloydb by @btuckVZ in #4281
  • Fix shebang in fast/stages/fast-links.sh for macOS compatibility by @LucaPrete in #4283
  • Update output_files and default perimeter examples in 1-vpcsc README by @LucaPrete in #4284
  • Update factories_config and delegations documentation in 2-networking README by @LucaPrete in #4285
  • Add missing dependencies on Workload Identity Pool in project module by @ludoo in #4289
  • Add security_profile_groups context to net-firewall-policy and FAST 2-networking by @ludoo in #4291
  • Add AlloyDB, Cloud KMS, Dataproc, Cloud Storage, and Vertex AI controls to FAST hardened dataset by @estebanbouza in #4292
  • Fix cloudsql-instance PSC write endpoint DNS and compute-vm storage pool E2E tests by @LucaPrete in #4296
  • Wire URL map header actions, CORS list types, and target HTTP proxy attributes in ALB modules by @aghassemlouei in #4287
  • Apply instance labels to the inline boot disk in compute-vm by @mkawalek in #4290
  • Add Service Directory registration support for global PSC endpoints by @dibaskar-google in #4293
  • Add CMEK support to modules/ai-applications by @zhhuta in #4294
  • Add CAS context interpolations and align FAST NGFW/SWP add-ons by @ludoo in #4303
  • Add compliance org policies and custom constraints to FAST hardened dataset by @estebanbouza in #4302
  • Support Subordinate CA hierarchy in FAST 2-security and NGFW/SWP add-ons by @ludoo in #4306
  • Add disable_l4_lb_firewall_reconciliation support to GKE cluster modules by @jmgreger in #4301
  • Add service connection policies to modules/net-vpc-factory by @threddast in #4305
  • Fix empty URL filtering profile condition in FAST NGFW add-on by @ludoo in #4308
  • Add Vertex AI and Gemini Enterprise controls to FAST hardened dataset by @zhhuta in #4288
  • Add Gemini Code Assist and other AI services to FAST VPC-SC restricted services by @zhhuta in #4309
  • Fix outdated dataset paths and examples in FAST 0-org-setup README by @ludoo in #4322
  • Fix folder automation and bucket prefix handling in project factory by @ludoo in #4324
  • Fix outdated dataset paths and output file docs in FAST 2-project-factory by @ludoo in #4323
  • Improve Private NAT support in modules/net-cloudnat, modules/net-vpc, and 2-networking by @sruffilli in #4325
  • Fix automation context, dependencies, and schemas in project factory by @ludoo in #4326
  • Add NCC router appliance mode to FAST 2-networking NVAs by @sruffilli in #4313
  • Use GA provider and filter deprecated protocols output in geap-agent-gateway by @LucaPrete in #4311
  • Add ADR on secret values in module interfaces by @ludoo in #4329
  • Forward address, CIDR and IAM contexts in 2-networking and net-vpc by @sruffilli in #4330
  • Allow IAM group authentication in modules/alloydb by @btuckVZ in #4328
  • Add ADR on binding policies to resource manager objects by @ludoo in #4334
  • Fix IAM v3 principal normalization in geap-agent-gateway by @ludoo in #4333
  • Bump fast-uri from 3.1.7 to 3.1.9 in /modules/api-gateway/recipe-multi-region/function by @dependabot[bot] in #4337
  • Bump body-parser from 2.3.0 to 2.4.0 in /modules/api-gateway/recipe-multi-region/function by @dependabot[bot] in #4339
  • Bump qs from 6.16.0 to 6.17.1 in /modules/api-gateway/recipe-multi-region/function by @dependabot[bot] in #4340
  • Bump proxy-addr from 2.0.7 to 2.0.8 in /modules/api-gateway/recipe-multi-region/function by @dependabot[bot] in #4338
  • Format principals from context for IAM deny policies by @V0idC0de in #4331
  • Add FAST 2-networking dataset designer skill and agents-cli extension by @sruffilli in #4342
  • Add hierarchical policy support to modules/net-cloud-armor by @sepehrjavid in #4286
  • Rework region computation to support GCD universe by @karpok78 in #4347
  • Fix TLS inspection policy attachment and CAS service agent in fast/addons/2-networking-swp by @sruffilli in #4353
  • Update CI versions, lockfile overrides, and GitHub Actions by @ludoo in #4349
  • Add cloud_armor_policy to project-factory projects by @sepehrjavid in #4352
  • Add hierarchical Cloud Armor policies to FAST networking and security stages by @sepehrjavid in #4351
  • Remove legacy alpha provider override and add E2E tests in modules/geap-agent-gateway by @LucaPrete in #4356
  • Switch API Gateway recipe function to Python and default CF runtime to python313 by @ludoo in #4360
  • Add Model Armor floor setting support to modules/organization by @zhhuta in #4310
  • Fix context.folder_ids from defaults.yaml being ignored in FAST 2-networking by @maheshrijal in #4359
  • Bump google provider to 8.10.0 by @sruffilli in #4364
  • Fix default runtime in cloud-function-v1 to python312 by @ludoo in #4368
  • Prep v60.0.0 by @LucaPrete in #4369

New Contributors

Full Changelog: v59.2.0...v60.0.0

Check out latest releases or
releases around GoogleCloudPlatform/cloud-foundation-fabric v60.0.0

Don't miss a new cloud-foundation-fabric release

NewReleases is sending notifications on new releases.

Get notifications