Initial development (#1)

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

.github/dependabot.yml

@@ -0,0 +1,12 @@
+# Dependabot
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+
+    # NOTE: The "/" here is for checking for workflow files in .github/workflows
+
+    directory: /
+    schedule:
+      interval: daily

.github/workflows/add-to-projects.yml

@@ -0,0 +1,21 @@
+name: Add To GitHub Projects
+
+on:
+  issues:
+    types:
+      - opened
+  pull_request:
+    types:
+      - opened
+
+permissions:
+  issues: write
+
+jobs:
+  add-to-osinfra-project:
+    name: Open Source Infrastructure (as Code)
+    uses: osinfra-io/github-misc-called-workflows/.github/workflows/add-to-project.yml@v0.1.5
+    with:
+     project_id: 1
+    secrets:
+     add_to_project_pat: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/dependabot.yml

@@ -0,0 +1,13 @@
+name: Dependabot Approve and Merge
+
+on: pull_request_target
+
+permissions:
+  contents: read
+
+jobs:
+  dependabot:
+    name: Dependabot
+    uses: osinfra-io/github-misc-called-workflows/.github/workflows/dependabot.yml@v0.1.5
+    secrets:
+      pr_approve_and_merge_pat: ${{ secrets.PR_APPROVE_AND_MERGE_PAT }}

.github/workflows/test.yml

@@ -0,0 +1,23 @@
+name: Terraform Tests
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+    paths-ignore:
+      - "**.md"
+
+permissions:
+  id-token: write
+
+jobs:
+  tests:
+    name: Tests
+    uses: osinfra-io/github-terraform-gcp-called-workflows/.github/workflows/test.yml@v0.2.4
+    if: github.actor != 'dependabot[bot]'
+    with:
+      service_account: plt-lz-testing-github@ptl-lz-terraform-tf91-sb.iam.gserviceaccount.com
+      terraform_version: ${{ vars.TERRAFORM_VERSION }}
+      workload_identity_provider: projects/746490462722/locations/global/workloadIdentityPools/github-actions/providers/github-actions-oidc

.gitignore

@@ -0,0 +1,43 @@
+# .gitignore
+# https://docs.github.com/en/get-started/getting-started-with-git/ignoring-files
+
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+
+# Ignore provider lock file
+.terraform.lock.hcl
+
+# Ignore any local.tfvars. Most .tfvars files are managed as part of configuration and so should
+# be included in version control.
+local.tfvars
+
+# Provider.tf is used for local development of modules and shouldn't be added to repos.
+provider.tf
+
+# Ignore override files as they are usually used to override ressources locally
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Ignore plan output files
+plan.out
+
+# Ignore Infracost directories and files
+.infracost
+
+# Other Files
+*.log
+*.bak
+*.swp
+*.tmp
+*.gz
+*.tgz
+*.tar

.pre-commit-config.yaml

@@ -0,0 +1,37 @@
+# Pre-commit
+# https://github.com/pre-commit/pre-commit
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: check-yaml
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-symlinks
+
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.92.0
+    hooks:
+      - id: terraform_fmt
+
+      # To speed up local validation add the following to your ~/.zshrc:
+      # export TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin-cache
+
+      - id: terraform_validate
+        args:
+          - --hook-config=--retry-once-with-cleanup=true
+          - --tf-init-args=-upgrade
+        exclude: tests/fixtures/shared
+
+      # Always run after terraform_validate
+
+      - id: terraform_docs
+
+  - repo: https://github.com/bridgecrewio/checkov.git
+    rev: 3.2.195
+    hooks:
+      - id: checkov
+        verbose: true
+        args:
+          - --quiet

.terraform-docs.yml

@@ -0,0 +1,14 @@
+# Terraform Docs
+# https://github.com/terraform-docs/terraform-docs
+
+formatter: markdown
+
+sections:
+  hide:
+    - requirements
+
+settings:
+  anchor: false
+  hide-empty: true
+  html: false
+  indent: 3

README.md

@@ -0,0 +1,103 @@
+# <img align="left" width="45" height="45" src="https://github.com/osinfra-io/terraform-google-vpc/assets/1610100/b99acbaf-aea0-4004-b3cf-641eafa137c4"> Google Cloud Platform - Network Module
+
+**[GitHub Actions](https://github.com/osinfra-io/terraform-google-vpc/actions):**
+
+[![Terraform Tests](https://github.com/osinfra-io/terraform-google-vpc/actions/workflows/test.yml/badge.svg)](https://github.com/osinfra-io/terraform-google-vpc/actions/workflows/test.yml) [![Dependabot](https://github.com/osinfra-io/terraform-google-vpc/actions/workflows/dependabot.yml/badge.svg)](https://github.com/osinfra-io/terraform-google-vpc/actions/workflows/dependabot.yml)
+
+**[Infracost](https://www.infracost.io):**
+
+[![infracost](https://img.shields.io/endpoint?url=https://dashboard.api.infracost.io/shields/json/cbeecfe3-576f-4553-984c-e451a575ee47/repos/19c599ec-c2ad-4031-8480-2110b02be0eb/branch/d36a38e2-44a6-4e64-a082-5f81bd3f9f61)](https://dashboard.infracost.io/org/osinfra-io/repos/19c599ec-c2ad-4031-8480-2110b02be0eb?tab=settings)
+
+💵 Monthly estimates based on Infracost baseline costs.
+
+## Repository Description
+
+Terraform **example** module for a Google Cloud Platform network.
+
+> [!NOTE]
+> We do not recommend consuming this module like you might a [public module](https://registry.terraform.io/browse/modules). It is a baseline, something you can fork, potentially maintain, and modify to fit your organization's needs. Using public modules vs. writing your own has various [drivers and trade-offs](https://docs.osinfra.io/fundamentals/architecture-decision-records/adr-0003) that your organization should evaluate.
+
+## 🔩 Usage
+
+> [!TIP]
+> You can check the [tests/fixtures](tests/fixtures) directory for example configurations. These fixtures set up the system for testing by providing all the necessary initial code, thus creating good examples on which to base your configurations.
+
+## <img align="left" width="35" height="35" src="https://github.com/osinfra-io/github-organization-management/assets/1610100/39d6ae3b-ccc2-42db-92f1-276a5bc54e65"> Development
+
+Our focus is on the core fundamental practice of platform engineering, Infrastructure as Code.
+
+>Open Source Infrastructure (as Code) is a development model for infrastructure that focuses on open collaboration and applying relative lessons learned from software development practices that organizations can use internally at scale. - [Open Source Infrastructure (as Code)](https://www.osinfra.io)
+
+To avoid slowing down stream-aligned teams, we want to open up the possibility for contributions. The Open Source Infrastructure (as Code) model allows team members external to the platform team to contribute with only a slight increase in cognitive load. This section is for developers who want to contribute to this repository, describing the tools used, the skills, and the knowledge required, along with Terraform documentation.
+
+See the documentation for setting up a local development environment [here](https://docs.osinfra.io/fundamentals/development-setup).
+
+### 🛠️ Tools
+
+- [checkov](https://github.com/bridgecrewio/checkov)
+- [infracost](https://github.com/infracost/infracost)
+- [pre-commit](https://github.com/pre-commit/pre-commit)
+- [pre-commit-terraform](https://github.com/antonbabenko/pre-commit-terraform)
+- [terraform-docs](https://github.com/terraform-docs/terraform-docs)
+
+### 📋 Skills and Knowledge
+
+Links to documentation and other resources required to develop and iterate in this repository successfully.
+
+- [cloud dns](https://cloud.google.com/dns/docs)
+- [cloud nat](https://cloud.google.com/nat/docs/overview)
+- [firewall](https://cloud.google.com/vpc/docs/firewalls)
+- [shared vpc](https://cloud.google.com/vpc/docs/shared-vpc)
+- [subnets](https://cloud.google.com/vpc/docs/subnets)
+- [vpc](https://cloud.google.com/vpc/docs/vpc)
+
+### 🔍 Tests
+
+You'll need to be a member of the [platform-contributors](https://groups.google.com/a/osinfra.io/g/platform-contributors) Google Group to run the tests. This group manages access to the resource hierarchy's `Testing/Sandbox` folder. You can request access to this group by opening an issue [here](https://github.com/osinfra-io/google-cloud-hierarchy/issues/new?assignees=&labels=enhancement&projects=&template=add-update-identity-group.yml&title=Add+or+update+identity+group).
+
+```none
+terraform init
+```
+
+```none
+terraform test
+```
+
+## 📓 Terraform Documentation
+
+> A child module automatically inherits default (un-aliased) provider configurations from its parent. The provider versions below are informational only and do **not** need to align with the provider configurations from its parent.
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+### Providers
+
+| Name | Version |
+|------|---------|
+| google | 5.38.0 |
+
+### Resources
+
+| Name | Type |
+|------|------|
+| [google_compute_firewall.rules](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall) | resource |
+| [google_compute_network.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_network) | resource |
+| [google_compute_shared_vpc_host_project.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_shared_vpc_host_project) | resource |
+| [google_compute_shared_vpc_service_project.this](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_shared_vpc_service_project) | resource |
+
+### Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| name | Name of the network to create | `string` | `"osinfra-vpc"` | no |
+| project | The ID of the project in which the resource belongs | `string` | n/a | yes |
+| rules | List of firewall rule definitions | ```list(object({ allow = optional(list(object({ ports = list(string) protocol = string })), []) deny = optional(list(object({ ports = list(string) protocol = string })), []) description = optional(string) direction = string log_config_enabled = optional(bool, true) log_config_metadata = optional(string, "INCLUDE_ALL_METADATA") name = string priority = optional(number) ranges = optional(list(string)) source_tags = optional(list(string)) target_tags = optional(list(string)) }))``` | `[]` | no |
+| shared\_vpc | Enable VPC sharing | `bool` | `false` | no |
+| shared\_vpc\_service\_projects | The set of service projects to attach to the shared VPC | `set(string)` | `[]` | no |
+
+### Outputs
+
+| Name | Description |
+|------|-------------|
+| name | The network name |
+| project | The ID of the project in which the resource belongs |
+| self\_link | The URI of the created resource |
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

SECURITY.md

@@ -7,4 +7,4 @@ the community, but it does come with some risks.
 ## Reporting a Vulnerability
 
 Privately discuss, fix, and publish information about security vulnerabilities in this repository by drafting a new
-[security advisory](https://github.com/osinfra-io/terraform-google-network/security/advisories/new).
+[security advisory](https://github.com/osinfra-io/terraform-google-vpc/security/advisories/new).

dns/main.tf

@@ -0,0 +1,34 @@
+# DNS Zone Managed Resource
+# https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/dns_managed_zone
+
+resource "google_dns_managed_zone" "this" {
+
+  # Ensure that DNSSEC is enabled for Cloud DNS
+  # checkov:skip=CKV_GCP_16: False positive
+
+  description = var.description
+  dns_name    = var.dns_name
+  labels      = var.labels
+  name        = var.name
+  project     = var.project
+  visibility  = var.visibility
+
+  dynamic "dnssec_config" {
+    for_each = var.visibility != "public" ? [] : [1]
+    content {
+      state = "on"
+    }
+  }
+
+  dynamic "private_visibility_config" {
+    for_each = var.visibility != "private" ? [] : length(var.private_visibility_config_networks) == 0 ? [] : [1]
+    content {
+      dynamic "networks" {
+        for_each = var.private_visibility_config_networks
+        content {
+          network_url = networks.value
+        }
+      }
+    }
+  }
+}

dns/outputs.tf

@@ -0,0 +1,14 @@
+output "name" {
+  description = "The DNS zone name"
+  value       = google_dns_managed_zone.this.name
+}
+
+output "dns_name" {
+  description = "The DNS zone domain name"
+  value       = google_dns_managed_zone.this.dns_name
+}
+
+output "name_servers" {
+  description = "The DNS zone name servers"
+  value       = google_dns_managed_zone.this.name_servers
+}

dns/variables.tf

@@ -0,0 +1,37 @@
+variable "description" {
+  description = "A textual description field. Defaults to 'Managed by Terraform'"
+  type        = string
+  default     = null
+}
+
+variable "dns_name" {
+  description = "The DNS name of this managed zone, for instance 'example.com.' (must end with a period)"
+  type        = string
+}
+
+variable "labels" {
+  description = "A map of key/value pairs to assign to the resources being created"
+  type        = map(string)
+  default     = {}
+}
+
+variable "name" {
+  description = "User assigned name for this resource. Must be unique within the project"
+  type        = string
+}
+
+variable "private_visibility_config_networks" {
+  description = "For privately visible zones, the set of Virtual Private Cloud network resources that the zone is visible from"
+  type        = list(string)
+  default     = []
+}
+
+variable "project" {
+  description = "The ID of the project in which the resource belongs"
+  type        = string
+}
+
+variable "visibility" {
+  description = "The zone's visibility: public zones are exposed to the Internet, while private zones are visible only to Virtual Private Cloud resources"
+  type        = string
+}