v38.0.0

FAST Upgrading Notes

• the moved/v37.4.0-v38.0.0.tf file can be used in the resource management stage to move several changed resources, link or copy it in the stage before applying the new version
• the project factory service accounts and buckets have been renamed, move project factory state to a local file before running the updated resource management, then restart project factory from local state with the new provider

Breaking Changes

• modules/vpc-sc: Referencing ingress/egress policies that are not defined results in an error (previously, undefined directional policies were silently ignored) [#2909]
• modules/project-factory: The automation.buckets attribute has been changed to automation.bucket and support for multiple state buckets has been dropped. Save your state to a local file for any automation-enabled project before applying changes in the project factory. [#2914]
• modules/project: Move input variable service_agents_config.services_enabled to project_reuse.project_attributes.services_enabled [#2900]
• fast/stages/0-boostrap: Enabled restrictProtocolForwardingCreationForTypes organization policy to internal only by default [#2884]
• fast/stages/0-boostrap/data/org-policies-managed: New set of org policies using managed constraints [#2884]
• fast/stages/0-boostrap: If you use var.org_policies_config.constraints.allowed_policy_member_domains or var.org_policies_config.constraints.allowed_policy_member_domains, move their values to a YAML file under bootstrap's org policy factory. [#2878]

What's Changed

• Flexible stage 2s in FAST resource manager by @ludoo in #2840
• Support mulitple universes in bootstrap by @juliocc in #2851
• Allow addons to any flex stage 2 by @juliocc in #2853
• Expose custom constraint factory in bootstrap by @juliocc in #2854
• Workflow fix by @karpok78 in #2864
• Add bucket IAM policy read by @karpok78 in #2872
• New FAST stages diagram by @ludoo in #2875
• Move DRS and essential contact domains to factory by @juliocc in #2878
• Add new set of org policies with managed constraints to FAST bootstrap by @juliocc in #2884
• Add restrictProtocolForwardingCreationForTypes to FAST import policies by @juliocc in #2888
• Address DNS issues with googleapis RPZ and forwarding by @ludoo in #2891
• Update VPC-SC module and FAST stage by @juliocc in #2887
• Add universe support to iam-service-account by @juliocc in #2892
• Add support for project-level log sinks to FAST stage 0 by @ludoo in #2893
• Make service agents work in different universes by @juliocc in #2894
• FAST project templates example by @ludoo in #2897
• Project factory additions, project module reuse implementation by @ludoo in #2899
• New SecOps anonymization pipeline by @simonebruzzechesse in #2794
• Allow passing explicit regions in net test addon subnets by @ludoo in #2902
• Fix default compute.restrictProtocolForwardingCreationForTypes value by @juliocc in #2904
• Update default FAST org policies by @juliocc in #2906
• Add ability to refer to other project service accounts in Project Factory by @wiktorn in #2900
• Add provider output files to project factory stage, single automation bucket in module by @ludoo in #2914
• Add title to VPC-SC directional policies by @juliocc in #2909
• Add error messages for failing interpolations in project-factory by @wiktorn in #2917

New Contributors

• @karpok78 made their first contribution in #2864

Full Changelog: v37.4.0...v38.0.0

v37.4.0

Breaking changes in this release:

• modules/workstation-cluster: Changed the interface for configuration timeouts to object, timeouts are now specified as numbers. [#2911]
• modules/cloudsql-instance: Changed the name of the var.ssl.ssl_mode attribute to var.ssl.mode. [#2910]
• modules/iam-service-account: Removed service account key generation functionality [#2907]
• modules/net-lb-app-ext: Adds the two missing fields for locality_lb_policy and locality_lb_policies with field and block set, validation for both and tests. [#2898]

What's Changed

• Add support for locality policies to net-lb-app-ext module by @jacklever-hub24 in #2898
• Add CA chain output to CAS module by @ludoo in #2901
• Increase the default complexity of Cloud SQL DB passwords by @lyricnz in #2886
• Remove Service Account key generation by @wiktorn in #2907
• Add breaking changes to changelog by @juliocc in #2908
• Add ssl_mode support to cloudsql-instance replicas by @sruffilli in #2910
• Add support for max workstations, refactor timeouts in workstation-cluster module by @ludoo in #2911
• Add generated_id backends output to net-lb-app-ext by @danistrebel in #2913
• Fix dns_keys output in dns module by @nathou in #2915
• Add support for custom error response policies to net_lb_app_ext module by @peter-norton in #2916

New Contributors

• @jacklever-hub24 made their first contribution in #2898
• @peter-norton made their first contribution in #2916

Full Changelog: v37.3.0...v37.4.0

v37.3.0

What's Changed

• Fix ipv6 and align loadbalancer address types by @wiktorn in #2883

Full Changelog: v37.2.0...v37.3.0

v37.2.0

This release addresses several fixes and new features in modules.

What's Changed

• Refactor data catalog tag template module by @ludoo in #2842
• Support project creation in different universes by @juliocc in #2848
• Allow universe-bound projects to exclude services by @juliocc in #2852
• Add cAdvisor Metrics to Autopilot/Standard GKE Cluster by @HeiglAnna in #2841
• Add support for advanced machine features to compute-vm by @ludoo in #2855
• Deprecate composer-2 blueprint by @wiktorn in #2863
• update docs: clarify 0-bootstrap.auto.tfvars creation and outputs_loc… by @ZoranBatman in #2862
• Disable E2E test for direct VPC Egress by @wiktorn in #2867
• Expose org policy parameters by @juliocc in #2869
• Add dependency for compute-vm schedule by @wiktorn in #2870
• Fix KMS E2E tests by @wiktorn in #2871
• Add note about the use of n-stagename/moved/ files during upgrade by @lyricnz in #2874
• Add context to organization policy factories by @juliocc in #2876
• Address outstanding load balancer FRs by @ludoo in #2879

New Contributors

• @HeiglAnna made their first contribution in #2841
• @ZoranBatman made their first contribution in #2862

Full Changelog: v37.1.0...v37.2.0

v37.1.0

This release reverts a breaking change to the FAST project factory introduced in v37.0.0.

What's Changed

• Revert "Allow multiple stage-2 project factories" by @ludoo in #2839

Full Changelog: v37.0.0...v37.1.0

v37.0.0

Please be advised this release has a FAST incompatibility and a breaking bug to FAST stage 1 CI/CD support. Use v37.1.0 instead. We will reintroduce a similar change to the project factory in the next major version.

What's Changed

• Leverage environments for folder and project creation in FAST resman and security by @ludoo in #2787
• Add optional support for fw policies via new vpc_configs variable, refactor factories variable in net stages by @ludoo in #2801
• Implement FAST stage add-ons, refactor netsec as add-on by @ludoo in #2800
• Small fixes and improvements to FAST netsec/net by @ludoo in #2810
• feat: restructure how var files are provided to workflow templates by @Liam-Johnston in #2813
• [FAST] Add missing permission to ngfwEnterprise org by @LucaPrete in #2815
• Fix permadiff in stage 0 vpc-sc service account, add schemas to hierarchical policy YAML files by @ludoo in #2817
• Top level folder factory support for automation SA IAM by @sruffilli in #2818
• Do not create service agent resources in project module for services not explicitly enabled by @ludoo in #2820
• FAST SWP networking add-on, refactor CAS module interface by @ludoo in #2821
• Update service activation in ngfw add-on by @ludoo in #2823
• FAST add-on for networking test resources by @ludoo in #2825
• Fix stage 1 addons provider outputs by @juliocc in #2826
• Small fix to net test add-on context expansion by @ludoo in #2828
• Allow networking stage to be disabled by @juliocc in #2831
• Allow multiple stage-2 project factories by @juliocc in #2834
• Interpolate SAs in tag-level iam by @juliocc in #2836

New Contributors

• @Liam-Johnston made their first contribution in #2813

Full Changelog: v36.2.0...v37.0.0

v36.2.0

Point release just before releasing v37.0.0

What's Changed

• Simplify versions tf and update FAST workflows by @juliocc in #2812
• Add iam_by_principals_additive to project, organization and folder modules by @juliocc in #2814
• Update logging_data_access type by @juliocc in #2816
• modules/compute-vm end-to-end tests and fixes by @wiktorn in #2819
• feat(certificate-manager): add dns_authorizations output by @frits-v in #2830
• Add bucket_create to modules/gcs by @juliocc in #2827
• fix(certificate-manager): reference dns_authz by fully qualified id by @frits-v in #2833
• Update module metadata format and prep v36.2.0 by @juliocc in #2837

Full Changelog: v36.1.0...v36.2.0

v37.0.0-rc2

This release fixes some minor issues in the previous release candidate, and expands on FAST support for add-ons.

FAST

• [#2821] FAST SWP networking add-on, refactor CAS module interface (ludoo)
• [#2818] Top level folder factory support for automation SA IAM (sruffilli)
• [#2817] Fix permadiff in stage 0 vpc-sc service account, add schemas to hierarchical policy YAML files (ludoo)
• [#2815] [FAST] Add missing permission to ngfwEnterprise org (LucaPrete)
• [#2813] feat: restructure how var files are provided to workflow templates (Liam-Johnston)
• [#2810] Small fixes and improvements to FAST netsec/net (ludoo)
• [#2800] Implement FAST stage add-ons, refactor netsec as add-on (ludoo)
• [#2801] Add optional support for fw policies via new vpc_configs variable, refactor factories variable in net stages (ludoo)
• [#2787] Leverage environments for folder and project creation in FAST resman and security (ludoo)

MODULES

• [#2821] incompatible change: FAST SWP networking add-on, refactor CAS module interface (ludoo)
• [#2820] incompatible change: Do not create service agent resources in project module for services not explicitly enabled (ludoo)

v37.0.0-rc1

This is a preview of the upcoming v37.0.0 release, containing breaking changes to FAST.

• [#2800] Implement FAST stage add-ons, refactor netsec as add-on (ludoo)
• [#2801] Add optional support for fw policies via new vpc_configs variable, refactor factories variable in net stages (ludoo)
• [#2787] Leverage environments for folder and project creation in FAST resman and security (ludoo)

v36.1.0

This release will be shortly followed by a release candidate for v37.0.0 containing the FAST changes, as has become our custom.

What's Changed

• Updating yaml naming in prod subnet folder to match other lifecycles by @mtndrew404 in #2733
• SWP module refactor by @ludoo in #2737
• Add basename to SWP policy rules factory by @LucaPrete in #2739
• Support switchover in alloydb module by @simonebruzzechesse in #2738
• Allow override of GKE Nodepool SA Display Name by @robrankin in #2734
• Add support for secret manager config to gke cluster modules by @ludoo in #2741
• Fix parent id lookup for networking and security in resource management stage by @ludoo in #2744
• Add optional automated MD5 generation to net-vlan-attachment module by @LucaPrete in #2745
• Bump path-to-regexp and express in /blueprints/gke/binauthz/image by @dependabot in #2749
• Add ability to autogenerate md5 keys in net-vpn-ha by @LucaPrete in #2748
• Bump path-to-regexp and express in /blueprints/apigee/apigee-x-foundations/functions/instance-monitor by @dependabot in #2752
• Add support for routing mode to net-swp module by @ludoo in #2751
• remove default location in tag value - cloud-run-v2 tags.tf by @Mattible in #2755
• Add path_template_match and path_template_rewrite support to net-lb-app-ext by @rosmo in #2718
• Add disk encyption key to the google_compute_instance_template - Sovereign support by @rune92 in #2750
• Add support for password validation policy to cloudsql module by @ludoo in #2740
• Add confidential compute support to google_dataproc_cluster module, bump provider versions by @steenblik in #2736
• Update net-vlan-attachment module readme by @LucaPrete in #2757
• Ignore ssl certificates if none are passed in net-lb-app-int module by @ludoo in #2764
• Refactor GKE cluster modules access configurations, add support for DNS endpoint by @ludoo in #2761
• Update issue templates by @juliocc in #2765
• Allow optional creation of billing resources in FAST boostrap stage by @ludoo in #2766
• Fix workspace logs sink in FAST bootstrap stage by @ludoo in #2767
• Support customizable resource names in FAST stage 0 by @ludoo in #2768
• Support customizable resource names to fast stage 1 by @ludoo in #2769
• Use separate versions.tofu for OpenTofu constraints by @wiktorn in #2771
• Fix for perma-diff when using PSC NEGs. by @wiktorn in #2772
• [FAST] Remove unused stage 1 CICD variables by @LucaPrete in #2774
• New BindPlane OP Management console on GKE SecOps blueprint by @simonebruzzechesse in #2721
• Add support for log views and log scopes by @juliocc in #2776
• Document tag_bindings definition as map(string) by @juliocc in #2777
• Fix failing tests for OpenTofu by @wiktorn in #2778
• Fix handling of SSL certificates in external load balancer modules by @rodriguezsergio in #2780
• Fix bindplane cos module by @simonebruzzechesse in #2781
• Update net-lb-app-ext security_settings variables by @wenzizone in #2783
• Fix validation message in cas module by @ludoo in #2784
• Make PSA connection more robust by @wiktorn in #2786
• Fix cycle in the autopilot-cluster blueprint by @wiktorn in #2790
• Fabric e2e fixes by @juliocc in #2791
• fix non-empty plan after apply for vertex mlops by @wiktorn in #2792
• Add docker image tag to bindplane config variable by @simonebruzzechesse in #2796
• ADR proposal for FAST add-on stages by @ludoo in #2798
• Add Alerts, Logging, Channels Factories by @joshw123 in #2758
• Added BGP priority variable for dedicated interconnect because it was… by @apichick in #2802
• New tool versions.py to manage versions.tf/tofu by @juliocc in #2803
• Bump golang.org/x/net from 0.23.0 to 0.33.0 in /blueprints/cloud-operations/unmanaged-instances-healthcheck/function/restarter by @dependabot in #2807
• ASN should be optional in router_config variable as it is not necessa… by @apichick in #2806
• Add intercepting sinks to the organization and folder modules by @rshokati2 in #2799
• Bump golang.org/x/net from 0.23.0 to 0.33.0 in /blueprints/cloud-operations/unmanaged-instances-healthcheck/function/healthchecker by @dependabot in #2808

New Contributors

• @mtndrew404 made their first contribution in #2733
• @Mattible made their first contribution in #2755
• @rune92 made their first contribution in #2750
• @rodriguezsergio made their first contribution in #2780
• @wenzizone made their first contribution in #2783
• @rshokati2 made their first contribution in #2799

Full Changelog: v36.0.1...v36.1.0