config/servicemappings/compute.yaml (2,716 lines of code) (raw):
# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: core.cnrm.cloud.google.com/v1alpha1
kind: ServiceMapping
metadata:
name: compute.cnrm.cloud.google.com
namespace: cnrm-system
spec:
name: Compute
version: v1beta1
serviceHostName: "compute.googleapis.com"
resources:
- name: google_compute_address
kind: ComputeAddress
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/addresses/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
locationality: regional
observedFields:
- address
resourceReferences:
- key: networkRef
tfField: network
description: |-
The network in which to reserve the address. If global, the address
must be within the RFC1918 IP space. The network cannot be deleted
if there are any reserved IP ranges referring to it. This field can
only be used with INTERNAL type with the VPC_PEERING and
IPSEC_INTERCONNECT purposes.
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: subnetworkRef
tfField: subnetwork
description: |-
The subnetwork in which to reserve the address. If an IP address is
specified, it must be within the subnetwork's IP range. This field
can only be used with INTERNAL type with GCE_ENDPOINT/DNS_RESOLVER
purposes.
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_backend_bucket
kind: ComputeBackendBucket
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/backendBuckets/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: bucketRef
tfField: bucket_name
description: |-
Reference to the bucket.
gvk:
kind: StorageBucket
version: v1beta1
group: storage.cnrm.cloud.google.com
containers:
- type: project
tfField: project
iamConfig:
policyName: google_compute_backend_bucket_iam_policy
policyMemberName: google_compute_backend_bucket_iam_member
referenceField:
name: name
type: name
supportsConditions: false
- name: google_compute_backend_service
kind: ComputeBackendService
metadataMapping:
name: name
resourceID:
targetField: name
locationality: global
idTemplate: "projects/{{project}}/global/backendServices/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: health_checks
description: |-
The health check resources for health checking this
ComputeBackendService. Currently at most one health check can be
specified, and a health check is required.
types:
- key: healthCheckRef
gvk:
kind: ComputeHealthCheck
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: httpHealthCheckRef
gvk:
kind: ComputeHTTPHealthCheck
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: backend.group
description: |-
Reference to a ComputeInstanceGroup or ComputeNetworkEndpointGroup
resource. In case of instance group this defines the list of
instances that serve traffic. Member virtual machine instances from
each instance group must live in the same zone as the instance
group itself. No two backends in a backend service are allowed to
use same Instance Group resource.
For Network Endpoint Groups this defines list of endpoints. All
endpoints of Network Endpoint Group must be hosted on instances
located in the same zone as the Network Endpoint Group.
Backend services cannot mix Instance Group and Network Endpoint
Group backends.
When the 'load_balancing_scheme' is INTERNAL, only instance groups
are supported.
types:
- key: instanceGroupRef
gvk:
kind: ComputeInstanceGroup
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: networkEndpointGroupRef
gvk:
kind: ComputeNetworkEndpointGroup
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: security_policy
description: |-
The security policy associated with this backend service.
key: securityPolicyRef
gvk:
kind: ComputeSecurityPolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: security_settings.client_tls_policy
description: |-
ClientTlsPolicy is a resource that specifies how a client should
authenticate connections to backends of a service. This resource itself
does not affect configuration unless it is attached to a backend
service resource.
key: clientTLSPolicyRef
gvk:
kind: NetworkSecurityClientTLSPolicy
version: v1beta1
group: networksecurity.cnrm.cloud.google.com
valueTemplate: "//networksecurity.googleapis.com/projects/{{project}}/locations/{{location}}/clientTlsPolicies/{{value}}"
dclBasedResource: true
- tfField: iap.oauth2_client_id
description: OAuth2 Client ID for IAP.
key: oauth2ClientIdRef
gvk:
kind: IAPIdentityAwareProxyClient
version: v1beta1
group: iap.cnrm.cloud.google.com
dclBasedResource: true
- tfField: edge_security_policy
description: |-
The resource URL for the edge security policy associated with this
backend service.
key: edgeSecurityPolicyRef
gvk:
kind: ComputeSecurityPolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
mutableButUnreadableFields:
- iap.oauth2_client_secret
- name: google_compute_disk
kind: ComputeDisk
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
idTemplate: "projects/{{project}}/zones/{{zone}}/disks/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
locationality: zonal
iamConfig:
policyName: google_compute_disk_iam_policy
policyMemberName: google_compute_disk_iam_member
referenceField:
name: name
type: name
supportsConditions: false
resourceReferences:
- tfField: project
key: projectRef
description: |-
The project that this resource belongs to.
gvk:
kind: Project
version: v1beta1
group: resourcemanager.cnrm.cloud.google.com
- tfField: image
description: |-
The image from which to initialize this disk.
key: imageRef
targetField: self_link
gvk:
kind: ComputeImage
version: v1beta1
group: compute.cnrm.cloud.google.com
- tfField: snapshot
description: |-
The source snapshot used to create this disk.
key: snapshotRef
targetField: self_link
gvk:
kind: ComputeSnapshot
version: v1beta1
group: compute.cnrm.cloud.google.com
- tfField: disk_encryption_key.kms_key_self_link
description: |-
The encryption key used to encrypt the disk. Your project's Compute
Engine System service account
('service-{{PROJECT_NUMBER}}@compute-system.iam.gserviceaccount.com')
must have 'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this
feature. See
https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
key: kmsKeyRef
targetField: self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
- tfField: disk_encryption_key.kms_key_service_account
description: |-
The service account used for the encryption request for the given KMS key.
If absent, the Compute Engine Service Agent service account is used.
key: kmsKeyServiceAccountRef
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
- tfField: source_image_encryption_key.kms_key_self_link
description: |-
The encryption key used to encrypt the disk. Your project's Compute
Engine System service account
('service-{{PROJECT_NUMBER}}@compute-system.iam.gserviceaccount.com')
must have 'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this
feature. See
https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
key: kmsKeyRef
targetField: self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
- tfField: source_image_encryption_key.kms_key_service_account
description: |-
The service account used for the encryption request for the given KMS key.
If absent, the Compute Engine Service Agent service account is used.
key: kmsKeyServiceAccountRef
targetField: email
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
- tfField: source_snapshot_encryption_key.kms_key_self_link
description: |-
The encryption key used to encrypt the disk. Your project's Compute
Engine System service account
('service-{{PROJECT_NUMBER}}@compute-system.iam.gserviceaccount.com')
must have 'roles/cloudkms.cryptoKeyEncrypterDecrypter' to use this
feature. See
https://cloud.google.com/compute/docs/disks/customer-managed-encryption#encrypt_a_new_persistent_disk_with_your_own_keys
key: kmsKeyRef
targetField: self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
- tfField: source_snapshot_encryption_key.kms_key_service_account
description: |-
The service account used for the encryption request for the given KMS key.
If absent, the Compute Engine Service Agent service account is used.
key: kmsKeyServiceAccountRef
targetField: email
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
- tfField: resource_policies
description: |-
Resource policies applied to this disk for automatic snapshot creations.
This field only applies for zonal compute disk resources.
gvk:
kind: ComputeResourcePolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: source_disk
key: sourceDiskRef
description: |-
The source disk used to create this disk.
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: diskRef
tfField: async_primary_disk.disk
description: |-
Immutable. Primary disk for asynchronous disk replication.
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
hierarchicalReferences:
- type: project
key: projectRef
- name: google_compute_external_vpn_gateway
kind: ComputeExternalVPNGateway
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/externalVpnGateways/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
ignoredFields:
# TODO(b/269499072): Map it to `metadata.labels`.
- labels
- name: google_compute_firewall
kind: ComputeFirewall
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/firewalls/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: network
description: |-
The network to attach this firewall to.
key: networkRef
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: source_service_accounts
description: |-
If source service accounts are specified, the firewall will apply only
to traffic originating from an instance with a service account in this
list. Source service accounts cannot be used to control traffic to an
instance's external IP address because service accounts are associated
with an instance, not an IP address. sourceRanges can be set at the
same time as sourceServiceAccounts. If both are set, the firewall will
apply to traffic that has source IP address within sourceRanges OR the
source IP belongs to an instance with service account listed in
sourceServiceAccount. The connection does not need to match both
properties for the firewall to apply. sourceServiceAccounts cannot be
used at the same time as sourceTags or targetTags.
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
- tfField: target_service_accounts
description: |-
A list of service accounts indicating sets of instances located in the
network that may make network connections as specified in allowed[].
targetServiceAccounts cannot be used at the same time as targetTags or
sourceTags. If neither targetServiceAccounts nor targetTags are
specified, the firewall rule applies to all instances on the specified
network.
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
containers:
- type: project
tfField: project
- name: google_compute_forwarding_rule
kind: ComputeForwardingRule
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
locationality: regional
idTemplate: "projects/{{project}}/regions/{{region}}/forwardingRules/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: target
description: |-
The target resource to receive the matched traffic. The forwarded
traffic must be of a type appropriate to the target object. For
INTERNAL_SELF_MANAGED load balancing, only HTTP and HTTPS targets
are valid.
types:
- key: targetVPNGatewayRef
gvk:
kind: ComputeTargetVPNGateway
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetHTTPProxyRef
gvk:
kind: ComputeTargetHTTPProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetHTTPSProxyRef
gvk:
kind: ComputeTargetHTTPSProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetTCPProxyRef
gvk:
kind: ComputeTargetTCPProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetSSLProxyRef
gvk:
kind: ComputeTargetSSLProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetGRPCProxyRef
gvk:
kind: ComputeTargetGRPCProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: serviceAttachmentRef
gvk:
kind: ComputeServiceAttachment
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
dclBasedResource: true
- tfField: ip_address
description: |-
The IP address that this forwarding rule is serving on behalf of.
Addresses are restricted based on the forwarding rule's load
balancing scheme (EXTERNAL or INTERNAL) and scope (global or
regional).
When the load balancing scheme is EXTERNAL, for global forwarding
rules, the address must be a global IP, and for regional forwarding
rules, the address must live in the same region as the forwarding
rule. If this field is empty, an ephemeral IPv4 address from the
same scope (global or regional) will be assigned. A regional
forwarding rule supports IPv4 only. A global forwarding rule
supports either IPv4 or IPv6.
When the load balancing scheme is INTERNAL, this can only be an RFC
1918 IP address belonging to the network/subnet configured for the
forwarding rule. By default, if this field is empty, an ephemeral
internal IP address will be automatically allocated from the IP
range of the subnet or network configured for this forwarding rule.
types:
- key: ip
jsonSchemaType: string
- key: addressRef
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: address
- key: networkRef
description: |-
This field is not used for external load balancing. For internal
load balancing, this field identifies the network that the load
balanced IP should belong to for this forwarding rule. If this
field is not specified, the default network will be used.
tfField: network
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: subnetworkRef
description: |-
Immutable. The subnetwork that the load balanced IP should belong to for this
forwarding rule. This field is only used for internal load
balancing.
If the network specified is in auto subnet mode, this field is
optional. However, if the network is in custom subnet mode, a
subnetwork must be specified.
tfField: subnetwork
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: backendServiceRef
tfField: backend_service
description: |-
A ComputeBackendService to receive the matched traffic. This is
used only for internal load balancing.
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_global_address
kind: ComputeAddress
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/addresses/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
locationality: global
observedFields:
- address
resourceReferences:
- key: networkRef
tfField: network
description: |-
The network in which to reserve the address. If global, the address
must be within the RFC1918 IP space. The network cannot be deleted
if there are any reserved IP ranges referring to it. This field can
only be used with INTERNAL type with the VPC_PEERING and
IPSEC_INTERCONNECT purposes.
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_global_forwarding_rule
kind: ComputeForwardingRule
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
locationality: global
idTemplate: "projects/{{project}}/global/forwardingRules/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: ip_address
description: |-
The IP address that this forwarding rule is serving on behalf of.
Addresses are restricted based on the forwarding rule's load
balancing scheme (EXTERNAL or INTERNAL) and scope (global or
regional).
When the load balancing scheme is EXTERNAL, for global forwarding
rules, the address must be a global IP, and for regional forwarding
rules, the address must live in the same region as the forwarding
rule. If this field is empty, an ephemeral IPv4 address from the
same scope (global or regional) will be assigned. A regional
forwarding rule supports IPv4 only. A global forwarding rule
supports either IPv4 or IPv6.
When the load balancing scheme is INTERNAL, this can only be an RFC
1918 IP address belonging to the network/subnet configured for the
forwarding rule. By default, if this field is empty, an ephemeral
internal IP address will be automatically allocated from the IP
range of the subnet or network configured for this forwarding rule.
types:
- key: addressRef
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: address
- key: ip
jsonSchemaType: string
- tfField: target
description: |-
The target resource to receive the matched traffic. The forwarded
traffic must be of a type appropriate to the target object. For
INTERNAL_SELF_MANAGED load balancing, only HTTP and HTTPS targets
are valid.
types:
- key: targetHTTPProxyRef
gvk:
kind: ComputeTargetHTTPProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetHTTPSProxyRef
gvk:
kind: ComputeTargetHTTPSProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetTCPProxyRef
gvk:
kind: ComputeTargetTCPProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetSSLProxyRef
gvk:
kind: ComputeTargetSSLProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: targetGRPCProxyRef
gvk:
kind: ComputeTargetGRPCProxy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: networkRef
tfField: network
description: |-
This field is not used for external load balancing. For internal
load balancing, this field identifies the network that the load
balanced IP should belong to for this forwarding rule. If this
field is not specified, the default network will be used.
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: subnetworkRef
description: |-
Immutable. The subnetwork that the load balanced IP should belong to for this
forwarding rule. This field is only used for internal load
balancing.
If the network specified is in auto subnet mode, this field is
optional. However, if the network is in custom subnet mode, a
subnetwork must be specified.
tfField: subnetwork
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_ha_vpn_gateway
kind: ComputeVPNGateway
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/vpnGateways/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: networkRef
tfField: network
description: |-
The network this VPN gateway is accepting traffic for.
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: interconnectAttachmentRef
tfField: vpn_interfaces.interconnect_attachment
description: |-
Immutable. When this value is present, the VPN Gateway will be used
for IPsec-encrypted Cloud Interconnect; all Egress or Ingress
traffic for this VPN Gateway interface will go through the specified
interconnect attachment resource. Not currently available publicly.
gvk:
kind: ComputeInterconnectAttachment
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_health_check
kind: ComputeHealthCheck
metadataMapping:
name: name
resourceID:
targetField: name
locationality: global
idTemplate: "projects/{{project}}/global/healthChecks/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_http_health_check
kind: ComputeHTTPHealthCheck
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/httpHealthChecks/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_https_health_check
kind: ComputeHTTPSHealthCheck
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/httpsHealthChecks/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_image
kind: ComputeImage
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
iamConfig:
policyName: google_compute_image_iam_policy
policyMemberName: google_compute_image_iam_member
referenceField:
name: image
type: name
supportsConditions: true
resourceReferences:
- key: diskRef
tfField: source_disk
description: |-
The source disk to create this image based on.
You must provide either this property or the
rawDisk.source property but not both to create an image.
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: source_image
key: sourceImageRef
description: |-
The source image used to create this image.
gvk:
kind: ComputeImage
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: source_snapshot
key: sourceSnapshotRef
description: |-
The source snapshot used to create this image.
gvk:
kind: ComputeSnapshot
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: image_encryption_key.kms_key_self_link
key: kmsKeySelfLinkRef
description: |-
The self link of the encryption key that is stored in Google Cloud
KMS.
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
targetField: self_link
- tfField: image_encryption_key.kms_key_service_account
key: kmsKeyServiceAccountRef
description: |-
The service account being used for the encryption request for the
given KMS key. If absent, the Compute Engine default service account
is used.
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
idTemplate: "projects/{{project}}/global/images/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_instance
kind: ComputeInstance
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
iamConfig:
policyName: google_compute_instance_iam_policy
policyMemberName: google_compute_instance_iam_member
referenceField:
name: instance_name
type: name
supportsConditions: true
resourceReferences:
- key: sourceDiskRef
tfField: attached_disk.source
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: kmsKeyRef
tfField: attached_disk.kms_key_self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
targetField: self_link
- key: sourceDiskRef
tfField: boot_disk.source
description: |-
Immutable. The source disk used to create this disk.
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: sourceImageRef # prefix with "source" as that's how it is in the underlying API
tfField: boot_disk.initialize_params.image
description: |-
Immutable. The image from which to initialize this disk.
gvk:
kind: ComputeImage
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: kmsKeyRef
tfField: boot_disk.kms_key_self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
targetField: self_link
- key: networkRef
tfField: network_interface.network
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: subnetworkRef
tfField: network_interface.subnetwork
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: natIpRef
tfField: network_interface.access_config.nat_ip
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: address
- tfField: scheduling.node_affinities
types:
- key: value
jsonSchemaType: object
- key: serviceAccountRef
tfField: service_account.email
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
- tfField: resource_policies
gvk:
kind: ComputeResourcePolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: networkIpRef
tfField: network_interface.network_ip
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: address
idTemplate: "projects/{{project}}/zones/{{zone}}/instances/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
directives:
- allow_stopping_for_update
containers:
- type: project
tfField: project
- name: google_compute_instance_from_template
kind: ComputeInstance
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
iamConfig:
policyName: google_compute_instance_iam_policy
policyMemberName: google_compute_instance_iam_member
referenceField:
name: instance_name
type: name
supportsConditions: true
resourceReferences:
- key: sourceDiskRef
tfField: attached_disk.source
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: kmsKeyRef
tfField: attached_disk.kms_key_self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
targetField: self_link
- key: sourceDiskRef
tfField: boot_disk.source
description: |-
Immutable. The source disk used to create this disk.
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: sourceImageRef # prefix with "source" as that's how it is in the underlying API
tfField: boot_disk.initialize_params.image
description: |-
Immutable. The image from which to initialize this disk.
gvk:
kind: ComputeImage
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: kmsKeyRef
tfField: boot_disk.kms_key_self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
targetField: self_link
- key: instanceTemplateRef
tfField: source_instance_template
gvk:
kind: ComputeInstanceTemplate
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: networkRef
tfField: network_interface.network
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: subnetworkRef
tfField: network_interface.subnetwork
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: natIpRef
tfField: network_interface.access_config.nat_ip
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: address
- tfField: scheduling.node_affinities
types:
- key: value
jsonSchemaType: object
- key: serviceAccountRef
tfField: service_account.email
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
idTemplate: "projects/{{project}}/zones/{{zone}}/instances/{{name}}"
# would never have a URL, not a valid test case
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: true
directives:
- allow_stopping_for_update
containers:
- type: project
tfField: project
- name: google_compute_instance_group
kind: ComputeInstanceGroup
metadataMapping:
name: name
resourceID:
targetField: name
resourceReferences:
- key: networkRef
tfField: network
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: instances
gvk:
kind: ComputeInstance
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
idTemplate: "projects/{{project}}/zones/{{zone}}/instanceGroups/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
- name: google_compute_instance_template
kind: ComputeInstanceTemplate
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
resourceReferences:
- key: sourceDiskRef
tfField: disk.source
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
- key: sourceImageRef
tfField: disk.source_image
gvk:
kind: ComputeImage
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: kmsKeyRef
tfField: disk.disk_encryption_key.kms_key_self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
targetField: self_link
- key: networkRef
tfField: network_interface.network
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: subnetworkRef
tfField: network_interface.subnetwork
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: natIpRef
tfField: network_interface.access_config.nat_ip
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: address
- key: serviceAccountRef
tfField: service_account.email
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
- tfField: scheduling.node_affinities
types:
- key: value
jsonSchemaType: object
- tfField: disk.resource_policies
gvk:
kind: ComputeResourcePolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: disk.source_image_encryption_key.kms_key_self_link
key: kmsKeySelfLinkRef
description: |-
The self link of the encryption key that is stored in Google Cloud
KMS.
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
targetField: self_link
- tfField: disk.source_image_encryption_key.kms_key_service_account
key: kmsKeyServiceAccountRef
description: |-
The service account being used for the encryption request for the
given KMS key. If absent, the Compute Engine default service account
is used.
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
- tfField: disk.source_snapshot
description: |-
The source snapshot to create this disk. When creating a new
instance, one of initializeParams.sourceSnapshot,
initializeParams.sourceImage, or disks.source is required except for
local SSD.
key: sourceSnapshotRef
gvk:
kind: ComputeSnapshot
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: disk.source_snapshot_encryption_key.kms_key_self_link
key: kmsKeySelfLinkRef
description: |-
The self link of the encryption key that is stored in Google Cloud
KMS.
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
targetField: self_link
- tfField: disk.source_snapshot_encryption_key.kms_key_service_account
key: kmsKeyServiceAccountRef
description: |-
The service account being used for the encryption request for the
given KMS key. If absent, the Compute Engine default service account
is used.
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
- tfField: resource_policies
gvk:
kind: ComputeResourcePolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
idTemplate: "projects/{{project}}/global/instanceTemplates/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_interconnect_attachment
kind: ComputeInterconnectAttachment
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/interconnectAttachments/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: router
description: |-
The Cloud Router to be used for dynamic routing. This router must
be in the same region as this ComputeInterconnectAttachment. The
ComputeInterconnectAttachment will automatically connect the
interconnect to the network & region within which the Cloud Router
is configured.
key: routerRef
gvk:
kind: ComputeRouter
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: ipsec_internal_addresses
description: |-
Immutable. The addresses that have been reserved for the
interconnect attachment. Used only for interconnect attachment that
has the encryption option as IPSEC.
The addresses must be RFC 1918 IP address ranges. When creating HA
VPN gateway over the interconnect attachment, if the attachment is
configured to use an RFC 1918 IP address, then the VPN gateway's IP
address will be allocated from the IP address range specified
here.
For example, if the HA VPN gateway's interface 0 is paired to this
interconnect attachment, then an RFC 1918 IP address for the VPN
gateway interface 0 will be allocated from the IP address specified
for this interconnect attachment.
If this field is not specified for interconnect attachment that has
encryption option as IPSEC, later on when creating HA VPN gateway on
this interconnect attachment, the HA VPN gateway's IP address will
be allocated from regional external IP address pool.
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_managed_ssl_certificate
kind: ComputeManagedSSLCertificate
idTemplate: "projects/{{project}}/global/sslCertificates/{{name}}"
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
v1alpha1ToV1beta1: true
storageVersion: v1alpha1
metadataMapping:
name: name
resourceID:
targetField: name
hierarchicalReferences:
- type: project
key: projectRef
resourceReferences:
- tfField: project
key: projectRef
description: |-
The project that this resource belongs to.
gvk:
kind: Project
version: v1beta1
group: resourcemanager.cnrm.cloud.google.com
- name: google_compute_network
kind: ComputeNetwork
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/networks/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_network_endpoint_group
kind: ComputeNetworkEndpointGroup
metadataMapping:
name: name
resourceID:
targetField: name
locationality: zonal
idTemplate: "projects/{{project}}/zones/{{zone}}/networkEndpointGroups/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: network
description: |-
The network to which all network endpoints in the NEG belong. Uses
"default" project network if unspecified.
key: networkRef
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: subnetwork
description: |-
Optional subnetwork to which all network endpoints in the NEG belong.
key: subnetworkRef
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_network_firewall_policy
kind: ComputeNetworkFirewallPolicy
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/firewallPolicies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: false
hierarchicalReferences:
- type: project
key: projectRef
resourceReferences:
- tfField: project
key: projectRef
description: |-
The project that this resource belongs to.
gvk:
kind: Project
version: v1beta1
group: resourcemanager.cnrm.cloud.google.com
- name: google_compute_network_firewall_policy_association
kind: ComputeNetworkFirewallPolicyAssociation
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/firewallPolicies/{{firewall_policy}}/associations/{{name}}"
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
hierarchicalReferences:
- type: project
key: projectRef
resourceReferences:
- tfField: project
key: projectRef
description: |-
The project that this resource belongs to.
gvk:
kind: Project
version: v1beta1
group: resourcemanager.cnrm.cloud.google.com
- tfField: attachment_target
key: attachmentTargetRef
description: |-
The target that the firewall policy is attached to.
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: firewall_policy
key: firewallPolicyRef
description: |-
The firewall policy ID of the association.
gvk:
kind: ComputeNetworkFirewallPolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: network_firewall_policy_id
- name: google_compute_network_peering
kind: ComputeNetworkPeering
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "{{network}}/{{name}}"
# sub-method of a network, doesn't have a URL
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
resourceReferences:
- tfField: network
key: networkRef
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
parent: true
- tfField: peer_network
key: peerNetworkRef
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
skipImport: true
- name: google_compute_node_group
kind: ComputeNodeGroup
metadataMapping:
name: name
resourceID:
targetField: name
resourceReferences:
- key: nodeTemplateRef
tfField: node_template
description: |-
The node template to which this node group belongs.
targetField: self_link
gvk:
kind: ComputeNodeTemplate
version: v1beta1
group: compute.cnrm.cloud.google.com
- tfField: share_settings.project_map.id
key: idRef
description: |-
The key of this project config in the parent map.
gvk:
kind: Project
version: v1beta1
group: resourcemanager.cnrm.cloud.google.com
- tfField: share_settings.project_map.project_id
key: projectIdRef
description: |-
The project id/number should be the same as the key of this project
config in the project map.
gvk:
kind: Project
version: v1beta1
group: resourcemanager.cnrm.cloud.google.com
idTemplate: "projects/{{project}}/zones/{{zone}}/nodeGroups/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_node_template
kind: ComputeNodeTemplate
metadataMapping:
name: name
labels: node_affinity_labels
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/nodeTemplates/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_project_metadata
kind: ComputeProjectMetadata
idTemplate: "{{project}}"
# too hard to reason about yet
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
containers:
- type: project
tfField: project
- name: google_compute_region_backend_service
kind: ComputeBackendService
metadataMapping:
name: name
resourceID:
targetField: name
locationality: regional
idTemplate: "projects/{{project}}/regions/{{region}}/backendServices/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: health_checks
description: |-
The health check resources for health checking this
ComputeBackendService. Currently at most one health check can be
specified, and a health check is required.
types:
- key: healthCheckRef
gvk:
kind: ComputeHealthCheck
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: network
description: |-
The network to which this backend service belongs. This field can
only be specified when the load balancing scheme is set to
INTERNAL.
key: networkRef
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: backend.group
description: |-
Reference to a ComputeInstanceGroup or ComputeNetworkEndpointGroup
resource. In case of instance group this defines the list of
instances that serve traffic. Member virtual machine instances from
each instance group must live in the same zone as the instance
group itself. No two backends in a backend service are allowed to
use same Instance Group resource.
For Network Endpoint Groups this defines list of endpoints. All
endpoints of Network Endpoint Group must be hosted on instances
located in the same zone as the Network Endpoint Group.
Backend services cannot mix Instance Group and Network Endpoint
Group backends.
When the 'load_balancing_scheme' is INTERNAL, only instance groups
are supported.
types:
- key: instanceGroupRef
gvk:
kind: ComputeInstanceGroup
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: networkEndpointGroupRef
gvk:
kind: ComputeNetworkEndpointGroup
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: iap.oauth2_client_id
description: OAuth2 Client ID for IAP.
key: oauth2ClientIdRef
gvk:
kind: IAPIdentityAwareProxyClient
version: v1beta1
group: iap.cnrm.cloud.google.com
dclBasedResource: true
containers:
- type: project
tfField: project
mutableButUnreadableFields:
- iap.oauth2_client_secret
- name: google_compute_region_disk
kind: ComputeDisk
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/disks/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
locationality: regional
iamConfig:
policyName: google_compute_region_disk_iam_policy
policyMemberName: google_compute_region_disk_iam_member
referenceField:
name: name
type: name
resourceReferences:
- tfField: project
key: projectRef
description: |-
The project that this resource belongs to.
gvk:
kind: Project
version: v1beta1
group: resourcemanager.cnrm.cloud.google.com
- tfField: snapshot
description: |-
The source snapshot used to create this disk.
key: snapshotRef
targetField: self_link
gvk:
kind: ComputeSnapshot
version: v1beta1
group: compute.cnrm.cloud.google.com
- tfField: disk_encryption_key.kms_key_name
description: |-
The name of the encryption key that is stored in the Google Cloud KMS.
key: kmsKeyRef
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
- tfField: source_snapshot_encryption_key.kms_key_name
description: |-
The name of the encryption key that is stored in the Google Cloud KMS.
key: kmsKeyRef
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
- tfField: source_disk
key: sourceDiskRef
description: |-
The source disk used to create this disk.
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: diskRef
tfField: async_primary_disk.disk
description: |-
Immutable. Primary disk for asynchronous disk replication.
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
hierarchicalReferences:
- type: project
key: projectRef
- name: google_compute_region_health_check
kind: ComputeHealthCheck
metadataMapping:
name: name
resourceID:
targetField: name
locationality: regional
idTemplate: "projects/{{project}}/regions/{{region}}/healthChecks/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_region_network_endpoint_group
kind: ComputeRegionNetworkEndpointGroup
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/networkEndpointGroups/{{name}}"
idTemplateCanBeUsedToMatchResourceName: false
# TODO: (b/233123518) Config Connector CLI cannot currently support ComputeRegionNetworkEndpointGroup.
resourceAvailableInAssetInventory: false
resourceReferences:
- key: serviceRef
tfField: cloud_run.service
description: |-
Immutable. Cloud Run service is the main resource of Cloud Run.
The service must be 1-63 characters long, and comply with RFC1035.
Example value: "run-service".
gvk:
kind: RunService
version: v1beta1
group: run.cnrm.cloud.google.com
- key: functionRef
tfField: cloud_function.function
description: |-
Immutable. A user-defined name of the Cloud Function.
The function name is case-sensitive and must be 1-63 characters long.
Example value: "func1".
gvk:
kind: CloudFunctionsFunction
version: v1beta1
group: cloudfunctions.cnrm.cloud.google.com
dclBasedResource: true
- key: networkRef
tfField: network
description: |-
Immutable. This field is only used for PSC.
The URL of the network to which all network endpoints in the NEG belong. Uses
"default" project network if unspecified.
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: subnetworkRef
tfField: subnetwork
description: |-
Immutable. This field is only used for PSC.
Optional URL of the subnetwork to which all network endpoints in the NEG belong.
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
ignoredFields:
# As of 5/19/22 the only allowed value for serverlessDeployment.platform is `apigateway.googleapis.com`
# This field is ignored because APIGateway is not a supported resource at this time
- serverless_deployment
# This field is ignored because AppEngine is not a supported resource at this time
- app_engine
containers:
- type: project
tfField: project
- name: google_compute_region_ssl_certificate
kind: ComputeSSLCertificate
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/sslCertificates/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
locationality: regional
reconciliationIntervalInSeconds: 0
ignoredFields:
- name_prefix
containers:
- type: project
tfField: project
- name: google_compute_region_target_http_proxy
kind: ComputeTargetHTTPProxy
metadataMapping:
name: name
resourceID:
targetField: name
locationality: regional
idTemplate: "projects/{{project}}/regions/{{region}}/targetHttpProxies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: urlMapRef
tfField: url_map
description: |-
A reference to the ComputeURLMap resource that defines the mapping
from URL to the BackendService.
gvk:
kind: ComputeURLMap
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_region_target_https_proxy
kind: ComputeTargetHTTPSProxy
metadataMapping:
name: name
resourceID:
targetField: name
locationality: regional
idTemplate: "projects/{{project}}/regions/{{region}}/targetHttpsProxies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: urlMapRef
tfField: url_map
description: |-
A reference to the ComputeURLMap resource that defines the mapping
from URL to the BackendService.
gvk:
kind: ComputeURLMap
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: ssl_certificates
description: |-
A list of ComputeSSLCertificate resources that are used to
authenticate connections between users and the load balancer. At
least one SSL certificate must be specified.
gvk:
kind: ComputeSSLCertificate
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: sslPolicyRef
tfField: ssl_policy
description: |-
A reference to the ComputeSSLPolicy resource that will be
associated with the ComputeTargetHTTPSProxy resource. If not set,
the ComputeTargetHTTPSProxy resource will not have any SSL policy
configured.
gvk:
kind: ComputeSSLPolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_region_url_map
kind: ComputeURLMap
metadataMapping:
name: name
resourceID:
targetField: name
locationality: regional
idTemplate: "projects/{{project}}/regions/{{region}}/urlMaps/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: default_service
description: |-
The defaultService resource to which traffic is directed if none of
the hostRules match.
For the Global URL Map, it should be a reference to the backend
service or backend bucket.
For the Regional URL Map, it should be a reference to the backend
service.
If defaultRouteAction is additionally specified, advanced routing
actions like URL Rewrites, etc. take effect prior to sending the
request to the backend. However, if defaultService is specified,
defaultRouteAction cannot contain any weightedBackendServices.
Conversely, if routeAction specifies any weightedBackendServices,
service must not be specified. Only one of defaultService,
defaultUrlRedirect or defaultRouteAction.weightedBackendService
must be set.
# Use "types" to be better merged with the global URL map, which
# supports more than one reference type in `default_service` field.
types:
- key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: default_route_action.request_mirror_policy.backend_service
key: backendServiceRef
description: |-
The backend service resource being mirrored to.
The backend service configured for a mirroring policy must reference
backends that are of the same type as the original backend service
matched in the URL map.
Serverless NEG backends are not currently supported as a mirrored
backend service.
gvk:
group: compute.cnrm.cloud.google.com
version: v1beta1
kind: ComputeBackendService
targetField: self_link
- tfField: default_route_action.weighted_backend_services.backend_service
key: backendServiceRef
description: |-
The default backend service resource.
Before forwarding the request to backendService, the loadbalancer
applies any relevant headerActions specified as part of this
backendServiceWeight.
gvk:
group: compute.cnrm.cloud.google.com
version: v1beta1
kind: ComputeBackendService
targetField: self_link
- tfField: path_matcher.default_service
description: |-
The default service to use if none of the pathRules defined by this
PathMatcher is matched by the URL's path portion.
For the Global URL Map, it should be a reference to the backend
service or backend bucket.
For the Regional URL Map, it should be a reference to the backend
service.
# Use "types" to be better merged with the global URL map, which
# supports more than one reference type in
# `path_matcher.default_service` field.
types:
- key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: path_matcher.path_rule.service
description: |-
The backend service to which traffic is directed if this rule is
matched.
For the Global URL Map, it should be a reference to the backend
service or backend bucket.
For the Regional URL Map, it should be a reference to the backend
service.
If routeAction is additionally specified, advanced routing actions
like URL Rewrites, etc. take effect prior to sending the request to
the backend. However, if service is specified, routeAction cannot
contain any weightedBackendServices. Conversely, if routeAction
specifies any weightedBackendServices, service must not be
specified. Only one of urlRedirect, service or
routeAction.weightedBackendService must be set.
# Use "types" to be better merged with the global URL map, which
# supports more than one reference type in
# `path_matcher.path_rule.service` field.
types:
- key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: path_matcher.path_rule.route_action.request_mirror_policy.backend_service
description: |-
Required. The backend service resource being mirrored to.
key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: path_matcher.path_rule.route_action.weighted_backend_services.backend_service
description: |-
Required. The default backend service resource. Before forwarding
the request to backendService, the loadbalancer applies any relevant
headerActions specified as part of this backendServiceWeight.
key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: path_matcher.route_rules.route_action.request_mirror_policy.backend_service
description: |-
Required. The backend service resource being mirrored to.
key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: path_matcher.route_rules.route_action.weighted_backend_services.backend_service
description: |-
Required. The default backend service resource. Before forwarding
the request to backendService, the loadbalancer applies any relevant
headerActions specified as part of this backendServiceWeight.
key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: test.service
description: |-
The backend service resource that should be matched by this test.
For the Global URL Map, it should be a reference to the backend
service or backend bucket.
For the Regional URL Map, it should be a reference to the backend
service.
# Use "types" to be better merged with the global URL map, which
# supports more than one reference type in `test.service` field.
types:
- key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_reservation
kind: ComputeReservation
idTemplate: "projects/{{project}}/zones/{{zone}}/reservations/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
metadataMapping:
name: name
resourceID:
targetField: name
# TODO(b/217273773): Ignore shared_settings field for now until follow up
# with service team is completed.
ignoredFields:
- share_settings
containers:
- type: project
tfField: project
- name: google_compute_resource_policy
kind: ComputeResourcePolicy
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/resourcePolicies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_route
kind: ComputeRoute
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/routes/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: network
description: |-
The network that this route applies to.
key: networkRef
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: next_hop_instance
description: |-
Instance that should handle matching packets.
key: nextHopInstanceRef
gvk:
kind: ComputeInstance
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: next_hop_ilb
description: |-
A forwarding rule of type loadBalancingScheme=INTERNAL that should
handle matching packets. Note that this can only be used when the
destinationRange is a public (non-RFC 1918) IP CIDR range.
key: nextHopILBRef
gvk:
kind: ComputeForwardingRule
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: next_hop_vpn_tunnel
description: |-
The ComputeVPNTunnel that should handle matching packets
key: nextHopVPNTunnelRef
gvk:
kind: ComputeVPNTunnel
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
ignoredFields:
- next_hop_instance_zone
containers:
- type: project
tfField: project
- name: google_compute_router
kind: ComputeRouter
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/routers/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: network
description: |-
A reference to the network to which this router belongs.
key: networkRef
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_router_interface
kind: ComputeRouterInterface
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "{{region}}/{{router}}/{{name}}"
# sub-fields of Router that don't actually have a URL
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
resourceReferences:
- tfField: router
key: routerRef
gvk:
kind: ComputeRouter
version: v1beta1
group: compute.cnrm.cloud.google.com
parent: true
- tfField: vpn_tunnel
key: vpnTunnelRef
gvk:
kind: ComputeVPNTunnel
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: interconnect_attachment
key: interconnectAttachmentRef
gvk:
kind: ComputeInterconnectAttachment
version: v1beta1
group: compute.cnrm.cloud.google.com
- tfField: private_ip_address
key: privateIpAddressRef
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: address
- tfField: redundant_interface
description: |-
The interface the BGP peer is associated with.
key: redundantInterfaceRef
gvk:
kind: ComputeRouterInterface
version: v1beta1
group: compute.cnrm.cloud.google.com
- tfField: subnetwork
key: subnetworkRef
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_router_nat
kind: ComputeRouterNAT
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/routers/{{router}}/{{name}}"
# sub-fields of Router that don't actually have a URL
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
resourceReferences:
- tfField: router
description: |-
The Cloud Router in which this NAT will be configured.
key: routerRef
gvk:
kind: ComputeRouter
version: v1beta1
group: compute.cnrm.cloud.google.com
parent: true
- tfField: subnetwork.name
description: |-
The subnetwork to NAT.
key: subnetworkRef
gvk:
kind: ComputeSubnetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: nat_ips
description: |-
NAT IPs. Only valid if natIpAllocateOption is set to MANUAL_ONLY.
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: drain_nat_ips
description: |-
A list of IP resources to be drained. These IPs must be valid
static external IPs that have been assigned to the NAT.
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: rules.action.source_nat_active_ips
key: sourceNatActiveIpsRefs
description: |-
A list of URLs of the IP resources used for this NAT rule. These IP
addresses must be valid static external IP addresses assigned to the
project. This field is used for public NAT.
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: rules.action.source_nat_drain_ips
key: sourceNatDrainIpsRefs
description: |-
A list of URLs of the IP resources to be drained. These IPs must be
valid static external IPs that have been assigned to the NAT. These
IPs should be used for updating/patching a NAT rule only. This field
is used for public NAT.
gvk:
kind: ComputeAddress
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_router_peer
kind: ComputeRouterPeer
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/routers/{{router}}/{{name}}"
# sub-fields of Router that don't actually have a URL
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
resourceReferences:
- tfField: router
description: |-
The Cloud Router in which this BGP peer will be configured.
key: routerRef
gvk:
kind: ComputeRouter
version: v1beta1
group: compute.cnrm.cloud.google.com
parent: true
- tfField: interface
description: |-
The interface the BGP peer is associated with.
key: routerInterfaceRef
gvk:
kind: ComputeRouterInterface
version: v1beta1
group: compute.cnrm.cloud.google.com
# Preemptively converting to a resource reference despite the lack of a known type,
# as IP addresses should eventually at minimum be able to reference a Kubernetes
# Service or Endpoint.
#
# Note that references to ComputeAddress are invalid
# due to ComputeRouterPeer only allowing
# IPs in the 169.254.0.0/16 local-link range, which is an invalid
# ComputeAddress and subnetwork range for GCP.
- tfField: ip_address
types:
- key: external
jsonSchemaType: string
description: |-
IP address of the interface inside Google Cloud Platform.
Only IPv4 is supported.
- key: routerApplianceInstanceRef
tfField: router_appliance_instance
description: |-
The URI of the VM instance that is used as third-party router
appliances such as Next Gen Firewalls, Virtual Routers, or Router
Appliances. The VM instance must be located in zones contained in
the same region as this Cloud Router. The VM instance is the peer
side of the BGP session.
gvk:
kind: ComputeInstance
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_security_policy
kind: ComputeSecurityPolicy
idTemplate: "projects/{{project}}/global/securityPolicies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
metadataMapping:
name: name
resourceID:
targetField: name
resourceReferences:
- tfField: recaptcha_options_config.redirect_site_key
description: |-
A field to supply a reCAPTCHA site key to be used for all the rules
using the redirect action with the type of GOOGLE_RECAPTCHA under
the security policy. The specified site key needs to be created from
the reCAPTCHA API. The user is responsible for the validity of the
specified site key. If not specified, a Google-managed site key is
used.
key: redirectSiteKeyRef
gvk:
kind: RecaptchaEnterpriseKey
version: v1beta1
group: recaptchaenterprise.cnrm.cloud.google.com
targetField: name
dclBasedResource: true
containers:
- type: project
tfField: project
- name: google_compute_shared_vpc_host_project
kind: ComputeSharedVPCHostProject
idTemplate: "{{project}}"
# resource is a compute API request, doesn't have a URL
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
containers:
- type: project
tfField: project
- name: google_compute_shared_vpc_service_project
kind: ComputeSharedVPCServiceProject
idTemplate: "{{host_project}}/{{service_project}}"
# resource is a compute API request, doesn't have a URL
idTemplateCanBeUsedToMatchResourceName: false
resourceAvailableInAssetInventory: false
resourceReferences:
- tfField: service_project
key: projectRef
gvk:
kind: Project
version: v1beta1
group: resourcemanager.cnrm.cloud.google.com
containers:
- type: project
tfField: host_project
- name: google_compute_snapshot
kind: ComputeSnapshot
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/snapshots/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: sourceDiskRef
tfField: source_disk
description: |-
A reference to the disk used to create this snapshot.
gvk:
kind: ComputeDisk
version: v1beta1
group: compute.cnrm.cloud.google.com
- key: kmsKeyRef
tfField: snapshot_encryption_key.kms_key_self_link
description: |-
The encryption key that is stored in Google Cloud KMS.
targetField: self_link
gvk:
kind: KMSCryptoKey
version: v1beta1
group: kms.cnrm.cloud.google.com
- tfField: snapshot_encryption_key.kms_key_service_account
description: |-
The service account used for the encryption request for the given KMS key.
If absent, the Compute Engine Service Agent service account is used.
key: kmsKeyServiceAccountRef
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
- tfField: source_disk_encryption_key.kms_key_service_account
description: |-
The service account used for the encryption request for the given KMS key.
If absent, the Compute Engine Service Agent service account is used.
key: kmsKeyServiceAccountRef
gvk:
kind: IAMServiceAccount
version: v1beta1
group: iam.cnrm.cloud.google.com
targetField: email
containers:
- type: project
tfField: project
iamConfig:
policyName: google_compute_snapshot_iam_policy
policyMemberName: google_compute_snapshot_iam_member
referenceField:
name: name
type: name
supportsConditions: false
- name: google_compute_ssl_certificate
kind: ComputeSSLCertificate
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/sslCertificates/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
locationality: global
reconciliationIntervalInSeconds: 0
ignoredFields:
- name_prefix
containers:
- type: project
tfField: project
- name: google_compute_ssl_policy
kind: ComputeSSLPolicy
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/sslPolicies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
containers:
- type: project
tfField: project
- name: google_compute_subnetwork
kind: ComputeSubnetwork
metadataMapping:
name: name
resourceID:
targetField: name
iamConfig:
policyName: google_compute_subnetwork_iam_policy
policyMemberName: google_compute_subnetwork_iam_member
referenceField:
name: subnetwork
type: name
supportsConditions: true
idTemplate: "projects/{{project}}/regions/{{region}}/subnetworks/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: networkRef
description: |-
The network this subnet belongs to. Only networks that are in the
distributed mode can have subnetworks.
tfField: network
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_target_grpc_proxy
kind: ComputeTargetGRPCProxy
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/targetGrpcProxies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: false
resourceReferences:
- key: urlMapRef
description: |-
The UrlMap resource that defines the mapping from URL to the BackendService.
The protocol field in the BackendService must be set to GRPC.
tfField: url_map
gvk:
kind: ComputeURLMap
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_target_http_proxy
kind: ComputeTargetHTTPProxy
metadataMapping:
name: name
resourceID:
targetField: name
locationality: global
idTemplate: "projects/{{project}}/global/targetHttpProxies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: urlMapRef
tfField: url_map
description: |-
A reference to the ComputeURLMap resource that defines the mapping
from URL to the BackendService.
gvk:
kind: ComputeURLMap
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_target_https_proxy
kind: ComputeTargetHTTPSProxy
metadataMapping:
name: name
resourceID:
targetField: name
locationality: global
idTemplate: "projects/{{project}}/global/targetHttpsProxies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: urlMapRef
tfField: url_map
description: |-
A reference to the ComputeURLMap resource that defines the mapping
from URL to the BackendService.
gvk:
kind: ComputeURLMap
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: certificate_manager_certificates
description: |-
URLs to certificate manager certificate resources that are used to authenticate connections between users and the load balancer.
Currently, you may specify up to 15 certificates. Certificate manager certificates do not apply when the load balancing scheme is set to INTERNAL_SELF_MANAGED.
sslCertificates and certificateManagerCertificates fields cannot be defined together.
gvk:
kind: CertificateManagerCertificate
version: v1beta1
group: certificatemanager.cnrm.cloud.google.com
valueTemplate: projects/{{project}}/locations/global/certificates/{{value}}
- tfField: ssl_certificates
description: |-
A list of ComputeSSLCertificate resources that are used to
authenticate connections between users and the load balancer. At
least one SSL certificate must be specified.
gvk:
kind: ComputeSSLCertificate
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: sslPolicyRef
tfField: ssl_policy
description: |-
A reference to the ComputeSSLPolicy resource that will be
associated with the ComputeTargetHTTPSProxy resource. If not set,
the ComputeTargetHTTPSProxy resource will not have any SSL policy
configured.
gvk:
kind: ComputeSSLPolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: certificateMapRef
tfField: certificate_map
description: |-
A reference to the CertificateMap resource uri that identifies a
certificate map associated with the given target proxy. This field
can only be set for global target proxies. This field is only supported
for EXTERNAL and EXTERNAL_MANAGED load balancing schemes.
For INTERNAL_MANAGED, use certificateManagerCertificates instead.
sslCertificates and certificateMap fields cannot be defined together.
gvk:
kind: CertificateManagerCertificateMap
version: v1beta1
group: certificatemanager.cnrm.cloud.google.com
valueTemplate: "//certificatemanager.googleapis.com/projects/{{project}}/locations/global/certificateMaps/{{value}}"
- key: serverTlsPolicyRef
tfField: server_tls_policy
description: |-
Immutable. A URL referring to a networksecurity.ServerTlsPolicy
resource that describes how the proxy should authenticate inbound
traffic. serverTlsPolicy only applies to a global TargetHttpsProxy
attached to globalForwardingRules with the loadBalancingScheme
set to INTERNAL_SELF_MANAGED or EXTERNAL or EXTERNAL_MANAGED.
For details which ServerTlsPolicy resources are accepted with
INTERNAL_SELF_MANAGED and which with EXTERNAL, EXTERNAL_MANAGED
loadBalancingScheme consult ServerTlsPolicy documentation.
If left blank, communications are not encrypted.
gvk:
kind: NetworkSecurityServerTLSPolicy
version: v1beta1
group: networksecurity.cnrm.cloud.google.com
valueTemplate: "projects/{{project}}/locations/{{location}}/serverTlsPolicies/{{value}}"
dclBasedResource: true
containers:
- type: project
tfField: project
- name: google_compute_target_instance
kind: ComputeTargetInstance
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/zones/{{zone}}/targetInstances/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: instanceRef
tfField: instance
description: |-
The ComputeInstance handling traffic for this target instance.
gvk:
kind: ComputeInstance
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: networkRef
tfField: network
description: |-
The network this target instance uses to forward
traffic. If not specified, the traffic will be forwarded to the network
that the default network interface belongs to.
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: security_policy
description: |-
The resource URL for the security policy associated with this target instance.
key: securityPolicyRef
gvk:
kind: ComputeSecurityPolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_target_pool
kind: ComputeTargetPool
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/targetPools/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: backupTargetPoolRef
tfField: backup_pool
targetField: self_link
gvk:
kind: ComputeTargetPool
version: v1beta1
group: compute.cnrm.cloud.google.com
- tfField: instances
gvk:
kind: ComputeInstance
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: health_checks
types:
- key: httpHealthCheckRef
gvk:
kind: ComputeHTTPHealthCheck
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: security_policy
description: |-
The resource URL for the security policy associated with this target pool.
key: securityPolicyRef
gvk:
kind: ComputeSecurityPolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_target_ssl_proxy
kind: ComputeTargetSSLProxy
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/targetSslProxies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceReferences:
- key: backendServiceRef
tfField: backend_service
description: |-
A reference to the ComputeBackendService resource.
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: ssl_certificates
description: |-
A list of ComputeSSLCertificate resources that are used to
authenticate connections between users and the load balancer.
Currently, exactly one SSL certificate must be specified.
gvk:
kind: ComputeSSLCertificate
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: sslPolicyRef
tfField: ssl_policy
description: |-
A reference to the ComputeSSLPolicy resource that will be
associated with the TargetSslProxy resource. If not set, the
ComputeTargetSSLProxy resource will not have any SSL policy
configured.
gvk:
kind: ComputeSSLPolicy
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: certificate_map
description: |-
A reference to the CertificateMap resource uri that identifies a
certificate map associated with the given target proxy. This
field can only be set for global target proxies. Accepted format is
'//certificatemanager.googleapis.com/projects/{project}/locations/{location}/certificateMaps/{resourceName}'.
gvk:
kind: CertificateManagerCertificateMap
version: v1beta1
group: certificatemanager.cnrm.cloud.google.com
key: certificateMapRef
containers:
- type: project
tfField: project
- name: google_compute_target_tcp_proxy
kind: ComputeTargetTCPProxy
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/global/targetTcpProxies/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: backendServiceRef
description: |-
A reference to the ComputeBackendService resource.
tfField: backend_service
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_url_map
kind: ComputeURLMap
metadataMapping:
name: name
resourceID:
targetField: name
locationality: global
idTemplate: "projects/{{project}}/global/urlMaps/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- tfField: default_service
description: |-
The defaultService resource to which traffic is directed if none of
the hostRules match.
For the Global URL Map, it should be a reference to the backend
service or backend bucket.
For the Regional URL Map, it should be a reference to the backend
service.
If defaultRouteAction is additionally specified, advanced routing
actions like URL Rewrites, etc. take effect prior to sending the
request to the backend. However, if defaultService is specified,
defaultRouteAction cannot contain any weightedBackendServices.
Conversely, if routeAction specifies any weightedBackendServices,
service must not be specified. Only one of defaultService,
defaultUrlRedirect or defaultRouteAction.weightedBackendService
must be set.
types:
- key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: backendBucketRef
gvk:
kind: ComputeBackendBucket
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: default_route_action.request_mirror_policy.backend_service
key: backendServiceRef
description: |-
The backend service resource being mirrored to.
The backend service configured for a mirroring policy must reference
backends that are of the same type as the original backend service
matched in the URL map.
Serverless NEG backends are not currently supported as a mirrored
backend service.
gvk:
group: compute.cnrm.cloud.google.com
version: v1beta1
kind: ComputeBackendService
targetField: self_link
- tfField: default_route_action.weighted_backend_services.backend_service
key: backendServiceRef
description: |-
The default backend service resource.
Before forwarding the request to backendService, the loadbalancer
applies any relevant headerActions specified as part of this
backendServiceWeight.
gvk:
group: compute.cnrm.cloud.google.com
version: v1beta1
kind: ComputeBackendService
targetField: self_link
- tfField: path_matcher.default_service
description: |-
The default service to use if none of the pathRules defined by this
PathMatcher is matched by the URL's path portion.
For the Global URL Map, it should be a reference to the backend
service or backend bucket.
For the Regional URL Map, it should be a reference to the backend
service.
types:
- key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: backendBucketRef
gvk:
kind: ComputeBackendBucket
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: path_matcher.default_route_action.request_mirror_policy.backend_service
key: backendServiceRef
description: |-
Required. The backend service resource being mirrored to.
gvk:
group: compute.cnrm.cloud.google.com
version: v1beta1
kind: ComputeBackendService
targetField: self_link
- tfField: path_matcher.default_route_action.weighted_backend_services.backend_service
key: backendServiceRef
description: |-
The default backend service resource.
Before forwarding the request to backendService, the loadbalancer
applies any relevant headerActions specified as part of this
backendServiceWeight.
gvk:
group: compute.cnrm.cloud.google.com
version: v1beta1
kind: ComputeBackendService
targetField: self_link
- tfField: path_matcher.path_rule.service
description: |-
The backend service to which traffic is directed if this rule is
matched.
For the Global URL Map, it should be a reference to the backend
service or backend bucket.
For the Regional URL Map, it should be a reference to the backend
service.
If routeAction is additionally specified, advanced routing actions
like URL Rewrites, etc. take effect prior to sending the request to
the backend. However, if service is specified, routeAction cannot
contain any weightedBackendServices. Conversely, if routeAction
specifies any weightedBackendServices, service must not be
specified. Only one of urlRedirect, service or
routeAction.weightedBackendService must be set.
types:
- key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: backendBucketRef
gvk:
kind: ComputeBackendBucket
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: path_matcher.path_rule.route_action.request_mirror_policy.backend_service
key: backendServiceRef
description: |-
Required. The backend service resource being mirrored to.
gvk:
group: compute.cnrm.cloud.google.com
version: v1beta1
kind: ComputeBackendService
targetField: self_link
- tfField: path_matcher.path_rule.route_action.weighted_backend_services.backend_service
description: |-
Required. The default backend service resource. Before forwarding
the request to backendService, the loadbalancer applies any relevant
headerActions specified as part of this backendServiceWeight.
key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: path_matcher.route_rules.route_action.request_mirror_policy.backend_service
key: backendServiceRef
description: |-
Required. The backend service resource being mirrored to.
gvk:
group: compute.cnrm.cloud.google.com
version: v1beta1
kind: ComputeBackendService
targetField: self_link
- tfField: path_matcher.route_rules.route_action.weighted_backend_services.backend_service
description: |-
Required. The default backend service resource. Before forwarding
the request to backendService, the loadbalancer applies any relevant
headerActions specified as part of this backendServiceWeight.
key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: test.service
description: |-
The backend service resource that should be matched by this test.
For the Global URL Map, it should be a reference to the backend
service or backend bucket.
For the Regional URL Map, it should be a reference to the backend
service.
types:
- key: backendServiceRef
gvk:
kind: ComputeBackendService
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- key: backendBucketRef
gvk:
kind: ComputeBackendBucket
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_vpn_gateway
kind: ComputeTargetVPNGateway
metadataMapping:
name: name
resourceID:
targetField: name
idTemplate: "projects/{{project}}/regions/{{region}}/targetVpnGateways/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
resourceReferences:
- key: networkRef
tfField: network
description: |-
The network this VPN gateway is accepting traffic for.
gvk:
kind: ComputeNetwork
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project
- name: google_compute_vpn_tunnel
kind: ComputeVPNTunnel
idTemplate: "projects/{{project}}/regions/{{region}}/vpnTunnels/{{name}}"
idTemplateCanBeUsedToMatchResourceName: true
resourceAvailableInAssetInventory: true
metadataMapping:
name: name
labels: labels
resourceID:
targetField: name
resourceReferences:
- tfField: target_vpn_gateway
description: |-
The ComputeTargetVPNGateway with which this VPN tunnel is
associated.
key: targetVPNGatewayRef
gvk:
kind: ComputeTargetVPNGateway
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: vpn_gateway
description: |-
The ComputeVPNGateway with which this VPN tunnel is associated.
This must be used if a High Availability VPN gateway resource is
created.
key: vpnGatewayRef
gvk:
kind: ComputeVPNGateway
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: peer_external_gateway
description: |-
The peer side external VPN gateway to which this VPN tunnel
is connected.
key: peerExternalGatewayRef
gvk:
kind: ComputeExternalVPNGateway
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: peer_gcp_gateway
description: |-
The peer side HA GCP VPN gateway to which this VPN tunnel is
connected. If provided, the VPN tunnel will automatically use the
same VPN gateway interface ID in the peer GCP VPN gateway.
key: peerGCPGatewayRef
gvk:
kind: ComputeVPNGateway
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
- tfField: router
description: |-
The router to be used for dynamic routing.
key: routerRef
gvk:
kind: ComputeRouter
version: v1beta1
group: compute.cnrm.cloud.google.com
targetField: self_link
containers:
- type: project
tfField: project