Skip to content

Commit 8ecd481

Browse files
chkp-eddiekchkp-eddiek
authored
feat(VSECPC-10745): Initial commit of GCP Terraform module with NSI deployment
1 parent 6ede9d1 commit 8ecd481

File tree

23 files changed

+1733
-11
lines changed

23 files changed

+1733
-11
lines changed

‎README.md‎

Lines changed: 151 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,155 @@
1-
# Check Point CloudGuard Network Repository Overview
2-
Check Point CloudGuard Network (formerly known as CloudGuard IaaS) repository.
1+
![GitHub Wachers](https://img.shields.io/github/watchers/CheckPointSW/terraform-azure-cloudguard-network-security)
2+
![GitHub Release](https://img.shields.io/github/v/release/CheckPointSW/terraform-azure-cloudguard-network-security)
3+
![GitHub Commits Since Last Commit](https://img.shields.io/github/commits-since/CheckPointSW/terraform-azure-cloudguard-network-security/latest/master)
4+
![GitHub Last Commit](https://img.shields.io/github/last-commit/CheckPointSW/terraform-azure-cloudguard-network-security/master)
5+
![GitHub Repo Size](https://img.shields.io/github/repo-size/CheckPointSW/terraform-azure-cloudguard-network-security)
6+
![GitHub Downloads](https://img.shields.io/github/downloads/CheckPointSW/terraform-azure-cloudguard-network-security/total)
37

4-
The repository contains:
8+
# Terraform Modules for CloudGuard Network Security (CGNS) - GCP
59

6-
* Terraform modules
7-
* Community-supported content
810

9-
## Related Products and Solutions
10-
* CloudGuard Network Security for GCP
11+
## Introduction
12+
This repository provides a structured set of Terraform modules for deploying Check Point CloudGuard Network Security in GCP. These modules automate the creation of Virtual Networks, Security Gateways, High-Availability architectures, and more, enabling secure and scalable cloud deployments.
1113

12-
## References
13-
* For more information about Check Point CloudGuard for Public Cloud, see https://www.checkpoint.com/products/iaas-public-cloud-security/
14-
* CloudGuard documentation is available at https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk132552&
15-
* CloudGuard Network CheckMates community is available at https://community.checkpoint.com/t5/CloudGuard-IaaS/bd-p/cloudguard-iaas
14+
15+
## Before you begin
16+
1. Create a project in the [Google Cloud Console](https://console.cloud.google.com/) and set up billing on that project.
17+
2. [Install Terraform](https://learn.hashicorp.com/tutorials/terraform/install-cli) and read the Terraform getting started guide that follows. This guide will assume basic proficiency with Terraform - it is an introduction to the Google provider.
18+
19+
### Configuring the Provider
20+
The **main.tf** file includes the following provider configuration block used to configure the credentials you use to authenticate with GCP, as well as a default project and location for your resources:
21+
```
22+
provider "google" {
23+
credentials = file(var.service_account_path)
24+
project = var.project
25+
region = var.region
26+
}
27+
...
28+
```
29+
30+
1. [Create a Service Account](https://cloud.google.com/docs/authentication/getting-started) (or use the existing one). Next, download the JSON key file. Name it something you can remember and store it somewhere secure on your machine. <br/>
31+
2. Select "Editor" Role or verify you have the following permissions:
32+
```
33+
compute.autoscalers.create
34+
compute.autoscalers.delete
35+
compute.autoscalers.get
36+
compute.autoscalers.update
37+
compute.disks.create
38+
compute.firewalls.create
39+
compute.firewalls.delete
40+
compute.firewalls.get
41+
compute.firewalls.update
42+
compute.instanceGroupManagers.create
43+
compute.instanceGroupManagers.delete
44+
compute.instanceGroupManagers.get
45+
compute.instanceGroupManagers.use
46+
compute.instanceGroups.delete
47+
compute.instanceTemplates.create
48+
compute.instanceTemplates.delete
49+
compute.instanceTemplates.get
50+
compute.instanceTemplates.useReadOnly
51+
compute.instances.create
52+
compute.instances.setMetadata
53+
compute.instances.setTags
54+
compute.networks.get
55+
compute.networks.updatePolicy
56+
compute.regions.list
57+
compute.subnetworks.get
58+
compute.subnetworks.use
59+
compute.subnetworks.useExternalIp
60+
iam.serviceAccounts.actAs
61+
```
62+
3. ```credentials``` - Your service account key file is used to complete a two-legged OAuth 2.0 flow to obtain access tokens to authenticate with the GCP API as needed; Terraform will use it to reauthenticate automatically when tokens expire. <br/>
63+
The provider credentials can be provided either as static credentials or as [Environment Variables](https://www.terraform.io/docs/providers/google/guides/provider_reference.html#credentials-1).
64+
- Static credentials can be provided by adding the path to your service-account json file, project-id and region in /gcp/modules/autoscale-into-new-vpc/**terraform.tfvars** file as follows:
65+
```
66+
service_account_path = "service-accounts/service-account-file-name.json"
67+
project = "project-id"
68+
region = "us-central1"
69+
```
70+
- In case the Environment Variables are used, perform modifications described below:<br/>
71+
a. The next lines in the main.tf file, in the provider google resource, need to be deleted or commented:
72+
```
73+
provider "google" {
74+
// credentials = file(var.service_account_path)
75+
// project = var.project
76+
77+
region = var.region
78+
}
79+
```
80+
b.In the terraform.tfvars file leave empty double quotes for credentials and project variables:
81+
```
82+
service_account_path = ""
83+
project = ""
84+
```
85+
## Usage
86+
- Fill all variables in the /gcp/autoscale-into-existing-vpc/**terraform.tfvars** file with proper values (see below for variables descriptions).
87+
- From a command line initialize the Terraform configuration directory:
88+
```
89+
terraform init
90+
```
91+
- Create an execution plan:
92+
```
93+
terraform plan
94+
```
95+
- Create or modify the deployment:
96+
```
97+
terraform apply
98+
```
99+
100+
## Repository Structure
101+
`Submodules:` Contains modular, reusable, production-grade Terraform components, each with its own documentation.
102+
103+
`Examples:` Demonstrates how to use the modules.
104+
105+
106+
**Submodules:**
107+
* [`network-security-integration`](https://registry.terraform.io/modules/chkp-olgami/olgami/gcp/latest/submodules/network-security-integration) - Deploys GCP Network Security Integration.
108+
109+
Internal Submodules -
110+
111+
* [`firewall-rule`](https://registry.terraform.io/modules/chkp-olgami/olgami/gcp/latest/submodules/firewall-rule) - Deploys firewall rules on GCP VPCs.
112+
* [`internal-load-balancer`](https://registry.terraform.io/modules/chkp-olgami/olgami/gcp/latest/submodules/internal-load-balancer) - Deploys internal load balanncer.
113+
* [`network-and-subnet`](https://registry.terraform.io/modules/chkp-olgami/olgami/gcp/latest/submodules/network-and-subnet) - Deploys VPC and subnetwork in the VPC.
114+
* [`network-security-integration-common`](https://registry.terraform.io/modules/chkp-olgami/olgami/gcp/latest/submodules/network-security-integration-common) - Deploys Network Security Integration.
115+
116+
117+
***
118+
119+
# Best Practices for Using CloudGuard Modules
120+
121+
## Step 1: Use the Required Module
122+
Add the required module in your Terraform configuration file (`main.tf`) to deploy resources. For example:
123+
124+
```hcl
125+
provider "google" {
126+
features {}
127+
}
128+
129+
module "example_module" {
130+
source = "CheckPointSW/cloudguard-network-security/gcp//modules/{module_name}"
131+
version = "{chosen_version}"
132+
# Add the required inputs
133+
}
134+
```
135+
---
136+
137+
## Step 2: Deploy with Terraform
138+
Use Terraform commands to deploy resources securely.
139+
140+
### Initialize Terraform
141+
Prepare the working directory and download required provider plugins:
142+
```hcl
143+
terraform init
144+
```
145+
146+
### Plan Deployment
147+
Preview the changes Terraform will make:
148+
```hcl
149+
terraform plan
150+
```
151+
### Apply Deployment
152+
Apply the planned changes and deploy the resources:
153+
```hcl
154+
terraform apply
155+
```

‎modules/common/common/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
2+

‎modules/common/common/output.tf‎

Whitespace-only changes.

‎modules/common/common/variables.tf‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
variable "installation_type" {
2+
type = string
3+
description = "Installation type"
4+
default = "Gateway only"
5+
}
6+
variable "os_version" {
7+
type = string
8+
description = "GAIA OS version"
9+
default = "R8120"
10+
validation {
11+
condition = contains(["R8110", "R8120" , "R82"], var.os_version)
12+
error_message = "Allowed values for os_version are 'R8110' , 'R8120', 'R82'"
13+
}
14+
}
15+
variable "image_name" {
16+
type = string
17+
description = "The single gateway and management image name"
18+
}
19+
locals {
20+
regex_validate_mgmt_image_name = "^check-point-${lower(var.os_version)}-[^(gw)].*[0-9]{3}-([0-9]{3,}|[a-z]+)-v[0-9]{8,}.*"
21+
regex_validate_gw_image_name = "^check-point-${lower(var.os_version)}-gw-.*[0-9]{3}-([0-9]{3,}|[a-z]+)-v[0-9]{8,}.*"
22+
regex_validate_image_name = contains(["Gateway only", "Cluster", "AutoScale", "Network Security Integration"], var.installation_type) ? local.regex_validate_gw_image_name : local.regex_validate_mgmt_image_name
23+
regex_image_name = length(regexall(local.regex_validate_image_name, var.image_name)) > 0 ? 0 : "Variable [image_name] must be a valid Check Point image name of the correct version."
24+
index_image_name = index(["0"], local.regex_image_name)
25+
}
26+
variable "license" {
27+
type = string
28+
description = "Checkpoint license (BYOL)."
29+
default = "BYOL"
30+
}
31+
locals {
32+
license_allowed_values = [
33+
"BYOL"]
34+
// will fail if [var.license] is invalid:
35+
validate_license = index(local.license_allowed_values, upper(var.license))
36+
}
37+
variable "admin_SSH_key" {
38+
type = string
39+
description = "(Optional) The SSH public key for SSH authentication to the template instances. Leave this field blank to use all project-wide pre-configured SSH keys."
40+
default = ""
41+
}
42+
locals {
43+
regex_valid_admin_SSH_key = "^(^$|ssh-rsa AAAA[0-9A-Za-z+/]+[=]{0,3})"
44+
// Will fail if var.admin_SSH_key is invalid
45+
regex_admin_SSH_key = length(regexall(local.regex_valid_admin_SSH_key, var.admin_SSH_key)) > 0 ? 0 : "Please enter a valid SSH public key or leave empty"
46+
index_admin_SSH_key = index(["0"], local.regex_admin_SSH_key)
47+
}
48+
variable "admin_shell" {
49+
type = string
50+
description = "Change the admin shell to enable advanced command line configuration."
51+
default = "/etc/cli.sh"
52+
}
53+
locals {
54+
admin_shell_allowed_values = [
55+
"/etc/cli.sh",
56+
"/bin/bash",
57+
"/bin/csh",
58+
"/bin/tcsh"]
59+
// Will fail if var.admin_shell is invalid
60+
validate_admin_shell = index(local.admin_shell_allowed_values, var.admin_shell)
61+
}
62+
variable "externalIP" {
63+
type = string
64+
description = "External IP address type"
65+
default = "static"
66+
validation {
67+
condition = contains(["static", "ephemeral", "none"], var.externalIP)
68+
error_message = "Invalid value for externalIP. Allowed values are 'static', 'ephemeral' or 'none'."
69+
}
70+
}
71+
locals {
72+
external_ip_allowed_values = [
73+
"static",
74+
"ephemeral",
75+
"none"
76+
]
77+
validate_external_ip = index(local.external_ip_allowed_values, var.externalIP)
78+
}
79+

‎modules/common/firewall-rule/main.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "google_compute_firewall" "firewall_rules" {
2+
name = var.rule_name
3+
network = var.network[0]
4+
allow {
5+
protocol = var.protocol
6+
ports = var.ports
7+
}
8+
source_ranges = var.source_ranges
9+
target_tags = var.target_tags
10+
}

‎modules/common/firewall-rule/output.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "firewall_rule_name" {
2+
value = google_compute_firewall.firewall_rules.name
3+
}

‎modules/common/firewall-rule/variables.tf‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
variable "protocol" {
2+
type = string
3+
description = "The IP protocol to which this rule applies."
4+
}
5+
variable "source_ranges" {
6+
type = list(string)
7+
description = "(Optional) Source IP ranges for the protocol traffic - Traffic is only allowed from sources within these IP address ranges. Use CIDR notation when entering ranges. For gateway only. Please leave empty list to unable this protocol traffic."
8+
default = []
9+
}
10+
variable "rule_name" {
11+
type = string
12+
description = "Firewall rule name."
13+
}
14+
variable "network" {
15+
type = list(string)
16+
description = "The name or self_link of the network to attach this firewall to."
17+
}
18+
variable "target_tags" {
19+
description = "List of target tags for the firewall rule"
20+
type = list(string)
21+
default = ["checkpoint-gateway"]
22+
}
23+
variable "ports" {
24+
description = "List of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. "
25+
type = list(number)
26+
default = []
27+
28+
}

‎modules/common/internal-load-balancer/main.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
resource "google_compute_health_check" "health_check" {
2+
name = "${var.prefix}-health-check"
3+
project = var.project
4+
tcp_health_check {
5+
port = 8117
6+
}
7+
}
8+
9+
resource "google_compute_region_backend_service" "backend_service" {
10+
name = "${var.prefix}-internal-backend-service"
11+
project = var.project
12+
protocol = var.protocol
13+
health_checks = [google_compute_health_check.health_check.id]
14+
region = var.region
15+
network = var.network
16+
connection_draining_timeout_sec = var.connection_draining_timeout
17+
backend {
18+
group = var.instance_group
19+
}
20+
}
21+
22+
resource "google_compute_forwarding_rule" "forwarding_rule" {
23+
for_each = toset(var.intercept_deployment_zones)
24+
name = "${var.prefix}-forwarding-rule-${each.key}"
25+
project = var.project
26+
region = var.region
27+
load_balancing_scheme = "INTERNAL"
28+
ip_version = "IPV4"
29+
ip_protocol = var.ip_protocol
30+
ports = var.ports
31+
subnetwork = var.subnetwork
32+
backend_service = google_compute_region_backend_service.backend_service.self_link
33+
}

‎modules/common/internal-load-balancer/output.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
output "forwarding_rule" {
2+
value = { for key, rule in google_compute_forwarding_rule.forwarding_rule : key => rule.self_link }
3+
}

0 commit comments

Comments
 (0)