[Draft] Add post-quantum key exchange to compute ssl policy resources

mmv1/products/compute/RegionSslPolicy.yaml

@@ -43,6 +43,12 @@ custom_code:
   constants: 'templates/terraform/constants/region_ssl_policy.tmpl'
 custom_diff:
   - 'regionSslPolicyCustomizeDiff'
+examples:
+  - name: 'region_ssl_policy_basic'
+    primary_resource_id: 'region-ssl-policy'
+    vars:
+      region_ssl_policy_name: 'region-ssl-policy'
+      post_quantum_region_ssl_policy_name: 'region-post-quantum-ssl-policy'
 parameters:
   - name: 'region'
     type: ResourceRef
@@ -129,6 +135,23 @@ properties:
     send_empty_value: true
     item_type:
       type: String
+  - name: 'postQuantumKeyExchange'
+    api_name: 'postQuantumKeyExchange'
+    type: Enum
+    description: |
+      One of `DEFAULT`, `ENABLED`, or `DEFERRED`. Controls whether the load balancer negotiates
+      X25519MLKEM768 key exchange when clients advertise support for it.
+      When set to `DEFAULT`, or if no SSL Policy is attached to
+      the target proxy, the load balancer disallows X25519MLKEM768 key
+      exchange before October 2026, and allows it afterward. When set to
+      `ENABLED`, the load balancer allows X25519MLKEM768 key
+      exchange. When set to `DEFERRED`, the load balancer
+      disallows X25519MLKEM768 key exchange until October 2027, and allows
+      it afterward.
+    enum_values:
+      - 'DEFAULT'
+      - 'ENABLED'
+      - 'DEFERRED'
   - name: 'fingerprint'
     type: Fingerprint
     description: |

mmv1/products/compute/SslPolicy.yaml

@@ -50,6 +50,7 @@ examples:
       production_ssl_policy_name: 'production-ssl-policy'
       nonprod_ssl_policy_name: 'nonprod-ssl-policy'
       custom_ssl_policy_name: 'custom-ssl-policy'
+      post_quantum_ssl_policy_name: 'post-quantum-ssl-policy'
 parameters:
 properties:
   - name: 'creationTimestamp'
@@ -128,6 +129,23 @@ properties:
     is_set: true
     item_type:
       type: String
+  - name: 'postQuantumKeyExchange'
+    api_name: 'postQuantumKeyExchange'
+    type: Enum
+    description: |
+      One of `DEFAULT`, `ENABLED`, or `DEFERRED`. Controls whether the load balancer
+      negotiates X25519MLKEM768 key exchange when clients advertise support for it.
+      When set to `DEFAULT`, or if no SSL Policy is attached to
+      the target proxy, the load balancer disallows X25519MLKEM768 key
+      exchange before October 2026, and allows it afterward. When set to
+      `ENABLED`, the load balancer allows X25519MLKEM768 key
+      exchange. When set to `DEFERRED`, the load balancer
+      disallows X25519MLKEM768 key exchange until October 2027, and allows
+      it afterward.
+    enum_values:
+      - 'DEFAULT'
+      - 'ENABLED'
+      - 'DEFERRED'
   - name: 'fingerprint'
     type: String
     description: |

mmv1/templates/terraform/examples/region_ssl_policy_basic.tf.tmpl

@@ -0,0 +1,13 @@
+resource "google_compute_region_ssl_policy" "region-ssl-policy" {
+  name    = "{{index $.Vars "region_ssl_policy_name"}}"
+  region  = "us-central1"
+  profile = "MODERN"
+}
+
+resource "google_compute_region_ssl_policy" "region-post-quantum-ssl-policy" {
+  name                         = "{{index $.Vars "post_quantum_region_ssl_policy_name"}}"
+  region                       = "us-central1"
+  profile                      = "MODERN"
+  min_tls_version              = "TLS_1_2"
+  post_quantum_key_exchange    = "ENABLED"
+}

mmv1/templates/terraform/examples/ssl_policy_basic.tf.tmpl

@@ -15,3 +15,10 @@ resource "google_compute_ssl_policy" "custom-ssl-policy" {
   profile         = "CUSTOM"
   custom_features = ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"]
 }
+
+resource "google_compute_ssl_policy" "post-quantum-ssl-policy" {
+  name                         = "{{index $.Vars "post_quantum_ssl_policy_name"}}"
+  profile                      = "MODERN"
+  min_tls_version              = "TLS_1_2"
+  post_quantum_key_exchange    = "ENABLED"
+}

mmv1/third_party/terraform/services/compute/resource_compute_region_ssl_policy_test.go.tmpl

@@ -218,6 +218,81 @@ func TestAccComputeRegionSslPolicy_update_from_custom(t *testing.T) {
 	})
 }
 
+func TestAccComputeRegionSslPolicy_postQuantumKeyExchange(t *testing.T) {
+	t.Parallel()
+
+	var sslPolicy compute.SslPolicy
+	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeSslPolicyDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeRegionSslUpdate1(sslPolicyName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeRegionSslPolicyExists(
+						t, "google_compute_region_ssl_policy.update", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.update", "profile", "MODERN"),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.update", "min_tls_version", "TLS_1_0"),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum", "post_quantum_key_exchange", ""),
+				),
+			},
+			{
+				ResourceName:      "google_compute_region_ssl_policy.update",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRegionSslPostQuantum(sslPolicyName, "ENABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeRegionSslPolicyExists(
+						t, "google_compute_region_ssl_policy.post_quantum", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum", "post_quantum_key_exchange", "ENABLED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_region_ssl_policy.post_quantum",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRegionSslPostQuantum(sslPolicyName, "DEFERRED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeRegionSslPolicyExists(
+						t, "google_compute_region_ssl_policy.post_quantum", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum", "post_quantum_key_exchange", "DEFERRED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_region_ssl_policy.post_quantum",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeRegionSslPostQuantum(sslPolicyName, "DEFAULT"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeRegionSslPolicyExists(
+						t, "google_compute_region_ssl_policy.post_quantum", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_region_ssl_policy.post_quantum", "post_quantum_key_exchange", "DEFAULT"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_region_ssl_policy.post_quantum",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckComputeRegionSslPolicyExists(t *testing.T, n string, sslPolicy *compute.SslPolicy) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -336,3 +411,15 @@ resource "google_compute_region_ssl_policy" "foobar" {
 }
 `, resourceName)
 }
+
+func testAccComputeRegionSslPostQuantum(resourceName, pqke string) string {
+	return fmt.Sprintf(`
+resource "google_compute_region_ssl_policy" "postquantum" {
+  name                         = "%s"
+  profile                      = "MODERN"
+  min_tls_version              = "TLS_1_2"
+  region                       = "us-central1"
+  post_quantum_key_exchange    = "%s"
+}
+`, resourceName, pqke)
+}

mmv1/third_party/terraform/services/compute/resource_compute_ssl_policy_test.go.tmpl

@@ -188,6 +188,77 @@ func TestAccComputeSslPolicy_update_from_custom(t *testing.T) {
 	})
 }
 
+func TestAccComputeSslPolicy_postQuantumKeyExchange(t *testing.T) {
+	t.Parallel()
+
+	var sslPolicy compute.SslPolicy
+	sslPolicyName := fmt.Sprintf("test-ssl-policy-%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeSslPolicyDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeSslPostQuantum(sslPolicyName, ""),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeSslPolicyExists(
+						t, "google_compute_ssl_policy.post_quantum", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum", "post_quantum_key_exchange", "ENABLED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_ssl_policy.post_quantum",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeSslPostQuantum(sslPolicyName, "DEFAULT"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeSslPolicyExists(
+						t, "google_compute_ssl_policy.post_quantum", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum", "post_quantum_key_exchange", "DEFAULT"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_ssl_policy.post_quantum",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeSslPostQuantum(sslPolicyName, "ENABLED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeSslPolicyExists(
+						t, "google_compute_ssl_policy.post_quantum", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum", "post_quantum_key_exchange", "ENABLED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_ssl_policy.post_quantum",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+			{
+				Config: testAccComputeSslPostQuantum(sslPolicyName, "DEFERRED"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeSslPolicyExists(
+						t, "google_compute_ssl_policy.post_quantum", &sslPolicy),
+					resource.TestCheckResourceAttr(
+						"google_compute_ssl_policy.post_quantum", "post_quantum_key_exchange", "DEFERRED"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_ssl_policy.post_quantum",
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccCheckComputeSslPolicyExists(t *testing.T, n string, sslPolicy *compute.SslPolicy) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -279,3 +350,14 @@ resource "google_compute_ssl_policy" "update" {
 }
 `, resourceName)
 }
+
+func testAccComputeSslPostQuantum(resourceName, pqke string) string {
+	return fmt.Sprintf(`
+resource "google_compute_ssl_policy" "post_quantum" {
+  name                         = "%s"
+  profile                      = "MODERN"
+  min_tls_version              = "TLS_1_2"
+  post_quantum_key_exchange    = "%s"
+}
+`, resourceName, pqke)
+}