ComputeFirewallPolicyRule

Property Value
Google Cloud Service Name Compute Engine
Google Cloud Service Documentation /compute/docs/
Google Cloud REST Resource Name v1.firewallPolicies
Google Cloud REST Resource Documentation /compute/docs/reference/rest/v1/firewallPolicies
Config Connector Resource Short Names gcpcomputefirewallpolicyrule
gcpcomputefirewallpolicyrules
computefirewallpolicyrule
Config Connector Service Name compute.googleapis.com
Config Connector Resource Fully Qualified Name computefirewallpolicyrules.compute.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember No

Custom Resource Definition Properties

Spec

Schema

  action: string
  description: string
  direction: string
  disabled: boolean
  enableLogging: boolean
  firewallPolicyRef:
    external: string
    name: string
    namespace: string
  match:
    destIPRanges:
    - string
    layer4Configs:
    - ipProtocol: string
      ports:
      - string
    srcIPRanges:
    - string
  priority: integer
  targetResources:
  - external: string
    name: string
    namespace: string
  targetServiceAccounts:
  - external: string
    name: string
    namespace: string
Fields

action

Required

string

The Action to perform when the client connection triggers the rule. Can currently be either "allow" or "deny()" where valid values for status are 403, 404, and 502.

description

Optional

string

An optional description for this resource.

direction

Required

string

The direction in which this rule applies. Possible values: INGRESS, EGRESS

disabled

Optional

boolean

Denotes whether the firewall policy rule is disabled. When set to true, the firewall policy rule is not enforced and traffic behaves as if it did not exist. If this is unspecified, the firewall policy rule will be enabled.

enableLogging

Optional

boolean

Denotes whether to enable logging for a particular rule. If logging is enabled, logs will be exported to the configured export destination in Stackdriver. Logs may be exported to BigQuery or Pub/Sub. Note: you cannot enable logging on "goto_next" rules.

firewallPolicyRef

Required

object

firewallPolicyRef.external

Optional

string

The firewall policy of the resource.

firewallPolicyRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

firewallPolicyRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

match

Required

object

A match condition that incoming traffic is evaluated against. If it evaluates to true, the corresponding 'action' is enforced.

match.destIPRanges

Optional

list (string)

CIDR IP address range. Maximum number of destination CIDR IP ranges allowed is 256.

match.destIPRanges.[]

Optional

string

match.layer4Configs

Required

list (object)

Pairs of IP protocols and ports that the rule should match.

match.layer4Configs.[]

Required

object

match.layer4Configs.[].ipProtocol

Required

string

The IP protocol to which this rule applies. The protocol type is required when creating a firewall rule. This value can either be one of the following well known protocol strings (`tcp`, `udp`, `icmp`, `esp`, `ah`, `ipip`, `sctp`), or the IP protocol number.

match.layer4Configs.[].ports

Optional

list (string)

An optional list of ports to which this rule applies. This field is only applicable for UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ``.

match.layer4Configs.[].ports.[]

Optional

string

match.srcIPRanges

Optional

list (string)

CIDR IP address range. Maximum number of source CIDR IP ranges allowed is 256.

match.srcIPRanges.[]

Optional

string

priority

Required

integer

An integer indicating the priority of a rule in the list. The priority must be a positive value between 0 and 2147483647. Rules are evaluated from highest to lowest priority where 0 is the highest priority and 2147483647 is the lowest prority.

targetResources

Optional

list (object)

targetResources.[]

Optional

object

targetResources.[].external

Optional

string

targetResources.[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

targetResources.[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

targetServiceAccounts

Optional

list (object)

targetServiceAccounts.[]

Optional

object

targetServiceAccounts.[].external

Optional

string

targetServiceAccounts.[].name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

targetServiceAccounts.[].namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

Status

Schema

  conditions:
  - lastTransitionTime: string
    message: string
    reason: string
    status: string
    type: string
  kind: string
  observedGeneration: integer
  ruleTupleCount: integer
Fields
conditions

list (object)

Conditions represent the latest available observation of the resource's current state.

conditions.[]

object

conditions.[].lastTransitionTime

string

Last time the condition transitioned from one status to another.

conditions.[].message

string

Human-readable message indicating details about last transition.

conditions.[].reason

string

Unique, one-word, CamelCase reason for the condition's last transition.

conditions.[].status

string

Status is the status of the condition. Can be True, False, Unknown.

conditions.[].type

string

Type is the type of the condition.

kind

string

Type of the resource. Always `compute#firewallPolicyRule` for firewall policy rules

observedGeneration

integer

ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.

ruleTupleCount

integer

Calculation of the complexity of a single firewall policy rule.

Sample YAML(s)

Typical Use Case

  # Copyright 2020 Google LLC
  #
  # Licensed under the Apache License, Version 2.0 (the "License");
  # you may not use this file except in compliance with the License.
  # You may obtain a copy of the License at
  #
  #     http://www.apache.org/licenses/LICENSE-2.0
  #
  # Unless required by applicable law or agreed to in writing, software
  # distributed under the License is distributed on an "AS IS" BASIS,
  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  # See the License for the specific language governing permissions and
  # limitations under the License.
  
  apiVersion: compute.cnrm.cloud.google.com/v1beta1
  kind: ComputeFirewallPolicyRule
  metadata:
    name: firewallpolicyrule-sample
  spec:
    action: "deny"
    description: "A Firewall Policy Rule"
    direction: "INGRESS"
    disabled: false
    enableLogging: false
    firewallPolicyRef:
      name: firewallpolicyrule-dep
    match:
      layer4Configs:
      - ipProtocol: "tcp"
      srcIPRanges:
      - "10.100.0.1/32"
    priority: 9000
    targetResources:
      - name: firewallpolicyrule-dep
    targetServiceAccounts:
      - name: firewallpolicyrule-dep
  ---
  apiVersion: compute.cnrm.cloud.google.com/v1beta1
  kind: ComputeFirewallPolicy
  metadata:
    name: firewallpolicyrule-dep
  spec:
    organizationRef:
      # Replace "${ORG_ID?}" with the numeric ID for your organization
      external: "organizations/${ORG_ID?}"
    # ComputeFirewallPolicy shortNames must be unique in the organization in
    # which the firewall policy is created
    shortName: ${PROJECT_ID?}-short
    description: "A basic organization firewall policy"
  ---
  apiVersion: compute.cnrm.cloud.google.com/v1beta1
  kind: ComputeNetwork
  metadata:
    name: firewallpolicyrule-dep
  spec:
    routingMode: REGIONAL
    autoCreateSubnetworks: false
  ---
  apiVersion: iam.cnrm.cloud.google.com/v1beta1
  kind: IAMServiceAccount
  metadata:
    annotations:
      # Replace ${PROJECT_ID?} with your project ID.
      cnrm.cloud.google.com/project-id: "${PROJECT_ID?}"
    name: firewallpolicyrule-dep