diff --git a/modules/autoscale/README.md b/modules/autoscale/README.md index 1673e9a..18ce4ce 100755 --- a/modules/autoscale/README.md +++ b/modules/autoscale/README.md @@ -21,7 +21,7 @@ provider "google" { module "example_module" { source = "CheckPointSW/cloudguard-network-security/gcp//modules/autoscale" - version = "1.0.6" + version = "~> 1.0" # --- Project Configuration --- project_id = "your-gcp-project-id" @@ -72,12 +72,15 @@ module "example_module" { ## VPC For each network and subnet variable, you can choose whether to create a new network with a new subnet or to use an existing one. - If you want to create a new network and subnet, please input a subnet CIDR block for the desired new network - In this case, the network name and subnetwork name will not be used: + ``` external_network_name = "" # Leave empty when creating new network external_subnetwork_name = "" # Leave empty when creating new network external_network_cidr = "10.0.1.0/24" ``` + - Otherwise, if you want to use existing network and subnet, please leave empty double quotes in the CIDR variable for the desired network: + ``` external_network_name = "network name" external_subnetwork_name = "subnetwork name" @@ -86,17 +89,20 @@ For each network and subnet variable, you can choose whether to create a new net ## Multi-Project (Shared VPC) Support To attach the autoscale gateways to networks that live in a different host project (Shared VPC), set: + ``` project_id = "service-project-id" # provider context external_network_project = "host-project-id" internal_network_project = "host-project-id" ``` + Leave the network project variable(s) empty when network(s) are in the same project. **Note:** All networks must reside in projects within the same GCP organization. Cross-organization Shared VPC is not supported. ## Firewall Rules To create Firewall and allow traffic for ICMP, TCP, UDP, SCTP or/and ESP - enter string of Source IP ranges seperated by comma: + ``` external_network_icmp_source_ranges = ""123.123.0.0/24, 234.234.0.0/24"" external_network_tcp_source_ranges = "0.0.0.0/0" @@ -110,12 +116,15 @@ Please leave empty `""` for a protocol if you want to disable traffic for it. ## Images You can choose to either deploy with the latest image or with a custom image. - If you want to deploy with the latest image leave the `source_image` empty or with `"latest"` keyword and specify the `os_version` and `license`: + ``` source_image = "" os_version = "R82" license = "BYOL" ``` + - Otherwise specify the `source_image` with the path to the image: + ``` source_image = "check-point-r82-gw-byol-mig-777-991001866-v20250731" os_version = "" # Leave empty when using specific image diff --git a/modules/cluster/README.md b/modules/cluster/README.md index ca2fff8..6280cb2 100755 --- a/modules/cluster/README.md +++ b/modules/cluster/README.md @@ -22,7 +22,7 @@ provider "google" { module "example_module" { source = "CheckPointSW/cloudguard-network-security/gcp//modules/cluster" - version = "1.0.6" + version = "~> 1.0" project_id = "my-project-id" prefix = "chkp-tf-ha" @@ -80,12 +80,15 @@ module "example_module" { ## VPC For each network and subnet variable, you can choose whether to create a new network with a new subnet or to use an existing one. - If you want to create a new network and subnet, please input a subnet CIDR block for the desired new network - In this case, the network name and subnetwork name will not be used: + ``` cluster_network_cidr = "10.0.1.0/24" cluster_network_name = "" # Leave empty when creating new network cluster_network_subnetwork_name = "" # Leave empty when creating new network ``` + - Otherwise, if you want to use existing network and subnet, please leave empty double quotes in the CIDR variable for the desired network: + ``` cluster_network_cidr = "" cluster_network_name = "cluster-network" @@ -94,6 +97,7 @@ For each network and subnet variable, you can choose whether to create a new net ## Firewall Rules To create Firewall and allow traffic for ICMP, TCP, UDP, SCTP or/and ESP - enter list of Source IP ranges. - For cluster: + ``` cluster_network_icmp_source_ranges = "123.123.0.0/24, 234.234.0.0/24" cluster_network_tcp_source_ranges = "0.0.0.0/0" @@ -101,7 +105,9 @@ To create Firewall and allow traffic for ICMP, TCP, UDP, SCTP or/and ESP - enter cluster_network_sctp_source_ranges = "" cluster_network_esp_source_ranges = "" ``` + - For management: + ``` mgmt_network_icmp_source_ranges = "123.123.0.0/24, 234.234.0.0/24" mgmt_network_tcp_source_ranges = "0.0.0.0/0" @@ -115,6 +121,7 @@ Please leave empty "" for a protocol if you want to disable traffic for it. ## Internal Networks The cluster members will each have a network interface in each internal network and create high priority routes that will route all outgoing traffic to the cluster member that is currently active.
Using internal networks depends on the variable num_internal_networks, by selecting a number in range 1 - 6 that represents the number of internal networks: + ``` num_internal_networks = 3 internal_network1_cidr = "" @@ -131,12 +138,15 @@ internal_network3_subnetwork_name = "" ## Images You can choose to either deploy with the latest image or with a custom image. - If you want to deploy with the latest image leave the `source_image` empty or with `"latest"` keyword and specify the `os_version` and `license`: + ``` source_image = "" os_version = "R82" license = "BYOL" ``` + - Otherwise specify the `source_image` with the path to the image: + ``` source_image = "check-point-r82-gw-byol-cluster-777-991001869-v20250727" os_version = "" # Leave empty when specifying an image diff --git a/modules/network-security-integration/README.md b/modules/network-security-integration/README.md index f868fa1..a0cdef9 100644 --- a/modules/network-security-integration/README.md +++ b/modules/network-security-integration/README.md @@ -136,7 +136,7 @@ provider "google" { module "nsi-test" { source = "CheckPointSW/cloudguard-network-security/gcp//modules/network-security-integration" - version = "1.0.6" + version = "~> 1.0" # --- Google Provider --- project = "project-id" diff --git a/modules/single/README.md b/modules/single/README.md index caaad66..808570f 100755 --- a/modules/single/README.md +++ b/modules/single/README.md @@ -20,7 +20,7 @@ provider { module "example_module" { source = "CheckPointSW/cloudguard-network-security/gcp//modules/single" - version = "1.0.6" + version = "~> 1.0" # --- Project Configuration --- project_id = "your-gcp-project-id" @@ -69,11 +69,13 @@ module "example_module" { ## VPC For each network and subnet variable, you can choose whether to create a new network with a new subnet or to use an existing one. - If you want to create a new network and subnet, please input a subnet CIDR block for the desired new network - In this case, the network name and subnetwork name will not be used: + ``` network_cidr = "10.0.1.0/24" network_name = "" # Leave empty when specifying a CIDR subnetwork_name = "" # Leave empty when specifying a CIDR ``` + - Otherwise, if you want to use existing network and subnet, please leave empty double quotes in the CIDR variable for the desired network: ``` @@ -84,12 +86,14 @@ For each network and subnet variable, you can choose whether to create a new net ## Multi-Project (Shared VPC) Support To attach the management or single gateway to networks that live in a different host project (Shared VPC), set: + ``` project_id = "service-project-id" # provider context network_project = "host-project-id" # external network lives here # For additional internal networks in single gateway deployments: internal_network1_project = "host-project-id" # internal network lives here (when using additional networks) ``` + Leave the network project variable(s) empty when network(s) are in the same project. ### Limitation Shared VPC is not supported across organizations. The host project and service project must be in the same organization. @@ -97,6 +101,7 @@ Shared VPC is not supported across organizations. The host project and service p ## Firewall Rules To create Firewall and allow traffic for ICMP, TCP, UDP, SCTP or/and ESP - enter list of Source IP ranges. + ``` ICMP_traffic = "123.123.0.0/24, 234.234.0.0/24" TCP_traffic = "0.0.0.0/0" @@ -110,13 +115,16 @@ Please leave empty "" for a protocol if you want to disable traffic for it. ## Images You can choose to either deploy with the latest image or with a custom image. - If you want to deploy with the latest image leave the `source_image` empty or with `"latest"` keyword and specify the `os_version`, `license`, and `installation_type`: + ``` source_image = "" os_version = "R82" license = "BYOL" installation_type = "Gateway only" ``` + - Otherwise specify the `source_image` with the path to the image: + ``` source_image = "check-point-r82-gw-byol-single-777-991001869-v20250727" os_version = "" # Leave empty when specifying an image