Skip to content

[FIX] compute: validate psc_consumer_subnet_cidr #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
roeezolantz wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[FIX] compute: validate psc_consumer_subnet_cidr #14

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a23614c
[FIX] compute: validate psc_consumer_subnet_cidr
roeezolantz Oct 20, 2026
6589228
[FIX] compute: reject IPv6 in psc_consumer_subnet_cidr
roeezolantz Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions compute/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,11 @@ variable "psc_consumer_subnet_cidr" {
type = string
default = "10.0.2.0/29"
description = "CIDR for the PSC consumer subnet created in this VPC. Must not overlap var.subnet_cidr."

validation {
condition = can(cidrnetmask(var.psc_consumer_subnet_cidr))

@haimbj1 haimbj1 Oct 20, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This passes 10.0.2.1/29 and /30–/32, and GCP rejects both at apply. Also require a network address and a prefix of /29 or shorter.

Suggested change
condition = can(cidrnetmask(var.psc_consumer_subnet_cidr))
condition = (
can(cidrnetmask(var.psc_consumer_subnet_cidr)) &&
try(cidrsubnet(var.psc_consumer_subnet_cidr, 0, 0) == var.psc_consumer_subnet_cidr, false) &&
try(tonumber(split("/", var.psc_consumer_subnet_cidr)[1]) <= 29, false)
)

error_message = "psc_consumer_subnet_cidr must be an IPv4 CIDR such as 10.0.2.0/29."

@guya-fhenix guya-fhenix Oct 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor · With the condition from haimbj1's suggestion on line 64, this message is wrong for 10.0.2.1/29 and /30, because both are IPv4 CIDRs. Say what the check requires.

Suggested change
error_message = "psc_consumer_subnet_cidr must be an IPv4 CIDR such as 10.0.2.0/29."
error_message = "psc_consumer_subnet_cidr must be an IPv4 network address with a prefix of /29 or shorter, such as 10.0.2.0/29."

}
}

variable "caller_cidr" {
Expand Down
Loading