1import * as GCP from "@/GCP";
2import * as Test from "@/Test/Alchemy";
3import * as vmwareengine from "@distilled.cloud/gcp/vmwareengine_v1";
4import { expect } from "alchemy-test";
5import * as Effect from "effect/Effect";
6import { MinimumLogLevel } from "effect/References";
7import * as Schedule from "effect/Schedule";
8import { GcpEnvironment } from "@/GCP/Environment";
9
10const { test } = Test.make({ providers: GCP.providers() });
11
12const logLevel = Effect.provideService(
13 MinimumLogLevel,
14 process.env.DEBUG ? "Debug" : "Info",
15);
16
17// Private clouds need VMware Engine node quota and bill thousands of dollars
18// a month; set GCP_TEST_VMWAREENGINE=1 on an entitled project to opt in.
19const runLifecycle = !!process.env.GCP_TEST_VMWAREENGINE && !process.env.FAST;
20
21const waitUntilGone = (name: string) =>
22 vmwareengine
23 .getProjectsLocationsNetworkPoliciesExternalAccessRules({ name })
24 .pipe(
25 Effect.as("found" as const),
26 Effect.catchTag("NotFound", () => Effect.succeed("gone" as const)),
27 Effect.repeat({
28 schedule: Schedule.spaced("2 seconds"),
29 until: (status) => status === "gone",
30 times: 10,
31 }),
32 );
33
34test.provider(
35 "getProjectsLocationsNetworkPoliciesExternalAccessRules on a missing rule fails with a typed tag",
36 (stack) =>
37 Effect.gen(function* () {
38 const { project } = yield* GcpEnvironment.current;
39
40 yield* stack.destroy();
41
42 const error = yield* Effect.flip(
43 vmwareengine.getProjectsLocationsNetworkPoliciesExternalAccessRules({
44 name: `projects/${project}/locations/us-central1/networkPolicies/alchemy-missing/externalAccessRules/missing`,
45 }),
46 );
47 expect(error._tag).toEqual("NotFound");
48
49 yield* stack.destroy();
50 }).pipe(logLevel),
51 {
52 tags: ["provider:gcp", "provider:gcp:vmwareengine", "live"],
53 timeout: 90_000,
54 },
55);
56
57test.provider.skipIf(!runLifecycle)(
58 "create, update, and delete an external access rule",
59 (stack) =>
60 Effect.gen(function* () {
61 yield* stack.destroy();
62
63 const created = yield* stack.deploy(
64 Effect.gen(function* () {
65 const ven = yield* GCP.VMwareEngine.VmwareEngineNetwork("Ven", {
66 type: "STANDARD",
67 description: "rule grandparent",
68 });
69 const policy = yield* GCP.VMwareEngine.NetworkPolicy("Edge", {
70 vmwareEngineNetwork: ven.name,
71 edgeServicesCidr: "192.168.100.0/26",
72 internetAccess: { enabled: true },
73 externalIp: { enabled: true },
74 description: "rule parent",
75 });
76 const rule =
77 yield* GCP.VMwareEngine.NetworkPoliciesExternalAccessRule("Https", {
78 networkPolicy: policy.name,
79 action: "ALLOW",
80 ipProtocol: "tcp",
81 priority: 1000,
82 sourceIpRanges: [{ ipAddressRange: "0.0.0.0/0" }],
83 destinationIpRanges: [{ ipAddressRange: "0.0.0.0/0" }],
84 destinationPorts: ["443"],
85 description: "alchemy-test-ear",
86 });
87 return { ven, policy, rule };
88 }),
89 );
90
91 expect(created.rule.name).toContain("/externalAccessRules/");
92 expect(created.rule.action).toEqual("ALLOW");
93 expect(created.rule.priority).toEqual(1000);
94 expect(created.rule.description).toEqual("alchemy-test-ear");
95
96 const fetched =
97 yield* vmwareengine.getProjectsLocationsNetworkPoliciesExternalAccessRules(
98 { name: created.rule.name },
99 );
100 expect(fetched.name).toEqual(created.rule.name);
101 expect(fetched.description).toContain("alchemy-id=");
102 expect(fetched.description).toContain("alchemy-test-ear");
103
104 const updated = yield* stack.deploy(
105 Effect.gen(function* () {
106 const ven = yield* GCP.VMwareEngine.VmwareEngineNetwork("Ven", {
107 vmwareEngineNetworkId: created.ven.vmwareEngineNetworkId,
108 type: "STANDARD",
109 description: "rule grandparent",
110 });
111 const policy = yield* GCP.VMwareEngine.NetworkPolicy("Edge", {
112 networkPolicyId: created.policy.networkPolicyId,
113 vmwareEngineNetwork: ven.name,
114 edgeServicesCidr: "192.168.100.0/26",
115 internetAccess: { enabled: true },
116 externalIp: { enabled: true },
117 description: "rule parent",
118 });
119 const rule =
120 yield* GCP.VMwareEngine.NetworkPoliciesExternalAccessRule("Https", {
121 networkPolicy: policy.name,
122 externalAccessRuleId: created.rule.externalAccessRuleId,
123 action: "DENY",
124 ipProtocol: "tcp",
125 priority: 2000,
126 sourceIpRanges: [{ ipAddressRange: "0.0.0.0/0" }],
127 destinationIpRanges: [{ ipAddressRange: "0.0.0.0/0" }],
128 destinationPorts: ["443"],
129 description: "alchemy-prod-ear",
130 });
131 return { ven, policy, rule };
132 }),
133 );
134
135 expect(updated.rule.name).toEqual(created.rule.name);
136 expect(updated.rule.action).toEqual("DENY");
137 expect(updated.rule.priority).toEqual(2000);
138 expect(updated.rule.description).toEqual("alchemy-prod-ear");
139
140 yield* stack.destroy();
141
142 const gone = yield* waitUntilGone(created.rule.name);
143 expect(gone).toEqual("gone");
144 }).pipe(logLevel),
145 {
146 tags: ["provider:gcp", "provider:gcp:vmwareengine", "live"],
147 timeout: 120_000,
148 },
149);