compute: add Global External Passthrough NetLB support (#20007)

Author: slevenick

mmv1/products/compute/BackendService.yaml

@@ -52,6 +52,8 @@ include_in_tgc_next: true
 tgc_tests:
   - name: 'TestAccComputeBackendService_backendServiceCustomMetrics_update'
     skip: 'Test framework problem with single vs multiple block parsing of custom_metrics'
+api_version:
+  ga: '2026-11-01'
 custom_code:
   constants: 'templates/terraform/constants/backend_service.go.tmpl'
   encoder: 'templates/terraform/encoders/backend_service.go.tmpl'
@@ -1006,6 +1008,7 @@ properties:
       - 'INTERNAL_SELF_MANAGED'
       - 'INTERNAL_MANAGED'
       - 'EXTERNAL_MANAGED'
+      - 'EXTERNAL_PASSTHROUGH'
   - name: 'externalManagedMigrationState'
     type: Enum
     description: |

mmv1/products/compute/GlobalAddress.yaml

@@ -39,6 +39,8 @@ async:
     resource_inside_response: false
 collection_url_key: 'items'
 include_in_tgc_next: true
+api_version:
+  ga: '2026-11-01'
 custom_code:
   pre_create: 'templates/terraform/pre_create/compute_global_address.go.tmpl'
   post_create: 'templates/terraform/post_create/labels.tmpl'
@@ -140,6 +142,10 @@ properties:
       * VPC_PEERING - for peer networks
 
       * PRIVATE_SERVICE_CONNECT - for ([Beta](../guides/provider_versions.html.markdown)) only) Private Service Connect networks
+
+      * PASSTHROUGH_LOAD_BALANCER_AVAILABILITY_GROUP0 - for Global External Passthrough Network Load Balancers
+
+      * PASSTHROUGH_LOAD_BALANCER_AVAILABILITY_GROUP1 - for Global External Passthrough Network Load Balancers
   - name: 'network'
     type: ResourceRef
     description: |

mmv1/products/compute/GlobalForwardingRule.yaml

@@ -44,6 +44,8 @@ async:
     resource_inside_response: false
 collection_url_key: 'items'
 include_in_tgc_next: true
+api_version:
+  ga: '2026-11-01'
 custom_code:
   pre_create: 'templates/terraform/pre_create/compute_global_forwarding_rule.go.tmpl'
   post_create: 'templates/terraform/post_create/labels.tmpl'
@@ -240,6 +242,20 @@ samples:
           - 'ip_address'
 parameters:
 properties:
+
+  - name: 'backendService'
+    type: ResourceRef
+    description: |
+      Identifies the backend service to which the forwarding rule sends traffic.
+
+      Required for Global External Passthrough Network Load Balancing;
+      must be omitted for all other load balancer types.
+    custom_expand: 'templates/terraform/custom_expand/resourceref_with_validation.go.tmpl'
+    exactly_one_of:
+      - 'backend_service'
+      - 'target'
+    resource: 'BackendService'
+    imports: 'selfLink'
   - name: 'pscConnectionId'
     type: String
     description: 'The PSC connection id of the PSC Forwarding Rule.'
@@ -347,6 +363,16 @@ properties:
     update_url: 'projects/{{project}}/global/forwardingRules/{{name}}/setLabels'
     update_verb: 'POST'
     key_expander: ''
+  - name: 'ipAddresses'
+    api_name: 'IPAddresses'
+    type: Array
+    description: |
+      IP addresses for which this forwarding rule accepts traffic, ordered by
+      Availability Group 0 followed by Availability Group 1. Specify literal
+      IP addresses (for example, `google_compute_global_address.example.address`).
+    default_from_api: true
+    item_type:
+      type: String
   - name: 'loadBalancingScheme'
     type: Enum
     description: |
@@ -360,6 +386,7 @@ properties:
       - 'EXTERNAL_MANAGED'
       - 'INTERNAL_MANAGED'
       - 'INTERNAL_SELF_MANAGED'
+      - 'EXTERNAL_PASSTHROUGH'
     update_url: 'projects/{{project}}/global/forwardingRules/{{name}}'
     update_verb: 'PATCH'
   - name: 'metadataFilters'
@@ -521,7 +548,9 @@ properties:
         *  `all-apis` - [All supported Google APIs](https://cloud.google.com/vpc/docs/private-service-connect#supported-apis).
 
       For Private Service Connect forwarding rules that forward traffic to managed services, the target must be a service attachment.
-    required: true
+    exactly_one_of:
+      - 'backend_service'
+      - 'target'
     update_url: 'projects/{{project}}/global/forwardingRules/{{name}}/setTarget'
     update_verb: 'POST'
     diff_suppress_func: 'tpgresource.CompareSelfLinkRelativePaths'

mmv1/templates/terraform/post_create/compute_backend_service_security_policy.go.tmpl

@@ -24,6 +24,9 @@ if o, n := d.GetChange("security_policy"); o.(string) != n.(string) {
     UserAgent: userAgent,
     Body:      sBody,
     Headers:   headers,
+    {{- if $.ApiVersion }}
+    ApiVersion: "{{ $.ApiVersion }}",
+    {{- end }}
   })
 
   if err != nil {
@@ -61,6 +64,9 @@ if o, n := d.GetChange("edge_security_policy"); o.(string) != n.(string) {
     UserAgent: userAgent,
     Body:      eBody,
     Headers:   headers,
+    {{- if $.ApiVersion }}
+    ApiVersion: "{{ $.ApiVersion }}",
+    {{- end }}
   })
   if err != nil {
     return fmt.Errorf("Error setting Backend Service edge security policy: %w", err)

mmv1/templates/terraform/post_create/labels.tmpl

@@ -36,6 +36,9 @@ if v, ok := d.GetOkExists("effective_labels"); !tpgresource.IsEmptyValue(reflect
 		{{- if $.ErrorAbortPredicates }}
 		ErrorAbortPredicates: []transport_tpg.RetryErrorPredicateFunc{ {{- join $.ErrorAbortPredicates "," -}} },
 		{{- end }}
+		{{- if $.ApiVersion }}
+		ApiVersion: "{{ $.ApiVersion }}",
+		{{- end }}
 	})
 	if err != nil {
 		return fmt.Errorf("Error adding labels to {{$.ResourceName}} %q: %s", d.Id(), err)

mmv1/templates/terraform/pre_create/compute_global_forwarding_rule.go.tmpl

@@ -1,8 +1,10 @@
 // Labels cannot be set in a create for PSC forwarding rules, so remove it from the CREATE request.
-if strings.Contains(targetProp.(string), "/serviceAttachments/") ||
-    targetProp.(string) == "all-apis" ||
-    targetProp.(string) == "vpc-sc" {
-  if _, ok := obj["labels"]; ok {
-    delete(obj, "labels")
+if targetStr, ok := targetProp.(string); ok {
+  if strings.Contains(targetStr, "/serviceAttachments/") ||
+      targetStr == "all-apis" ||
+      targetStr == "vpc-sc" {
+    if _, ok := obj["labels"]; ok {
+      delete(obj, "labels")
+    }
   }
 }

mmv1/third_party/terraform/services/compute/resource_compute_global_forwarding_rule_test.go.tmpl

@@ -1109,3 +1109,69 @@ resource "google_compute_global_address" "my_global_ip" {
 }
 `, fr, percentage, proxy, urlmap, backendservice, address)
 }
+
+func TestAccComputeGlobalForwardingRule_ExternalPassthrough(t *testing.T) {
+	t.Parallel()
+
+	fr := fmt.Sprintf("tf-test-fr-%s", acctest.RandString(t, 10))
+	backendservice := fmt.Sprintf("tf-test-bs-%s", acctest.RandString(t, 10))
+	address0 := fmt.Sprintf("tf-test-addr0-%s", acctest.RandString(t, 10))
+	address1 := fmt.Sprintf("tf-test-addr1-%s", acctest.RandString(t, 10))
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeGlobalForwardingRuleDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeGlobalForwardingRule_externalPassthrough(fr, backendservice, address0, address1, "google_compute_backend_service.my_backend_service.name"),
+			},
+			{
+				ResourceName:            "google_compute_global_forwarding_rule.forwarding_rule",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"port_range"},
+			},
+			{
+				Config: testAccComputeGlobalForwardingRule_externalPassthrough(fr, backendservice, address0, address1, "google_compute_backend_service.my_backend_service.id"),
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectEmptyPlan(),
+					},
+				},
+			},
+		},
+	})
+}
+
+func testAccComputeGlobalForwardingRule_externalPassthrough(fr, backendservice, address0, address1, backendServiceRef string) string {
+	return fmt.Sprintf(`
+resource "google_compute_global_forwarding_rule" "forwarding_rule" {
+  name                  = "%s"
+  ip_protocol           = "TCP"
+  port_range            = "80"
+  load_balancing_scheme = "EXTERNAL_PASSTHROUGH"
+  backend_service       = %s
+  ip_addresses          = [
+    google_compute_global_address.my_global_ip0.address,
+    google_compute_global_address.my_global_ip1.address
+  ]
+}
+
+resource "google_compute_backend_service" "my_backend_service" {
+  name                  = "%s"
+  protocol              = "UNSPECIFIED"
+  load_balancing_scheme = "EXTERNAL_PASSTHROUGH"
+}
+
+resource "google_compute_global_address" "my_global_ip0" {
+  name    = "%s"
+  purpose = "PASSTHROUGH_LOAD_BALANCER_AVAILABILITY_GROUP0"
+}
+
+resource "google_compute_global_address" "my_global_ip1" {
+  name    = "%s"
+  purpose = "PASSTHROUGH_LOAD_BALANCER_AVAILABILITY_GROUP1"
+}
+`, fr, backendServiceRef, backendservice, address0, address1)
+}