[SwarnaBharathiMantena]

Summary

This PR upgrades the Cloud Foundation Toolkit (CFT) firewall-rules submodule in modules/network/firewall-rules to allow deployments with Google Cloud Provider 8.x (specifically unblocking google-beta >= 8.7.0 for features like GKE best-effort node pools and RoCE/RDMA GPU networking).

Previously, modules/network/firewall-rules pinned terraform-google-modules/network/google//modules/firewall-rules to ~> 13.0, which strictly constrained the Google provider to < 8.0.0.

Detailed Changes

1. terraform-google-modules/network/google//modules/firewall-rules: Upgraded from ~> 13.0 to ~> 18.3 (using the two-digit pessimistic version constraint to allow automatic minor/patch updates).
   • Relaxes provider constraints from < 8.0.0 to google >= 4.64, < 9 and google-beta >= 4.64, < 9.
   • ingress_rules and egress_rules input schemas and rule provisioning behaviors remain identical.
2. Documentation: Updated modules/network/firewall-rules/README.md.

Testing

• Ran terraform fmt across modified files.
• Ran tflint --config=.tflint.hcl on modules/network/firewall-rules (clean).
• Verified terraform init and terraform validate on firewall-rules with Google Provider 8.7.0.

---

Submission Checklist

• Commits include clear, descriptive messages.
• Changes are accompanied by relevant documentation and tests where applicable.
• I have read and followed the CONTRIBUTING.md guidelines.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request updates the firewall rules module dependency to version 18.3 to ensure compatibility with recent Google Cloud Provider releases. This change facilitates the use of updated infrastructure features while maintaining existing rule provisioning logic.

Highlights

• Module Version Upgrade: Upgraded the terraform-google-modules/network/firewall-rules module from ~> 13.0 to ~> 18.3.
• Provider Compatibility: Enabled support for Google Cloud Provider 8.x, facilitating the use of newer features like GKE best-effort node pools and advanced GPU networking.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the firewall_rule module version from ~> 13.0 to ~> 18.3 in both main.tf and the README. However, this upgrade introduces a compatibility issue because the new module version requires the google provider version to be >= 4.64, while the parent module's versions.tf still specifies >= 3.83. Please update the provider constraint in versions.tf to prevent initialization issues.

[SwarnaBharathiMantena]

Test Status & Verification Summary

The failure in PR-test-gke-managed-lustre (Build 803c6dc0) is due to a transient infrastructure capacity stockout ([GCE_STOCKOUT]) in us-central1 and is unrelated to the firewall-rules code change.

1. Functional Verification of CFT firewall-rules v18.3

The updated module was successfully downloaded, planned, and provisioned in GCP during the test run without schema or provider errors:

2026-10-16T07:22:30Z module.lustre_firewall_rule.module.firewall_rule.google_compute_firewall.rules_ingress_egress["gke-ml-803c6d-basic-allow-lustre-traffic"]: Creating...
2026-10-16T07:22:40Z module.lustre_firewall_rule.module.firewall_rule.google_compute_firewall.rules_ingress_egress["gke-ml-803c6d-basic-allow-lustre-traffic"]: Still creating... [00m10s elapsed]
2026-10-16T07:22:41Z module.lustre_firewall_rule.module.firewall_rule.google_compute_firewall.rules_ingress_egress["gke-ml-803c6d-basic-allow-lustre-traffic"]: Creation complete after 11s [id=projects/hpc-toolkit-dev/global/firewalls/gke-ml-803c6d-basic-allow-lustre-traffic]

[SwarnaBharathiMantena]

Successful PR test: PR-test-gke-managed-lustre

[agrawalkhushi18]

LGTM