@spinnaker/google 0.0.0-2025.1-0

package/src/securityGroup/details/securityGroupDetail.controller.js

@@ -0,0 +1,258 @@
+'use strict';
+
+import UIROUTER_ANGULARJS from '@uirouter/angularjs';
+import * as angular from 'angular';
+import _ from 'lodash';
+
+import {
+  AccountService,
+  CloudProviderRegistry,
+  ConfirmationModalService,
+  FirewallLabels,
+  SECURITY_GROUP_READER,
+  SecurityGroupWriter,
+} from '@spinnaker/core';
+
+import { GOOGLE_SECURITYGROUP_CLONE_CLONESECURITYGROUP_CONTROLLER } from '../clone/cloneSecurityGroup.controller';
+import { GCE_SECURITY_GROUP_HELP_TEXT_SERVICE } from '../securityGroupHelpText.service';
+
+export const GOOGLE_SECURITYGROUP_DETAILS_SECURITYGROUPDETAIL_CONTROLLER =
+  'spinnaker.securityGroup.gce.details.controller';
+export const name = GOOGLE_SECURITYGROUP_DETAILS_SECURITYGROUPDETAIL_CONTROLLER; // for backwards compatibility
+angular
+  .module(GOOGLE_SECURITYGROUP_DETAILS_SECURITYGROUPDETAIL_CONTROLLER, [
+    UIROUTER_ANGULARJS,
+    SECURITY_GROUP_READER,
+    GOOGLE_SECURITYGROUP_CLONE_CLONESECURITYGROUP_CONTROLLER,
+    GCE_SECURITY_GROUP_HELP_TEXT_SERVICE,
+  ])
+  .controller('gceSecurityGroupDetailsCtrl', [
+    '$scope',
+    '$state',
+    'resolvedSecurityGroup',
+    'app',
+    'securityGroupReader',
+    '$uibModal',
+    'gceSecurityGroupHelpTextService',
+    function (
+      $scope,
+      $state,
+      resolvedSecurityGroup,
+      app,
+      securityGroupReader,
+      $uibModal,
+      gceSecurityGroupHelpTextService,
+    ) {
+      const application = (this.application = app);
+      const securityGroup = resolvedSecurityGroup;
+
+      // needed for standalone instances
+      $scope.detailsTemplateUrl = CloudProviderRegistry.getValue('gce', 'securityGroup.detailsTemplateUrl');
+
+      $scope.state = {
+        loading: true,
+        standalone: app.isStandalone,
+      };
+
+      $scope.firewallLabel = FirewallLabels.get('Firewall');
+
+      function extractSecurityGroup() {
+        return securityGroupReader
+          .getSecurityGroupDetails(
+            application,
+            securityGroup.accountId,
+            securityGroup.provider,
+            securityGroup.region,
+            securityGroup.vpcId,
+            securityGroup.name,
+          )
+          .then(function (details) {
+            $scope.state.loading = false;
+
+            if (!details || _.isEmpty(details)) {
+              fourOhFour();
+            } else {
+              $scope.securityGroup = details;
+              const applicationSecurityGroup = securityGroupReader.getApplicationSecurityGroup(
+                application,
+                securityGroup.accountId,
+                securityGroup.region,
+                securityGroup.name,
+              );
+              $scope.securityGroup = angular.extend(_.cloneDeep(applicationSecurityGroup), $scope.securityGroup);
+
+              // These come back from the global firewall endpoint as '[tag-a, tag-b]'
+              if (typeof $scope.securityGroup.targetTags === 'string') {
+                const targetTags = $scope.securityGroup.targetTags;
+                $scope.securityGroup.targetTags = targetTags.substring(1, targetTags.length - 1).split(', ');
+              }
+              if (typeof $scope.securityGroup.sourceTags === 'string') {
+                const sourceTags = $scope.securityGroup.sourceTags;
+                $scope.securityGroup.sourceTags = sourceTags.substring(1, sourceTags.length - 1).split(', ');
+              }
+
+              // These come back from the global firewall endpoint as '[account-a@project.iam.gserviceaccount.com, account-b@project.iam.gserviceaccount.com]'
+              if (typeof $scope.securityGroup.targetServiceAccounts === 'string') {
+                const targetServiceAccounts = $scope.securityGroup.targetServiceAccounts;
+                $scope.securityGroup.targetServiceAccounts = targetServiceAccounts
+                  .substring(1, targetServiceAccounts.length - 1)
+                  .split(', ');
+              }
+              if (typeof $scope.securityGroup.sourceServiceAccounts === 'string') {
+                const sourceServiceAccounts = $scope.securityGroup.sourceServiceAccounts;
+                $scope.securityGroup.sourceServiceAccounts = sourceServiceAccounts
+                  .substring(1, sourceServiceAccounts.length - 1)
+                  .split(', ');
+              }
+
+              $scope.securityGroup.sourceRanges = _.chain($scope.securityGroup.ipRangeRules)
+                .map((rule) => {
+                  return rule.range.ip && rule.range.cidr ? rule.range.ip + rule.range.cidr : null;
+                })
+                .compact()
+                .uniq()
+                .value();
+
+              const ipIngress = _.map($scope.securityGroup.ipRangeRules, function (ipRangeRule) {
+                return {
+                  protocol: ipRangeRule.protocol,
+                  portRanges: ipRangeRule.portRanges,
+                };
+              });
+
+              let ipIngressRules = {};
+
+              ipIngress.forEach(function (ipIngressRule) {
+                if (_.has(ipIngressRules, ipIngressRule.protocol)) {
+                  ipIngressRules[ipIngressRule.protocol] = ipIngressRules[ipIngressRule.protocol].concat(
+                    ipIngressRule.portRanges,
+                  );
+
+                  ipIngressRules[ipIngressRule.protocol] = _.uniqBy(ipIngressRules[ipIngressRule.protocol], function (
+                    portRange,
+                  ) {
+                    return portRange.startPort + '->' + portRange.endPort;
+                  });
+                } else {
+                  ipIngressRules[ipIngressRule.protocol] = ipIngressRule.portRanges;
+                }
+              });
+
+              ipIngressRules = _.map(ipIngressRules, function (portRanges, protocol) {
+                return {
+                  protocol: protocol,
+                  portRanges: portRanges,
+                };
+              });
+
+              $scope.securityGroup.ipIngressRules = ipIngressRules;
+
+              $scope.securityGroup.protocolPortRangeCount = _.sumBy(ipIngressRules, function (ipIngressRule) {
+                return ipIngressRule.portRanges.length > 1 ? ipIngressRule.portRanges.length : 1;
+              });
+
+              AccountService.getAccountDetails(securityGroup.accountId).then(function (accountDetails) {
+                $scope.securityGroup.logsLink =
+                  'https://console.developers.google.com/project/' +
+                  accountDetails.project +
+                  '/logs?service=gce_firewall_rule&minLogLevel=0&filters=text:' +
+                  securityGroup.name;
+              });
+
+              gceSecurityGroupHelpTextService.register(
+                application,
+                $scope.securityGroup.accountName,
+                $scope.securityGroup.network,
+              );
+            }
+          }, fourOhFour);
+      }
+
+      function fourOhFour() {
+        if ($scope.$$destroyed) {
+          return;
+        }
+        $state.go('^', { allowModalToStayOpen: true }, { location: 'replace' });
+      }
+
+      application.securityGroups
+        .ready()
+        .then(() => extractSecurityGroup())
+        .then(() => {
+          // If the user navigates away from the view before the initial extractSecurityGroup call completes,
+          // do not bother subscribing to the refresh
+          if (!$scope.$$destroyed && !app.isStandalone) {
+            app.securityGroups.onRefresh($scope, extractSecurityGroup);
+          }
+        });
+
+      this.getTagHelpText = function (tag, tagType) {
+        return gceSecurityGroupHelpTextService.getHelpTextForTag(tag, tagType);
+      };
+
+      this.editInboundRules = function editInboundRules() {
+        $uibModal.open({
+          templateUrl: require('../configure/editSecurityGroup.html'),
+          controller: 'gceEditSecurityGroupCtrl as ctrl',
+          size: 'lg',
+          resolve: {
+            securityGroup: function () {
+              return angular.copy($scope.securityGroup);
+            },
+            application: function () {
+              return application;
+            },
+          },
+        });
+      };
+
+      this.cloneSecurityGroup = function cloneSecurityGroup() {
+        $uibModal.open({
+          templateUrl: require('../clone/cloneSecurityGroup.html'),
+          controller: 'gceCloneSecurityGroupController as ctrl',
+          size: 'lg',
+          resolve: {
+            securityGroup: function () {
+              const securityGroup = angular.copy($scope.securityGroup);
+              if (securityGroup.region) {
+                securityGroup.regions = [securityGroup.region];
+              }
+              return securityGroup;
+            },
+            application: function () {
+              return application;
+            },
+          },
+        });
+      };
+
+      this.deleteSecurityGroup = function deleteSecurityGroup() {
+        const taskMonitor = {
+          application: application,
+          title: 'Deleting ' + securityGroup.name,
+        };
+
+        const submitMethod = function () {
+          return SecurityGroupWriter.deleteSecurityGroup(securityGroup, application, {
+            cloudProvider: $scope.securityGroup.type,
+            securityGroupName: securityGroup.name,
+          });
+        };
+
+        ConfirmationModalService.confirm({
+          header: 'Really delete ' + securityGroup.name + '?',
+          buttonText: 'Delete ' + securityGroup.name,
+          account: securityGroup.accountId,
+          taskMonitorConfig: taskMonitor,
+          submitMethod: submitMethod,
+        });
+      };
+
+      if (app.isStandalone) {
+        // we still want the edit to refresh the firewall details when the modal closes
+        app.securityGroups = {
+          refresh: extractSecurityGroup,
+        };
+      }
+    },
+  ]);

package/src/securityGroup/details/securityGroupDetail.html

@@ -0,0 +1,171 @@
+<div class="details-panel">
+  <div class="header">
+    <div class="close-button" ng-if="!state.standalone">
+      <a class="btn btn-link" ui-sref="^">
+        <span class="glyphicon glyphicon-remove"></span>
+      </a>
+    </div>
+    <div ng-if="state.loading" class="horizontal center middle">
+      <loading-spinner size="'small'"></loading-spinner>
+    </div>
+    <div class="header-text horizontal middle" ng-if="!state.loading">
+      <span class="glyphicon glyphicon-transfer"></span>
+      <h3 class="horizontal middle space-between flex-1" select-on-dbl-click>
+        {{securityGroup.name || '(not found)'}}
+        <render-if-feature feature="entityTags">
+          <entity-notifications
+            ng-if="!state.loading"
+            entity="securityGroup"
+            application="ctrl.application"
+            placement="bottom"
+            h-offset-percent="90%"
+            entity-type="securityGroup"
+            page-location="details"
+            on-update="ctrl.application.securityGroups.refresh()"
+          ></entity-notifications>
+        </render-if-feature>
+      </h3>
+    </div>
+    <div class="actions">
+      <div ng-if="!securityGroup.id.includes('/')" class="dropdown" uib-dropdown dropdown-append-to-body>
+        <button type="button" class="btn btn-sm btn-primary dropdown-toggle" uib-dropdown-toggle>
+          <firewall-label label="Firewall"></firewall-label> Actions <span class="caret"></span>
+        </button>
+        <ul class="dropdown-menu" uib-dropdown-menu role="menu">
+          <li><a href ng-click="ctrl.editInboundRules()">Edit Inbound Rules</a></li>
+          <li>
+            <a href ng-click="ctrl.deleteSecurityGroup()">Delete <firewall-label label="Firewall"></firewall-label></a>
+          </li>
+          <li>
+            <a href ng-click="ctrl.cloneSecurityGroup()">Clone <firewall-label label="Firewall"></firewall-label></a>
+          </li>
+          <render-if-feature feature="entityTags">
+            <add-entity-tag-links
+              component="securityGroup"
+              application="ctrl.application"
+              entity-type="securityGroup"
+              on-update="ctrl.application.securityGroups.refresh"
+            ></add-entity-tag-links>
+          </render-if-feature>
+        </ul>
+      </div>
+      <div ng-if="securityGroup.id.includes('/')" class="dropdown" uib-dropdown dropdown-append-to-body>
+        <button type="button" class="btn btn-sm btn-primary dropdown-toggle" uib-dropdown-toggle>
+          <firewall-label label="Firewall"></firewall-label> Actions <span class="caret"></span>
+        </button>
+        <ul
+          uib-tooltip="You cannot modify shared VPC host project firewall rules."
+          class="dropdown-menu"
+          uib-dropdown-menu
+          role="menu"
+        >
+          <li class="disabled"><a>Edit Inbound Rules</a></li>
+          <li class="disabled">
+            <a>Delete <firewall-label label="Firewall"></firewall-label></a>
+          </li>
+          <li class="disabled">
+            <a>Clone <firewall-label label="Firewall"></firewall-label></a>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+  <div class="content" ng-if="!state.loading">
+    <collapsible-section heading="{{firewallLabel}} Details" expanded="true">
+      <dl class="dl-horizontal dl-medium">
+        <dt>ID</dt>
+        <dd>{{securityGroup.id}}</dd>
+        <dt>Account</dt>
+        <dd><account-tag account="securityGroup.accountName"></account-tag></dd>
+        <dt>Region</dt>
+        <dd>{{securityGroup.region}}</dd>
+        <dt>Network</dt>
+        <dd>{{securityGroup.network}}</dd>
+        <dt>Description</dt>
+        <dd>{{securityGroup.description}}</dd>
+      </dl>
+    </collapsible-section>
+    <collapsible-section
+      heading="IP Range Rules ({{securityGroup.sourceRanges.length || 0}})"
+      expanded="{{!!(securityGroup.sourceRanges && securityGroup.sourceRanges.length)}}"
+    >
+      <div ng-if="!securityGroup.sourceRanges.length">None</div>
+
+      <dl
+        ng-class="insightCtrl.vm.filtersExpanded ? '' : 'dl-horizontal dl-medium'"
+        ng-repeat="sourceRange in securityGroup.sourceRanges"
+      >
+        <dt>IP Range</dt>
+        <dd>{{sourceRange}}</dd>
+      </dl>
+    </collapsible-section>
+    <collapsible-section
+      heading="Protocol/Port Ranges ({{securityGroup.protocolPortRangeCount || 0}})"
+      expanded="{{!!(securityGroup.protocolPortRangeCount)}}"
+    >
+      <div ng-if="!securityGroup.ipIngressRules.length">None</div>
+
+      <dl
+        ng-class="insightCtrl.vm.filtersExpanded ? '' : 'dl-horizontal dl-medium'"
+        ng-repeat="ipIngressRule in securityGroup.ipIngressRules"
+      >
+        <dt ng-if="ipIngressRule.portRanges.length === 0">Protocol</dt>
+        <dd ng-if="ipIngressRule.portRanges.length === 0">{{ipIngressRule.protocol}}</dd>
+        <dt
+          ng-if="ipIngressRule.portRanges && ipIngressRule.portRanges.length === 1 && ipIngressRule.portRanges[0].startPort"
+        >
+          Port Range
+        </dt>
+        <dt
+          ng-if="ipIngressRule.portRanges && ipIngressRule.portRanges.length > 1 && ipIngressRule.portRanges[0].startPort"
+        >
+          Port Ranges
+        </dt>
+        <dd ng-repeat="portRange in ipIngressRule.portRanges" ng-if="portRange.startPort && portRange.endPort">
+          {{ipIngressRule.protocol}}: {{portRange.startPort}} &rarr; {{portRange.endPort}}
+        </dd>
+      </dl>
+    </collapsible-section>
+    <collapsible-section heading="Target Tags ({{securityGroup.targetTags.length || 0}})">
+      <ul ng-if="securityGroup.targetTags.length">
+        <li ng-repeat="tag in securityGroup.targetTags">
+          {{tag}} <help-field content="{{ctrl.getTagHelpText(tag, 'target')}}"></help-field>
+        </li>
+      </ul>
+      <div ng-if="!securityGroup.targetTags.length">None</div>
+    </collapsible-section>
+    <collapsible-section heading="Source Tags ({{securityGroup.sourceTags.length || 0}})">
+      <ul ng-if="securityGroup.sourceTags.length">
+        <li ng-repeat="tag in securityGroup.sourceTags">
+          {{tag}} <help-field content="{{ctrl.getTagHelpText(tag, 'source')}}"></help-field>
+        </li>
+      </ul>
+      <div ng-if="!securityGroup.sourceTags.length">None</div>
+    </collapsible-section>
+    <collapsible-section heading="Target Service Accounts ({{securityGroup.targetServiceAccounts.length || 0}})">
+      <ul ng-if="securityGroup.targetServiceAccounts.length">
+        <li ng-repeat="serviceAccount in securityGroup.targetServiceAccounts">{{serviceAccount}}</li>
+      </ul>
+      <div ng-if="!securityGroup.targetServiceAccounts.length">None</div>
+    </collapsible-section>
+    <collapsible-section heading="Source Service Accounts ({{securityGroup.sourceServiceAccounts.length || 0}})">
+      <ul ng-if="securityGroup.sourceServiceAccounts.length">
+        <li ng-repeat="serviceAccount in securityGroup.sourceServiceAccounts">{{serviceAccount}}</li>
+      </ul>
+      <div ng-if="!securityGroup.sourceServiceAccounts.length">None</div>
+    </collapsible-section>
+    <collapsible-section heading="Logs">
+      <ul>
+        <li ng-if="securityGroup.logsLink">
+          <a href="{{securityGroup.logsLink}}" target="_blank">Cloud Console Logs</a>
+          <copy-to-clipboard
+            class="copy-to-clipboard copy-to-clipboard-sm"
+            text="securityGroup.logsLink"
+            tool-tip="'Copy to clipboard'"
+          >
+          </copy-to-clipboard>
+        </li>
+      </ul>
+    </collapsible-section>
+  </div>
+</div>

package/src/securityGroup/securityGroup.reader.js

@@ -0,0 +1,15 @@
+'use strict';
+
+import { module } from 'angular';
+
+export const GOOGLE_SECURITYGROUP_SECURITYGROUP_READER = 'spinnaker.gce.securityGroup.reader';
+export const name = GOOGLE_SECURITYGROUP_SECURITYGROUP_READER; // for backwards compatibility
+module(GOOGLE_SECURITYGROUP_SECURITYGROUP_READER, []).factory('gceSecurityGroupReader', function () {
+  function resolveIndexedSecurityGroup(indexedSecurityGroups, container, securityGroupId) {
+    return indexedSecurityGroups[container.account].global[securityGroupId];
+  }
+
+  return {
+    resolveIndexedSecurityGroup: resolveIndexedSecurityGroup,
+  };
+});

package/src/securityGroup/securityGroup.transformer.js

@@ -0,0 +1,18 @@
+'use strict';
+
+import { module } from 'angular';
+
+export const GOOGLE_SECURITYGROUP_SECURITYGROUP_TRANSFORMER = 'spinnaker.gce.securityGroup.transformer';
+export const name = GOOGLE_SECURITYGROUP_SECURITYGROUP_TRANSFORMER; // for backwards compatibility
+module(GOOGLE_SECURITYGROUP_SECURITYGROUP_TRANSFORMER, []).factory('gceSecurityGroupTransformer', [
+  '$q',
+  function ($q) {
+    function normalizeSecurityGroup(securityGroup) {
+      return $q.when(securityGroup); // no-op
+    }
+
+    return {
+      normalizeSecurityGroup: normalizeSecurityGroup,
+    };
+  },
+]);

package/src/securityGroup/securityGroupHelpText.service.spec.ts

@@ -0,0 +1,102 @@
+import { mock } from 'angular';
+import type { GceSecurityGroupHelpTextService } from './securityGroupHelpText.service';
+import { GCE_SECURITY_GROUP_HELP_TEXT_SERVICE } from './securityGroupHelpText.service';
+
+describe('Service: gceSecurityGroupHelpTextService', () => {
+  let $q: ng.IQService;
+  let gceSecurityGroupHelpTextService: GceSecurityGroupHelpTextService;
+  let application: any;
+
+  beforeEach(mock.module(GCE_SECURITY_GROUP_HELP_TEXT_SERVICE));
+
+  beforeEach(
+    mock.inject(
+      (
+        _gceSecurityGroupHelpTextService_: GceSecurityGroupHelpTextService,
+        _$q_: ng.IQService,
+        _$timeout_: ng.ITimeoutService,
+      ) => {
+        gceSecurityGroupHelpTextService = _gceSecurityGroupHelpTextService_;
+        $q = _$q_;
+        const $timeout = _$timeout_;
+
+        application = {
+          ready: () => $q.resolve(),
+          getDataSource: () => {
+            return {
+              data: [
+                {
+                  name: 'match-v000',
+                  account: 'my-google-account',
+                  providerMetadata: {
+                    networkName: 'default',
+                    tags: ['tag-a', 'tag-b'],
+                  },
+                },
+                {
+                  name: 'match-v001',
+                  account: 'my-google-account',
+                  providerMetadata: {
+                    networkName: 'default',
+                    tags: ['tag-a'],
+                  },
+                },
+                {
+                  name: 'other-account-v000',
+                  account: 'my-other-google-account',
+                  providerMetadata: {
+                    networkName: 'default',
+                    tags: ['tag-a', 'tag-b'],
+                  },
+                },
+                {
+                  name: 'other-network-v000',
+                  account: 'my-google-account',
+                  providerMetadata: {
+                    networkName: 'other-network',
+                    tags: ['tag-a', 'tag-b'],
+                  },
+                },
+              ],
+            };
+          },
+        };
+
+        gceSecurityGroupHelpTextService.register(application, 'my-google-account', 'default');
+        $timeout.flush();
+      },
+    ),
+  );
+
+  it("should list server groups that match the rule's account and network and have a matching tag", () => {
+    let helpText = gceSecurityGroupHelpTextService.getHelpTextForTag('tag-a', 'source');
+    expect(helpText).toContain('match-v000');
+    expect(helpText).toContain('match-v001');
+    expect(helpText).not.toContain('other-account-v000');
+    expect(helpText).not.toContain('other-network-v000');
+
+    helpText = gceSecurityGroupHelpTextService.getHelpTextForTag('tag-b', 'target');
+    expect(helpText).toContain('match-v000');
+    expect(helpText).not.toContain('match-v001');
+    expect(helpText).not.toContain('other-account-v000');
+    expect(helpText).not.toContain('other-network-v000');
+  });
+
+  it('should be ok if no server groups match the given tag', () => {
+    const helpText = gceSecurityGroupHelpTextService.getHelpTextForTag('no-matches-tag', 'source');
+    expect(() => gceSecurityGroupHelpTextService.getHelpTextForTag('no-matches-tag', 'source')).not.toThrow();
+    expect(helpText).not.toContain('match-v000');
+    expect(helpText).not.toContain('match-v001');
+    expect(helpText).not.toContain('other-account-v000');
+    expect(helpText).not.toContain('other-network-v000');
+  });
+
+  it('should have no matches after a reset', () => {
+    gceSecurityGroupHelpTextService.reset();
+    const helpText = gceSecurityGroupHelpTextService.getHelpTextForTag('tag-a', 'source');
+    expect(helpText).not.toContain('match-v000');
+    expect(helpText).not.toContain('match-v001');
+    expect(helpText).not.toContain('other-account-v000');
+    expect(helpText).not.toContain('other-network-v000');
+  });
+});

package/src/securityGroup/securityGroupHelpText.service.ts

@@ -0,0 +1,83 @@
+import { module } from 'angular';
+import { has } from 'lodash';
+
+import type { Application, IServerGroup } from '@spinnaker/core';
+import { FirewallLabels } from '@spinnaker/core';
+
+export class GceSecurityGroupHelpTextService {
+  private serverGroupsIndexedByTag: Map<string, Set<string>>;
+  private application: Application;
+  private account: string;
+  private network: string;
+
+  public register(application: Application, account: string, network: string): PromiseLike<void> {
+    this.reset();
+    this.application = application;
+    this.account = account;
+    this.network = network;
+    return this.indexServerGroupsByTag();
+  }
+
+  public getHelpTextForTag(tag: string, tagType: 'source' | 'target'): string {
+    const serverGroups = this.getServerGroupsWithTag(tag);
+    let text: string;
+    switch (serverGroups.length) {
+      case 0:
+        text = null;
+        break;
+      case 1:
+        text = `This ${tagType} tag associates this ${FirewallLabels.get('firewall')} with the server group <em>${
+          serverGroups[0]
+        }</em>.`;
+        break;
+      default:
+        text = `This ${tagType} tag associates this ${FirewallLabels.get('firewall')} with the server groups
+                ${serverGroups.map((serverGroup) => `<em>${serverGroup}</em>`).join(', ')}.`;
+        break;
+    }
+    return text;
+  }
+
+  public getServerGroupsWithTag(tag: string): string[] {
+    if (this.serverGroupsIndexedByTag.get(tag)) {
+      return Array.from(this.serverGroupsIndexedByTag.get(tag)).sort();
+    } else {
+      return [];
+    }
+  }
+
+  public reset(): void {
+    this.application = null;
+    this.account = null;
+    this.serverGroupsIndexedByTag = new Map<string, Set<string>>();
+  }
+
+  private indexServerGroupsByTag(): PromiseLike<void> {
+    return this.application.ready().then(() => {
+      this.application.getDataSource('serverGroups').data.forEach((serverGroup: IServerGroup) => {
+        if (
+          has(serverGroup, 'providerMetadata.tags.length') &&
+          serverGroup.account === this.account &&
+          serverGroup.providerMetadata?.networkName === this.network
+        ) {
+          serverGroup.providerMetadata.tags.forEach((tag: string) => {
+            if (!this.serverGroupsIndexedByTag.get(tag)) {
+              this.serverGroupsIndexedByTag.set(
+                tag,
+                new Set<string>([serverGroup.name]),
+              );
+            } else {
+              this.serverGroupsIndexedByTag.get(tag).add(serverGroup.name);
+            }
+          });
+        }
+      });
+    });
+  }
+}
+
+export const GCE_SECURITY_GROUP_HELP_TEXT_SERVICE = 'spinnaker.gce.securityGroupHelpText.service';
+module(GCE_SECURITY_GROUP_HELP_TEXT_SERVICE, []).service(
+  'gceSecurityGroupHelpTextService',
+  GceSecurityGroupHelpTextService,
+);