2020-05-12 09:52:03 -07:00
# Google Cloud Service Directory Module
This module allows managing a single [Service Directory ](https://cloud.google.com/service-directory ) namespace, including multiple services, endpoints and IAM bindings at the namespace and service levels.
2020-05-12 22:54:46 -07:00
It can be used in conjunction with the [DNS ](../dns ) module to create [service-directory based DNS zones](https://cloud.google.com/service-directory/docs/configuring-service-directory-zone, offloading IAM control of `A` and `SRV` records at the namespace or service level to Service Directory. The last examples shows how to wire the two modules together.
2020-05-12 09:52:03 -07:00
## Examples
### Namespace with IAM
```hcl
module "service-directory" {
2022-09-06 08:46:09 -07:00
source = "./fabric/modules/service-directory"
2020-05-12 11:26:34 -07:00
project_id = "my-project"
2020-05-12 09:52:03 -07:00
location = "europe-west1"
name = "sd-1"
2020-11-04 05:08:33 -08:00
iam = {
2020-05-12 09:52:03 -07:00
"roles/servicedirectory.editor" = [
"serviceAccount:namespace-editor@example.com"
]
}
2020-05-12 11:26:34 -07:00
}
2022-01-28 11:15:35 -08:00
# tftest modules=1 resources=2
2020-05-12 09:52:03 -07:00
```
### Services with IAM and endpoints
```hcl
module "service-directory" {
2022-09-06 08:46:09 -07:00
source = "./fabric/modules/service-directory"
2020-05-12 11:26:34 -07:00
project_id = "my-project"
2020-05-12 09:52:03 -07:00
location = "europe-west1"
name = "sd-1"
services = {
one = {
endpoints = ["first", "second"]
metadata = null
}
}
2020-11-04 05:08:33 -08:00
service_iam = {
2020-05-12 09:52:03 -07:00
one = {
"roles/servicedirectory.editor" = [
"serviceAccount:service-editor.example.com"
]
}
}
endpoint_config = {
"one/first" = { address = "127.0.0.1", port = 80, metadata = {} }
"one/second" = { address = "127.0.0.2", port = 80, metadata = {} }
}
}
2022-01-28 11:15:35 -08:00
# tftest modules=1 resources=5
2020-05-12 09:52:03 -07:00
```
### DNS based zone
2020-05-12 11:26:34 -07:00
Wiring a service directory namespace to a private DNS zone allows querying the namespace, and delegating control of DNS records at the namespace or service level. This effectively allows fine grained ACL control of Cloud DNS zones.
2020-05-12 09:52:03 -07:00
```hcl
module "service-directory" {
2022-09-06 08:46:09 -07:00
source = "./fabric/modules/service-directory"
2020-05-12 11:26:34 -07:00
project_id = "my-project"
2020-05-12 09:52:03 -07:00
location = "europe-west1"
2020-05-12 11:26:34 -07:00
name = "apps"
2020-11-04 05:08:33 -08:00
iam = {
2020-05-12 22:54:03 -07:00
"roles/servicedirectory.editor" = [
"serviceAccount:namespace-editor@example.com"
]
}
2020-05-12 11:26:34 -07:00
services = {
app1 = { endpoints = ["one"], metadata = null }
}
endpoint_config = {
"app1/one" = { address = "127.0.0.1", port = 80, metadata = {} }
}
}
module "dns-sd" {
2022-09-06 08:46:09 -07:00
source = "./fabric/modules/dns"
2020-05-12 11:26:34 -07:00
project_id = "my-project"
type = "service-directory"
name = "apps"
domain = "apps.example.org."
2020-11-07 01:28:33 -08:00
client_networks = [var.vpc.self_link]
2020-05-12 11:26:34 -07:00
service_directory_namespace = module.service-directory.id
2020-05-12 09:52:03 -07:00
}
2022-01-28 11:15:35 -08:00
# tftest modules=2 resources=5
2020-05-12 09:52:03 -07:00
```
<!-- BEGIN TFDOC -->
2021-12-20 23:51:51 -08:00
2020-05-12 09:52:03 -07:00
## Variables
| name | description | type | required | default |
2021-12-20 23:51:51 -08:00
|---|---|:---:|:---:|:---:|
2022-01-22 04:34:35 -08:00
| [location ](variables.tf#L40 ) | Namespace location. | < code > string</ code > | ✓ | |
| [name ](variables.tf#L45 ) | Namespace name. | < code > string</ code > | ✓ | |
| [project_id ](variables.tf#L50 ) | Project used for resources. | < code > string</ code > | ✓ | |
| [endpoint_config ](variables.tf#L18 ) | Map of endpoint attributes, keys are in service/endpoint format. | < code title = "map(object({ address = string port = number metadata = map(string) }))" > map( object({…})) </ code > | | < code > {} </ code > |
| [iam ](variables.tf#L28 ) | IAM bindings for namespace, in {ROLE => [MEMBERS]} format. | < code > map( list( string)) </ code > | | < code > {} </ code > |
| [labels ](variables.tf#L34 ) | Labels. | < code > map( string) </ code > | | < code > {} </ code > |
| [service_iam ](variables.tf#L55 ) | IAM bindings for services, in {SERVICE => {ROLE => [MEMBERS]}} format. | < code > map( map( list( string))) </ code > | | < code > {} </ code > |
| [services ](variables.tf#L61 ) | Service configuration, using service names as keys. | < code title = "map(object({ endpoints = list(string) metadata = map(string) }))" > map( object({…})) </ code > | | < code > {} </ code > |
2020-05-12 09:52:03 -07:00
## Outputs
| name | description | sensitive |
|---|---|:---:|
2022-01-22 04:34:35 -08:00
| [endpoints ](outputs.tf#L17 ) | Endpoint resources. | |
| [id ](outputs.tf#L22 ) | Namespace id (short name). | |
| [name ](outputs.tf#L27 ) | Namespace name (long name). | |
| [namespace ](outputs.tf#L32 ) | Namespace resource. | |
| [service_id ](outputs.tf#L40 ) | Service ids (short names). | |
| [service_names ](outputs.tf#L50 ) | Service ids (long names). | |
| [services ](outputs.tf#L60 ) | Service resources. | |
2021-12-20 23:51:51 -08:00
2020-05-12 09:52:03 -07:00
<!-- END TFDOC -->