Add triggers to cloud functions v2
* add `trigger_config_v2` for v2 functions * add optional for objects in variables.tf * make examples in README runnable * add example for Cloud Function v2 * add exapmle for trigger for Cloud Function v2 * remove optional variables from examples with `null` value
This commit is contained in:
Wiktor Niesiobędzki
parent
df539b5e18
commit
303b51a0a9
|
|
@ -21,12 +21,27 @@ module "cf-http" {
|
|||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "my-cf-source-folder"
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
excludes = null
|
||||
}
|
||||
}
|
||||
# tftest skip
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
Analogous example using 2nd generation Cloud Functions
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function"
|
||||
v2 = true
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
### PubSub and non-HTTP triggers
|
||||
|
|
@ -40,19 +55,52 @@ module "cf-http" {
|
|||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "my-cf-source-folder"
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
excludes = null
|
||||
}
|
||||
trigger_config = {
|
||||
event = "google.pubsub.topic.publish"
|
||||
resource = local.my-topic
|
||||
retry = null
|
||||
resource = "local.my-topic"
|
||||
}
|
||||
}
|
||||
# tftest skip
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
Cloud Functions 2nd gen support only [Eventarc](https://cloud.google.com/eventarc/docs) and user separate structure
|
||||
to configure:
|
||||
```hcl
|
||||
module "trigger-service-account" {
|
||||
source = "./fabric/modules/iam-service-account"
|
||||
project_id = "my-project"
|
||||
name = "sa-cloudfunction"
|
||||
iam_project_roles = {
|
||||
"my-project" = [
|
||||
"roles/run.invoker"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function"
|
||||
project_id = "my-project"
|
||||
v2 = true
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
trigger_config_v2 = {
|
||||
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
|
||||
pubsub_topic = "local.my-topic"
|
||||
service_account_email = module.trigger-service-account.email
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=4
|
||||
```
|
||||
Ensure that pubsub robo-account `service-%s@gcp-sa-pubsub.iam.gserviceaccount.com` has `roles/iam.serviceAccountTokenCreatator`
|
||||
as documented [here](https://cloud.google.com/eventarc/docs/roles-permissions#pubsub-topic)
|
||||
|
||||
### Controlling HTTP access
|
||||
|
||||
To allow anonymous access to the function, grant the `roles/cloudfunctions.invoker` role to the special `allUsers` identifier. Use specific identities (service accounts, groups, etc.) instead of `allUsers` to only allow selective access.
|
||||
|
|
@ -64,15 +112,14 @@ module "cf-http" {
|
|||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "my-cf-source-folder"
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
excludes = null
|
||||
}
|
||||
iam = {
|
||||
"roles/cloudfunctions.invoker" = ["allUsers"]
|
||||
}
|
||||
}
|
||||
# tftest skip
|
||||
# tftest modules=1 resources=3
|
||||
```
|
||||
|
||||
### GCS bucket creation
|
||||
|
|
@ -86,16 +133,13 @@ module "cf-http" {
|
|||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bucket_config = {
|
||||
location = null
|
||||
lifecycle_delete_age = 1
|
||||
}
|
||||
bundle_config = {
|
||||
source_dir = "my-cf-source-folder"
|
||||
output_path = "bundle.zip"
|
||||
excludes = null
|
||||
source_dir = "fabric/assets/"
|
||||
}
|
||||
}
|
||||
# tftest skip
|
||||
# tftest modules=1 resources=3
|
||||
```
|
||||
|
||||
### Service account management
|
||||
|
|
@ -109,13 +153,12 @@ module "cf-http" {
|
|||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "my-cf-source-folder"
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
excludes = null
|
||||
}
|
||||
service_account_create = true
|
||||
}
|
||||
# tftest skip
|
||||
# tftest modules=1 resources=3
|
||||
```
|
||||
|
||||
To use an externally managed service account, pass its email in `service_account` and leave `service_account_create` to `false` (the default).
|
||||
|
|
@ -127,13 +170,12 @@ module "cf-http" {
|
|||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "my-cf-source-folder"
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
excludes = null
|
||||
}
|
||||
service_account = local.service_account_email
|
||||
service_account = "non-existent@serice.account.email"
|
||||
}
|
||||
# tftest skip
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
### Custom bundle config
|
||||
|
|
@ -147,12 +189,12 @@ module "cf-http" {
|
|||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "my-cf-source-folder"
|
||||
source_dir = "fabric/assets"
|
||||
output_path = "bundle.zip"
|
||||
excludes = ["__pycache__"]
|
||||
}
|
||||
}
|
||||
# tftest skip
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
### Private Cloud Build Pool
|
||||
|
|
@ -181,26 +223,27 @@ module "cf-http" {
|
|||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | <code title="object({ source_dir = string output_path = string excludes = list(string) })">object({…})</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | <code title="object({ source_dir = string output_path = optional(string, "/tmp/bundle.zip") excludes = optional(list(string)) })">object({…})</code> | ✓ | |
|
||||
| [name](variables.tf#L94) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L109) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object({ location = string lifecycle_delete_age = number })">object({…})</code> | | <code>null</code> |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object({ location = optional(string) lifecycle_delete_age = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [build_worker_pool](variables.tf#L31) | Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format | <code>string</code> | | <code>null</code> |
|
||||
| [description](variables.tf#L46) | Optional description. | <code>string</code> | | <code>"Terraform managed."</code> |
|
||||
| [environment_variables](variables.tf#L52) | Cloud function environment variables. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [function_config](variables.tf#L58) | Cloud function configuration. | <code title="object({ entry_point = string instances = number memory = number # Memory in MB runtime = string timeout = number })">object({…})</code> | | <code title="{ entry_point = "main" instances = 1 memory = 256 runtime = "python37" timeout = 180 }">{…}</code> |
|
||||
| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | <code title="object({ entry_point = optional(string, "main") instances = optional(number, 1) memory = optional(number, 256) # Memory in MB runtime = optional(string, "python37") timeout = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instances = 1 memory = 256 runtime = "python37" timeout = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L76) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L82) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L88) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L99) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [region](variables.tf#L114) | Region used for all resources. | <code>string</code> | | <code>"europe-west1"</code> |
|
||||
| [secrets](variables.tf#L120) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L132) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account](variables.tf#L132) | Service account email.service_account Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L138) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event = string resource = string retry = bool })">object({…})</code> | | <code>null</code> |
|
||||
| [v2](variables.tf#L173) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | <code>bool</code> | | <code>false</code> |
|
||||
| [vpc_connector](variables.tf#L154) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L164) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event = string resource = string retry = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [trigger_config_v2](variables.tf#L154) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ region = optional(string) event_type = optional(string) pubsub_topic = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = string })), []) service_account_email = optional(string) retry_policy = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [v2](variables.tf#L190) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | <code>bool</code> | | <code>false</code> |
|
||||
| [vpc_connector](variables.tf#L171) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L181) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
|||
|
|
@ -126,7 +126,6 @@ resource "google_cloudfunctions_function" "function" {
|
|||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
resource "google_cloudfunctions2_function" "function" {
|
||||
|
|
@ -148,6 +147,25 @@ resource "google_cloudfunctions2_function" "function" {
|
|||
}
|
||||
}
|
||||
}
|
||||
dynamic "event_trigger" {
|
||||
for_each = var.trigger_config_v2 == null ? [] : [""]
|
||||
content {
|
||||
trigger_region = var.trigger_config_v2.region
|
||||
event_type = var.trigger_config_v2.event_type
|
||||
pubsub_topic = var.trigger_config_v2.pubsub_topic
|
||||
dynamic "event_filters" {
|
||||
for_each = var.trigger_config_v2.event_filters
|
||||
iterator = event_filter
|
||||
content {
|
||||
attribute = event_filter.attribute
|
||||
value = event_filter.value
|
||||
operator = event_filter.operator
|
||||
}
|
||||
}
|
||||
service_account_email = var.trigger_config_v2.service_account_email
|
||||
retry_policy = var.trigger_config_v2.retry_policy
|
||||
}
|
||||
}
|
||||
service_config {
|
||||
max_instance_count = var.function_config.instances
|
||||
min_instance_count = 0
|
||||
|
|
@ -240,13 +258,9 @@ resource "google_storage_bucket_object" "bundle" {
|
|||
}
|
||||
|
||||
data "archive_file" "bundle" {
|
||||
type = "zip"
|
||||
source_dir = var.bundle_config.source_dir
|
||||
output_path = (
|
||||
var.bundle_config.output_path == null
|
||||
? "/tmp/bundle.zip"
|
||||
: var.bundle_config.output_path
|
||||
)
|
||||
type = "zip"
|
||||
source_dir = var.bundle_config.source_dir
|
||||
output_path = var.bundle_config.output_path
|
||||
output_file_mode = "0666"
|
||||
excludes = var.bundle_config.excludes
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,8 +17,8 @@
|
|||
variable "bucket_config" {
|
||||
description = "Enable and configure auto-created bucket. Set fields to null to use defaults."
|
||||
type = object({
|
||||
location = string
|
||||
lifecycle_delete_age = number
|
||||
location = optional(string)
|
||||
lifecycle_delete_age = optional(number)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
|
@ -38,8 +38,8 @@ variable "bundle_config" {
|
|||
description = "Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null."
|
||||
type = object({
|
||||
source_dir = string
|
||||
output_path = string
|
||||
excludes = list(string)
|
||||
output_path = optional(string, "/tmp/bundle.zip")
|
||||
excludes = optional(list(string))
|
||||
})
|
||||
}
|
||||
|
||||
|
|
@ -56,13 +56,13 @@ variable "environment_variables" {
|
|||
}
|
||||
|
||||
variable "function_config" {
|
||||
description = "Cloud function configuration."
|
||||
description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout"
|
||||
type = object({
|
||||
entry_point = string
|
||||
instances = number
|
||||
memory = number # Memory in MB
|
||||
runtime = string
|
||||
timeout = number
|
||||
entry_point = optional(string, "main")
|
||||
instances = optional(number, 1)
|
||||
memory = optional(number, 256) # Memory in MB
|
||||
runtime = optional(string, "python37")
|
||||
timeout = optional(number, 180)
|
||||
})
|
||||
default = {
|
||||
entry_point = "main"
|
||||
|
|
@ -130,7 +130,7 @@ variable "secrets" {
|
|||
}
|
||||
|
||||
variable "service_account" {
|
||||
description = "Service account email. Unused if service account is auto-created."
|
||||
description = "Service account email.service_account Unused if service account is auto-created."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
|
@ -146,7 +146,24 @@ variable "trigger_config" {
|
|||
type = object({
|
||||
event = string
|
||||
resource = string
|
||||
retry = bool
|
||||
retry = optional(bool)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "trigger_config_v2" {
|
||||
description = "Function trigger configuration. Leave null for HTTP trigger."
|
||||
type = object({
|
||||
region = optional(string)
|
||||
event_type = optional(string)
|
||||
pubsub_topic = optional(string)
|
||||
event_filters = optional(list(object({
|
||||
attribute = string
|
||||
value = string
|
||||
operator = string
|
||||
})), [])
|
||||
service_account_email = optional(string)
|
||||
retry_policy = optional(string)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue