From 63ac5710ac683fc6f34c2063823879a74cfe1422 Mon Sep 17 00:00:00 2001 From: Miren Esnaola Date: Sun, 30 Jul 2023 20:39:55 +0200 Subject: [PATCH] Added module for Regional Internal Proxy Load Balancer --- README.md | 2 +- modules/README.md | 8 +- modules/net-lb-proxy-int/README.md | 321 ++++++++++++++++++++ modules/net-lb-proxy-int/backend-service.tf | 102 +++++++ modules/net-lb-proxy-int/groups.tf | 37 +++ modules/net-lb-proxy-int/health-check.tf | 120 ++++++++ modules/net-lb-proxy-int/main.tf | 124 ++++++++ modules/net-lb-proxy-int/outputs.tf | 74 +++++ modules/net-lb-proxy-int/variables.tf | 273 +++++++++++++++++ modules/net-lb-proxy-int/versions.tf | 29 ++ 10 files changed, 1086 insertions(+), 4 deletions(-) create mode 100644 modules/net-lb-proxy-int/README.md create mode 100644 modules/net-lb-proxy-int/backend-service.tf create mode 100644 modules/net-lb-proxy-int/groups.tf create mode 100644 modules/net-lb-proxy-int/health-check.tf create mode 100644 modules/net-lb-proxy-int/main.tf create mode 100644 modules/net-lb-proxy-int/outputs.tf create mode 100644 modules/net-lb-proxy-int/variables.tf create mode 100644 modules/net-lb-proxy-int/versions.tf diff --git a/README.md b/README.md index 3597fb7f..1e00ac46 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ The current list of modules supports most of the core foundational and networkin Currently available modules: - **foundational** - [billing budget](./modules/billing-budget), [Cloud Identity group](./modules/cloud-identity-group/), [folder](./modules/folder), [service accounts](./modules/iam-service-account), [logging bucket](./modules/logging-bucket), [organization](./modules/organization), [project](./modules/project), [projects-data-source](./modules/projects-data-source) -- **networking** - [DNS](./modules/dns), [DNS Response Policy](./modules/dns-response-policy/), [Cloud Endpoints](./modules/endpoints), [address reservation](./modules/net-address), [NAT](./modules/net-cloudnat), [VLAN Attachment](./modules/net-vlan-attachment/), [External Application LB](./modules/net-lb-app-ext/), [External Network Passthrough LB](./modules/net-lb-ext), [Internal Application LB](./modules/net-lb-app-int), [Internal Network Passthrough LB](./modules/net-lb-int), [IPSec over Interconnect](./modules/net-ipsec-over-interconnect), [VPC](./modules/net-vpc), [VPC firewall](./modules/net-vpc-firewall), [VPC firewall policy](./modules/net-vpc-firewall-policy), [VPC peering](./modules/net-vpc-peering), [VPN dynamic](./modules/net-vpn-dynamic), [HA VPN](./modules/net-vpn-ha), [VPN static](./modules/net-vpn-static), [Service Directory](./modules/service-directory) +- **networking** - [DNS](./modules/dns), [DNS Response Policy](./modules/dns-response-policy/), [Cloud Endpoints](./modules/endpoints), [address reservation](./modules/net-address), [NAT](./modules/net-cloudnat), [VLAN Attachment](./modules/net-vlan-attachment/), [External Application LB](./modules/net-lb-app-ext/), [External Passthrough Network LB](./modules/net-lb-ext), [Internal Application LB](./modules/net-lb-app-int), [Internal Passthrough Network LB](./modules/net-lb-int), [Internal Proxy Network LB](./modules/net-lb-proxy-int), [IPSec over Interconnect](./modules/net-ipsec-over-interconnect), [VPC](./modules/net-vpc), [VPC firewall](./modules/net-vpc-firewall), [VPC firewall policy](./modules/net-vpc-firewall-policy), [VPC peering](./modules/net-vpc-peering), [VPN dynamic](./modules/net-vpn-dynamic), [HA VPN](./modules/net-vpn-ha), [VPN static](./modules/net-vpn-static), [Service Directory](./modules/service-directory) - **compute** - [VM/VM group](./modules/compute-vm), [MIG](./modules/compute-mig), [COS container](./modules/cloud-config-container/cos-generic-metadata/) (coredns, mysql, onprem, squid), [GKE cluster](./modules/gke-cluster-standard), [GKE hub](./modules/gke-hub), [GKE nodepool](./modules/gke-nodepool) - **data** - [AlloyDB instance](./modules/alloydb-instance), [BigQuery dataset](./modules/bigquery-dataset), [Bigtable instance](./modules/bigtable-instance), [Dataplex](./modules/dataplex), [Cloud SQL instance](./modules/cloudsql-instance), [Data Catalog Policy Tag](./modules/data-catalog-policy-tag), [Datafusion](./modules/datafusion), [Dataproc](./modules/dataproc), [GCS](./modules/gcs), [Pub/Sub](./modules/pubsub) - **development** - [API Gateway](./modules/api-gateway), [Apigee](./modules/apigee), [Artifact Registry](./modules/artifact-registry), [Container Registry](./modules/container-registry), [Cloud Source Repository](./modules/source-repository) diff --git a/modules/README.md b/modules/README.md index 057b4853..93627d16 100644 --- a/modules/README.md +++ b/modules/README.md @@ -46,9 +46,11 @@ These modules are used in the examples included in this repository. If you are u - [DNS](./dns) - [DNS Response Policy](./dns-response-policy/) - [External Application Load Balancer](./net-lb-app-ext/) -- [External Network Passthrough Load Balancer](./net-lb-ext) -- [Internal Application LB](./net-lb-app-int) -- [Internal Network Passthrough Load Balancer](./net-lb-int) +- [External Passthrough Network Load Balancer](./net-lb-ext) +- [Internal Application Load Balancer](./net-lb-app-int) +- [Internal Passthrough Network Load Balancer](./net-lb-int) +- [Internal Proxy Network Load Balancer](./net-lb-proxy-int) +- [Internal ] - [NAT](./net-cloudnat) - [Service Directory](./service-directory) - [VPC](./net-vpc) diff --git a/modules/net-lb-proxy-int/README.md b/modules/net-lb-proxy-int/README.md new file mode 100644 index 00000000..e606b6bc --- /dev/null +++ b/modules/net-lb-proxy-int/README.md @@ -0,0 +1,321 @@ +# Internal Proxy Network Load Balancer Module + +This module allows managing Internal HTTP/HTTPS Load Balancers (L7 ILBs). It's designed to expose the full configuration of the underlying resources, and to facilitate common usage patterns by providing sensible defaults, and optionally managing prerequisite resources like health checks, instance groups, etc. + +Due to the complexity of the underlying resources, changes to the configuration that involve recreation of resources are best applied in stages, starting by disabling the configuration in the urlmap that references the resources that need recreation, then doing the same for the backend service, etc. + +## Examples + + +- [Examples](#examples) + - [Minimal Example](#minimal-example) + - [Health Checks](#health-checks) + - [Instance Groups](#instance-groups) + - [Network Endpoint Groups (NEGs)](#network-endpoint-groups-negs) + - [Zonal NEG creation](#zonal-neg-creation) + - [Hybrid NEG creation](#hybrid-neg-creation) + - [Private Service Connect NEG creation](#private-service-connect-neg-creation) +- [Files](#files) +- [Variables](#variables) +- [Outputs](#outputs) + + +### Minimal Example + +An Regional internal proxy Network Load Balancer with a backend service pointing to an existing GCE instance group: + +```hcl +module "tcp-proxy" { + source = "./fabric/modules/net-lb-proxy-int" + name = "ilb-test" + project_id = var.project_id + region = "europe-west1" + backend_service_config = { + backends = [{ + group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig" + }] + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=4 +``` + +### Health Checks + +You can leverage externally defined health checks for backend services, or have the module create them for you. By default a simple TCP health check on port 80 is created, and used in backend services. + +Health check configuration is controlled via the `health_check_config` variable, which behaves in a similar way to other LB modules in this repository. + +```hcl +module "int-tcp-proxy" { + source = "./fabric/modules/net-lb-proxy-int" + name = "int-tcp-proxy" + project_id = var.project_id + region = "europe-west1" + backend_service_config = { + backends = [{ + group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig" + }] + } + health_check_config = { + tcp = { port = 80 } + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=4 +``` + +To leverage an existing health check without having the module create them, simply pass its self link: + +```hcl +module "int-tcp-proxy" { + source = "./fabric/modules/net-lb-proxy-int" + name = "int-tcp-proxy" + project_id = var.project_id + region = "europe-west1" + backend_service_config = { + backends = [{ + group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig" + }] + } + health_check = "projects/myprj/global/healthChecks/custom" + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=4 +``` + +### Instance Groups + +The module can optionally create unmanaged instance groups, which can then be referred in backends via their key: + +```hcl +module "int-tcp-proxy" { + source = "./fabric/modules/net-lb-proxy-int" + name = "int-tcp-proxy" + project_id = var.project_id + region = "europe-west1" + backend_service_config = { + port_name = "http" + backends = [ + { group = "default" } + ] + } + group_configs = { + default = { + zone = "europe-west1-b" + instances = [ + "projects/myprj/zones/europe-west1-b/instances/vm-a" + ] + named_ports = { http = 80 } + } + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=5 +``` + +### Network Endpoint Groups (NEGs) + +Network Endpoint Groups (NEGs) can be used as backends, by passing their id as the backend group: + +```hcl +module "int-tcp-proxy" { + source = "./fabric/modules/net-lb-proxy-int" + name = "int-tcp-proxy" + project_id = var.project_id + region = "europe-west1" + backend_service_config = { + backends = [{ + group = "projects/myprj/zones/europe-west1-a/networkEndpointGroups/my-neg" + }] + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=4 +``` + +Similarly to instance groups, NEGs can also be managed by this module which supports GCE, hybrid and Private Service Connect NEGs: + +#### Zonal NEG creation + +```hcl +resource "google_compute_address" "test" { + name = "neg-test" + subnetwork = var.subnet.self_link + address_type = "INTERNAL" + address = "10.0.0.10" + region = "europe-west1" +} + +module "int-tcp-proxy" { + source = "./fabric/modules/net-lb-proxy-int" + name = "int-tcp-proxy" + project_id = var.project_id + region = "europe-west1" + backend_service_config = { + backends = [{ + group = "my-neg" + balancing_mode = "CONNECTION" + max_connections = { + per_endpoint = 10 + } + }] + } + neg_configs = { + my-neg = { + gce = { + zone = "europe-west1-b" + endpoints = { + e-0 = { + instance = "test-1" + ip_address = google_compute_address.test.address + # ip_address = "10.0.0.10" + port = 80 + } + } + } + } + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=7 +``` + +#### Hybrid NEG creation + +```hcl +module "int-tcp-proxy" { + source = "./fabric/modules/net-lb-proxy-int" + name = "int-tcp-proxy" + project_id = var.project_id + region = "europe-west1" + backend_service_config = { + backends = [{ + group = "my-neg" + balancing_mode = "CONNECTION" + max_connections = { + per_endpoint = 10 + } + }] + } + neg_configs = { + my-neg = { + hybrid = { + zone = "europe-west1-b" + endpoints = { + e-0 = { + ip_address = "10.0.0.10" + port = 80 + } + } + } + } + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=6 +``` + +#### Private Service Connect NEG creation + +```hcl +module "int-tcp-proxy" { + source = "./fabric/modules/net-lb-proxy-int" + name = "int-tcp-proxy" + project_id = var.project_id + region = "europe-west1" + backend_service_config = { + backends = [{ + group = "my-neg" + balancing_mode = "CONNECTION" + max_connections = { + per_endpoint = 10 + } + }] + } + neg_configs = { + my-neg = { + psc = { + region = "europe-west1" + target_service = "europe-west1-cloudkms.googleapis.com" + } + } + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=5 +``` + + + +## Files + +| name | description | resources | +|---|---|---| +| [backend-service.tf](./backend-service.tf) | Backend service resources. | google_compute_region_backend_service | +| [groups.tf](./groups.tf) | None | google_compute_instance_group | +| [health-check.tf](./health-check.tf) | Health check resource. | google_compute_region_health_check | +| [main.tf](./main.tf) | Module-level locals and resources. | google_compute_forwarding_rule · google_compute_network_endpoint · google_compute_network_endpoint_group · google_compute_region_network_endpoint_group · google_compute_region_target_tcp_proxy | +| [outputs.tf](./outputs.tf) | Module outputs. | | +| [variables.tf](./variables.tf) | Module variables. | | +| [versions.tf](./versions.tf) | Version pins. | | + +## Variables + +| name | description | type | required | default | +|---|---|:---:|:---:|:---:| +| [name](variables.tf#L198) | Load balancer name. | string | ✓ | | +| [project_id](variables.tf#L256) | Project id. | string | ✓ | | +| [region](variables.tf#L261) | The region where to allocate the ILB resources. | string | ✓ | | +| [vpc_config](variables.tf#L266) | VPC-level configuration. | object({…}) | ✓ | | +| [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null | +| [backend_service_config](variables.tf#L23) | Backend service level configuration. | object({…}) | | {} | +| [description](variables.tf#L75) | Optional description used for resources. | string | | "Terraform managed." | +| [global_access](variables.tf#L82) | Allow client access from all regions. | bool | | null | +| [group_configs](variables.tf#L88) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [health_check](variables.tf#L100) | Name of existing health check to use, disables auto-created health check. | string | | null | +| [health_check_config](variables.tf#L106) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | object({…}) | | {…} | +| [labels](variables.tf#L192) | Labels set on resources. | map(string) | | {} | +| [neg_configs](variables.tf#L203) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [port](variables.tf#L250) | Port. | number | | 80 | + +## Outputs + +| name | description | sensitive | +|---|---|:---:| +| [backend_service](outputs.tf#L17) | Backend resource. | | +| [backend_service_id](outputs.tf#L22) | Backend id. | | +| [backend_service_self_link](outputs.tf#L27) | Backend self link. | | +| [forwarding_rule](outputs.tf#L32) | Forwarding rule resource. | | +| [group_self_links](outputs.tf#L37) | Optional unmanaged instance group self links. | | +| [groups](outputs.tf#L44) | Optional unmanaged instance group resources. | | +| [health_check](outputs.tf#L49) | Auto-created health-check resource. | | +| [health_check_self_id](outputs.tf#L54) | Auto-created health-check self id. | | +| [health_check_self_link](outputs.tf#L59) | Auto-created health-check self link. | | +| [id](outputs.tf#L64) | Fully qualified forwarding rule id. | | +| [neg_ids](outputs.tf#L69) | Autogenerated network endpoint group ids. | | + diff --git a/modules/net-lb-proxy-int/backend-service.tf b/modules/net-lb-proxy-int/backend-service.tf new file mode 100644 index 00000000..f5cf6e1c --- /dev/null +++ b/modules/net-lb-proxy-int/backend-service.tf @@ -0,0 +1,102 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description Backend service resources. + +locals { + group_ids = merge( + { + for k, v in google_compute_instance_group.default : k => v.id + }, + { + for k, v in google_compute_network_endpoint_group.default : k => v.id + }, + { + for k, v in google_compute_region_network_endpoint_group.psc : k => v.id + } + ) + hc_ids = { + for k, v in google_compute_region_health_check.default : k => v.id + } +} + +resource "google_compute_region_backend_service" "default" { + provider = google-beta + project = var.project_id + region = var.region + name = var.name + description = var.description + affinity_cookie_ttl_sec = var.backend_service_config.affinity_cookie_ttl_sec + connection_draining_timeout_sec = var.backend_service_config.connection_draining_timeout_sec + health_checks = [local.health_check] + load_balancing_scheme = "INTERNAL_MANAGED" + port_name = var.backend_service_config.port_name # defaults to http, not for NEGs + protocol = "TCP" + session_affinity = var.backend_service_config.session_affinity + timeout_sec = var.backend_service_config.timeout_sec + + dynamic "backend" { + for_each = { for b in coalesce(var.backend_service_config.backends, []) : b.group => b } + content { + group = lookup(local.group_ids, backend.key, backend.key) + balancing_mode = backend.value.balancing_mode + capacity_scaler = backend.value.capacity_scaler + description = backend.value.description + failover = backend.value.failover + max_connections = try( + backend.value.max_connections.per_group, null + ) + max_connections_per_endpoint = try( + backend.value.max_connections.per_endpoint, null + ) + max_connections_per_instance = try( + backend.value.max_connections.per_instance, null + ) + max_utilization = backend.value.max_utilization + } + } + + dynamic "connection_tracking_policy" { + for_each = var.backend_service_config.connection_tracking == null ? [] : [""] + content { + connection_persistence_on_unhealthy_backends = ( + ar.backend_service_config.connection_tracking.persist_conn_on_unhealthy != null + ? ar.backend_service_config.connection_tracking.persist_conn_on_unhealthy + : null + ) + idle_timeout_sec = var.backend_service_config.connection_tracking.idle_timeout_sec + tracking_mode = try(local.bs_conntrack.track_per_session ? "PER_SESSION" : "PER_CONNECTION", null) + } + } + + dynamic "failover_policy" { + for_each = var.backend_service_config.failover_config == null ? [] : [""] + content { + disable_connection_drain_on_failover = var.backend_service_config.failover_config.disable_conn_drain + drop_traffic_if_unhealthy = var.backend_service_config.failover_config.drop_traffic_if_unhealthy + failover_ratio = var.backend_service_config.failover_config.ratio + } + } + + dynamic "log_config" { + for_each = var.backend_service_config.log_sample_rate == null ? [] : [""] + content { + enable = true + sample_rate = var.backend_service_config.log_sample_rate + } + } + +} diff --git a/modules/net-lb-proxy-int/groups.tf b/modules/net-lb-proxy-int/groups.tf new file mode 100644 index 00000000..53ba6b27 --- /dev/null +++ b/modules/net-lb-proxy-int/groups.tf @@ -0,0 +1,37 @@ +/** + * Copyright 2023 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +resource "google_compute_instance_group" "default" { + for_each = var.group_configs + project = ( + each.value.project_id == null + ? var.project_id + : each.value.project_id + ) + zone = each.value.zone + name = "${var.name}-${each.key}" + description = var.description + instances = each.value.instances + + dynamic "named_port" { + for_each = each.value.named_ports + content { + name = named_port.key + port = named_port.value + } + } +} + diff --git a/modules/net-lb-proxy-int/health-check.tf b/modules/net-lb-proxy-int/health-check.tf new file mode 100644 index 00000000..8c0ff4f1 --- /dev/null +++ b/modules/net-lb-proxy-int/health-check.tf @@ -0,0 +1,120 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description Health check resource. + +locals { + hc = var.health_check_config + hc_grpc = try(local.hc.grpc, null) != null + hc_http = try(local.hc.http, null) != null + hc_http2 = try(local.hc.http2, null) != null + hc_https = try(local.hc.https, null) != null + hc_ssl = try(local.hc.ssl, null) != null + hc_tcp = try(local.hc.tcp, null) != null +} + +resource "google_compute_region_health_check" "default" { + provider = google-beta + count = local.hc != null ? 1 : 0 + project = var.project_id + name = var.name + region = var.region + description = local.hc.description + check_interval_sec = local.hc.check_interval_sec + healthy_threshold = local.hc.healthy_threshold + timeout_sec = local.hc.timeout_sec + unhealthy_threshold = local.hc.unhealthy_threshold + + dynamic "grpc_health_check" { + for_each = local.hc_grpc ? [""] : [] + content { + port = local.hc.grpc.port + port_name = local.hc.grpc.port_name + port_specification = local.hc.grpc.port_specification + grpc_service_name = local.hc.grpc.service_name + } + } + + dynamic "http_health_check" { + for_each = local.hc_http ? [""] : [] + content { + host = local.hc.http.host + port = local.hc.http.port + port_name = local.hc.http.port_name + port_specification = local.hc.http.port_specification + proxy_header = local.hc.http.proxy_header + request_path = local.hc.http.request_path + response = local.hc.http.response + } + } + + dynamic "http2_health_check" { + for_each = local.hc_http2 ? [""] : [] + content { + host = local.hc.http2.host + port = local.hc.http2.port + port_name = local.hc.http2.port_name + port_specification = local.hc.http2.port_specification + proxy_header = local.hc.http2.proxy_header + request_path = local.hc.http2.request_path + response = local.hc.http2.response + } + } + + dynamic "https_health_check" { + for_each = local.hc_https ? [""] : [] + content { + host = local.hc.https.host + port = local.hc.https.port + port_name = local.hc.https.port_name + port_specification = local.hc.https.port_specification + proxy_header = local.hc.https.proxy_header + request_path = local.hc.https.request_path + response = local.hc.https.response + } + } + + dynamic "ssl_health_check" { + for_each = local.hc_ssl ? [""] : [] + content { + port = local.hc.ssl.port + port_name = local.hc.ssl.port_name + port_specification = local.hc.ssl.port_specification + proxy_header = local.hc.ssl.proxy_header + request = local.hc.ssl.request + response = local.hc.ssl.response + } + } + + dynamic "tcp_health_check" { + for_each = local.hc_tcp ? [""] : [] + content { + port = local.hc.tcp.port + port_name = local.hc.tcp.port_name + port_specification = local.hc.tcp.port_specification + proxy_header = local.hc.tcp.proxy_header + request = local.hc.tcp.request + response = local.hc.tcp.response + } + } + + dynamic "log_config" { + for_each = try(local.hc.enable_logging, null) == true ? [""] : [] + content { + enable = true + } + } +} diff --git a/modules/net-lb-proxy-int/main.tf b/modules/net-lb-proxy-int/main.tf new file mode 100644 index 00000000..f90d86fe --- /dev/null +++ b/modules/net-lb-proxy-int/main.tf @@ -0,0 +1,124 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +locals { + # we need keys in the endpoint type to address issue #1055 + _neg_endpoints = flatten([ + for k, v in local.neg_zonal : [ + for kk, vv in v.endpoints : merge(vv, { + key = "${k}-${kk}", neg = k, zone = v.zone + }) + ] + ]) + neg_endpoints = { + for v in local._neg_endpoints : (v.key) => v + } + neg_zonal = { + # we need to rebuild new objects as we cannot merge different types + for k, v in var.neg_configs : k => { + endpoints = v.gce != null ? v.gce.endpoints : v.hybrid.endpoints + network = v.gce != null ? v.gce.network : v.hybrid.network + project_id = v.project_id + subnetwork = v.gce != null ? v.gce.subnetwork : null + type = v.gce != null ? "GCE_VM_IP_PORT" : "NON_GCP_PRIVATE_IP_PORT" + zone = v.gce != null ? v.gce.zone : v.hybrid.zone + } if v.gce != null || v.hybrid != null + } + neg_regional_psc = { + for k, v in var.neg_configs : + k => v if v.psc != null + } + health_check = ( + var.health_check != null + ? var.health_check + : google_compute_region_health_check.default.0.self_link + ) +} + +resource "google_compute_forwarding_rule" "default" { + provider = google-beta + project = var.project_id + region = var.region + name = var.name + description = var.description + ip_address = var.address + ip_protocol = "TCP" + load_balancing_scheme = "INTERNAL_MANAGED" + network = var.vpc_config.network + port_range = var.port + subnetwork = var.vpc_config.subnetwork + labels = var.labels + target = google_compute_region_target_tcp_proxy.default.id + # during the preview phase you cannot change this attribute on an existing rule + allow_global_access = var.global_access +} + +resource "google_compute_region_target_tcp_proxy" "default" { + project = var.project_id + name = var.name + description = var.description + region = var.region + backend_service = google_compute_region_backend_service.default.self_link +} + +resource "google_compute_network_endpoint_group" "default" { + for_each = local.neg_zonal + project = ( + each.value.project_id == null + ? var.project_id + : each.value.project_id + ) + zone = each.value.zone + name = "${var.name}-${each.key}" + # re-enable once provider properly supports this + # default_port = each.value.default_port + description = var.description + network_endpoint_type = each.value.type + network = ( + each.value.network != null ? each.value.network : var.vpc_config.network + ) + subnetwork = ( + each.value.type == "NON_GCP_PRIVATE_IP_PORT" + ? null + : try(each.value.subnetwork, var.vpc_config.subnetwork) + ) +} + +resource "google_compute_network_endpoint" "default" { + for_each = local.neg_endpoints + project = ( + google_compute_network_endpoint_group.default[each.value.neg].project + ) + network_endpoint_group = ( + google_compute_network_endpoint_group.default[each.value.neg].name + ) + instance = try(each.value.instance, null) + ip_address = each.value.ip_address + port = each.value.port + zone = each.value.zone +} + +resource "google_compute_region_network_endpoint_group" "psc" { + for_each = local.neg_regional_psc + project = var.project_id + region = each.value.psc.region + name = "${var.name}-${each.key}" + //description = coalesce(each.value.description, var.description) + network_endpoint_type = "PRIVATE_SERVICE_CONNECT" + psc_target_service = each.value.psc.target_service + network = each.value.psc.network + subnetwork = each.value.psc.subnetwork +} diff --git a/modules/net-lb-proxy-int/outputs.tf b/modules/net-lb-proxy-int/outputs.tf new file mode 100644 index 00000000..2bd35ee3 --- /dev/null +++ b/modules/net-lb-proxy-int/outputs.tf @@ -0,0 +1,74 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +output "backend_service" { + description = "Backend resource." + value = google_compute_region_backend_service.default +} + +output "backend_service_id" { + description = "Backend id." + value = google_compute_region_backend_service.default.id +} + +output "backend_service_self_link" { + description = "Backend self link." + value = google_compute_region_backend_service.default.self_link +} + +output "forwarding_rule" { + description = "Forwarding rule resource." + value = google_compute_forwarding_rule.default +} + +output "group_self_links" { + description = "Optional unmanaged instance group self links." + value = { + for k, v in google_compute_instance_group.default : k => v.self_link + } +} + +output "groups" { + description = "Optional unmanaged instance group resources." + value = google_compute_instance_group.default +} + +output "health_check" { + description = "Auto-created health-check resource." + value = try(google_compute_region_health_check.default.0, null) +} + +output "health_check_self_id" { + description = "Auto-created health-check self id." + value = try(google_compute_region_health_check.default.0.id, null) +} + +output "health_check_self_link" { + description = "Auto-created health-check self link." + value = try(google_compute_region_health_check.default.0.self_link, null) +} + +output "id" { + description = "Fully qualified forwarding rule id." + value = google_compute_forwarding_rule.default.id +} + +output "neg_ids" { + description = "Autogenerated network endpoint group ids." + value = { + for k, v in google_compute_network_endpoint_group.default : k => v.id + } +} diff --git a/modules/net-lb-proxy-int/variables.tf b/modules/net-lb-proxy-int/variables.tf new file mode 100644 index 00000000..70a725a6 --- /dev/null +++ b/modules/net-lb-proxy-int/variables.tf @@ -0,0 +1,273 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +variable "address" { + description = "Optional IP address used for the forwarding rule." + type = string + default = null +} + +variable "backend_service_config" { + description = "Backend service level configuration." + type = object({ + affinity_cookie_ttl_sec = optional(number) + connection_draining_timeout_sec = optional(number) + health_checks = optional(list(string), ["default"]) + log_sample_rate = optional(number) + port_name = optional(string) + project_id = optional(string) + session_affinity = optional(string, "NONE") + timeout_sec = optional(number) + backends = optional(list(object({ + group = string + balancing_mode = optional(string, "UTILIZATION") + capacity_scaler = optional(number, 1) + description = optional(string, "Terraform managed.") + failover = optional(bool, false) + max_connections = optional(object({ + per_endpoint = optional(number) + per_group = optional(number) + per_instance = optional(number) + })) + max_utilization = optional(number) + }))) + connection_tracking = optional(object({ + idle_timeout_sec = optional(number) + persist_conn_on_unhealthy = optional(string) + track_per_session = optional(bool) + })) + failover_config = optional(object({ + disable_conn_drain = optional(bool) + drop_traffic_if_unhealthy = optional(bool) + ratio = optional(number) + })) + }) + default = {} + nullable = false + validation { + condition = (var.backend_service_config == null || contains(["NONE", "CLIENT_IP"], + var.backend_service_config.session_affinity + )) + error_message = "Invalid session affinity value." + } + validation { + condition = alltrue([ + for b in var.backend_service_config.backends : contains( + ["CONNECTION", "UTILIZATION"], coalesce(b.balancing_mode, "CONNECTION") + )]) + error_message = "When specified balancing mode needs to be 'CONNECTION' or 'UTILIZATION'." + } +} + +variable "description" { + description = "Optional description used for resources." + type = string + default = "Terraform managed." +} + +# during the preview phase you cannot change this attribute on an existing rule +variable "global_access" { + description = "Allow client access from all regions." + type = bool + default = null +} + +variable "group_configs" { + description = "Optional unmanaged groups to create. Can be referenced in backends via key or outputs." + type = map(object({ + zone = string + instances = optional(list(string)) + named_ports = optional(map(number), {}) + project_id = optional(string) + })) + default = {} + nullable = false +} + +variable "health_check" { + description = "Name of existing health check to use, disables auto-created health check." + type = string + default = null +} + +variable "health_check_config" { + description = "Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage." + type = object({ + check_interval_sec = optional(number) + description = optional(string, "Terraform managed.") + enable_logging = optional(bool, false) + healthy_threshold = optional(number) + project_id = optional(string) + timeout_sec = optional(number) + unhealthy_threshold = optional(number) + grpc = optional(object({ + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + service_name = optional(string) + })) + http = optional(object({ + host = optional(string) + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request_path = optional(string) + response = optional(string) + })) + http2 = optional(object({ + host = optional(string) + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request_path = optional(string) + response = optional(string) + })) + https = optional(object({ + host = optional(string) + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request_path = optional(string) + response = optional(string) + })) + tcp = optional(object({ + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request = optional(string) + response = optional(string) + })) + ssl = optional(object({ + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request = optional(string) + response = optional(string) + })) + }) + default = { + tcp = { + port_specification = "USE_SERVING_PORT" + } + } + validation { + condition = ( + (try(var.health_check_config.grpc, null) == null ? 0 : 1) + + (try(var.health_check_config.http, null) == null ? 0 : 1) + + (try(var.health_check_config.http2, null) == null ? 0 : 1) + + (try(var.health_check_config.https, null) == null ? 0 : 1) + + (try(var.health_check_config.tcp, null) == null ? 0 : 1) + + (try(var.health_check_config.ssl, null) == null ? 0 : 1) <= 1 + ) + error_message = "Only one health check type can be configured at a time." + } + validation { + condition = alltrue([ + for k, v in var.health_check_config : contains([ + "-", "USE_FIXED_PORT", "USE_NAMED_PORT", "USE_SERVING_PORT" + ], coalesce(try(v.port_specification, null), "-")) + ]) + error_message = "Invalid 'port_specification' value. Supported values are 'USE_FIXED_PORT', 'USE_NAMED_PORT', 'USE_SERVING_PORT'." + } +} + +variable "labels" { + description = "Labels set on resources." + type = map(string) + default = {} +} + +variable "name" { + description = "Load balancer name." + type = string +} + +variable "neg_configs" { + description = "Optional network endpoint groups to create. Can be referenced in backends via key or outputs." + type = map(object({ + project_id = optional(string) + gce = optional(object({ + zone = string + # default_port = optional(number) + network = optional(string) + subnetwork = optional(string) + endpoints = optional(map(object({ + instance = string + ip_address = string + port = number + }))) + + })) + hybrid = optional(object({ + zone = string + network = optional(string) + # re-enable once provider properly support this + # default_port = optional(number) + endpoints = optional(map(object({ + ip_address = string + port = number + }))) + })) + psc = optional(object({ + region = string + target_service = string + network = optional(string) + subnetwork = optional(string) + })) + })) + default = {} + nullable = false + validation { + condition = alltrue([ + for k, v in var.neg_configs : ( + (try(v.gce, null) == null ? 0 : 1) + + (try(v.hybrid, null) == null ? 0 : 1) + + (try(v.psc, null) == null ? 0 : 1) == 1 + ) + ]) + error_message = "Only one type of neg can be configured at a time." + } +} + +variable "port" { + description = "Port." + type = number + default = 80 +} + +variable "project_id" { + description = "Project id." + type = string +} + +variable "region" { + description = "The region where to allocate the ILB resources." + type = string +} + +variable "vpc_config" { + description = "VPC-level configuration." + type = object({ + network = string + subnetwork = string + }) + nullable = false +} diff --git a/modules/net-lb-proxy-int/versions.tf b/modules/net-lb-proxy-int/versions.tf new file mode 100644 index 00000000..2ce95782 --- /dev/null +++ b/modules/net-lb-proxy-int/versions.tf @@ -0,0 +1,29 @@ +# Copyright 2022 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +terraform { + required_version = ">= 1.4.4" + required_providers { + google = { + source = "hashicorp/google" + version = ">= 4.71.0" # tftest + } + google-beta = { + source = "hashicorp/google-beta" + version = ">= 4.71.0" # tftest + } + } +} + +