Add trigger service account creation
This commit is contained in:
Wiktor Niesiobędzki
parent
9e37a915c8
commit
755ff7b1d2
|
|
@ -171,7 +171,7 @@ module "cloud-function" {
|
|||
v2 = {
|
||||
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
|
||||
pubsub_topic = module.pubsub.topic.id
|
||||
# TODO: service_account_email
|
||||
service_account_create = true
|
||||
}
|
||||
} : {
|
||||
v1 = {
|
||||
|
|
|
|||
|
|
@ -234,7 +234,7 @@ module "cf-http" {
|
|||
| [build_worker_pool](variables.tf#L31) | Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format | <code>string</code> | | <code>null</code> |
|
||||
| [description](variables.tf#L46) | Optional description. | <code>string</code> | | <code>"Terraform managed."</code> |
|
||||
| [environment_variables](variables.tf#L52) | Cloud function environment variables. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | <code title="object({ entry_point = optional(string, "main") instances = optional(number, 1) memory = optional(number, 256) # Memory in MB runtime = optional(string, "python310") timeout = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instances = 1 memory = 256 runtime = "python37" timeout = 180 }">{…}</code> |
|
||||
| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | <code title="object({ entry_point = optional(string, "main") instances = optional(number, 1) memory = optional(number, 256) # Memory in MB runtime = optional(string, "python310") timeout = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instances = 1 memory = 256 runtime = "python310" timeout = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L76) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L82) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L88) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
|
|
@ -243,10 +243,10 @@ module "cf-http" {
|
|||
| [secrets](variables.tf#L120) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L132) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L138) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ v1 = optional(object({ event = string resource = string retry = optional(bool) })), v2 = optional(object({ region = optional(string) event_type = optional(string) pubsub_topic = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = string }))) service_account_email = optional(string) retry_policy = optional(string) })) })">object({…})</code> | | <code>null</code> |
|
||||
| [v2](variables.tf#L191) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | <code>bool</code> | | <code>false</code> |
|
||||
| [vpc_connector](variables.tf#L172) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L182) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ v1 = optional(object({ event = string resource = string retry = optional(bool) })), v2 = optional(object({ region = optional(string) event_type = optional(string) pubsub_topic = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = string }))) service_account_email = optional(string) service_account_create = optional(bool) retry_policy = optional(string) })) })">object({…})</code> | | <code>null</code> |
|
||||
| [v2](variables.tf#L192) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | <code>bool</code> | | <code>false</code> |
|
||||
| [vpc_connector](variables.tf#L173) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L183) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
@ -259,7 +259,10 @@ module "cf-http" {
|
|||
| [service_account](outputs.tf#L42) | Service account resource. | |
|
||||
| [service_account_email](outputs.tf#L47) | Service account email. | |
|
||||
| [service_account_iam_email](outputs.tf#L52) | Service account email. | |
|
||||
| [trigger_service_account](outputs.tf#L60) | Service account resource. | |
|
||||
| [trigger_service_account_email](outputs.tf#L65) | Service account email. | |
|
||||
| [trigger_service_account_iam_email](outputs.tf#L70) | Service account email. | |
|
||||
| [uri](outputs.tf#L38) | Cloud function service uri. | |
|
||||
| [vpc_connector](outputs.tf#L60) | VPC connector resource if created. | |
|
||||
| [vpc_connector](outputs.tf#L78) | VPC connector resource if created. | |
|
||||
|
||||
<!-- END TFDOC -->
|
||||
|
|
|
|||
|
|
@ -39,6 +39,16 @@ locals {
|
|||
)
|
||||
: var.service_account
|
||||
)
|
||||
trigger_service_account_email = (
|
||||
try(var.trigger_config.v2.service_account_create, null) == null
|
||||
? false
|
||||
: var.trigger_config.v2.service_account_create ? (
|
||||
length(google_service_account.trigger_service_account) > 0
|
||||
? google_service_account.trigger_service_account[0].email
|
||||
: null
|
||||
)
|
||||
: try(var.trigger_config.v2.service_account_email, null)
|
||||
)
|
||||
vpc_connector = (
|
||||
var.vpc_connector == null
|
||||
? null
|
||||
|
|
@ -212,7 +222,7 @@ resource "google_cloudfunctions2_function" "function" {
|
|||
}
|
||||
|
||||
resource "google_cloudfunctions_function_iam_binding" "default" {
|
||||
for_each = var.iam
|
||||
for_each = var.v2 == false ? var.iam : {}
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
cloud_function = local.function.name
|
||||
|
|
@ -220,6 +230,15 @@ resource "google_cloudfunctions_function_iam_binding" "default" {
|
|||
members = each.value
|
||||
}
|
||||
|
||||
resource "google_cloudfunctions2_function_iam_binding" "default" {
|
||||
for_each = var.v2 == true ? var.iam : {}
|
||||
project = var.project_id
|
||||
location = google_cloudfunctions2_function.function[0].location
|
||||
cloud_function = local.function.name
|
||||
role = each.key
|
||||
members = each.value
|
||||
}
|
||||
|
||||
resource "google_storage_bucket" "bucket" {
|
||||
count = var.bucket_config == null ? 0 : 1
|
||||
project = var.project_id
|
||||
|
|
@ -271,3 +290,21 @@ resource "google_service_account" "service_account" {
|
|||
account_id = "tf-cf-${var.name}"
|
||||
display_name = "Terraform Cloud Function ${var.name}."
|
||||
}
|
||||
|
||||
resource "google_service_account" "trigger_service_account" {
|
||||
count = try(var.trigger_config.v2.service_account_create, null) == null ? 0 : (
|
||||
var.trigger_config.v2.service_account_create ? 1 : 0
|
||||
)
|
||||
project = var.project_id
|
||||
account_id = "tf-cf-trigger-${var.name}"
|
||||
display_name = "Terraform trigger for Cloud Function ${var.name}."
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "trigger_iam" {
|
||||
count = try(var.trigger_config.v2.service_account_create, null) == null ? 0 : (
|
||||
var.trigger_config.v2.service_account_create ? 1 : 0
|
||||
)
|
||||
project = var.project_id
|
||||
member = "serviceAccount:${google_service_account.trigger_service_account[0].email}"
|
||||
role = "roles/run.invoker"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -57,6 +57,24 @@ output "service_account_iam_email" {
|
|||
])
|
||||
}
|
||||
|
||||
output "trigger_service_account" {
|
||||
description = "Service account resource."
|
||||
value = try(google_service_account.trigger_service_account[0], null)
|
||||
}
|
||||
|
||||
output "trigger_service_account_email" {
|
||||
description = "Service account email."
|
||||
value = local.trigger_service_account_email
|
||||
}
|
||||
|
||||
output "trigger_service_account_iam_email" {
|
||||
description = "Service account email."
|
||||
value = join("", [
|
||||
"serviceAccount:",
|
||||
local.trigger_service_account_email == null ? "" : local.trigger_service_account_email
|
||||
])
|
||||
}
|
||||
|
||||
output "vpc_connector" {
|
||||
description = "VPC connector resource if created."
|
||||
value = try(google_vpc_access_connector.connector.0.id, null)
|
||||
|
|
|
|||
|
|
@ -68,7 +68,7 @@ variable "function_config" {
|
|||
entry_point = "main"
|
||||
instances = 1
|
||||
memory = 256
|
||||
runtime = "python37"
|
||||
runtime = "python310"
|
||||
timeout = 180
|
||||
}
|
||||
}
|
||||
|
|
@ -159,6 +159,7 @@ variable "trigger_config" {
|
|||
operator = string
|
||||
})))
|
||||
service_account_email = optional(string)
|
||||
service_account_create = optional(bool)
|
||||
retry_policy = optional(string)
|
||||
}))
|
||||
})
|
||||
|
|
|
|||
Loading…
Reference in New Issue