first service-directory module implementation

This commit is contained in:
Ludovico Magnocavallo 2020-05-12 18:52:03 +02:00
parent da97405e31
commit 88b124ddc8
5 changed files with 345 additions and 0 deletions

View File

@ -0,0 +1,99 @@
# Google Cloud Service Directory Module
This module allows managing a single [Service Directory](https://cloud.google.com/service-directory) namespace, including multiple services, endpoints and IAM bindings at the namespace and service levels.
It can be used in conjunction with the [DNS](../dns) module to create service-directory based DNS zones, offloading IAM control of `A` and `SRV` records at the namespace or service level to Service Directory. The last examples shows how to wire the two modules together.
## Examples
### Namespace with IAM
```hcl
module "service-directory" {
source = "./modules/service-directory"
project_id = "my-project
location = "europe-west1"
name = "sd-1"
iam_members = {
"roles/servicedirectory.editor" = [
"serviceAccount:namespace-editor@example.com"
]
}
iam_roles = [
"roles/servicedirectory.editor"
]
```
### Services with IAM and endpoints
```hcl
module "service-directory" {
source = "./modules/service-directory"
project_id = "my-project
location = "europe-west1"
name = "sd-1"
services = {
one = {
endpoints = ["first", "second"]
metadata = null
}
}
service_iam_members = {
one = {
"roles/servicedirectory.editor" = [
"serviceAccount:service-editor.example.com"
]
}
}
service_iam_roles = {
one = ["roles/servicedirectory.editor"]
}
endpoint_config = {
"one/first" = { address = "127.0.0.1", port = 80, metadata = {} }
"one/second" = { address = "127.0.0.2", port = 80, metadata = {} }
}
}
```
### DNS based zone
TODO
```hcl
module "service-directory" {
source = "./modules/service-directory"
project_id = "my-project
location = "europe-west1"
name = "sd-1"
}
```
<!-- BEGIN TFDOC -->
## Variables
| name | description | type | required | default |
|---|---|:---: |:---:|:---:|
| location | Namespace location. | <code title="">string</code> | ✓ | |
| name | Namespace name. | <code title="">string</code> | ✓ | |
| project_id | Project used for resources. | <code title="">string</code> | ✓ | |
| *endpoint_config* | Map of endpoint attributes, keys are in service/endpoint format. | <code title="map&#40;object&#40;&#123;&#10;address &#61; string&#10;port &#61; number&#10;metadata &#61; map&#40;string&#41;&#10;&#125;&#41;&#41;">map(object({...}))</code> | | <code title="">{}</code> |
| *iam_members* | IAM members for each namespace role. | <code title="map&#40;list&#40;string&#41;&#41;">map(list(string))</code> | | <code title="">{}</code> |
| *iam_roles* | IAM roles for the namespace. | <code title="list&#40;string&#41;">list(string)</code> | | <code title="">[]</code> |
| *labels* | Labels. | <code title="map&#40;string&#41;">map(string)</code> | | <code title="">{}</code> |
| *service_iam_members* | IAM members for each service and role. | <code title="map&#40;map&#40;list&#40;string&#41;&#41;&#41;">map(map(list(string)))</code> | | <code title="">{}</code> |
| *service_iam_roles* | IAM roles for each service. | <code title="map&#40;list&#40;string&#41;&#41;">map(list(string))</code> | | <code title="">{}</code> |
| *services* | Service configuration, using service names as keys. | <code title="map&#40;object&#40;&#123;&#10;endpoints &#61; list&#40;string&#41;&#10;metadata &#61; map&#40;string&#41;&#10;&#125;&#41;&#41;">map(object({...}))</code> | | <code title="">{}</code> |
## Outputs
| name | description | sensitive |
|---|---|:---:|
| endpoints | Endpoint resources. | |
| id | Namespace id (short name). | |
| name | Namespace name (long name). | |
| namespace | Namespace resource. | |
| service_id | Service ids (short names). | |
| service_names | Service ids (long names). | |
| services | Service resources. | |
<!-- END TFDOC -->

View File

@ -0,0 +1,81 @@
/**
* Copyright 2020 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
locals {
endpoint_list = flatten([
for name, attrs in var.services : [
for endpoint in attrs.endpoints : { service : name, endpoint : endpoint }
]
])
endpoints = {
for ep in local.endpoint_list : "${ep.service}/${ep.endpoint}" => ep
}
iam_pairs = var.service_iam_roles == null ? [] : flatten([
for name, roles in var.service_iam_roles :
[for role in roles : { name = name, role = role }]
])
iam_keypairs = {
for pair in local.iam_pairs :
"${pair.name}-${pair.role}" => pair
}
iam_members = (
var.service_iam_members == null ? {} : var.service_iam_members
)
}
resource "google_service_directory_namespace" "default" {
provider = google-beta
project = var.project_id
namespace_id = var.name
location = var.location
labels = var.labels
}
resource "google_service_directory_namespace_iam_binding" "default" {
provider = google-beta
for_each = toset(var.iam_roles)
name = google_service_directory_namespace.default.name
role = each.value
members = lookup(var.iam_members, each.value, [])
}
resource "google_service_directory_service" "default" {
provider = google-beta
for_each = var.services
namespace = google_service_directory_namespace.default.id
service_id = each.key
metadata = each.value.metadata
}
resource "google_service_directory_service_iam_binding" "default" {
provider = google-beta
for_each = local.iam_keypairs
name = google_service_directory_service.default[each.value.name].name
role = each.value.role
members = lookup(
lookup(local.iam_members, each.value.name, {}), each.value.role, []
)
}
resource "google_service_directory_endpoint" "default" {
provider = google-beta
for_each = local.endpoints
endpoint_id = each.value.endpoint
service = google_service_directory_service.default[each.value.service].id
metadata = try(var.endpoint_config[each.key].metadata, null)
address = try(var.endpoint_config[each.key].address, null)
port = try(var.endpoint_config[each.key].port, null)
}

View File

@ -0,0 +1,66 @@
/**
* Copyright 2020 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
output "endpoints" {
description = "Endpoint resources."
value = google_service_directory_endpoint.default
}
output "id" {
description = "Namespace id (short name)."
value = google_service_directory_namespace.default.id
}
output "name" {
description = "Namespace name (long name)."
value = google_service_directory_namespace.default.name
}
output "namespace" {
description = "Namespace resource."
value = google_service_directory_namespace.default
depends_on = [
google_service_directory_namespace_iam_binding.default
]
}
output "services" {
description = "Service resources."
value = google_service_directory_service.default
depends_on = [
google_service_directory_service_iam_binding.default
]
}
output "service_id" {
description = "Service ids (short names)."
value = {
for k, v in google_service_directory_service.default : k => v.id
}
depends_on = [
google_service_directory_service_iam_binding.default
]
}
output "service_names" {
description = "Service ids (long names)."
value = {
for k, v in google_service_directory_service.default : k => v.name
}
depends_on = [
google_service_directory_service_iam_binding.default
]
}

View File

@ -0,0 +1,80 @@
/**
* Copyright 2020 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
# we need a separate variable as address will be dynamic in most cases
variable "endpoint_config" {
description = "Map of endpoint attributes, keys are in service/endpoint format."
type = map(object({
address = string
port = number
metadata = map(string)
}))
default = {}
}
variable "iam_members" {
description = "IAM members for each namespace role."
type = map(list(string))
default = {}
}
variable "iam_roles" {
description = "IAM roles for the namespace."
type = list(string)
default = []
}
variable "labels" {
description = "Labels."
type = map(string)
default = {}
}
variable "location" {
description = "Namespace location."
type = string
}
variable "name" {
description = "Namespace name."
type = string
}
variable "project_id" {
description = "Project used for resources."
type = string
}
variable "service_iam_members" {
description = "IAM members for each service and role."
type = map(map(list(string)))
default = {}
}
variable "service_iam_roles" {
description = "IAM roles for each service."
type = map(list(string))
default = {}
}
variable "services" {
description = "Service configuration, using service names as keys."
type = map(object({
endpoints = list(string)
metadata = map(string)
}))
default = {}
}

View File

@ -0,0 +1,19 @@
/**
* Copyright 2019 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
terraform {
required_version = ">= 0.12.6"
}