Add https security to cloud-functions-v1 module (#2118)
* Add https security level to cf v1 module * Update tfdoc.py raw strings for slug var to avoid [SyntaxWarning: invalid escape sequence]
This commit is contained in:
Mohamed Ikbal Belbahri
GitHub
parent
dbabfb9ae0
commit
ae6ee03de2
|
|
@ -265,24 +265,25 @@ module "cf-http" {
|
|||
|---|---|:---:|:---:|:---:|
|
||||
| [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L38) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | <code title="object({ source_dir = string output_path = optional(string) excludes = optional(list(string)) })">object({…})</code> | ✓ | |
|
||||
| [name](variables.tf#L97) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L112) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L117) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L103) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L118) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L123) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object({ location = optional(string) lifecycle_delete_age_days = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [build_worker_pool](variables.tf#L32) | Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format. | <code>string</code> | | <code>null</code> |
|
||||
| [description](variables.tf#L47) | Optional description. | <code>string</code> | | <code>"Terraform managed."</code> |
|
||||
| [environment_variables](variables.tf#L53) | Cloud function environment variables. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [function_config](variables.tf#L59) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code title="object({ entry_point = optional(string, "main") instance_count = optional(number, 1) memory_mb = optional(number, 256) # Memory in MB cpu = optional(string, "0.166") runtime = optional(string, "python310") timeout_seconds = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instance_count = 1 memory_mb = 256 cpu = "0.166" runtime = "python310" timeout_seconds = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L79) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L85) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L91) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L102) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L122) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L134) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L140) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L146) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event = string resource = string retry = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L156) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L166) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
| [https_security_level](variables.tf#L79) | The security level for the function: Allowed values are SECURE_ALWAYS, SECURE_OPTIONAL. | <code>string</code> | | <code>null</code> |
|
||||
| [iam](variables.tf#L85) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L91) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L97) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L108) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L128) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L140) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L146) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L152) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event = string resource = string retry = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L162) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L172) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
|||
|
|
@ -51,21 +51,22 @@ resource "google_vpc_access_connector" "connector" {
|
|||
}
|
||||
|
||||
resource "google_cloudfunctions_function" "function" {
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
name = "${local.prefix}${var.name}"
|
||||
description = var.description
|
||||
runtime = var.function_config.runtime
|
||||
available_memory_mb = var.function_config.memory_mb
|
||||
max_instances = var.function_config.instance_count
|
||||
timeout = var.function_config.timeout_seconds
|
||||
entry_point = var.function_config.entry_point
|
||||
environment_variables = var.environment_variables
|
||||
service_account_email = local.service_account_email
|
||||
source_archive_bucket = local.bucket
|
||||
source_archive_object = google_storage_bucket_object.bundle.name
|
||||
labels = var.labels
|
||||
trigger_http = var.trigger_config == null ? true : null
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
name = "${local.prefix}${var.name}"
|
||||
description = var.description
|
||||
runtime = var.function_config.runtime
|
||||
available_memory_mb = var.function_config.memory_mb
|
||||
max_instances = var.function_config.instance_count
|
||||
timeout = var.function_config.timeout_seconds
|
||||
entry_point = var.function_config.entry_point
|
||||
environment_variables = var.environment_variables
|
||||
service_account_email = local.service_account_email
|
||||
source_archive_bucket = local.bucket
|
||||
source_archive_object = google_storage_bucket_object.bundle.name
|
||||
labels = var.labels
|
||||
trigger_http = var.trigger_config == null ? true : null
|
||||
https_trigger_security_level = var.https_security_level == null ? "SECURE_ALWAYS" : var.https_security_level
|
||||
|
||||
ingress_settings = var.ingress_settings
|
||||
build_worker_pool = var.build_worker_pool
|
||||
|
|
|
|||
|
|
@ -76,6 +76,12 @@ variable "function_config" {
|
|||
}
|
||||
}
|
||||
|
||||
variable "https_security_level" {
|
||||
description = "The security level for the function: Allowed values are SECURE_ALWAYS, SECURE_OPTIONAL."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "iam" {
|
||||
description = "IAM bindings for topic in {ROLE => [MEMBERS]} format."
|
||||
type = map(list(string))
|
||||
|
|
|
|||
|
|
@ -366,8 +366,8 @@ def create_toc(readme):
|
|||
for h in headings[1:]:
|
||||
title = h.children[0].children
|
||||
slug = title.lower().strip()
|
||||
slug = re.sub('[^\w\s-]', '', slug)
|
||||
slug = re.sub('[-\s]+', '-', slug)
|
||||
slug = re.sub(r'[^\w\s-]', '', slug)
|
||||
slug = re.sub(r'[-\s]+', '-', slug)
|
||||
link = f'- [{title}](#{slug})'
|
||||
indent = ' ' * (h.level - 2)
|
||||
lines.append(f'{indent}{link}')
|
||||
|
|
|
|||
Loading…
Reference in New Issue