Ludovico Magnocavallo
GitHub
parent
f1924914af
commit
bd73e1ade9
|
|
@ -158,6 +158,3 @@ module "bigquery-dataset" {
|
|||
| views | View resources. | |
|
||||
<!-- END TFDOC -->
|
||||
|
||||
## TODO
|
||||
|
||||
- [ ] add support for tables
|
||||
|
|
|
|||
|
|
@ -0,0 +1,120 @@
|
|||
# Google Cloud Pub/Sub Module
|
||||
|
||||
This module allows managing a single Pub/Sub topic, including multiple subscriptions and IAM bindings at the topic and subscriptions levels.
|
||||
|
||||
|
||||
## Examples
|
||||
|
||||
### Simple topic with IAM
|
||||
|
||||
```hcl
|
||||
module "pubsub" {
|
||||
source = "./modules/pubsub"
|
||||
project_id = "my-project
|
||||
name = "my-topic"
|
||||
iam_roles = [
|
||||
"roles/pubsub.viewer",
|
||||
"roles/pubsub.subscriber"
|
||||
]
|
||||
iam_members = {
|
||||
"roles/pubsub.viewer" = ["group:foo@example.com"]
|
||||
"roles/pubsub.subscriber" = ["user:user1@example.com"]
|
||||
}
|
||||
```
|
||||
|
||||
### Subscriptions
|
||||
|
||||
Subscriptions are defined with the `subscriptions` variable, allowing optional configuration of per-subscription defaults. Push subscriptions need extra configuration, shown in the following example.
|
||||
|
||||
```hcl
|
||||
module "pubsub" {
|
||||
source = "./modules/pubsub"
|
||||
project_id = "my-project
|
||||
name = "my-topic"
|
||||
subscriptions = {
|
||||
test-pull = null
|
||||
test-pull-override = {
|
||||
labels = { test = "override" }
|
||||
options = {
|
||||
ack_deadline_seconds = null
|
||||
message_retention_duration = null
|
||||
retain_acked_messages = true
|
||||
expiration_policy_ttl = null
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Push subscriptions
|
||||
|
||||
Push subscriptions need extra configuration in the `push_configs` variable.
|
||||
|
||||
```hcl
|
||||
module "pubsub" {
|
||||
source = "./modules/pubsub"
|
||||
project_id = "my-project
|
||||
name = "my-topic"
|
||||
subscriptions = {
|
||||
test-push = null
|
||||
}
|
||||
push_configs = {
|
||||
test-push = {
|
||||
endpoint = "https://example.com/foo"
|
||||
attributes = null
|
||||
oidc_token = null
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Subscriptions with IAM
|
||||
|
||||
```hcl
|
||||
module "pubsub" {
|
||||
source = "./modules/pubsub"
|
||||
project_id = "my-project
|
||||
name = "my-topic"
|
||||
subscriptions = {
|
||||
test-1 = null
|
||||
test-1 = null
|
||||
}
|
||||
subscription_iam_roles = {
|
||||
test-1 = ["roles/pubsub.subscriber"]
|
||||
}
|
||||
subscription_iam_members = {
|
||||
test-1 = {
|
||||
"roles/pubsub.subscriber" = ["user:user1@ludomagno.net"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---: |:---:|:---:|
|
||||
| name | PubSub topic name. | <code title="">string</code> | ✓ | |
|
||||
| project_id | Project used for resources. | <code title="">string</code> | ✓ | |
|
||||
| *dead_letter_configs* | Per-subscription dead letter policy configuration. | <code title="map(object({ topic = string max_delivery_attemps = number }))">map(object({...}))</code> | | <code title="">{}</code> |
|
||||
| *defaults* | Subscription defaults for options. | <code title="object({ ack_deadline_seconds = number message_retention_duration = number retain_acked_messages = bool expiration_policy_ttl = string })">object({...})</code> | | <code title="{ ack_deadline_seconds = null message_retention_duration = null retain_acked_messages = null expiration_policy_ttl = null }">...</code> |
|
||||
| *iam_members* | IAM members for each topic role. | <code title="map(list(string))">map(list(string))</code> | | <code title="">{}</code> |
|
||||
| *iam_roles* | IAM roles for topic. | <code title="list(string)">list(string)</code> | | <code title="">[]</code> |
|
||||
| *kms_key* | KMS customer managed encryption key. | <code title="">string</code> | | <code title="">null</code> |
|
||||
| *labels* | Labels. | <code title="map(string)">map(string)</code> | | <code title="">{}</code> |
|
||||
| *push_configs* | Push subscription configurations. | <code title="map(object({ attributes = map(string) endpoint = string oidc_token = object({ audience = string service_account_email = string }) }))">map(object({...}))</code> | | <code title="">{}</code> |
|
||||
| *regions* | List of regions used to set persistence policy. | <code title="list(string)">list(string)</code> | | <code title="">[]</code> |
|
||||
| *subscription_iam_members* | IAM members for each subscription and role. | <code title="map(map(list(string)))">map(map(list(string)))</code> | | <code title="">{}</code> |
|
||||
| *subscription_iam_roles* | IAM roles for each subscription. | <code title="map(list(string))">map(list(string))</code> | | <code title="">{}</code> |
|
||||
| *subscriptions* | Topic subscriptions. Also define push configs for push subscriptions. If options is set to null subscription defaults will be used. Labels default to topic labels if set to null. | <code title="map(object({ labels = map(string) options = object({ ack_deadline_seconds = number message_retention_duration = number retain_acked_messages = bool expiration_policy_ttl = string }) }))">map(object({...}))</code> | | <code title="">{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
| name | description | sensitive |
|
||||
|---|---|:---:|
|
||||
| id | Topic id. | |
|
||||
| subscription_id | Subscription ids. | |
|
||||
| subscriptions | Subscription resources. | |
|
||||
| topic | Topic resource. | |
|
||||
<!-- END TFDOC -->
|
||||
|
|
@ -0,0 +1,113 @@
|
|||
/**
|
||||
* Copyright 2020 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
locals {
|
||||
iam_pairs = var.subscription_iam_roles == null ? [] : flatten([
|
||||
for name, roles in var.subscription_iam_roles :
|
||||
[for role in roles : { name = name, role = role }]
|
||||
])
|
||||
iam_keypairs = {
|
||||
for pair in local.iam_pairs :
|
||||
"${pair.name}-${pair.role}" => pair
|
||||
}
|
||||
iam_members = (
|
||||
var.subscription_iam_members == null ? {} : var.subscription_iam_members
|
||||
)
|
||||
oidc_config = {
|
||||
for k, v in var.push_configs : k => v.oidc_token
|
||||
}
|
||||
subscriptions = {
|
||||
for k, v in var.subscriptions : k => {
|
||||
labels = try(v.labels, v, null) == null ? var.labels : v.labels
|
||||
options = try(v.options, v, null) == null ? var.defaults : v.options
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_pubsub_topic" "default" {
|
||||
project = var.project_id
|
||||
name = var.name
|
||||
kms_key_name = var.kms_key
|
||||
labels = var.labels
|
||||
|
||||
dynamic message_storage_policy {
|
||||
for_each = length(var.regions) > 0 ? [var.regions] : []
|
||||
content {
|
||||
allowed_persistence_regions = var.regions
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_pubsub_topic_iam_binding" "default" {
|
||||
for_each = toset(var.iam_roles)
|
||||
project = var.project_id
|
||||
topic = google_pubsub_topic.default.name
|
||||
role = each.value
|
||||
members = lookup(var.iam_members, each.value, [])
|
||||
}
|
||||
|
||||
resource "google_pubsub_subscription" "default" {
|
||||
for_each = local.subscriptions
|
||||
project = var.project_id
|
||||
name = each.key
|
||||
topic = google_pubsub_topic.default.name
|
||||
labels = each.value.labels
|
||||
ack_deadline_seconds = each.value.options.ack_deadline_seconds
|
||||
message_retention_duration = each.value.options.message_retention_duration
|
||||
retain_acked_messages = each.value.options.retain_acked_messages
|
||||
|
||||
dynamic expiration_policy {
|
||||
for_each = each.value.options.expiration_policy_ttl == null ? [] : [""]
|
||||
content {
|
||||
ttl = each.value.options.expiration_policy_ttl
|
||||
}
|
||||
}
|
||||
|
||||
dynamic dead_letter_policy {
|
||||
for_each = try(var.dead_letter_configs[each.key], null) == null ? [] : [""]
|
||||
content {
|
||||
dead_letter_topic = var.dead_letter_configs[each.key].topic
|
||||
max_delivery_attempts = var.dead_letter_configs[each.key].max_delivery_attempts
|
||||
}
|
||||
}
|
||||
|
||||
dynamic push_config {
|
||||
for_each = try(var.push_configs[each.key], null) == null ? [] : [""]
|
||||
content {
|
||||
push_endpoint = var.push_configs[each.key].endpoint
|
||||
attributes = var.push_configs[each.key].attributes
|
||||
dynamic oidc_token {
|
||||
for_each = (
|
||||
local.oidc_config[each.key] == null ? [] : [""]
|
||||
)
|
||||
content {
|
||||
service_account_email = local.oidc_config[each.key].service_account_email
|
||||
audience = local.oidc_config[each.key].audience
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_pubsub_subscription_iam_binding" "default" {
|
||||
for_each = local.iam_keypairs
|
||||
project = var.project_id
|
||||
subscription = google_pubsub_subscription.default[each.value.name].name
|
||||
role = each.value.role
|
||||
members = lookup(
|
||||
lookup(local.iam_members, each.value.name, {}), each.value.role, []
|
||||
)
|
||||
}
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
/**
|
||||
* Copyright 2020 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
output "id" {
|
||||
description = "Topic id."
|
||||
value = google_pubsub_topic.default.id
|
||||
}
|
||||
|
||||
output "subscriptions" {
|
||||
description = "Subscription resources."
|
||||
value = google_pubsub_subscription.default
|
||||
depends_on = [
|
||||
google_pubsub_subscription_iam_binding.default
|
||||
]
|
||||
}
|
||||
|
||||
output "subscription_id" {
|
||||
description = "Subscription ids."
|
||||
value = {
|
||||
for k, v in google_pubsub_subscription.default : k => v.id
|
||||
}
|
||||
depends_on = [
|
||||
google_pubsub_subscription_iam_binding.default
|
||||
]
|
||||
}
|
||||
|
||||
output "topic" {
|
||||
description = "Topic resource."
|
||||
value = google_pubsub_topic.default
|
||||
depends_on = [
|
||||
google_pubsub_topic_iam_binding.default
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,120 @@
|
|||
/**
|
||||
* Copyright 2020 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
variable "dead_letter_configs" {
|
||||
description = "Per-subscription dead letter policy configuration."
|
||||
type = map(object({
|
||||
topic = string
|
||||
max_delivery_attemps = number
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "defaults" {
|
||||
description = "Subscription defaults for options."
|
||||
type = object({
|
||||
ack_deadline_seconds = number
|
||||
message_retention_duration = number
|
||||
retain_acked_messages = bool
|
||||
expiration_policy_ttl = string
|
||||
})
|
||||
default = {
|
||||
ack_deadline_seconds = null
|
||||
message_retention_duration = null
|
||||
retain_acked_messages = null
|
||||
expiration_policy_ttl = null
|
||||
}
|
||||
}
|
||||
|
||||
variable "iam_members" {
|
||||
description = "IAM members for each topic role."
|
||||
type = map(list(string))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "iam_roles" {
|
||||
description = "IAM roles for topic."
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "kms_key" {
|
||||
description = "KMS customer managed encryption key."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "labels" {
|
||||
description = "Labels."
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "name" {
|
||||
description = "PubSub topic name."
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "regions" {
|
||||
description = "List of regions used to set persistence policy."
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
description = "Project used for resources."
|
||||
type = string
|
||||
}
|
||||
|
||||
|
||||
variable "push_configs" {
|
||||
description = "Push subscription configurations."
|
||||
type = map(object({
|
||||
attributes = map(string)
|
||||
endpoint = string
|
||||
oidc_token = object({
|
||||
audience = string
|
||||
service_account_email = string
|
||||
})
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "subscriptions" {
|
||||
description = "Topic subscriptions. Also define push configs for push subscriptions. If options is set to null subscription defaults will be used. Labels default to topic labels if set to null."
|
||||
type = map(object({
|
||||
labels = map(string)
|
||||
options = object({
|
||||
ack_deadline_seconds = number
|
||||
message_retention_duration = number
|
||||
retain_acked_messages = bool
|
||||
expiration_policy_ttl = string
|
||||
})
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "subscription_iam_members" {
|
||||
description = "IAM members for each subscription and role."
|
||||
type = map(map(list(string)))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "subscription_iam_roles" {
|
||||
description = "IAM roles for each subscription."
|
||||
type = map(list(string))
|
||||
default = {}
|
||||
}
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
/**
|
||||
* Copyright 2019 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
terraform {
|
||||
required_version = ">= 0.12.6"
|
||||
}
|
||||
Loading…
Reference in New Issue