From 724dfda09c86b83482faf04e5361bb2ed8f94b5e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Thu, 21 Dec 2023 15:25:12 +0000 Subject: [PATCH 01/13] Provider doesn't set defaults on config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Can't provide just one size (like `web_server` or `triggerrer`) because of no defaults are taken: module.composer.google_composer_environment.env: Modifying... [id=***] ╷ │ Error: googleapi: Error 400: Found 6 problems: │ 1) You have to specify Scheduler CPUs not lower than 0.5. │ 2) You have to specify number of schedulers larger than 0. │ 3) You have to specify Web Server CPUs not lower than 0.5. │ 4) You have to specify Worker CPUs not lower than 0.5. │ 5) You have to specify minimum number of workers larger than 0. │ 6) Triggerer memory must be between 1.00GB and 6.50GB for given vCpu So provide the defaults as set workloads_config == null --- .../data-solutions/composer-2/variables.tf | 42 ++++++++----------- 1 file changed, 18 insertions(+), 24 deletions(-) diff --git a/blueprints/data-solutions/composer-2/variables.tf b/blueprints/data-solutions/composer-2/variables.tf index 5a850127..312e9170 100644 --- a/blueprints/data-solutions/composer-2/variables.tf +++ b/blueprints/data-solutions/composer-2/variables.tf @@ -20,35 +20,29 @@ variable "composer_config" { environment_size = optional(string) software_config = optional(any) workloads_config = optional(object({ - scheduler = optional(object( - { - count = optional(number) - cpu = optional(number) - memory_gb = optional(number) - storage_gb = optional(number) - } - )) + scheduler = optional(object({ + count = optional(number, 1) + cpu = optional(number, 0.5) + memory_gb = optional(number, 2) + storage_gb = optional(number, 1) + }), {}) triggerer = optional(object({ count = number cpu = number memory_gb = number })) - web_server = optional(object( - { - cpu = optional(number) - memory_gb = optional(number) - storage_gb = optional(number) - } - )) - worker = optional(object( - { - cpu = optional(number) - memory_gb = optional(number) - min_count = optional(number) - max_count = optional(number) - storage_gb = optional(number) - } - )) + web_server = optional(object({ + cpu = optional(number, 0.5) + memory_gb = optional(number, 2) + storage_gb = optional(number, 1) + }), {}) + worker = optional(object({ + cpu = optional(number, 0.5) + memory_gb = optional(number, 2) + min_count = optional(number, 1) + max_count = optional(number, 3) + storage_gb = optional(number, 1) + }), {}) })) }) default = { From 1eea077460ec93c3bc01b4aceb4372b6ba58199e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Thu, 21 Dec 2023 15:27:18 +0000 Subject: [PATCH 02/13] Add service account email to outputs to manage its permissions --- blueprints/data-solutions/composer-2/README.md | 17 +++++++++-------- blueprints/data-solutions/composer-2/outputs.tf | 5 +++++ 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/blueprints/data-solutions/composer-2/README.md b/blueprints/data-solutions/composer-2/README.md index 511dde04..2ec5c685 100644 --- a/blueprints/data-solutions/composer-2/README.md +++ b/blueprints/data-solutions/composer-2/README.md @@ -113,14 +113,14 @@ service_encryption_keys = { | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [prefix](variables.tf#L87) | Prefix used for resource names. | string | ✓ | | -| [project_id](variables.tf#L105) | Project id, references existing project if `project_create` is null. | string | ✓ | | -| [region](variables.tf#L110) | Region where instances will be deployed. | string | ✓ | | -| [composer_config](variables.tf#L17) | Composer environment configuration. It accepts only following attributes: `environment_size`, `software_config` and `workloads_config`. See [attribute reference](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/composer_environment#argument-reference---cloud-composer-2) for details on settings variables. | object({…}) | | {…} | -| [iam_bindings_additive](variables.tf#L62) | Map of Role => principal in IAM format (`group:foo@example.org`) to be added on the project. | map(list(string)) | | {} | -| [network_config](variables.tf#L69) | Shared VPC network configurations to use. If null networks will be created in projects with preconfigured values. | object({…}) | | null | -| [project_create](variables.tf#L96) | Provide values if project creation is needed, uses existing project if null. Parent is in 'folders/nnn' or 'organizations/nnn' format. | object({…}) | | null | -| [service_encryption_keys](variables.tf#L115) | Cloud KMS keys to use to encrypt resources. Provide a key for each region in use. | map(string) | | null | +| [prefix](variables.tf#L81) | Prefix used for resource names. | string | ✓ | | +| [project_id](variables.tf#L99) | Project id, references existing project if `project_create` is null. | string | ✓ | | +| [region](variables.tf#L104) | Region where instances will be deployed. | string | ✓ | | +| [composer_config](variables.tf#L17) | Composer environment configuration. It accepts only following attributes: `environment_size`, `software_config` and `workloads_config`. See [attribute reference](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/composer_environment#argument-reference---cloud-composer-2) for details on settings variables. | object({…}) | | {…} | +| [iam_bindings_additive](variables.tf#L56) | Map of Role => principal in IAM format (`group:foo@example.org`) to be added on the project. | map(list(string)) | | {} | +| [network_config](variables.tf#L63) | Shared VPC network configurations to use. If null networks will be created in projects with preconfigured values. | object({…}) | | null | +| [project_create](variables.tf#L90) | Provide values if project creation is needed, uses existing project if null. Parent is in 'folders/nnn' or 'organizations/nnn' format. | object({…}) | | null | +| [service_encryption_keys](variables.tf#L109) | Cloud KMS keys to use to encrypt resources. Provide a key for each region in use. | map(string) | | null | ## Outputs @@ -128,6 +128,7 @@ service_encryption_keys = { |---|---|:---:| | [composer_airflow_uri](outputs.tf#L17) | The URI of the Apache Airflow Web UI hosted within the Cloud Composer environment.. | | | [composer_dag_gcs](outputs.tf#L22) | The Cloud Storage prefix of the DAGs for the Cloud Composer environment. | | +| [composer_service_account](outputs.tf#L27) | Cloud Composer nodes Service Account email | | ## Test diff --git a/blueprints/data-solutions/composer-2/outputs.tf b/blueprints/data-solutions/composer-2/outputs.tf index 2b1138a6..7c681a7b 100644 --- a/blueprints/data-solutions/composer-2/outputs.tf +++ b/blueprints/data-solutions/composer-2/outputs.tf @@ -23,3 +23,8 @@ output "composer_dag_gcs" { description = "The Cloud Storage prefix of the DAGs for the Cloud Composer environment." value = google_composer_environment.env.config[0].dag_gcs_prefix } + +output "composer_service_account" { + description = " Cloud Composer nodes Service Account email" + value = module.comp-sa.email +} \ No newline at end of file From 6c258e6562c8a7237b9adb9bbe880c3d636e0078 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Thu, 28 Dec 2023 10:29:07 +0000 Subject: [PATCH 03/13] Fix description --- blueprints/data-solutions/composer-2/README.md | 2 +- blueprints/data-solutions/composer-2/outputs.tf | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/blueprints/data-solutions/composer-2/README.md b/blueprints/data-solutions/composer-2/README.md index 2ec5c685..51e49bd3 100644 --- a/blueprints/data-solutions/composer-2/README.md +++ b/blueprints/data-solutions/composer-2/README.md @@ -128,7 +128,7 @@ service_encryption_keys = { |---|---|:---:| | [composer_airflow_uri](outputs.tf#L17) | The URI of the Apache Airflow Web UI hosted within the Cloud Composer environment.. | | | [composer_dag_gcs](outputs.tf#L22) | The Cloud Storage prefix of the DAGs for the Cloud Composer environment. | | -| [composer_service_account](outputs.tf#L27) | Cloud Composer nodes Service Account email | | +| [composer_service_account](outputs.tf#L27) | Cloud Composer nodes Service Account email. | | ## Test diff --git a/blueprints/data-solutions/composer-2/outputs.tf b/blueprints/data-solutions/composer-2/outputs.tf index 7c681a7b..09a821d9 100644 --- a/blueprints/data-solutions/composer-2/outputs.tf +++ b/blueprints/data-solutions/composer-2/outputs.tf @@ -25,6 +25,6 @@ output "composer_dag_gcs" { } output "composer_service_account" { - description = " Cloud Composer nodes Service Account email" + description = "Cloud Composer nodes Service Account email." value = module.comp-sa.email -} \ No newline at end of file +} From 29b615e20dd894f173760098f7f8e79f6f33dd42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Sat, 30 Dec 2023 09:09:10 +0100 Subject: [PATCH 04/13] Add version check to tools/lint.sh (#1955) --- tools/lint.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/lint.sh b/tools/lint.sh index a24ce779..573a4c46 100755 --- a/tools/lint.sh +++ b/tools/lint.sh @@ -39,3 +39,6 @@ yapf --style="{based_on_style: google, indent_width: 2, SPLIT_BEFORE_NAMED_ASSIG echo -- Blueprint metadata -- python3 tools/validate_metadata.py -v blueprints --verbose --failed-only + +echo -- Version checks -- +find . -type f -name 'versions.tf' -exec diff -ub default-versions.tf {} \; From 22e9e9e9501f716ef718b6945b50ad235ed1a46c Mon Sep 17 00:00:00 2001 From: Jason Steenblik Date: Fri, 5 Jan 2024 09:29:36 +0100 Subject: [PATCH 05/13] Support CMEK encryption on Bigtable instances. (#1956) --- modules/bigtable-instance/README.md | 11 ++++++----- modules/bigtable-instance/main.tf | 1 + modules/bigtable-instance/variables.tf | 6 ++++++ 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/modules/bigtable-instance/README.md b/modules/bigtable-instance/README.md index 05dcbdde..42ad0975 100644 --- a/modules/bigtable-instance/README.md +++ b/modules/bigtable-instance/README.md @@ -230,15 +230,16 @@ module "bigtable-instance" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [clusters](variables.tf#L17) | Clusters to be created in the BigTable instance. Set more than one cluster to enable replication. If you set autoscaling, num_nodes will be ignored. | map(object({…})) | ✓ | | -| [name](variables.tf#L81) | The name of the Cloud Bigtable instance. | string | ✓ | | -| [project_id](variables.tf#L86) | Id of the project where datasets will be created. | string | ✓ | | +| [name](variables.tf#L87) | The name of the Cloud Bigtable instance. | string | ✓ | | +| [project_id](variables.tf#L92) | Id of the project where datasets will be created. | string | ✓ | | | [default_autoscaling](variables.tf#L33) | Default settings for autoscaling of clusters. This will be the default autoscaling for any cluster not specifying any autoscaling details. | object({…}) | | null | | [default_gc_policy](variables.tf#L44) | Default garbage collection policy, to be applied to all column families and all tables. Can be override in the tables variable for specific column families. | object({…}) | | null | | [deletion_protection](variables.tf#L56) | Whether or not to allow Terraform to destroy the instance. Unless this field is set to false in Terraform state, a terraform destroy or terraform apply that would delete the instance will fail. | bool | | true | | [display_name](variables.tf#L63) | The human-readable display name of the Bigtable instance. | string | | null | -| [iam](variables.tf#L69) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | -| [labels](variables.tf#L75) | Labels to be attached to the instance. | map(string) | | {} | -| [tables](variables.tf#L91) | Tables to be created in the BigTable instance. | map(object({…})) | | {} | +| [encryption_key](variables.tf#L69) | The KMS key id to used for encryption of the Bigtable instance. | string | | null | +| [iam](variables.tf#L75) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | +| [labels](variables.tf#L81) | Labels to be attached to the instance. | map(string) | | {} | +| [tables](variables.tf#L97) | Tables to be created in the BigTable instance. | map(object({…})) | | {} | ## Outputs diff --git a/modules/bigtable-instance/main.tf b/modules/bigtable-instance/main.tf index 309bbb1a..3aafaf26 100644 --- a/modules/bigtable-instance/main.tf +++ b/modules/bigtable-instance/main.tf @@ -49,6 +49,7 @@ resource "google_bigtable_instance" "default" { zone = cluster.value.zone storage_type = cluster.value.storage_type num_nodes = cluster.value.num_nodes + kms_key_name = var.encryption_key dynamic "autoscaling_config" { for_each = cluster.value.autoscaling == null ? [] : [""] diff --git a/modules/bigtable-instance/variables.tf b/modules/bigtable-instance/variables.tf index 132d5c2c..ca1fbb0e 100644 --- a/modules/bigtable-instance/variables.tf +++ b/modules/bigtable-instance/variables.tf @@ -66,6 +66,12 @@ variable "display_name" { default = null } +variable "encryption_key" { + description = "The KMS key id to used for encryption of the Bigtable instance." + type = string + default = null +} + variable "iam" { description = "IAM bindings for topic in {ROLE => [MEMBERS]} format." type = map(list(string)) From 3edacd0aba39add2d5066efea09c26341af04171 Mon Sep 17 00:00:00 2001 From: Andy Bubune Amewuda Date: Thu, 4 Jan 2024 22:47:32 +0100 Subject: [PATCH 06/13] Add e2e test for net_lb_app_ext module --- modules/net-lb-app-ext/README.md | 196 ++++++------ .../examples/classic-vs-non-classic.yaml | 105 +++++++ .../examples/complex-example.yaml | 294 ++++++++++++++++++ .../examples/health-check-1.yaml | 104 +++++++ .../examples/health-check-2.yaml | 84 +++++ .../examples/http-backends.yaml | 120 +++++++ .../examples/http-https-redirect.yaml | 169 ++++++++++ .../examples/https-backends.yaml | 119 +++++++ .../net_lb_app_ext/examples/hybrid-neg.yaml | 128 ++++++++ .../examples/instance-groups.yaml | 118 +++++++ .../net_lb_app_ext/examples/internet-neg.yaml | 101 ++++++ .../examples/managed-instance-groups.yaml | 106 +++++++ .../net_lb_app_ext/examples/minimal-http.yaml | 105 +++++++ .../examples/network-endpoint-groups.yaml | 119 +++++++ .../examples/serverless-neg.yaml | 102 ++++++ .../examples/ssl-certificates.yaml | 146 +++++++++ .../net_lb_app_ext/examples/storage.yaml | 67 ++++ .../net_lb_app_ext/examples/url-map.yaml | 144 +++++++++ .../examples/zonal-neg-creation.yaml | 129 ++++++++ 19 files changed, 2364 insertions(+), 92 deletions(-) create mode 100644 tests/modules/net_lb_app_ext/examples/classic-vs-non-classic.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/complex-example.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/health-check-1.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/health-check-2.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/http-backends.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/http-https-redirect.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/https-backends.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/hybrid-neg.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/instance-groups.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/internet-neg.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/managed-instance-groups.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/minimal-http.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/network-endpoint-groups.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/serverless-neg.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/ssl-certificates.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/storage.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/url-map.yaml create mode 100644 tests/modules/net_lb_app_ext/examples/zonal-neg-creation.yaml diff --git a/modules/net-lb-app-ext/README.md b/modules/net-lb-app-ext/README.md index 606076a8..c4f84868 100644 --- a/modules/net-lb-app-ext/README.md +++ b/modules/net-lb-app-ext/README.md @@ -52,7 +52,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-ab.tf e2e +# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-ab.tf inventory=minimal-http.yaml e2e ``` ### Minimal HTTPS examples @@ -64,13 +64,13 @@ An HTTPS load balancer needs a certificate and backends can be HTTP or HTTPS. TH ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { backends = [ - { backend = "projects/myprj/zones/europe-west8-b/instanceGroups/myig-b" }, - { backend = "projects/myprj/zones/europe-west8-c/instanceGroups/myig-c" }, + { backend = module.compute-mig-a.group.id }, + { backend = module.compute-mig-b.group.id }, ] protocol = "HTTP" } @@ -84,7 +84,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=6 +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-ab.tf inventory=http-backends.yaml e2e ``` #### HTTPS backends @@ -94,13 +94,13 @@ For HTTPS backends the backend service protocol needs to be set to `HTTPS`. The ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { backends = [ - { backend = "projects/myprj/zones/europe-west8-b/instanceGroups/myig-b" }, - { backend = "projects/myprj/zones/europe-west8-c/instanceGroups/myig-c" }, + { backend = module.compute-mig-a.group.id }, + { backend = module.compute-mig-b.group.id }, ] protocol = "HTTPS" } @@ -121,7 +121,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=6 +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-ab.tf inventory=https-backends.yaml e2e ``` #### HTTP to HTTPS redirect @@ -131,7 +131,7 @@ Redirect is implemented via an additional HTTP load balancer with a custom URL m ```hcl module "addresses" { source = "./fabric/modules/net-address" - project_id = "myprj" + project_id = var.project_id global_addresses = { "glb-test-0" = {} } @@ -139,7 +139,7 @@ module "addresses" { module "glb-test-0-redirect" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0-redirect" address = ( module.addresses.global_addresses["glb-test-0"].address @@ -156,7 +156,7 @@ module "glb-test-0-redirect" { module "glb-test-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" use_classic_version = false address = ( @@ -165,7 +165,7 @@ module "glb-test-0" { backend_service_configs = { default = { backends = [ - { backend = "projects/myprj/zones/europe-west8-b/instanceGroups/myig-b" }, + { backend = module.compute-mig-b.group.id }, ] protocol = "HTTP" } @@ -180,7 +180,7 @@ module "glb-test-0" { } } -# tftest modules=3 resources=10 +# tftest modules=5 resources=14 fixtures=fixtures/compute-mig-ab.tf inventory=http-https-redirect.yaml e2e ``` ### Classic vs Non-classic @@ -190,19 +190,19 @@ The module uses a classic Global Load Balancer by default. To use the non-classi ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" use_classic_version = false backend_service_configs = { default = { backends = [ - { backend = "projects/myprj/zones/europe-west8-b/instanceGroups/myig-b" }, - { backend = "projects/myprj/zones/europe-west8-c/instanceGroups/myig-c" }, + { backend = module.compute-mig-a.group.id }, + { backend = module.compute-mig-b.group.id }, ] } } } -# tftest modules=1 resources=5 +# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-ab.tf inventory=classic-vs-non-classic.yaml e2e ``` ### Health Checks @@ -221,7 +221,7 @@ module "glb-0" { backend_service_configs = { default = { backends = [{ - backend = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig" + backend = module.compute-mig-a.group.id }] # no need to reference the hc explicitly when using the `default` key # health_checks = ["default"] @@ -233,7 +233,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=5 +# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-ab.tf inventory=health-check-1.yaml e2e ``` To leverage existing health checks without having the module create them, simply pass their self links to backend services and set the `health_check_configs` variable to an empty map: @@ -246,14 +246,14 @@ module "glb-0" { backend_service_configs = { default = { backends = [{ - backend = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig" + backend = module.compute-mig-b.group.id }] - health_checks = ["projects/myprj/global/healthChecks/custom"] + health_checks = ["projects/${var.project_id}/global/healthChecks/custom"] } } health_check_configs = {} } -# tftest modules=1 resources=4 +# tftest modules=3 resources=8 fixtures=fixtures/compute-mig-ab.tf inventory=health-check-2.yaml ``` ### Backend Types and Management @@ -265,7 +265,7 @@ The module can optionally create unmanaged instance groups, which can then be re ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { @@ -276,15 +276,15 @@ module "glb-0" { } group_configs = { default-b = { - zone = "europe-west8-b" + zone = "${var.region}-b" instances = [ - "projects/myprj/zones/europe-west8-b/instances/vm-a" + "${module.compute-mig-b.id}" ] named_ports = { http = 80 } } } } -# tftest modules=1 resources=6 +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-ab.tf inventory=instance-groups.yaml e2e ``` #### Managed Instance Groups @@ -294,8 +294,8 @@ This example shows how to use the module with a manage instance group as backend ```hcl module "win-template" { source = "./fabric/modules/compute-vm" - project_id = "myprj" - zone = "europe-west8-a" + project_id = var.project_id + zone = "${var.region}-a" name = "win-template" instance_type = "n2d-standard-2" create_template = true @@ -315,8 +315,8 @@ module "win-template" { module "win-mig" { source = "./fabric/modules/compute-mig" - project_id = "myprj" - location = "europe-west8-a" + project_id = var.project_id + location = "${var.region}-a" name = "win-mig" instance_template = module.win-template.template.self_link autoscaler_config = { @@ -336,7 +336,7 @@ module "win-mig" { module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { @@ -346,7 +346,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=8 +# tftest modules=3 resources=8 inventory=managed-instance-groups.yaml e2e ``` #### Storage Buckets @@ -356,17 +356,17 @@ GCS bucket backends can also be managed and used in this module in a similar way ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_buckets_config = { default = { - bucket_name = "tf-playground-svpc-gce-public" + bucket_name = var.bucket } } # with a single GCS backend the implied default health check is not needed health_check_configs = {} } -# tftest modules=1 resources=4 +# tftest modules=1 resources=4 inventory=storage.yaml e2e ``` #### Network Endpoint Groups (NEGs) @@ -376,21 +376,31 @@ Supported Network Endpoint Groups (NEGs) can also be used as backends. Similarly ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { backends = [ { - backend = "projects/myprj/zones/europe-west8-b/networkEndpointGroups/myneg-b" + backend = "myneg-b" balancing_mode = "RATE" max_rate = { per_endpoint = 10 } } ] } } + neg_configs = { + myneg-b = { + hybrid = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + zone = "${var.region}-b" + endpoints = {} + } + } + } } -# tftest modules=1 resources=5 +# tftest modules=1 resources=6 inventory=network-endpoint-groups.yaml e2e ``` #### Zonal NEG creation @@ -400,7 +410,7 @@ This example shows how to create and manage zonal NEGs using GCE VMs as endpoint ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { @@ -416,13 +426,13 @@ module "glb-0" { neg_configs = { neg-0 = { gce = { - network = "projects/myprj-host/global/networks/svpc" - subnetwork = "projects/myprj-host/regions/europe-west8/subnetworks/gce" - zone = "europe-west8-b" + network = var.vpc.self_link + subnetwork = var.subnet.self_link + zone = "${var.region}-b" endpoints = { e-0 = { - instance = "myinstance-b-0" - ip_address = "10.24.32.25" + instance = "my-ig-b" + ip_address = "${module.compute-mig-b.internal_ip}" port = 80 } } @@ -430,7 +440,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=7 +# tftest modules=3 resources=11 fixtures=fixtures/compute-mig-ab.tf inventory=zonal-neg-creation.yaml e2e ``` #### Hybrid NEG creation @@ -440,7 +450,7 @@ This example shows how to create and manage hybrid NEGs: ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { @@ -456,8 +466,8 @@ module "glb-0" { neg_configs = { neg-0 = { hybrid = { - network = "projects/myprj-host/global/networks/svpc" - zone = "europe-west8-b" + network = var.vpc.self_link + zone = "${var.region}-b" endpoints = { e-0 = { ip_address = "10.0.0.10" @@ -468,7 +478,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=7 +# tftest modules=1 resources=7 inventory=hybrid-neg.yaml e2e ``` #### Internet NEG creation @@ -478,7 +488,7 @@ This example shows how to create and manage internet NEGs: ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { @@ -504,7 +514,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=6 +# tftest modules=1 resources=6 inventory=internet-neg.yaml e2e ``` #### Private Service Connect NEG creation @@ -514,7 +524,7 @@ The module supports managing PSC NEGs if the non-classic version of the load bal ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" use_classic_version = false backend_service_configs = { @@ -530,13 +540,13 @@ module "glb-0" { neg_configs = { neg-0 = { psc = { - region = "europe-west8" - target_service = "europe-west8-cloudkms.googleapis.com" + region = var.region + target_service = "${var.region}-cloudkms.googleapis.com" } } } } -# tftest modules=1 resources=5 +# tftest modules=1 resources=5 ``` #### Serverless NEG creation @@ -546,7 +556,7 @@ The module supports managing Serverless NEGs for Cloud Run and Cloud Function. T ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { @@ -561,7 +571,7 @@ module "glb-0" { neg_configs = { neg-0 = { cloudrun = { - region = "europe-west8" + region = var.region target_service = { name = "hello" } @@ -569,7 +579,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=5 +# tftest modules=1 resources=5 inventory=serverless-neg.yaml e2e ``` Serverless NEGs don't use the port name but it should be set to `http`. An HTTPS frontend requires the protocol to be set to `HTTPS`, and the port name field will infer this value if omitted so you need to set it explicitly: @@ -577,7 +587,7 @@ Serverless NEGs don't use the port name but it should be set to `http`. An HTTPS ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { @@ -593,7 +603,7 @@ module "glb-0" { neg_configs = { neg-0 = { cloudrun = { - region = "europe-west8" + region = var.region target_service = { name = "hello" } @@ -609,7 +619,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=6 inventory=https-sneg.yaml +# tftest modules=1 resources=6 inventory=https-sneg.yaml e2e ``` ### URL Map @@ -621,17 +631,17 @@ The default URL map configuration sets the `default` backend service as the defa ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { backends = [{ - backend = "projects/myprj/zones/europe-west8-b/instanceGroups/ig-0" + backend = module.compute-mig-a.group.id }] } other = { backends = [{ - backend = "projects/myprj/zones/europe-west8-c/instanceGroups/ig-1" + backend = module.compute-mig-b.group.id }] } } @@ -653,7 +663,7 @@ module "glb-0" { } } -# tftest modules=1 resources=6 +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-ab.tf inventory=url-map.yaml e2e ``` ### SSL Certificates @@ -665,7 +675,7 @@ THe [HTTPS example above](#minimal-https-examples) shows how to configure manage ```hcl resource "tls_private_key" "default" { algorithm = "RSA" - rsa_bits = 4096 + rsa_bits = 2048 } resource "tls_self_signed_cert" "default" { @@ -684,13 +694,13 @@ resource "tls_self_signed_cert" "default" { module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_service_configs = { default = { backends = [ - { backend = "projects/myprj/zones/europe-west8-b/instanceGroups/myig-b" }, - { backend = "projects/myprj/zones/europe-west8-c/instanceGroups/myig-c" }, + { backend = module.compute-mig-a.group.id }, + { backend = module.compute-mig-b.group.id }, ] protocol = "HTTP" } @@ -706,7 +716,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=8 +# tftest modules=3 resources=12 fixtures=fixtures/compute-mig-ab.tf inventory=ssl-certificates.yaml e2e ``` ### Complex example @@ -716,47 +726,49 @@ This example mixes group and NEG backends, and shows how to set HTTPS for specif ```hcl module "glb-0" { source = "./fabric/modules/net-lb-app-ext" - project_id = "myprj" + project_id = var.project_id name = "glb-test-0" backend_buckets_config = { gcs-0 = { - bucket_name = "my-bucket" + bucket_name = var.bucket } } backend_service_configs = { default = { backends = [ - { backend = "ew8-b" }, - { backend = "ew8-c" }, + { backend = "ew4-a" }, + { backend = "ew4-b" }, ] } neg-gce-0 = { backends = [{ balancing_mode = "RATE" - backend = "neg-ew8-c" + backend = "neg-ew4-b" max_rate = { per_endpoint = 10 } }] } neg-hybrid-0 = { backends = [{ - backend = "neg-hello" + balancing_mode = "RATE" + backend = "neg-hello" + max_rate = { per_endpoint = 10 } }] health_checks = ["neg"] protocol = "HTTPS" } } group_configs = { - ew8-b = { - zone = "europe-west8-b" + ew4-a = { + zone = "${var.region}-a" instances = [ - "projects/prj-gce/zones/europe-west8-b/instances/nginx-ew8-b" + "${module.compute-mig-a.id}" ] named_ports = { http = 80 } } - ew8-c = { - zone = "europe-west8-c" + ew4-b = { + zone = "${var.region}-b" instances = [ - "projects/prj-gce/zones/europe-west8-c/instances/nginx-ew8-c" + "${module.compute-mig-b.id}" ] named_ports = { http = 80 } } @@ -775,15 +787,15 @@ module "glb-0" { } } neg_configs = { - neg-ew8-c = { + neg-ew4-b = { gce = { - network = "projects/myprj-host/global/networks/svpc" - subnetwork = "projects/myprj-host/regions/europe-west8/subnetworks/gce" - zone = "europe-west8-c" + network = var.vpc.self_link + subnetwork = var.subnet.self_link + zone = "${var.region}-b" endpoints = { e-0 = { - instance = "nginx-ew8-c" - ip_address = "10.24.32.26" + instance = "my-ig-b" + ip_address = "${module.compute-mig-b.internal_ip}" port = 80 } } @@ -791,8 +803,8 @@ module "glb-0" { } neg-hello = { hybrid = { - network = "projects/myprj-host/global/networks/svpc" - zone = "europe-west8-b" + network = var.vpc.self_link + zone = "${var.region}-b" endpoints = { e-0 = { ip_address = "192.168.0.3" @@ -837,7 +849,7 @@ module "glb-0" { } } } -# tftest modules=1 resources=15 +# tftest modules=3 resources=19 fixtures=fixtures/compute-mig-ab.tf inventory=complex-example.yaml e2e ``` diff --git a/tests/modules/net_lb_app_ext/examples/classic-vs-non-classic.yaml b/tests/modules/net_lb_app_ext/examples/classic-vs-non-classic.yaml new file mode 100644 index 00000000..038f4d89 --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/classic-vs-non-classic.yaml @@ -0,0 +1,105 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL_MANAGED + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL_MANAGED + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 9 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/complex-example.yaml b/tests/modules/net_lb_app_ext/examples/complex-example.yaml new file mode 100644 index 00000000..dc0aa07a --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/complex-example.yaml @@ -0,0 +1,294 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_bucket.default["gcs-0"]: + bucket_name: bucket + compression_mode: null + custom_response_headers: null + description: null + edge_security_policy: null + enable_cdn: null + name: glb-test-0-gcs-0 + project: project-id + timeouts: null + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: UTILIZATION + capacity_scaler: 1 + description: Terraform managed. + - balancing_mode: UTILIZATION + capacity_scaler: 1 + description: Terraform managed. + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_backend_service.default["neg-gce-0"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: RATE + capacity_scaler: 1 + description: Terraform managed. + max_rate_per_endpoint: 10 + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-neg-gce-0 + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_backend_service.default["neg-hybrid-0"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: RATE + capacity_scaler: 1 + description: Terraform managed. + max_rate_per_endpoint: 10 + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-neg-hybrid-0 + outlier_detection: [] + port_name: https + project: project-id + protocol: HTTPS + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: 80 + port_name: null + port_specification: null + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_health_check.default["neg"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: [] + https_health_check: + - host: hello.example.com + port: 443 + port_name: null + port_specification: null + proxy_header: NONE + request_path: / + response: null + name: glb-test-0-neg + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_instance_group.default["ew4-a"]: + description: Terraform managed. + name: glb-test-0-ew4-a + named_port: + - name: http + port: 80 + project: project-id + timeouts: null + zone: europe-west8-a + module.glb-0.google_compute_instance_group.default["ew4-b"]: + description: Terraform managed. + name: glb-test-0-ew4-b + named_port: + - name: http + port: 80 + project: project-id + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_network_endpoint.default["neg-ew4-b-e-0"]: + instance: my-ig-b + network_endpoint_group: glb-test-0-neg-ew4-b + port: 80 + project: project-id + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_network_endpoint.default["neg-hello-e-0"]: + instance: null + ip_address: 192.168.0.3 + network_endpoint_group: glb-test-0-neg-hello + port: 443 + project: project-id + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_network_endpoint_group.default["neg-ew4-b"]: + default_port: null + description: Terraform managed. + name: glb-test-0-neg-ew4-b + network: projects/xxx/global/networks/aaa + network_endpoint_type: GCE_VM_IP_PORT + project: project-id + subnetwork: subnet_self_link + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_network_endpoint_group.default["neg-hello"]: + default_port: null + description: Terraform managed. + name: glb-test-0-neg-hello + network: projects/xxx/global/networks/aaa + network_endpoint_type: NON_GCP_PRIVATE_IP_PORT + project: project-id + subnetwork: null + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: + - description: '' + hosts: + - '*' + path_matcher: gce + - description: '' + hosts: + - hello.example.com + path_matcher: hello + - description: '' + hosts: + - static.example.com + path_matcher: static + name: glb-test-0 + path_matcher: + - default_route_action: [] + default_url_redirect: [] + description: null + header_action: [] + name: gce + path_rule: + - paths: + - /gce-neg + - /gce-neg/* + route_action: [] + url_redirect: [] + route_rules: [] + - default_route_action: [] + default_url_redirect: [] + description: null + header_action: [] + name: hello + path_rule: [] + route_rules: [] + - default_route_action: [] + default_url_redirect: [] + description: null + header_action: [] + name: static + path_rule: [] + route_rules: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_bucket: 1 + google_compute_backend_service: 3 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 2 + google_compute_instance: 2 + google_compute_instance_group: 4 + google_compute_network_endpoint: 2 + google_compute_network_endpoint_group: 2 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 19 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/health-check-1.yaml b/tests/modules/net_lb_app_ext/examples/health-check-1.yaml new file mode 100644 index 00000000..32484b3c --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/health-check-1.yaml @@ -0,0 +1,104 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: [] + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: + - port: 80 + port_name: null + port_specification: null + proxy_header: NONE + request: null + response: null + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 9 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/health-check-2.yaml b/tests/modules/net_lb_app_ext/examples/health-check-2.yaml new file mode 100644 index 00000000..c263956b --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/health-check-2.yaml @@ -0,0 +1,84 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + health_checks: + - projects/project-id/global/healthChecks/custom + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 8 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/http-backends.yaml b/tests/modules/net_lb_app_ext/examples/http-backends.yaml new file mode 100644 index 00000000..7375d3b3 --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/http-backends.yaml @@ -0,0 +1,120 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '443' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_managed_ssl_certificate.default["default"]: + description: null + managed: + - domains: + - glb-test-0.example.org + name: glb-test-0-default + project: project-id + timeouts: null + type: MANAGED + module.glb-0.google_compute_target_https_proxy.default[0]: + certificate_manager_certificates: null + certificate_map: null + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + quic_override: NONE + server_tls_policy: null + ssl_policy: null + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_managed_ssl_certificate: 1 + google_compute_target_https_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 10 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/http-https-redirect.yaml b/tests/modules/net_lb_app_ext/examples/http-https-redirect.yaml new file mode 100644 index 00000000..1ee6aa92 --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/http-https-redirect.yaml @@ -0,0 +1,169 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.addresses.google_compute_global_address.global["glb-test-0"]: + address_type: null + description: Terraform managed. + ip_version: null + name: glb-test-0 + network: null + project: project-id + purpose: null + timeouts: null + module.glb-test-0-redirect.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0-redirect + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-test-0-redirect.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0-redirect + project: project-id + timeouts: null + module.glb-test-0-redirect.google_compute_url_map.default: + default_route_action: [] + default_service: null + default_url_redirect: + - host_redirect: null + https_redirect: true + path_redirect: null + prefix_redirect: null + redirect_response_code: MOVED_PERMANENTLY_DEFAULT + strip_query: false + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0-redirect + path_matcher: [] + project: project-id + test: [] + timeouts: null + module.glb-test-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL_MANAGED + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-test-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL_MANAGED + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '443' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-test-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-test-0.google_compute_managed_ssl_certificate.default["default"]: + description: null + managed: + - domains: + - glb-test.example.com + name: glb-test-0-default + project: project-id + timeouts: null + type: MANAGED + module.glb-test-0.google_compute_target_https_proxy.default[0]: + certificate_manager_certificates: null + certificate_map: null + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + quic_override: NONE + server_tls_policy: null + ssl_policy: null + timeouts: null + module.glb-test-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_address: 1 + google_compute_global_forwarding_rule: 2 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_managed_ssl_certificate: 1 + google_compute_target_http_proxy: 1 + google_compute_target_https_proxy: 1 + google_compute_url_map: 2 + modules: 5 + resources: 14 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/https-backends.yaml b/tests/modules/net_lb_app_ext/examples/https-backends.yaml new file mode 100644 index 00000000..b370e123 --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/https-backends.yaml @@ -0,0 +1,119 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: https + project: project-id + protocol: HTTPS + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '443' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: [] + https_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_managed_ssl_certificate.default["default"]: + description: null + managed: + - domains: + - glb-test-0.example.org + name: glb-test-0-default + project: project-id + timeouts: null + type: MANAGED + module.glb-0.google_compute_target_https_proxy.default[0]: + certificate_manager_certificates: null + certificate_map: null + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + quic_override: NONE + server_tls_policy: null + ssl_policy: null + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_managed_ssl_certificate: 1 + google_compute_target_https_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 10 + +outputs: {} diff --git a/tests/modules/net_lb_app_ext/examples/hybrid-neg.yaml b/tests/modules/net_lb_app_ext/examples/hybrid-neg.yaml new file mode 100644 index 00000000..83bc38eb --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/hybrid-neg.yaml @@ -0,0 +1,128 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: RATE + capacity_scaler: 1 + description: Terraform managed. + max_rate_per_endpoint: 10 + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_network_endpoint.default["neg-0-e-0"]: + instance: null + ip_address: 10.0.0.10 + network_endpoint_group: glb-test-0-neg-0 + port: 80 + project: project-id + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_network_endpoint_group.default["neg-0"]: + default_port: null + description: Terraform managed. + name: glb-test-0-neg-0 + network: projects/xxx/global/networks/aaa + network_endpoint_type: NON_GCP_PRIVATE_IP_PORT + project: project-id + subnetwork: null + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_network_endpoint: 1 + google_compute_network_endpoint_group: 1 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 1 + resources: 7 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/instance-groups.yaml b/tests/modules/net_lb_app_ext/examples/instance-groups.yaml new file mode 100644 index 00000000..7693ddb9 --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/instance-groups.yaml @@ -0,0 +1,118 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: UTILIZATION + capacity_scaler: 1 + description: Terraform managed. + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_instance_group.default["default-b"]: + description: Terraform managed. + name: glb-test-0-default-b + named_port: + - name: http + port: 80 + project: project-id + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 3 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 10 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/internet-neg.yaml b/tests/modules/net_lb_app_ext/examples/internet-neg.yaml new file mode 100644 index 00000000..fa9e45e2 --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/internet-neg.yaml @@ -0,0 +1,101 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: UTILIZATION + capacity_scaler: 1 + description: Terraform managed. + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + health_checks: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_global_network_endpoint.default["neg-0-e-0"]: + fqdn: www.example.org + global_network_endpoint_group: glb-test-0-neg-0 + ip_address: null + port: 80 + project: project-id + timeouts: null + module.glb-0.google_compute_global_network_endpoint_group.default["neg-0"]: + default_port: null + description: Terraform managed. + name: glb-test-0-neg-0 + network_endpoint_type: INTERNET_FQDN_PORT + project: project-id + timeouts: null + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_global_network_endpoint: 1 + google_compute_global_network_endpoint_group: 1 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 1 + resources: 6 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/managed-instance-groups.yaml b/tests/modules/net_lb_app_ext/examples/managed-instance-groups.yaml new file mode 100644 index 00000000..e4fd360d --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/managed-instance-groups.yaml @@ -0,0 +1,106 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_autoscaler: 1 + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance_group_manager: 1 + google_compute_instance_template: 1 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 8 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/minimal-http.yaml b/tests/modules/net_lb_app_ext/examples/minimal-http.yaml new file mode 100644 index 00000000..770eaa5e --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/minimal-http.yaml @@ -0,0 +1,105 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 9 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/network-endpoint-groups.yaml b/tests/modules/net_lb_app_ext/examples/network-endpoint-groups.yaml new file mode 100644 index 00000000..9900a57f --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/network-endpoint-groups.yaml @@ -0,0 +1,119 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: RATE + capacity_scaler: 1 + description: Terraform managed. + max_rate_per_endpoint: 10 + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_network_endpoint_group.default["myneg-b"]: + default_port: null + description: Terraform managed. + name: glb-test-0-myneg-b + network: projects/xxx/global/networks/aaa + network_endpoint_type: NON_GCP_PRIVATE_IP_PORT + project: project-id + subnetwork: null + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_network_endpoint_group: 1 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 1 + resources: 6 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/serverless-neg.yaml b/tests/modules/net_lb_app_ext/examples/serverless-neg.yaml new file mode 100644 index 00000000..8fc37a36 --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/serverless-neg.yaml @@ -0,0 +1,102 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: UTILIZATION + capacity_scaler: 1 + description: Terraform managed. + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + health_checks: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_region_network_endpoint_group.serverless["neg-0"]: + app_engine: [] + cloud_function: [] + cloud_run: + - service: hello + tag: null + url_mask: null + description: Terraform managed. + name: glb-test-0-neg-0 + network: null + network_endpoint_type: SERVERLESS + project: project-id + psc_target_service: null + region: europe-west8 + subnetwork: null + timeouts: null + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_region_network_endpoint_group: 1 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 1 + resources: 5 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/ssl-certificates.yaml b/tests/modules/net_lb_app_ext/examples/ssl-certificates.yaml new file mode 100644 index 00000000..111ca9a6 --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/ssl-certificates.yaml @@ -0,0 +1,146 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '443' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_ssl_certificate.default["default"]: + description: null + name: glb-test-0-default + project: project-id + timeouts: null + module.glb-0.google_compute_target_https_proxy.default[0]: + certificate_manager_certificates: null + certificate_map: null + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + quic_override: NONE + server_tls_policy: null + ssl_policy: null + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + tls_private_key.default: + algorithm: RSA + ecdsa_curve: P224 + rsa_bits: 2048 + tls_self_signed_cert.default: + allowed_uses: + - key_encipherment + - digital_signature + - server_auth + dns_names: null + early_renewal_hours: 0 + ip_addresses: null + is_ca_certificate: false + ready_for_renewal: false + set_authority_key_id: false + set_subject_key_id: false + subject: + - common_name: example.com + country: null + locality: null + organization: ACME Examples, Inc + organizational_unit: null + postal_code: null + province: null + serial_number: null + street_address: null + uris: null + validity_period_hours: 720 + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_ssl_certificate: 1 + google_compute_target_https_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 12 + tls_private_key: 1 + tls_self_signed_cert: 1 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/storage.yaml b/tests/modules/net_lb_app_ext/examples/storage.yaml new file mode 100644 index 00000000..6307478b --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/storage.yaml @@ -0,0 +1,67 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_bucket.default["default"]: + bucket_name: bucket + compression_mode: null + custom_response_headers: null + description: null + edge_security_policy: null + enable_cdn: null + name: glb-test-0-default + project: project-id + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_bucket: 1 + google_compute_global_forwarding_rule: 1 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 1 + resources: 4 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/url-map.yaml b/tests/modules/net_lb_app_ext/examples/url-map.yaml new file mode 100644 index 00000000..bf61105e --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/url-map.yaml @@ -0,0 +1,144 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_backend_service.default["other"]: + affinity_cookie_ttl_sec: null + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-other + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: + - description: '' + hosts: + - '*' + path_matcher: pathmap + name: glb-test-0 + path_matcher: + - default_route_action: [] + default_url_redirect: [] + description: null + header_action: [] + name: pathmap + path_rule: + - paths: + - /other + - /other/* + route_action: [] + url_redirect: [] + route_rules: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 2 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 10 + +outputs: {} + diff --git a/tests/modules/net_lb_app_ext/examples/zonal-neg-creation.yaml b/tests/modules/net_lb_app_ext/examples/zonal-neg-creation.yaml new file mode 100644 index 00000000..04c1807d --- /dev/null +++ b/tests/modules/net_lb_app_ext/examples/zonal-neg-creation.yaml @@ -0,0 +1,129 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.glb-0.google_compute_backend_service.default["default"]: + affinity_cookie_ttl_sec: null + backend: + - balancing_mode: RATE + capacity_scaler: 1 + description: Terraform managed. + max_rate_per_endpoint: 10 + circuit_breakers: [] + compression_mode: null + connection_draining_timeout_sec: 300 + consistent_hash: [] + custom_request_headers: null + custom_response_headers: null + description: Terraform managed. + edge_security_policy: null + enable_cdn: null + iap: [] + load_balancing_scheme: EXTERNAL + locality_lb_policies: [] + locality_lb_policy: null + name: glb-test-0-default + outlier_detection: [] + port_name: http + project: project-id + protocol: HTTP + security_policy: null + security_settings: [] + timeouts: null + module.glb-0.google_compute_global_forwarding_rule.default: + allow_psc_global_access: null + description: Terraform managed. + ip_protocol: TCP + ip_version: null + labels: null + load_balancing_scheme: EXTERNAL + metadata_filters: [] + name: glb-test-0 + no_automate_dns_zone: null + port_range: '80' + project: project-id + source_ip_ranges: null + timeouts: null + module.glb-0.google_compute_health_check.default["default"]: + check_interval_sec: 5 + description: Terraform managed. + grpc_health_check: [] + healthy_threshold: 2 + http2_health_check: [] + http_health_check: + - host: null + port: null + port_name: null + port_specification: USE_SERVING_PORT + proxy_header: NONE + request_path: / + response: null + https_health_check: [] + name: glb-test-0-default + project: project-id + ssl_health_check: [] + tcp_health_check: [] + timeout_sec: 5 + timeouts: null + unhealthy_threshold: 2 + module.glb-0.google_compute_network_endpoint.default["neg-0-e-0"]: + instance: my-ig-b + network_endpoint_group: glb-test-0-neg-0 + port: 80 + project: project-id + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_network_endpoint_group.default["neg-0"]: + default_port: null + description: Terraform managed. + name: glb-test-0-neg-0 + network: projects/xxx/global/networks/aaa + network_endpoint_type: GCE_VM_IP_PORT + project: project-id + subnetwork: subnet_self_link + timeouts: null + zone: europe-west8-b + module.glb-0.google_compute_target_http_proxy.default[0]: + description: Terraform managed. + http_keep_alive_timeout_sec: null + name: glb-test-0 + project: project-id + timeouts: null + module.glb-0.google_compute_url_map.default: + default_route_action: [] + default_url_redirect: [] + description: Terraform managed. + header_action: [] + host_rule: [] + name: glb-test-0 + path_matcher: [] + project: project-id + test: [] + timeouts: null + +counts: + google_compute_backend_service: 1 + google_compute_global_forwarding_rule: 1 + google_compute_health_check: 1 + google_compute_instance: 2 + google_compute_instance_group: 2 + google_compute_network_endpoint: 1 + google_compute_network_endpoint_group: 1 + google_compute_target_http_proxy: 1 + google_compute_url_map: 1 + modules: 3 + resources: 11 + +outputs: {} + From cc079e3a3251c24f5d7ef8d331282e6d8dcd82ad Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Fri, 5 Jan 2024 14:38:30 +0100 Subject: [PATCH 07/13] net-lb-app-ext example fixes (#1959) * Fix typos * Small fixes net-lb-app-ext examples --- modules/net-lb-app-ext/README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/net-lb-app-ext/README.md b/modules/net-lb-app-ext/README.md index c4f84868..ff515926 100644 --- a/modules/net-lb-app-ext/README.md +++ b/modules/net-lb-app-ext/README.md @@ -59,7 +59,7 @@ module "glb-0" { #### HTTP backends -An HTTPS load balancer needs a certificate and backends can be HTTP or HTTPS. THis is an example With HTTP backends and a managed certificate: +An HTTPS load balancer needs a certificate and backends can be HTTP or HTTPS. This is an example With HTTP backends and a managed certificate: ```hcl module "glb-0" { @@ -260,7 +260,7 @@ module "glb-0" { #### Instance Groups -The module can optionally create unmanaged instance groups, which can then be referred to in backends via their key. THis is the simple HTTP example above but with instance group creation managed by the module: +The module can optionally create unmanaged instance groups, which can then be referred to in backends via their key. This is the simple HTTP example above but with instance group creation managed by the module: ```hcl module "glb-0" { @@ -278,7 +278,7 @@ module "glb-0" { default-b = { zone = "${var.region}-b" instances = [ - "${module.compute-mig-b.id}" + module.compute-mig-b.id ] named_ports = { http = 80 } } @@ -432,7 +432,7 @@ module "glb-0" { endpoints = { e-0 = { instance = "my-ig-b" - ip_address = "${module.compute-mig-b.internal_ip}" + ip_address = module.compute-mig-b.internal_ip port = 80 } } @@ -761,14 +761,14 @@ module "glb-0" { ew4-a = { zone = "${var.region}-a" instances = [ - "${module.compute-mig-a.id}" + module.compute-mig-a.id ] named_ports = { http = 80 } } ew4-b = { zone = "${var.region}-b" instances = [ - "${module.compute-mig-b.id}" + module.compute-mig-b.id ] named_ports = { http = 80 } } @@ -795,7 +795,7 @@ module "glb-0" { endpoints = { e-0 = { instance = "my-ig-b" - ip_address = "${module.compute-mig-b.internal_ip}" + ip_address = module.compute-mig-b.internal_ip port = 80 } } From c13a192755ae394111980ea2f3c23dac1e7ff19d Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Fri, 5 Jan 2024 16:02:12 +0100 Subject: [PATCH 08/13] Use zones b and c for MIG fixture (#1961) --- modules/net-lb-app-ext/README.md | 72 +++++++++---------- .../{compute-mig-ab.tf => compute-mig-bc.tf} | 36 +++++----- .../examples/complex-example.yaml | 38 +++++----- 3 files changed, 73 insertions(+), 73 deletions(-) rename tests/fixtures/{compute-mig-ab.tf => compute-mig-bc.tf} (91%) diff --git a/modules/net-lb-app-ext/README.md b/modules/net-lb-app-ext/README.md index ff515926..bb0d7963 100644 --- a/modules/net-lb-app-ext/README.md +++ b/modules/net-lb-app-ext/README.md @@ -46,13 +46,13 @@ module "glb-0" { backend_service_configs = { default = { backends = [ - { backend = module.compute-mig-a.group.id }, { backend = module.compute-mig-b.group.id }, + { backend = module.compute-mig-c.group.id }, ] } } } -# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-ab.tf inventory=minimal-http.yaml e2e +# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-bc.tf inventory=minimal-http.yaml e2e ``` ### Minimal HTTPS examples @@ -69,8 +69,8 @@ module "glb-0" { backend_service_configs = { default = { backends = [ - { backend = module.compute-mig-a.group.id }, { backend = module.compute-mig-b.group.id }, + { backend = module.compute-mig-c.group.id }, ] protocol = "HTTP" } @@ -84,7 +84,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-ab.tf inventory=http-backends.yaml e2e +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf inventory=http-backends.yaml e2e ``` #### HTTPS backends @@ -99,8 +99,8 @@ module "glb-0" { backend_service_configs = { default = { backends = [ - { backend = module.compute-mig-a.group.id }, { backend = module.compute-mig-b.group.id }, + { backend = module.compute-mig-c.group.id }, ] protocol = "HTTPS" } @@ -121,7 +121,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-ab.tf inventory=https-backends.yaml e2e +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf inventory=https-backends.yaml e2e ``` #### HTTP to HTTPS redirect @@ -180,7 +180,7 @@ module "glb-test-0" { } } -# tftest modules=5 resources=14 fixtures=fixtures/compute-mig-ab.tf inventory=http-https-redirect.yaml e2e +# tftest modules=5 resources=14 fixtures=fixtures/compute-mig-bc.tf inventory=http-https-redirect.yaml e2e ``` ### Classic vs Non-classic @@ -196,13 +196,13 @@ module "glb-0" { backend_service_configs = { default = { backends = [ - { backend = module.compute-mig-a.group.id }, { backend = module.compute-mig-b.group.id }, + { backend = module.compute-mig-c.group.id }, ] } } } -# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-ab.tf inventory=classic-vs-non-classic.yaml e2e +# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-bc.tf inventory=classic-vs-non-classic.yaml e2e ``` ### Health Checks @@ -221,7 +221,7 @@ module "glb-0" { backend_service_configs = { default = { backends = [{ - backend = module.compute-mig-a.group.id + backend = module.compute-mig-b.group.id }] # no need to reference the hc explicitly when using the `default` key # health_checks = ["default"] @@ -233,7 +233,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-ab.tf inventory=health-check-1.yaml e2e +# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-bc.tf inventory=health-check-1.yaml e2e ``` To leverage existing health checks without having the module create them, simply pass their self links to backend services and set the `health_check_configs` variable to an empty map: @@ -253,7 +253,7 @@ module "glb-0" { } health_check_configs = {} } -# tftest modules=3 resources=8 fixtures=fixtures/compute-mig-ab.tf inventory=health-check-2.yaml +# tftest modules=3 resources=8 fixtures=fixtures/compute-mig-bc.tf inventory=health-check-2.yaml ``` ### Backend Types and Management @@ -284,7 +284,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-ab.tf inventory=instance-groups.yaml e2e +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf inventory=instance-groups.yaml e2e ``` #### Managed Instance Groups @@ -440,7 +440,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=11 fixtures=fixtures/compute-mig-ab.tf inventory=zonal-neg-creation.yaml e2e +# tftest modules=3 resources=11 fixtures=fixtures/compute-mig-bc.tf inventory=zonal-neg-creation.yaml e2e ``` #### Hybrid NEG creation @@ -636,12 +636,12 @@ module "glb-0" { backend_service_configs = { default = { backends = [{ - backend = module.compute-mig-a.group.id + backend = module.compute-mig-b.group.id }] } other = { backends = [{ - backend = module.compute-mig-b.group.id + backend = module.compute-mig-c.group.id }] } } @@ -663,7 +663,7 @@ module "glb-0" { } } -# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-ab.tf inventory=url-map.yaml e2e +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf inventory=url-map.yaml e2e ``` ### SSL Certificates @@ -699,8 +699,8 @@ module "glb-0" { backend_service_configs = { default = { backends = [ - { backend = module.compute-mig-a.group.id }, { backend = module.compute-mig-b.group.id }, + { backend = module.compute-mig-c.group.id }, ] protocol = "HTTP" } @@ -716,7 +716,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=12 fixtures=fixtures/compute-mig-ab.tf inventory=ssl-certificates.yaml e2e +# tftest modules=3 resources=12 fixtures=fixtures/compute-mig-bc.tf inventory=ssl-certificates.yaml e2e ``` ### Complex example @@ -736,14 +736,14 @@ module "glb-0" { backend_service_configs = { default = { backends = [ - { backend = "ew4-a" }, - { backend = "ew4-b" }, + { backend = "group-zone-b" }, + { backend = "group-zone-c" }, ] } neg-gce-0 = { backends = [{ balancing_mode = "RATE" - backend = "neg-ew4-b" + backend = "neg-zone-c" max_rate = { per_endpoint = 10 } }] } @@ -758,20 +758,20 @@ module "glb-0" { } } group_configs = { - ew4-a = { - zone = "${var.region}-a" - instances = [ - module.compute-mig-a.id - ] - named_ports = { http = 80 } - } - ew4-b = { + group-zone-b = { zone = "${var.region}-b" instances = [ module.compute-mig-b.id ] named_ports = { http = 80 } } + group-zone-c = { + zone = "${var.region}-c" + instances = [ + module.compute-mig-c.id + ] + named_ports = { http = 80 } + } } health_check_configs = { default = { @@ -787,15 +787,15 @@ module "glb-0" { } } neg_configs = { - neg-ew4-b = { + neg-zone-c = { gce = { network = var.vpc.self_link subnetwork = var.subnet.self_link - zone = "${var.region}-b" + zone = "${var.region}-c" endpoints = { e-0 = { - instance = "my-ig-b" - ip_address = module.compute-mig-b.internal_ip + instance = "my-ig-c" + ip_address = module.compute-mig-c.internal_ip port = 80 } } @@ -849,7 +849,7 @@ module "glb-0" { } } } -# tftest modules=3 resources=19 fixtures=fixtures/compute-mig-ab.tf inventory=complex-example.yaml e2e +# tftest modules=3 resources=19 fixtures=fixtures/compute-mig-bc.tf inventory=complex-example.yaml e2e ``` @@ -911,5 +911,5 @@ module "glb-0" { ## Fixtures -- [compute-mig-ab.tf](../../tests/fixtures/compute-mig-ab.tf) +- [compute-mig-bc.tf](../../tests/fixtures/compute-mig-bc.tf) diff --git a/tests/fixtures/compute-mig-ab.tf b/tests/fixtures/compute-mig-bc.tf similarity index 91% rename from tests/fixtures/compute-mig-ab.tf rename to tests/fixtures/compute-mig-bc.tf index f287cad2..fbf8f311 100644 --- a/tests/fixtures/compute-mig-ab.tf +++ b/tests/fixtures/compute-mig-bc.tf @@ -1,4 +1,4 @@ -# Copyright 2023 Google LLC +# Copyright 2024 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -13,23 +13,6 @@ # limitations under the License. -module "compute-mig-a" { - source = "./fabric/modules/compute-vm" - project_id = var.project_id - zone = "${var.region}-a" - name = "my-ig-a" - network_interfaces = [{ - network = var.vpc.self_link - subnetwork = var.subnet.self_link - }] - boot_disk = { - initialize_params = { - image = "cos-cloud/cos-stable" - } - } - group = { named_ports = {} } -} - module "compute-mig-b" { source = "./fabric/modules/compute-vm" project_id = var.project_id @@ -46,3 +29,20 @@ module "compute-mig-b" { } group = { named_ports = {} } } + +module "compute-mig-c" { + source = "./fabric/modules/compute-vm" + project_id = var.project_id + zone = "${var.region}-c" + name = "my-ig-c" + network_interfaces = [{ + network = var.vpc.self_link + subnetwork = var.subnet.self_link + }] + boot_disk = { + initialize_params = { + image = "cos-cloud/cos-stable" + } + } + group = { named_ports = {} } +} diff --git a/tests/modules/net_lb_app_ext/examples/complex-example.yaml b/tests/modules/net_lb_app_ext/examples/complex-example.yaml index dc0aa07a..4ab33a97 100644 --- a/tests/modules/net_lb_app_ext/examples/complex-example.yaml +++ b/tests/modules/net_lb_app_ext/examples/complex-example.yaml @@ -1,4 +1,4 @@ -# Copyright 2023 Google LLC +# Copyright 2024 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -167,31 +167,31 @@ values: timeout_sec: 5 timeouts: null unhealthy_threshold: 2 - module.glb-0.google_compute_instance_group.default["ew4-a"]: + module.glb-0.google_compute_instance_group.default["group-zone-b"]: description: Terraform managed. - name: glb-test-0-ew4-a - named_port: - - name: http - port: 80 - project: project-id - timeouts: null - zone: europe-west8-a - module.glb-0.google_compute_instance_group.default["ew4-b"]: - description: Terraform managed. - name: glb-test-0-ew4-b + name: glb-test-0-group-zone-b named_port: - name: http port: 80 project: project-id timeouts: null zone: europe-west8-b - module.glb-0.google_compute_network_endpoint.default["neg-ew4-b-e-0"]: - instance: my-ig-b - network_endpoint_group: glb-test-0-neg-ew4-b + module.glb-0.google_compute_instance_group.default["group-zone-c"]: + description: Terraform managed. + name: glb-test-0-group-zone-c + named_port: + - name: http + port: 80 + project: project-id + timeouts: null + zone: europe-west8-c + module.glb-0.google_compute_network_endpoint.default["neg-zone-c-e-0"]: + instance: my-ig-c + network_endpoint_group: glb-test-0-neg-zone-c port: 80 project: project-id timeouts: null - zone: europe-west8-b + zone: europe-west8-c module.glb-0.google_compute_network_endpoint.default["neg-hello-e-0"]: instance: null ip_address: 192.168.0.3 @@ -200,16 +200,16 @@ values: project: project-id timeouts: null zone: europe-west8-b - module.glb-0.google_compute_network_endpoint_group.default["neg-ew4-b"]: + module.glb-0.google_compute_network_endpoint_group.default["neg-zone-c"]: default_port: null description: Terraform managed. - name: glb-test-0-neg-ew4-b + name: glb-test-0-neg-zone-c network: projects/xxx/global/networks/aaa network_endpoint_type: GCE_VM_IP_PORT project: project-id subnetwork: subnet_self_link timeouts: null - zone: europe-west8-b + zone: europe-west8-c module.glb-0.google_compute_network_endpoint_group.default["neg-hello"]: default_port: null description: Terraform managed. From a4def10c19fa807b2d384a5d77dc8efe3e79d1d0 Mon Sep 17 00:00:00 2001 From: Stefano Tribioli Date: Thu, 4 Jan 2024 18:18:34 +0100 Subject: [PATCH 09/13] Add PNA support to Service Directory module Endpoints in Service Directory can be *associated* with a VPC. In this case, they can be used by supported Google Cloud products to send requests directly to resources inside a VPC. This feature is called Private Network Access. The `google_service_directory_endpoint` resource supports this configuration with a new argument `network`. Unfortunately, this argument has an unusual format: it is similar to a standard VPC ID, but instead of the project ID, it expects the project number. --- modules/service-directory/README.md | 58 +++++++++++++++---- modules/service-directory/main.tf | 1 + modules/service-directory/variables.tf | 1 + .../service_directory/examples/pna.yaml | 37 ++++++++++++ 4 files changed, 87 insertions(+), 10 deletions(-) create mode 100644 tests/modules/service_directory/examples/pna.yaml diff --git a/modules/service-directory/README.md b/modules/service-directory/README.md index 3b16cbeb..1faf8e81 100644 --- a/modules/service-directory/README.md +++ b/modules/service-directory/README.md @@ -90,20 +90,59 @@ module "dns-sd" { } # tftest modules=2 resources=5 inventory=dns.yaml ``` - +### Services with endpoints using private network access + +[Private network access](https://cloud.google.com/service-directory/docs/private-network-access-overview) enables supported Google Cloud products to send HTTP requests to resources inside a VPC. + +```hcl +locals { + project_number = "123456789012" +} + +module "service-directory" { + source = "./fabric/modules/service-directory" + project_id = "my-project" + location = "europe-west1" + name = "sd-1" + services = { + one = { + endpoints = ["first", "second"] + metadata = null + } + } + endpoint_config = { + "one/first" = { + address = "10.0.0.11", + port = 443, + network = "projects/${local.project_number}/locations/global/networks/${var.vpc.name}" + metadata = {} + } + "one/second" = { + address = "10.0.0.12", + port = 443, + network = "projects/${local.project_number}/locations/global/networks/${var.vpc.name}" + metadata = {} + } + } +} +# tftest modules=1 resources=4 inventory=pna.yaml +``` + +Note that the `network` argument is unusual in that it requires the project number, instead of the more common project ID. + ## Variables | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [location](variables.tf#L40) | Namespace location. | string | ✓ | | -| [name](variables.tf#L45) | Namespace name. | string | ✓ | | -| [project_id](variables.tf#L50) | Project used for resources. | string | ✓ | | -| [endpoint_config](variables.tf#L18) | Map of endpoint attributes, keys are in service/endpoint format. | map(object({…})) | | {} | -| [iam](variables.tf#L28) | IAM bindings for namespace, in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | -| [labels](variables.tf#L34) | Labels. | map(string) | | {} | -| [service_iam](variables.tf#L55) | IAM bindings for services, in {SERVICE => {ROLE => [MEMBERS]}} format. | map(map(list(string))) | | {} | -| [services](variables.tf#L61) | Service configuration, using service names as keys. | map(object({…})) | | {} | +| [location](variables.tf#L41) | Namespace location. | string | ✓ | | +| [name](variables.tf#L46) | Namespace name. | string | ✓ | | +| [project_id](variables.tf#L51) | Project used for resources. | string | ✓ | | +| [endpoint_config](variables.tf#L18) | Map of endpoint attributes, keys are in service/endpoint format. | map(object({…})) | | {} | +| [iam](variables.tf#L29) | IAM bindings for namespace, in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | +| [labels](variables.tf#L35) | Labels. | map(string) | | {} | +| [service_iam](variables.tf#L56) | IAM bindings for services, in {SERVICE => {ROLE => [MEMBERS]}} format. | map(map(list(string))) | | {} | +| [services](variables.tf#L62) | Service configuration, using service names as keys. | map(object({…})) | | {} | ## Outputs @@ -116,5 +155,4 @@ module "dns-sd" { | [service_id](outputs.tf#L40) | Service ids (short names). | | | [service_names](outputs.tf#L50) | Service ids (long names). | | | [services](outputs.tf#L60) | Service resources. | | - diff --git a/modules/service-directory/main.tf b/modules/service-directory/main.tf index 781bae60..25017a28 100644 --- a/modules/service-directory/main.tf +++ b/modules/service-directory/main.tf @@ -75,4 +75,5 @@ resource "google_service_directory_endpoint" "default" { metadata = try(var.endpoint_config[each.key].metadata, null) address = try(var.endpoint_config[each.key].address, null) port = try(var.endpoint_config[each.key].port, null) + network = try(var.endpoint_config[each.key].network, null) } diff --git a/modules/service-directory/variables.tf b/modules/service-directory/variables.tf index 326aeff8..8212081e 100644 --- a/modules/service-directory/variables.tf +++ b/modules/service-directory/variables.tf @@ -20,6 +20,7 @@ variable "endpoint_config" { type = map(object({ address = string port = number + network = optional(string, null) metadata = map(string) })) default = {} diff --git a/tests/modules/service_directory/examples/pna.yaml b/tests/modules/service_directory/examples/pna.yaml new file mode 100644 index 00000000..167c5f82 --- /dev/null +++ b/tests/modules/service_directory/examples/pna.yaml @@ -0,0 +1,37 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.service-directory.google_service_directory_endpoint.default["one/first"]: + address: 10.0.0.11 + endpoint_id: first + port: 443 + network: projects/123456789012/locations/global/networks/vpc-name + module.service-directory.google_service_directory_endpoint.default["one/second"]: + address: 10.0.0.12 + endpoint_id: second + port: 443 + network: projects/123456789012/locations/global/networks/vpc-name + module.service-directory.google_service_directory_namespace.default: + location: europe-west1 + namespace_id: sd-1 + project: my-project + module.service-directory.google_service_directory_service.default["one"]: + metadata: null + service_id: one + +counts: + google_service_directory_endpoint: 2 + google_service_directory_namespace: 1 + google_service_directory_service: 1 From 0ca3203e52a316ff26869a1a0c38b146cf2b619f Mon Sep 17 00:00:00 2001 From: Stefano Tribioli Date: Fri, 5 Jan 2024 15:10:07 +0100 Subject: [PATCH 10/13] Capitalize Private Network Access --- modules/service-directory/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/service-directory/README.md b/modules/service-directory/README.md index 1faf8e81..c89fe143 100644 --- a/modules/service-directory/README.md +++ b/modules/service-directory/README.md @@ -91,9 +91,9 @@ module "dns-sd" { # tftest modules=2 resources=5 inventory=dns.yaml ``` -### Services with endpoints using private network access +### Services with endpoints using Private Network Access -[Private network access](https://cloud.google.com/service-directory/docs/private-network-access-overview) enables supported Google Cloud products to send HTTP requests to resources inside a VPC. +[Private Network Access](https://cloud.google.com/service-directory/docs/private-network-access-overview) enables supported Google Cloud products to send HTTP requests to resources inside a VPC. ```hcl locals { From 8beb621e070226b7f11a82807a706170ae7040ea Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Fri, 5 Jan 2024 16:59:27 +0100 Subject: [PATCH 11/13] New module for external regional application load balancer (#1892) * Initial version of regional external application load balancer. * Fix tests * Remove unsupported features in regional app lbs * update readme with fixtures * Add ssl-certificate fixture * Switch examples to regions b c * Remove redundant NEG examples * Update README * Update versions.tf * Add missing boilerplate --- modules/net-lb-app-ext-regional/README.md | 750 ++++++++++++++++++ .../backend-service.tf | 249 ++++++ modules/net-lb-app-ext-regional/groups.tf | 36 + .../net-lb-app-ext-regional/health-check.tf | 114 +++ modules/net-lb-app-ext-regional/main.tf | 87 ++ modules/net-lb-app-ext-regional/negs.tf | 118 +++ modules/net-lb-app-ext-regional/outputs.tf | 65 ++ modules/net-lb-app-ext-regional/urlmap.tf | 736 +++++++++++++++++ .../variables-backend-service.tf | 144 ++++ .../variables-health-check.tf | 109 +++ .../variables-urlmap.tf | 303 +++++++ modules/net-lb-app-ext-regional/variables.tf | 191 +++++ modules/net-lb-app-ext-regional/versions.tf | 27 + tests/fixtures/ssl-certificate.tf | 32 + 14 files changed, 2961 insertions(+) create mode 100644 modules/net-lb-app-ext-regional/README.md create mode 100644 modules/net-lb-app-ext-regional/backend-service.tf create mode 100644 modules/net-lb-app-ext-regional/groups.tf create mode 100644 modules/net-lb-app-ext-regional/health-check.tf create mode 100644 modules/net-lb-app-ext-regional/main.tf create mode 100644 modules/net-lb-app-ext-regional/negs.tf create mode 100644 modules/net-lb-app-ext-regional/outputs.tf create mode 100644 modules/net-lb-app-ext-regional/urlmap.tf create mode 100644 modules/net-lb-app-ext-regional/variables-backend-service.tf create mode 100644 modules/net-lb-app-ext-regional/variables-health-check.tf create mode 100644 modules/net-lb-app-ext-regional/variables-urlmap.tf create mode 100644 modules/net-lb-app-ext-regional/variables.tf create mode 100644 modules/net-lb-app-ext-regional/versions.tf create mode 100644 tests/fixtures/ssl-certificate.tf diff --git a/modules/net-lb-app-ext-regional/README.md b/modules/net-lb-app-ext-regional/README.md new file mode 100644 index 00000000..1de3a82a --- /dev/null +++ b/modules/net-lb-app-ext-regional/README.md @@ -0,0 +1,750 @@ +# External Regional Application Load Balancer Module + +This module allows managing External Regional HTTP/HTTPS Application Load Balancers. It's designed to expose the full configuration of the underlying resources, and to facilitate common usage patterns by providing sensible defaults, and optionally managing prerequisite resources like health checks, instance groups, etc. + +Due to the complexity of the underlying resources, changes to the configuration that involve recreation of resources are best applied in stages, starting by disabling the configuration in the urlmap that references the resources that need recreation, then doing the same for the backend service, etc. + +The variable space of this module closely mirrors that of [net-lb-app-ext](../net-lb-app-ext), with the exception of certain features not supported by the regional version. These unsupported features include GCS backends and Internet NEGs, among others. For a comprehensive overview of feature disparities, please consult the [load balancer feature comparison matrix](https://cloud.google.com/load-balancing/docs/features). + +## Examples + + +- [Examples](#examples) + - [Minimal HTTP Example](#minimal-http-example) + - [Minimal HTTPS examples](#minimal-https-examples) + - [HTTP backends](#http-backends) + - [HTTPS backends](#https-backends) + - [HTTP to HTTPS redirect](#http-to-https-redirect) + - [Health Checks](#health-checks) + - [Backend Types and Management](#backend-types-and-management) + - [Instance Groups](#instance-groups) + - [Managed Instance Groups](#managed-instance-groups) + - [Zonal NEG creation](#zonal-neg-creation) + - [Hybrid NEG creation](#hybrid-neg-creation) + - [Private Service Connect NEG creation](#private-service-connect-neg-creation) + - [Serverless NEG creation](#serverless-neg-creation) + - [URL Map](#url-map) + - [Complex example](#complex-example) +- [Files](#files) +- [Variables](#variables) +- [Outputs](#outputs) +- [Fixtures](#fixtures) + + +### Minimal HTTP Example + +An HTTP load balancer with a backend service pointing to a GCE instance group: + +```hcl +module "glb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { backend = module.compute-mig-b.group.id }, + { backend = module.compute-mig-c.group.id } + ] + } + } +} +# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-bc.tf +``` + +### Minimal HTTPS examples + +#### HTTP backends + +An HTTPS load balancer needs a certificate and backends can be HTTP or HTTPS. Regional external application load balancers don't support managed certificates, so you have to provide the certificate and private key manually as shown below: + +```hcl +resource "tls_private_key" "default" { + algorithm = "RSA" + rsa_bits = 2048 +} + +resource "tls_self_signed_cert" "default" { + private_key_pem = tls_private_key.default.private_key_pem + subject { + common_name = "example.com" + organization = "ACME Examples, Inc" + } + validity_period_hours = 720 + allowed_uses = [ + "key_encipherment", + "digital_signature", + "server_auth", + ] +} + +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { backend = module.compute-mig-b.group.id }, + { backend = module.compute-mig-c.group.id } + ] + protocol = "HTTP" + } + } + protocol = "HTTPS" + ssl_certificates = { + create_configs = { + default = { + # certificate and key could also be read via file() from external files + certificate = tls_self_signed_cert.default.cert_pem + private_key = tls_private_key.default.private_key_pem + } + } + } +} +# tftest modules=3 resources=12 fixtures=fixtures/compute-mig-bc.tf +``` + +#### HTTPS backends + +For HTTPS backends the backend service protocol needs to be set to `HTTPS`. The port name if omitted is inferred from the protocol, in this case it is set internally to `https`. The health check also needs to be set to https. This is a complete example: + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { backend = module.compute-mig-b.group.id }, + { backend = module.compute-mig-c.group.id } + ] + protocol = "HTTPS" + } + } + health_check_configs = { + default = { + https = { + port_specification = "USE_SERVING_PORT" + } + } + } + protocol = "HTTPS" + ssl_certificates = { + create_configs = { + default = { + certificate = tls_self_signed_cert.default.cert_pem + private_key = tls_private_key.default.private_key_pem + } + } + } +} +# tftest modules=3 resources=12 fixtures=fixtures/ssl-certificate.tf,fixtures/compute-mig-bc.tf +``` + +#### HTTP to HTTPS redirect + +Redirect is implemented via an additional HTTP load balancer with a custom URL map, similarly to how it's done via the GCP Console. The address shared by the two load balancers needs to be reserved. + +```hcl +module "addresses" { + source = "./fabric/modules/net-address" + project_id = var.project_id + global_addresses = { + "ralb-test-0" = {} + } +} + +module "ralb-test-0-redirect" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0-redirect" + vpc = var.vpc.self_link + region = var.region + address = ( + module.addresses.global_addresses["ralb-test-0"].address + ) + health_check_configs = {} + urlmap_config = { + description = "URL redirect for ralb-test-0." + default_url_redirect = { + https = true + response_code = "MOVED_PERMANENTLY_DEFAULT" + } + } +} + +module "ralb-test-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + address = ( + module.addresses.global_addresses["ralb-test-0"].address + ) + backend_service_configs = { + default = { + backends = [ + { backend = module.compute-mig-b.group.id }, + ] + protocol = "HTTP" + } + } + protocol = "HTTPS" + ssl_certificates = { + create_configs = { + default = { + certificate = tls_self_signed_cert.default.cert_pem + private_key = tls_private_key.default.private_key_pem + } + } + } +} + +# tftest modules=5 resources=16 fixtures=fixtures/ssl-certificate.tf,fixtures/compute-mig-bc.tf +``` + +### Health Checks + +You can leverage externally defined health checks for backend services, or have the module create them for you. + +By default a simple HTTP health check named `default` is created and used in backend services. If you need to override the default, simply define your own health check using the same key (`default`). For more complex configurations you can define your own health checks and reference them via keys in the backend service configurations. + +Health checks created by this module are controlled via the `health_check_configs` variable, which behaves in a similar way to other LB modules in this repository. This is an example that overrides the default health check configuration using a TCP health check: + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [{ + backend = module.compute-mig-b.group.id + }] + # no need to reference the hc explicitly when using the `default` key + # health_checks = ["default"] + } + } + health_check_configs = { + default = { + tcp = { port = 80 } + } + } +} +# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-bc.tf +``` + +To leverage existing health checks without having the module create them, simply pass their self links to backend services and set the `health_check_configs` variable to an empty map: + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [{ + backend = module.compute-mig-b.group.id + }] + health_checks = ["projects/${var.project_id}/global/healthChecks/custom"] + } + } + health_check_configs = {} +} +# tftest modules=3 resources=8 fixtures=fixtures/compute-mig-bc.tf +``` + +### Backend Types and Management + +#### Instance Groups + +The module can optionally create unmanaged instance groups, which can then be referred to in backends via their key. This is the simple HTTP example above but with instance group creation managed by the module: + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { backend = "default-b" } + ] + } + } + group_configs = { + default-b = { + zone = "${var.region}-b" + instances = [ + module.compute-mig-b.id + ] + named_ports = { http = 80 } + } + } +} +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf +``` + +#### Managed Instance Groups + +This example shows how to use the module with a manage instance group as backend: + +```hcl +module "win-template" { + source = "./fabric/modules/compute-vm" + project_id = var.project_id + zone = "${var.region}-a" + name = "win-template" + instance_type = "n2d-standard-2" + create_template = true + boot_disk = { + initialize_params = { + image = "projects/windows-cloud/global/images/windows-server-2019-dc-v20221214" + size = 70 + } + } + network_interfaces = [{ + network = var.vpc.self_link + subnetwork = var.subnet.self_link + nat = false + addresses = null + }] +} + +module "win-mig" { + source = "./fabric/modules/compute-mig" + project_id = var.project_id + location = "${var.region}-a" + name = "win-mig" + instance_template = module.win-template.template.self_link + autoscaler_config = { + max_replicas = 3 + min_replicas = 1 + cooldown_period = 30 + scaling_signals = { + cpu_utilization = { + target = 0.80 + } + } + } + named_ports = { + http = 80 + } +} + +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { backend = module.win-mig.group_manager.instance_group } + ] + } + } +} +# tftest modules=3 resources=8 +``` + +#### Zonal NEG creation + +Supported Network Endpoint Groups (NEGs) can also be used as backends. Similarly to groups, you can pass a self link for existing NEGs or have the module manage them for you. + +This example shows how to create and manage zonal NEGs using GCE VMs as endpoints: + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { + backend = "neg-0" + balancing_mode = "RATE" + max_rate = { per_endpoint = 10 } + } + ] + } + } + neg_configs = { + neg-0 = { + gce = { + network = "projects/myprj-host/global/networks/svpc" + subnetwork = "projects/myprj-host/regions/europe-west8/subnetworks/gce" + zone = "${var.region}-b" + endpoints = { + e-0 = { + instance = "my-ig-b" + ip_address = module.compute-mig-b.internal_ip + port = 80 + } + } + } + } + } +} +# tftest modules=3 resources=11 fixtures=fixtures/compute-mig-bc.tf +``` + +#### Hybrid NEG creation + +This example shows how to create and manage hybrid NEGs: + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { + backend = "neg-0" + balancing_mode = "RATE" + max_rate = { per_endpoint = 10 } + } + ] + } + } + neg_configs = { + neg-0 = { + hybrid = { + network = "projects/myprj-host/global/networks/svpc" + zone = "${var.region}-b" + endpoints = { + e-0 = { + ip_address = "10.0.0.10" + port = 80 + } + } + } + } + } +} +# tftest modules=1 resources=7 +``` + +#### Private Service Connect NEG creation + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { backend = "neg-0" } + ] + health_checks = [] + } + } + # with a single PSC NEG the implied default health check is not needed + health_check_configs = {} + neg_configs = { + neg-0 = { + psc = { + region = var.region + target_service = "${var.region}-cloudkms.googleapis.com" + } + } + } +} +# tftest modules=1 resources=5 +``` + +#### Serverless NEG creation + +The module supports managing Serverless NEGs for Cloud Run and Cloud Function. This is an example of a Cloud Run NEG: + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { backend = "neg-0" } + ] + health_checks = [] + } + } + # with a single serverless NEG the implied default health check is not needed + health_check_configs = {} + neg_configs = { + neg-0 = { + cloudrun = { + region = var.region + target_service = { + name = "hello" + } + } + } + } +} +# tftest modules=1 resources=5 +``` + +### URL Map + +The module exposes the full URL map resource configuration, with some minor changes to the interface to decrease verbosity, and support for aliasing backend services via keys. + +The default URL map configuration sets the `default` backend service as the default service for the load balancer as a convenience. Just override the `urlmap_config` variable to change the default behaviour: + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [{ + backend = module.compute-mig-b.group.id + }] + } + other = { + backends = [{ + backend = module.compute-mig-c.group.id + }] + } + } + urlmap_config = { + default_service = "default" + host_rules = [{ + hosts = ["*"] + path_matcher = "pathmap" + }] + path_matchers = { + pathmap = { + default_service = "default" + path_rules = [{ + paths = ["/other", "/other/*"] + service = "other" + }] + } + } + } +} + +# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf +``` + +### Complex example + +This example mixes group and NEG backends, and shows how to set HTTPS for specific backends. + +```hcl +module "ralb-0" { + source = "./fabric/modules/net-lb-app-ext-regional" + project_id = var.project_id + name = "ralb-test-0" + vpc = var.vpc.self_link + region = var.region + backend_service_configs = { + default = { + backends = [ + { backend = "group-zone-b" }, + { backend = "group-zone-c" }, + ] + } + neg-gce-0 = { + backends = [{ + balancing_mode = "RATE" + backend = "neg-zone-c" + max_rate = { per_endpoint = 10 } + }] + } + neg-hybrid-0 = { + backends = [{ + balancing_mode = "RATE" + backend = "neg-hello" + max_rate = { per_endpoint = 10 } + }] + health_checks = ["neg"] + protocol = "HTTPS" + } + } + group_configs = { + group-zone-b = { + zone = "${var.region}-b" + instances = [ + module.compute-mig-b.id + ] + named_ports = { http = 80 } + } + group-zone-c = { + zone = "${var.region}-c" + instances = [ + module.compute-mig-c.id + ] + named_ports = { http = 80 } + } + } + health_check_configs = { + default = { + http = { + port = 80 + } + } + neg = { + https = { + host = "hello.example.com" + port = 443 + } + } + } + neg_configs = { + neg-zone-c = { + gce = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + zone = "${var.region}-c" + endpoints = { + e-0 = { + instance = "my-ig-c" + ip_address = module.compute-mig-c.internal_ip + port = 80 + } + } + } + } + neg-hello = { + hybrid = { + network = var.vpc.self_link + zone = "${var.region}-b" + endpoints = { + e-0 = { + ip_address = "192.168.0.3" + port = 443 + } + } + } + } + } + urlmap_config = { + default_service = "default" + host_rules = [ + { + hosts = ["*"] + path_matcher = "gce" + }, + { + hosts = ["hello.example.com"] + path_matcher = "hello" + }, + { + hosts = ["static.example.com"] + path_matcher = "static" + } + ] + path_matchers = { + gce = { + default_service = "default" + path_rules = [ + { + paths = ["/gce-neg", "/gce-neg/*"] + service = "neg-gce-0" + } + ] + } + hello = { + default_service = "neg-hybrid-0" + } + static = { + default_service = "neg-gce-0" + } + } + } +} +# tftest modules=3 resources=18 fixtures=fixtures/compute-mig-bc.tf +``` + + + +## Files + +| name | description | resources | +|---|---|---| +| [backend-service.tf](./backend-service.tf) | Backend service resources. | google_compute_region_backend_service | +| [groups.tf](./groups.tf) | None | google_compute_instance_group | +| [health-check.tf](./health-check.tf) | Health check resource. | google_compute_region_health_check | +| [main.tf](./main.tf) | Module-level locals and resources. | google_compute_forwarding_rule · google_compute_region_ssl_certificate · google_compute_region_target_http_proxy · google_compute_region_target_https_proxy | +| [negs.tf](./negs.tf) | NEG resources. | google_compute_network_endpoint · google_compute_network_endpoint_group · google_compute_region_network_endpoint_group | +| [outputs.tf](./outputs.tf) | Module outputs. | | +| [urlmap.tf](./urlmap.tf) | URL map resources. | google_compute_region_url_map | +| [variables-backend-service.tf](./variables-backend-service.tf) | Backend services variables. | | +| [variables-health-check.tf](./variables-health-check.tf) | Health check variable. | | +| [variables-urlmap.tf](./variables-urlmap.tf) | URLmap variable. | | +| [variables.tf](./variables.tf) | Module variables. | | +| [versions.tf](./versions.tf) | Version pins. | | + +## Variables + +| name | description | type | required | default | +|---|---|:---:|:---:|:---:| +| [name](variables.tf#L58) | Load balancer name. | string | ✓ | | +| [project_id](variables.tf#L150) | Project id. | string | ✓ | | +| [region](variables.tf#L168) | Region where the load balancer is created. | string | ✓ | | +| [vpc](variables.tf#L187) | VPC-level configuration. | string | ✓ | | +| [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null | +| [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} | +| [description](variables.tf#L23) | Optional description used for resources. | string | | "Terraform managed." | +| [group_configs](variables.tf#L29) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) | | {…} | +| [https_proxy_config](variables.tf#L41) | HTTPS proxy connfiguration. | object({…}) | | {} | +| [labels](variables.tf#L52) | Labels set on resources. | map(string) | | {} | +| [neg_configs](variables.tf#L63) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [ports](variables.tf#L144) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | +| [protocol](variables.tf#L155) | Protocol supported by this load balancer. | string | | "HTTP" | +| [ssl_certificates](variables.tf#L173) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | +| [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | + +## Outputs + +| name | description | sensitive | +|---|---|:---:| +| [address](outputs.tf#L17) | Forwarding rule address. | | +| [backend_service_ids](outputs.tf#L22) | Backend service resources. | | +| [backend_service_names](outputs.tf#L29) | Backend service resource names. | | +| [forwarding_rule](outputs.tf#L36) | Forwarding rule resource. | | +| [group_ids](outputs.tf#L41) | Autogenerated instance group ids. | | +| [health_check_ids](outputs.tf#L48) | Autogenerated health check ids. | | +| [id](outputs.tf#L55) | Fully qualified forwarding rule id. | | +| [neg_ids](outputs.tf#L60) | Autogenerated network endpoint group ids. | | + +## Fixtures + +- [compute-mig-bc.tf](../../tests/fixtures/compute-mig-bc.tf) +- [ssl-certificate.tf](../../tests/fixtures/ssl-certificate.tf) + diff --git a/modules/net-lb-app-ext-regional/backend-service.tf b/modules/net-lb-app-ext-regional/backend-service.tf new file mode 100644 index 00000000..f594d6e4 --- /dev/null +++ b/modules/net-lb-app-ext-regional/backend-service.tf @@ -0,0 +1,249 @@ +/** + * Copyright 2024 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description Backend service resources. + +locals { + group_ids = merge( + { + for k, v in google_compute_instance_group.default : k => v.id + }, + { + for k, v in google_compute_network_endpoint_group.default : k => v.id + }, + { + for k, v in google_compute_region_network_endpoint_group.psc : k => v.id + }, + { + for k, v in google_compute_region_network_endpoint_group.serverless : k => v.id + } + ) + hc_ids = { + for k, v in google_compute_region_health_check.default : k => v.id + } +} + +# TODO(jccb): add security_policy block +# TODO(jccb): add connection_tracking_policy block + +resource "google_compute_region_backend_service" "default" { + provider = google-beta + for_each = var.backend_service_configs + project = ( + each.value.project_id == null + ? var.project_id + : each.value.project_id + ) + name = "${var.name}-${each.key}" + region = var.region + description = var.description + affinity_cookie_ttl_sec = each.value.affinity_cookie_ttl_sec + connection_draining_timeout_sec = each.value.connection_draining_timeout_sec + enable_cdn = each.value.enable_cdn + health_checks = length(each.value.health_checks) == 0 ? null : [ + for k in each.value.health_checks : lookup(local.hc_ids, k, k) + ] + # external regional load balancer is always EXTERNAL_MANAGER. + # TODO(jccb): double check if this is true + load_balancing_scheme = "EXTERNAL_MANAGED" + #TODO(jccb): add locality_lb_policy with MAGLEV and WEIGHTED_MAGLEV when scheme EXTERNAL + port_name = ( + each.value.port_name == null + ? lower(each.value.protocol == null ? var.protocol : each.value.protocol) + : each.value.port_name + ) + protocol = ( + each.value.protocol == null ? var.protocol : each.value.protocol + ) + session_affinity = each.value.session_affinity + timeout_sec = each.value.timeout_sec + + dynamic "backend" { + for_each = { for b in coalesce(each.value.backends, []) : b.backend => b } + content { + group = lookup(local.group_ids, backend.key, backend.key) + balancing_mode = backend.value.balancing_mode # UTILIZATION, RATE + capacity_scaler = backend.value.capacity_scaler + description = backend.value.description + max_connections = try( + backend.value.max_connections.per_group, null + ) + max_connections_per_endpoint = try( + backend.value.max_connections.per_endpoint, null + ) + max_connections_per_instance = try( + backend.value.max_connections.per_instance, null + ) + max_rate = try( + backend.value.max_rate.per_group, null + ) + max_rate_per_endpoint = try( + backend.value.max_rate.per_endpoint, null + ) + max_rate_per_instance = try( + backend.value.max_rate.per_instance, null + ) + max_utilization = backend.value.max_utilization + } + } + + dynamic "cdn_policy" { + for_each = ( + each.value.cdn_policy == null ? [] : [each.value.cdn_policy] + ) + iterator = cdn + content { + cache_mode = cdn.value.cache_mode + client_ttl = cdn.value.client_ttl + default_ttl = cdn.value.default_ttl + max_ttl = cdn.value.max_ttl + negative_caching = cdn.value.negative_caching + serve_while_stale = cdn.value.serve_while_stale + signed_url_cache_max_age_sec = cdn.value.signed_url_cache_max_age_sec + dynamic "cache_key_policy" { + for_each = ( + cdn.value.cache_key_policy == null + ? [] + : [cdn.value.cache_key_policy] + ) + iterator = ck + content { + include_host = ck.value.include_host + include_named_cookies = ck.value.include_named_cookies + include_protocol = ck.value.include_protocol + include_query_string = ck.value.include_query_string + query_string_blacklist = ck.value.query_string_blacklist + query_string_whitelist = ck.value.query_string_whitelist + } + } + dynamic "negative_caching_policy" { + for_each = ( + cdn.value.negative_caching_policy == null + ? [] + : [cdn.value.negative_caching_policy] + ) + iterator = nc + content { + code = nc.value.code + ttl = nc.value.ttl + } + } + } + } + + dynamic "circuit_breakers" { + for_each = ( + each.value.circuit_breakers == null ? [] : [each.value.circuit_breakers] + ) + iterator = cb + content { + max_connections = cb.value.max_connections + max_pending_requests = cb.value.max_pending_requests + max_requests = cb.value.max_requests + max_requests_per_connection = cb.value.max_requests_per_connection + max_retries = cb.value.max_retries + dynamic "connect_timeout" { + for_each = ( + cb.value.connect_timeout == null ? [] : [cb.value.connect_timeout] + ) + content { + seconds = connect_timeout.value.seconds + nanos = connect_timeout.value.nanos + } + } + } + } + + dynamic "consistent_hash" { + for_each = ( + each.value.consistent_hash == null ? [] : [each.value.consistent_hash] + ) + iterator = ch + content { + http_header_name = ch.value.http_header_name + minimum_ring_size = ch.value.minimum_ring_size + dynamic "http_cookie" { + for_each = ch.value.http_cookie == null ? [] : [ch.value.http_cookie] + content { + name = http_cookie.value.name + path = http_cookie.value.path + dynamic "ttl" { + for_each = ( + http_cookie.value.ttl == null ? [] : [http_cookie.value.ttl] + ) + content { + seconds = ttl.value.seconds + nanos = ttl.value.nanos + } + } + } + } + } + } + + dynamic "iap" { + for_each = each.value.iap_config == null ? [] : [each.value.iap_config] + content { + oauth2_client_id = iap.value.oauth2_client_id + oauth2_client_secret = iap.value.oauth2_client_secret + oauth2_client_secret_sha256 = iap.value.oauth2_client_secret_sha256 + } + } + + dynamic "log_config" { + for_each = each.value.log_sample_rate == null ? [] : [""] + content { + enable = true + sample_rate = each.value.log_sample_rate + } + } + + dynamic "outlier_detection" { + for_each = ( + each.value.outlier_detection == null ? [] : [each.value.outlier_detection] + ) + iterator = od + content { + consecutive_errors = od.value.consecutive_errors + consecutive_gateway_failure = od.value.consecutive_gateway_failure + enforcing_consecutive_errors = od.value.enforcing_consecutive_errors + enforcing_consecutive_gateway_failure = od.value.enforcing_consecutive_gateway_failure + enforcing_success_rate = od.value.enforcing_success_rate + max_ejection_percent = od.value.max_ejection_percent + success_rate_minimum_hosts = od.value.success_rate_minimum_hosts + success_rate_request_volume = od.value.success_rate_request_volume + success_rate_stdev_factor = od.value.success_rate_stdev_factor + dynamic "base_ejection_time" { + for_each = ( + od.value.base_ejection_time == null ? [] : [od.value.base_ejection_time] + ) + content { + seconds = base_ejection_time.value.seconds + nanos = base_ejection_time.value.nanos + } + } + dynamic "interval" { + for_each = ( + od.value.interval == null ? [] : [od.value.interval] + ) + content { + seconds = interval.value.seconds + nanos = interval.value.nanos + } + } + } + } +} diff --git a/modules/net-lb-app-ext-regional/groups.tf b/modules/net-lb-app-ext-regional/groups.tf new file mode 100644 index 00000000..285ca79a --- /dev/null +++ b/modules/net-lb-app-ext-regional/groups.tf @@ -0,0 +1,36 @@ +/** + * Copyright 2023 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +resource "google_compute_instance_group" "default" { + for_each = var.group_configs + project = ( + each.value.project_id == null + ? var.project_id + : each.value.project_id + ) + zone = each.value.zone + name = "${var.name}-${each.key}" + description = var.description + instances = each.value.instances + + dynamic "named_port" { + for_each = each.value.named_ports + content { + name = named_port.key + port = named_port.value + } + } +} diff --git a/modules/net-lb-app-ext-regional/health-check.tf b/modules/net-lb-app-ext-regional/health-check.tf new file mode 100644 index 00000000..f7dc9c17 --- /dev/null +++ b/modules/net-lb-app-ext-regional/health-check.tf @@ -0,0 +1,114 @@ +/** + * Copyright 2023 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description Health check resource. + +resource "google_compute_region_health_check" "default" { + provider = google-beta + for_each = var.health_check_configs + project = ( + each.value.project_id == null + ? var.project_id + : each.value.project_id + ) + name = "${var.name}-${each.key}" + region = var.region + description = each.value.description + check_interval_sec = each.value.check_interval_sec + healthy_threshold = each.value.healthy_threshold + timeout_sec = each.value.timeout_sec + unhealthy_threshold = each.value.unhealthy_threshold + + dynamic "grpc_health_check" { + for_each = try(each.value.grpc, null) != null ? [""] : [] + content { + port = each.value.grpc.port + port_name = each.value.grpc.port_name + port_specification = each.value.grpc.port_specification + grpc_service_name = each.value.grpc.service_name + } + } + + dynamic "http_health_check" { + for_each = try(each.value.http, null) != null ? [""] : [] + content { + host = each.value.http.host + port = each.value.http.port + port_name = each.value.http.port_name + port_specification = each.value.http.port_specification + proxy_header = each.value.http.proxy_header + request_path = each.value.http.request_path + response = each.value.http.response + } + } + + dynamic "http2_health_check" { + for_each = try(each.value.http2, null) != null ? [""] : [] + content { + host = each.value.http2.host + port = each.value.http2.port + port_name = each.value.http2.port_name + port_specification = each.value.http2.port_specification + proxy_header = each.value.http2.proxy_header + request_path = each.value.http2.request_path + response = each.value.http2.response + } + } + + dynamic "https_health_check" { + for_each = try(each.value.https, null) != null ? [""] : [] + content { + host = each.value.https.host + port = each.value.https.port + port_name = each.value.https.port_name + port_specification = each.value.https.port_specification + proxy_header = each.value.https.proxy_header + request_path = each.value.https.request_path + response = each.value.https.response + } + } + + dynamic "ssl_health_check" { + for_each = try(each.value.ssl, null) != null ? [""] : [] + content { + port = each.value.ssl.port + port_name = each.value.ssl.port_name + port_specification = each.value.ssl.port_specification + proxy_header = each.value.ssl.proxy_header + request = each.value.ssl.request + response = each.value.ssl.response + } + } + + dynamic "tcp_health_check" { + for_each = try(each.value.tcp, null) != null ? [""] : [] + content { + port = each.value.tcp.port + port_name = each.value.tcp.port_name + port_specification = each.value.tcp.port_specification + proxy_header = each.value.tcp.proxy_header + request = each.value.tcp.request + response = each.value.tcp.response + } + } + + dynamic "log_config" { + for_each = try(each.value.enable_logging, null) == true ? [""] : [] + content { + enable = true + } + } +} diff --git a/modules/net-lb-app-ext-regional/main.tf b/modules/net-lb-app-ext-regional/main.tf new file mode 100644 index 00000000..dfabdd75 --- /dev/null +++ b/modules/net-lb-app-ext-regional/main.tf @@ -0,0 +1,87 @@ +/** + * Copyright 2024 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +locals { + fwd_rule_ports = ( + var.protocol == "HTTPS" ? [443] : coalesce(var.ports, [80]) + ) + fwd_rule_target = ( + var.protocol == "HTTPS" + ? google_compute_region_target_https_proxy.default.0.id + : google_compute_region_target_http_proxy.default.0.id + ) + proxy_ssl_certificates = concat( + coalesce(var.ssl_certificates.certificate_ids, []), + [for k, v in google_compute_region_ssl_certificate.default : v.id], + ) +} + +resource "google_compute_forwarding_rule" "default" { + provider = google-beta + project = var.project_id + name = var.name + region = var.region + description = var.description + ip_address = var.address + ip_protocol = "TCP" + # external regional load balancer is always EXTERNAL_MANAGER. + # TODO(jccb): double check if this is true + load_balancing_scheme = "EXTERNAL_MANAGED" + port_range = join(",", local.fwd_rule_ports) + labels = var.labels + target = local.fwd_rule_target + network = var.vpc + # external regional app lb only supports standard tier + network_tier = "STANDARD" +} + +# certificates + +resource "google_compute_region_ssl_certificate" "default" { + for_each = var.ssl_certificates.create_configs + project = var.project_id + name = "${var.name}-${each.key}" + region = var.region + certificate = trimspace(each.value.certificate) + private_key = trimspace(each.value.private_key) + lifecycle { + create_before_destroy = true + } +} + +# proxies + +resource "google_compute_region_target_http_proxy" "default" { + count = var.protocol == "HTTPS" ? 0 : 1 + project = var.project_id + region = var.region + name = var.name + description = var.description + url_map = google_compute_region_url_map.default.id +} + +resource "google_compute_region_target_https_proxy" "default" { + count = var.protocol == "HTTPS" ? 1 : 0 + project = var.project_id + name = var.name + region = var.region + description = var.description + # certificate_map = var.https_proxy_config.certificate_map + # quic_override = var.https_proxy_config.quic_override + ssl_certificates = local.proxy_ssl_certificates + ssl_policy = var.https_proxy_config.ssl_policy + url_map = google_compute_region_url_map.default.id +} diff --git a/modules/net-lb-app-ext-regional/negs.tf b/modules/net-lb-app-ext-regional/negs.tf new file mode 100644 index 00000000..5fbf71bc --- /dev/null +++ b/modules/net-lb-app-ext-regional/negs.tf @@ -0,0 +1,118 @@ +/** + * Copyright 2024 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description NEG resources. + +locals { + _neg_endpoints_zonal = flatten([ + for k, v in local.neg_zonal : [ + for kk, vv in v.endpoints : merge(vv, { + key = "${k}-${kk}", neg = k, zone = v.zone + }) + ] + ]) + neg_endpoints_zonal = { + for v in local._neg_endpoints_zonal : (v.key) => v + } + neg_regional_psc = { + for k, v in var.neg_configs : + k => v if v.psc != null + } + neg_regional_serverless = { + for k, v in var.neg_configs : + k => v if v.cloudrun != null || v.cloudfunction != null + } + neg_zonal = { + # we need to rebuild new objects as we cannot merge different types + for k, v in var.neg_configs : k => { + description = v.description + endpoints = v.gce != null ? v.gce.endpoints : v.hybrid.endpoints + network = v.gce != null ? v.gce.network : v.hybrid.network + subnetwork = v.gce != null ? v.gce.subnetwork : null + type = v.gce != null ? "GCE_VM_IP_PORT" : "NON_GCP_PRIVATE_IP_PORT" + zone = v.gce != null ? v.gce.zone : v.hybrid.zone + } if v.gce != null || v.hybrid != null + } +} + +resource "google_compute_network_endpoint_group" "default" { + for_each = local.neg_zonal + project = var.project_id + zone = each.value.zone + name = "${var.name}-${each.key}" + # re-enable once provider properly supports this + # default_port = each.value.default_port + description = coalesce(each.value.description, var.description) + network_endpoint_type = each.value.type + network = each.value.network + subnetwork = ( + each.value.type == "NON_GCP_PRIVATE_IP_PORT" + ? null + : each.value.subnetwork + ) +} + +resource "google_compute_network_endpoint" "default" { + for_each = local.neg_endpoints_zonal + project = ( + google_compute_network_endpoint_group.default[each.value.neg].project + ) + network_endpoint_group = ( + google_compute_network_endpoint_group.default[each.value.neg].name + ) + instance = try(each.value.instance, null) + ip_address = each.value.ip_address + port = each.value.port + zone = each.value.zone +} + +resource "google_compute_region_network_endpoint_group" "psc" { + for_each = local.neg_regional_psc + project = var.project_id + region = each.value.psc.region + name = "${var.name}-${each.key}" + description = coalesce(each.value.description, var.description) + network_endpoint_type = "PRIVATE_SERVICE_CONNECT" + psc_target_service = each.value.psc.target_service + network = each.value.psc.network + subnetwork = each.value.psc.subnetwork +} + +resource "google_compute_region_network_endpoint_group" "serverless" { + for_each = local.neg_regional_serverless + project = var.project_id + region = try( + each.value.cloudrun.region, each.value.cloudfunction.region, null + ) + name = "${var.name}-${each.key}" + description = coalesce(each.value.description, var.description) + network_endpoint_type = "SERVERLESS" + dynamic "cloud_function" { + for_each = each.value.cloudfunction == null ? [] : [""] + content { + function = each.value.cloudfunction.target_function + url_mask = each.value.cloudfunction.target_urlmask + } + } + dynamic "cloud_run" { + for_each = each.value.cloudrun == null ? [] : [""] + content { + service = try(each.value.cloudrun.target_service.name, null) + tag = try(each.value.cloudrun.target_service.tag, null) + url_mask = each.value.cloudrun.target_urlmask + } + } +} diff --git a/modules/net-lb-app-ext-regional/outputs.tf b/modules/net-lb-app-ext-regional/outputs.tf new file mode 100644 index 00000000..dc1824be --- /dev/null +++ b/modules/net-lb-app-ext-regional/outputs.tf @@ -0,0 +1,65 @@ +/** + * Copyright 2023 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +output "address" { + description = "Forwarding rule address." + value = google_compute_forwarding_rule.default.ip_address +} + +output "backend_service_ids" { + description = "Backend service resources." + value = { + for k, v in google_compute_region_backend_service.default : k => v.id + } +} + +output "backend_service_names" { + description = "Backend service resource names." + value = { + for k, v in google_compute_region_backend_service.default : k => v.name + } +} + +output "forwarding_rule" { + description = "Forwarding rule resource." + value = google_compute_forwarding_rule.default +} + +output "group_ids" { + description = "Autogenerated instance group ids." + value = { + for k, v in google_compute_instance_group.default : k => v.id + } +} + +output "health_check_ids" { + description = "Autogenerated health check ids." + value = { + for k, v in google_compute_region_health_check.default : k => v.id + } +} + +output "id" { + description = "Fully qualified forwarding rule id." + value = google_compute_forwarding_rule.default.id +} + +output "neg_ids" { + description = "Autogenerated network endpoint group ids." + value = { + for k, v in google_compute_network_endpoint_group.default : k => v.id + } +} diff --git a/modules/net-lb-app-ext-regional/urlmap.tf b/modules/net-lb-app-ext-regional/urlmap.tf new file mode 100644 index 00000000..2cc7abde --- /dev/null +++ b/modules/net-lb-app-ext-regional/urlmap.tf @@ -0,0 +1,736 @@ +/** + * Copyright 2024 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description URL map resources. + +locals { + backend_ids = merge( + { for k, v in google_compute_region_backend_service.default : k => v.id }, + ) +} + +resource "google_compute_region_url_map" "default" { + provider = google-beta + project = var.project_id + name = var.name + region = var.region + description = var.description + default_service = ( + var.urlmap_config.default_service == null ? null : lookup( + local.backend_ids, + var.urlmap_config.default_service, + var.urlmap_config.default_service + ) + ) + + dynamic "default_route_action" { + for_each = ( + var.urlmap_config.default_route_action == null + ? [] + : [var.urlmap_config.default_route_action] + ) + iterator = route_action + content { + dynamic "cors_policy" { + for_each = ( + route_action.value.cors_policy == null + ? [] + : [route_action.value.cors_policy] + ) + content { + allow_credentials = cors_policy.value.allow_credentials + allow_headers = cors_policy.value.allow_headers + allow_methods = cors_policy.value.allow_methods + allow_origin_regexes = cors_policy.value.allow_origin_regexes + allow_origins = cors_policy.value.allow_origins + disabled = cors_policy.value.disabled + expose_headers = cors_policy.value.expose_headers + max_age = cors_policy.value.max_age + } + } + dynamic "fault_injection_policy" { + for_each = ( + route_action.value.fault_injection_policy == null + ? [] + : [route_action.value.fault_injection_policy] + ) + content { + dynamic "abort" { + for_each = ( + fault_injection_policy.value.abort == null + ? [] + : [fault_injection_policy.value.abort] + ) + content { + http_status = abort.value.status + percentage = abort.value.percentage + } + } + dynamic "delay" { + for_each = ( + fault_injection_policy.value.delay == null + ? [] + : [fault_injection_policy.value.delay] + ) + content { + percentage = delay.value.percentage + fixed_delay { + nanos = delay.value.fixed.nanos + seconds = delay.value.fixed.seconds + } + } + } + } + } + dynamic "request_mirror_policy" { + for_each = ( + route_action.value.request_mirror_backend == null + ? [] + : [""] + ) + content { + backend_service = lookup( + local.backend_ids, + route_action.value.request_mirror_backend, + route_action.value.request_mirror_backend + ) + } + } + dynamic "retry_policy" { + for_each = ( + route_action.value.retry_policy == null + ? [] + : [route_action.value.retry_policy] + ) + content { + num_retries = retry_policy.value.num_retries + retry_conditions = retry_policy.value.retry_conditions + dynamic "per_try_timeout" { + for_each = ( + retry_policy.value.per_try_timeout == null + ? [] + : [retry_policy.value.per_try_timeout] + ) + content { + nanos = per_try_timeout.value.nanos + seconds = per_try_timeout.value.seconds + } + } + } + } + dynamic "timeout" { + for_each = ( + route_action.value.timeout == null + ? [] + : [route_action.value.timeout] + ) + content { + nanos = timeout.value.nanos + seconds = timeout.value.seconds + } + } + dynamic "url_rewrite" { + for_each = ( + route_action.value.url_rewrite == null + ? [] + : [route_action.value.url_rewrite] + ) + content { + host_rewrite = url_rewrite.value.host + path_prefix_rewrite = url_rewrite.value.path_prefix + } + } + dynamic "weighted_backend_services" { + for_each = coalesce( + route_action.value.weighted_backend_services, {} + ) + iterator = service + content { + backend_service = lookup( + local.backend_ids, service.key, service.key + ) + weight = service.value.weight + dynamic "header_action" { + for_each = ( + service.value.header_action == null + ? [] + : [service.value.header_action] + ) + iterator = h + content { + request_headers_to_remove = h.value.request_remove + response_headers_to_remove = h.value.response_remove + dynamic "request_headers_to_add" { + for_each = coalesce(h.value.request_add, {}) + content { + header_name = request_headers_to_add.key + header_value = request_headers_to_add.value.value + replace = request_headers_to_add.value.replace + } + } + dynamic "response_headers_to_add" { + for_each = coalesce(h.value.response_add, {}) + content { + header_name = response_headers_to_add.key + header_value = response_headers_to_add.value.value + replace = response_headers_to_add.value.replace + } + } + } + } + } + } + } + } + + dynamic "default_url_redirect" { + for_each = ( + var.urlmap_config.default_url_redirect == null + ? [] + : [var.urlmap_config.default_url_redirect] + ) + iterator = r + content { + host_redirect = r.value.host + https_redirect = r.value.https + path_redirect = r.value.path + prefix_redirect = r.value.prefix + redirect_response_code = r.value.response_code + strip_query = r.value.strip_query + } + } + + dynamic "host_rule" { + for_each = coalesce(var.urlmap_config.host_rules, []) + iterator = r + content { + hosts = r.value.hosts + path_matcher = r.value.path_matcher + description = r.value.description + } + } + + dynamic "path_matcher" { + for_each = coalesce(var.urlmap_config.path_matchers, {}) + iterator = m + content { + default_service = m.value.default_service == null ? null : lookup( + local.backend_ids, m.value.default_service, m.value.default_service + ) + description = m.value.description + name = m.key + dynamic "default_url_redirect" { + for_each = ( + m.value.default_url_redirect == null + ? [] + : [m.value.default_url_redirect] + ) + content { + host_redirect = default_url_redirect.value.host + https_redirect = default_url_redirect.value.https + path_redirect = default_url_redirect.value.path + prefix_redirect = default_url_redirect.value.prefix + redirect_response_code = default_url_redirect.value.response_code + strip_query = default_url_redirect.value.strip_query + } + } + dynamic "path_rule" { + for_each = toset(coalesce(m.value.path_rules, [])) + content { + paths = path_rule.value.paths + service = path_rule.value.service == null ? null : lookup( + local.backend_ids, + path_rule.value.service, + path_rule.value.service + ) + dynamic "route_action" { + for_each = ( + path_rule.value.route_action == null + ? [] + : [path_rule.value.route_action] + ) + content { + dynamic "cors_policy" { + for_each = ( + route_action.value.cors_policy == null + ? [] + : [route_action.value.cors_policy] + ) + content { + allow_credentials = cors_policy.value.allow_credentials + allow_headers = cors_policy.value.allow_headers + allow_methods = cors_policy.value.allow_methods + allow_origin_regexes = cors_policy.value.allow_origin_regexes + allow_origins = cors_policy.value.allow_origins + disabled = cors_policy.value.disabled + expose_headers = cors_policy.value.expose_headers + max_age = cors_policy.value.max_age + } + } + dynamic "fault_injection_policy" { + for_each = ( + route_action.value.fault_injection_policy == null + ? [] + : [route_action.value.fault_injection_policy] + ) + content { + dynamic "abort" { + for_each = ( + fault_injection_policy.value.abort == null + ? [] + : [fault_injection_policy.value.abort] + ) + content { + http_status = abort.value.status + percentage = abort.value.percentage + } + } + dynamic "delay" { + for_each = ( + fault_injection_policy.value.delay == null + ? [] + : [fault_injection_policy.value.delay] + ) + content { + percentage = delay.value.percentage + fixed_delay { + nanos = delay.value.fixed.nanos + seconds = delay.value.fixed.seconds + } + } + } + } + } + dynamic "request_mirror_policy" { + for_each = ( + route_action.value.request_mirror_backend == null + ? [] + : [""] + ) + content { + backend_service = lookup( + local.backend_ids, + route_action.value.request_mirror_backend, + route_action.value.request_mirror_backend + ) + } + } + dynamic "retry_policy" { + for_each = ( + route_action.value.retry_policy == null + ? [] + : [route_action.value.retry_policy] + ) + content { + num_retries = retry_policy.value.num_retries + retry_conditions = retry_policy.value.retry_conditions + dynamic "per_try_timeout" { + for_each = ( + retry_policy.value.per_try_timeout == null + ? [] + : [retry_policy.value.per_try_timeout] + ) + content { + nanos = per_try_timeout.value.nanos + seconds = per_try_timeout.value.seconds + } + } + } + } + dynamic "timeout" { + for_each = ( + route_action.value.timeout == null + ? [] + : [route_action.value.timeout] + ) + content { + nanos = timeout.value.nanos + seconds = timeout.value.seconds + } + } + dynamic "url_rewrite" { + for_each = ( + route_action.value.url_rewrite == null + ? [] + : [route_action.value.url_rewrite] + ) + content { + host_rewrite = url_rewrite.value.host + path_prefix_rewrite = url_rewrite.value.path_prefix + } + } + dynamic "weighted_backend_services" { + for_each = coalesce( + route_action.value.weighted_backend_services, {} + ) + iterator = service + content { + backend_service = lookup( + local.backend_ids, service.key, service.key + ) + weight = service.value.weight + dynamic "header_action" { + for_each = ( + service.value.header_action == null + ? [] + : [service.value.header_action] + ) + iterator = h + content { + request_headers_to_remove = h.value.request_remove + response_headers_to_remove = h.value.response_remove + dynamic "request_headers_to_add" { + for_each = coalesce(h.value.request_add, {}) + content { + header_name = request_headers_to_add.key + header_value = request_headers_to_add.value.value + replace = request_headers_to_add.value.replace + } + } + dynamic "response_headers_to_add" { + for_each = coalesce(h.value.response_add, {}) + content { + header_name = response_headers_to_add.key + header_value = response_headers_to_add.value.value + replace = response_headers_to_add.value.replace + } + } + } + } + } + } + } + } + dynamic "url_redirect" { + for_each = ( + path_rule.value.url_redirect == null + ? [] + : [path_rule.value.url_redirect] + ) + content { + host_redirect = url_redirect.value.host + https_redirect = url_redirect.value.https + path_redirect = url_redirect.value.path + prefix_redirect = url_redirect.value.prefix + redirect_response_code = url_redirect.value.response_code + strip_query = url_redirect.value.strip_query + } + } + } + } + dynamic "route_rules" { + for_each = toset(coalesce(m.value.route_rules, [])) + content { + priority = route_rules.value.priority + service = route_rules.value.service == null ? null : lookup( + local.backend_ids, + route_rules.value.service, + route_rules.value.service + ) + dynamic "header_action" { + for_each = ( + route_rules.value.header_action == null + ? [] + : [route_rules.value.header_action] + ) + iterator = h + content { + request_headers_to_remove = h.value.request_remove + response_headers_to_remove = h.value.response_remove + dynamic "request_headers_to_add" { + for_each = coalesce(h.value.request_add, {}) + content { + header_name = request_headers_to_add.key + header_value = request_headers_to_add.value.value + replace = request_headers_to_add.value.replace + } + } + dynamic "response_headers_to_add" { + for_each = coalesce(h.value.response_add, {}) + content { + header_name = response_headers_to_add.key + header_value = response_headers_to_add.value.value + replace = response_headers_to_add.value.replace + } + } + } + } + dynamic "match_rules" { + for_each = toset(coalesce(route_rules.value.match_rules, [])) + content { + ignore_case = match_rules.value.ignore_case + full_path_match = ( + try(match_rules.value.path.type, null) == "full" + ? match_rules.value.path.value + : null + ) + prefix_match = ( + try(match_rules.value.path.type, null) == "prefix" + ? match_rules.value.path.value + : null + ) + regex_match = ( + try(match_rules.value.path.type, null) == "regex" + ? match_rules.value.path.value + : null + ) + dynamic "header_matches" { + for_each = toset(coalesce(match_rules.value.headers, [])) + iterator = h + content { + header_name = h.value.name + exact_match = h.value.type == "exact" ? h.value.value : null + invert_match = h.value.invert_match + prefix_match = h.value.type == "prefix" ? h.value.value : null + present_match = h.value.type == "present" ? h.value.value : null + regex_match = h.value.type == "regex" ? h.value.value : null + suffix_match = h.value.type == "suffix" ? h.value.value : null + dynamic "range_match" { + for_each = ( + h.value.type != "range" || h.value.range_value == null + ? [] + : [""] + ) + content { + range_end = h.value.range_value.end + range_start = h.value.range_value.start + } + } + } + } + dynamic "metadata_filters" { + for_each = toset(coalesce(match_rules.value.metadata_filters, [])) + iterator = m + content { + filter_match_criteria = ( + m.value.match_all ? "MATCH_ALL" : "MATCH_ANY" + ) + dynamic "filter_labels" { + for_each = m.value.labels + content { + name = filter_labels.key + value = filter_labels.value + } + } + } + } + dynamic "query_parameter_matches" { + for_each = toset(coalesce(match_rules.value.query_params, [])) + iterator = q + content { + name = q.value.name + exact_match = ( + q.value.type == "exact" ? q.value.value : null + ) + present_match = ( + q.value.type == "present" ? q.value.value : null + ) + regex_match = ( + q.value.type == "regex" ? q.value.value : null + ) + } + } + } + } + dynamic "route_action" { + for_each = ( + route_rules.value.route_action == null + ? [] + : [route_rules.value.route_action] + ) + content { + dynamic "cors_policy" { + for_each = ( + route_action.value.cors_policy == null + ? [] + : [route_action.value.cors_policy] + ) + content { + allow_credentials = cors_policy.value.allow_credentials + allow_headers = cors_policy.value.allow_headers + allow_methods = cors_policy.value.allow_methods + allow_origin_regexes = cors_policy.value.allow_origin_regexes + allow_origins = cors_policy.value.allow_origins + disabled = cors_policy.value.disabled + expose_headers = cors_policy.value.expose_headers + max_age = cors_policy.value.max_age + } + } + dynamic "fault_injection_policy" { + for_each = ( + route_action.value.fault_injection_policy == null + ? [] + : [route_action.value.fault_injection_policy] + ) + content { + dynamic "abort" { + for_each = ( + fault_injection_policy.value.abort == null + ? [] + : [fault_injection_policy.value.abort] + ) + content { + http_status = abort.value.status + percentage = abort.value.percentage + } + } + dynamic "delay" { + for_each = ( + fault_injection_policy.value.delay == null + ? [] + : [fault_injection_policy.value.delay] + ) + content { + percentage = delay.value.percentage + fixed_delay { + nanos = delay.value.fixed.nanos + seconds = delay.value.fixed.seconds + } + } + } + } + } + dynamic "request_mirror_policy" { + for_each = ( + route_action.value.request_mirror_backend == null + ? [] + : [""] + ) + content { + backend_service = lookup( + local.backend_ids, + route_action.value.request_mirror_backend, + route_action.value.request_mirror_backend + ) + } + } + dynamic "retry_policy" { + for_each = ( + route_action.value.retry_policy == null + ? [] + : [route_action.value.retry_policy] + ) + content { + num_retries = retry_policy.value.num_retries + retry_conditions = retry_policy.value.retry_conditions + dynamic "per_try_timeout" { + for_each = ( + retry_policy.value.per_try_timeout == null + ? [] + : [retry_policy.value.per_try_timeout] + ) + content { + nanos = per_try_timeout.value.nanos + seconds = per_try_timeout.value.seconds + } + } + } + } + dynamic "timeout" { + for_each = ( + route_action.value.timeout == null + ? [] + : [route_action.value.timeout] + ) + content { + nanos = timeout.value.nanos + seconds = timeout.value.seconds + } + } + dynamic "url_rewrite" { + for_each = ( + route_action.value.url_rewrite == null + ? [] + : [route_action.value.url_rewrite] + ) + content { + host_rewrite = url_rewrite.value.host + path_prefix_rewrite = url_rewrite.value.path_prefix + } + } + dynamic "weighted_backend_services" { + for_each = coalesce( + route_action.value.weighted_backend_services, {} + ) + iterator = service + content { + backend_service = lookup( + local.backend_ids, service.key, service.key + ) + weight = service.value.weight + dynamic "header_action" { + for_each = ( + service.value.header_action == null + ? [] + : [service.value.header_action] + ) + iterator = h + content { + request_headers_to_remove = h.value.request_remove + response_headers_to_remove = h.value.response_remove + dynamic "request_headers_to_add" { + for_each = coalesce(h.value.request_add, {}) + content { + header_name = request_headers_to_add.key + header_value = request_headers_to_add.value.value + replace = request_headers_to_add.value.replace + } + } + dynamic "response_headers_to_add" { + for_each = coalesce(h.value.response_add, {}) + content { + header_name = response_headers_to_add.key + header_value = response_headers_to_add.value.value + replace = response_headers_to_add.value.replace + } + } + } + } + } + } + } + } + dynamic "url_redirect" { + for_each = ( + route_rules.value.url_redirect == null + ? [] + : [route_rules.value.url_redirect] + ) + content { + host_redirect = url_redirect.value.host + https_redirect = url_redirect.value.https + path_redirect = url_redirect.value.path + prefix_redirect = url_redirect.value.prefix + redirect_response_code = url_redirect.value.response_code + strip_query = url_redirect.value.strip_query + } + } + } + } + } + } + + dynamic "test" { + for_each = toset(coalesce(var.urlmap_config.test, [])) + content { + host = test.value.host + path = test.value.path + service = test.value.service + description = test.value.description + } + } + +} diff --git a/modules/net-lb-app-ext-regional/variables-backend-service.tf b/modules/net-lb-app-ext-regional/variables-backend-service.tf new file mode 100644 index 00000000..c6b4d658 --- /dev/null +++ b/modules/net-lb-app-ext-regional/variables-backend-service.tf @@ -0,0 +1,144 @@ +/** + * Copyright 2023 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description Backend services variables. + +variable "backend_service_configs" { + description = "Backend service level configuration." + type = map(object({ + affinity_cookie_ttl_sec = optional(number) + connection_draining_timeout_sec = optional(number) + enable_cdn = optional(bool) + health_checks = optional(list(string), ["default"]) + log_sample_rate = optional(number) + port_name = optional(string) + project_id = optional(string) + protocol = optional(string) + security_policy = optional(string) + session_affinity = optional(string) + timeout_sec = optional(number) + backends = list(object({ + # group renamed to backend + backend = string + balancing_mode = optional(string, "UTILIZATION") + capacity_scaler = optional(number, 1) + description = optional(string, "Terraform managed.") + failover = optional(bool, false) + max_connections = optional(object({ + per_endpoint = optional(number) + per_group = optional(number) + per_instance = optional(number) + })) + max_rate = optional(object({ + per_endpoint = optional(number) + per_group = optional(number) + per_instance = optional(number) + })) + max_utilization = optional(number) + })) + cdn_policy = optional(object({ + cache_mode = optional(string) + client_ttl = optional(number) + default_ttl = optional(number) + max_ttl = optional(number) + negative_caching = optional(bool) + serve_while_stale = optional(number) + signed_url_cache_max_age_sec = optional(number) + cache_key_policy = optional(object({ + include_host = optional(bool) + include_named_cookies = optional(list(string)) + include_protocol = optional(bool) + include_query_string = optional(bool) + query_string_blacklist = optional(list(string)) + query_string_whitelist = optional(list(string)) + })) + negative_caching_policy = optional(object({ + code = optional(number) + ttl = optional(number) + })) + })) + circuit_breakers = optional(object({ + max_connections = optional(number) + max_pending_requests = optional(number) + max_requests = optional(number) + max_requests_per_connection = optional(number) + max_retries = optional(number) + connect_timeout = optional(object({ + seconds = number + nanos = optional(number) + })) + })) + consistent_hash = optional(object({ + http_header_name = optional(string) + minimum_ring_size = optional(number) + http_cookie = optional(object({ + name = optional(string) + path = optional(string) + ttl = optional(object({ + seconds = number + nanos = optional(number) + })) + })) + })) + iap_config = optional(object({ + oauth2_client_id = string + oauth2_client_secret = string + oauth2_client_secret_sha256 = optional(string) + })) + outlier_detection = optional(object({ + consecutive_errors = optional(number) + consecutive_gateway_failure = optional(number) + enforcing_consecutive_errors = optional(number) + enforcing_consecutive_gateway_failure = optional(number) + enforcing_success_rate = optional(number) + max_ejection_percent = optional(number) + success_rate_minimum_hosts = optional(number) + success_rate_request_volume = optional(number) + success_rate_stdev_factor = optional(number) + base_ejection_time = optional(object({ + seconds = number + nanos = optional(number) + })) + interval = optional(object({ + seconds = number + nanos = optional(number) + })) + })) + })) + default = {} + nullable = false + validation { + condition = alltrue([ + for backend_service in values(var.backend_service_configs) : contains( + [ + "NONE", "CLIENT_IP", "CLIENT_IP_NO_DESTINATION", + "CLIENT_IP_PORT_PROTO", "CLIENT_IP_PROTO" + ], + coalesce(backend_service.session_affinity, "NONE") + ) + ]) + error_message = "Invalid session affinity value." + } + validation { + condition = alltrue(flatten([ + for backend_service in values(var.backend_service_configs) : [ + for backend in backend_service.backends : contains( + ["RATE", "UTILIZATION"], coalesce(backend.balancing_mode, "UTILIZATION") + )] + ])) + error_message = "When specified, balancing mode needs to be 'RATE' or 'UTILIZATION'." + } +} diff --git a/modules/net-lb-app-ext-regional/variables-health-check.tf b/modules/net-lb-app-ext-regional/variables-health-check.tf new file mode 100644 index 00000000..be34d779 --- /dev/null +++ b/modules/net-lb-app-ext-regional/variables-health-check.tf @@ -0,0 +1,109 @@ +/** + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description Health check variable. + +variable "health_check_configs" { + description = "Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage." + type = map(object({ + check_interval_sec = optional(number) + description = optional(string, "Terraform managed.") + enable_logging = optional(bool, false) + healthy_threshold = optional(number) + project_id = optional(string) + timeout_sec = optional(number) + unhealthy_threshold = optional(number) + grpc = optional(object({ + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + service_name = optional(string) + })) + http = optional(object({ + host = optional(string) + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request_path = optional(string) + response = optional(string) + })) + http2 = optional(object({ + host = optional(string) + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request_path = optional(string) + response = optional(string) + })) + https = optional(object({ + host = optional(string) + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request_path = optional(string) + response = optional(string) + })) + tcp = optional(object({ + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request = optional(string) + response = optional(string) + })) + ssl = optional(object({ + port = optional(number) + port_name = optional(string) + port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT + proxy_header = optional(string) + request = optional(string) + response = optional(string) + })) + })) + default = { + default = { + http = { + port_specification = "USE_SERVING_PORT" + } + } + } + validation { + condition = alltrue([ + for k, v in var.health_check_configs : ( + (try(v.grpc, null) == null ? 0 : 1) + + (try(v.http, null) == null ? 0 : 1) + + (try(v.http2, null) == null ? 0 : 1) + + (try(v.https, null) == null ? 0 : 1) + + (try(v.tcp, null) == null ? 0 : 1) + + (try(v.ssl, null) == null ? 0 : 1) <= 1 + ) + ]) + error_message = "At most one health check type can be configured at a time." + } + validation { + condition = alltrue(flatten([ + for k, v in var.health_check_configs : [ + for kk, vv in v : contains([ + "-", "USE_FIXED_PORT", "USE_NAMED_PORT", "USE_SERVING_PORT" + ], coalesce(try(vv.port_specification, null), "-")) + ] + ])) + error_message = "Invalid 'port_specification' value. Supported values are 'USE_FIXED_PORT', 'USE_NAMED_PORT', 'USE_SERVING_PORT'." + } +} diff --git a/modules/net-lb-app-ext-regional/variables-urlmap.tf b/modules/net-lb-app-ext-regional/variables-urlmap.tf new file mode 100644 index 00000000..c3149c51 --- /dev/null +++ b/modules/net-lb-app-ext-regional/variables-urlmap.tf @@ -0,0 +1,303 @@ +/** + * Copyright 2023 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +# tfdoc:file:description URLmap variable. + +variable "urlmap_config" { + description = "The URL map configuration." + type = object({ + default_route_action = optional(object({ + request_mirror_backend = optional(string) + cors_policy = optional(object({ + allow_credentials = optional(bool) + allow_headers = optional(string) + allow_methods = optional(string) + allow_origin_regexes = list(string) + allow_origins = list(string) + disabled = optional(bool) + expose_headers = optional(string) + max_age = optional(string) + })) + fault_injection_policy = optional(object({ + abort = optional(object({ + percentage = number + status = number + })) + delay = optional(object({ + fixed = object({ + seconds = number + nanos = number + }) + percentage = number + })) + })) + retry_policy = optional(object({ + num_retries = number + retry_conditions = optional(list(string)) + per_try_timeout = optional(object({ + seconds = number + nanos = optional(number) + })) + })) + timeout = optional(object({ + seconds = number + nanos = optional(number) + })) + url_rewrite = optional(object({ + host = optional(string) + path_prefix = optional(string) + })) + weighted_backend_services = optional(map(object({ + weight = number + header_action = optional(object({ + request_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + request_remove = optional(list(string)) + response_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + response_remove = optional(list(string)) + })) + }))) + })) + default_service = optional(string) + default_url_redirect = optional(object({ + host = optional(string) + https = optional(bool) + path = optional(string) + prefix = optional(string) + response_code = optional(string) + strip_query = optional(bool, false) + })) + header_action = optional(object({ + request_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + request_remove = optional(list(string)) + response_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + response_remove = optional(list(string)) + })) + host_rules = optional(list(object({ + hosts = list(string) + path_matcher = string + description = optional(string) + }))) + path_matchers = optional(map(object({ + description = optional(string) + default_service = optional(string) + default_url_redirect = optional(object({ + host = optional(string) + https = optional(bool) + path = optional(string) + prefix = optional(string) + response_code = optional(string) + strip_query = optional(bool) + })) + path_rules = optional(list(object({ + paths = list(string) + service = optional(string) + route_action = optional(object({ + request_mirror_backend = optional(string) + cors_policy = optional(object({ + allow_credentials = optional(bool) + allow_headers = optional(string) + allow_methods = optional(string) + allow_origin_regexes = list(string) + allow_origins = list(string) + disabled = optional(bool) + expose_headers = optional(string) + max_age = optional(string) + })) + fault_injection_policy = optional(object({ + abort = optional(object({ + percentage = number + status = number + })) + delay = optional(object({ + fixed = object({ + seconds = number + nanos = number + }) + percentage = number + })) + })) + retry_policy = optional(object({ + num_retries = number + retry_conditions = optional(list(string)) + per_try_timeout = optional(object({ + seconds = number + nanos = optional(number) + })) + })) + timeout = optional(object({ + seconds = number + nanos = optional(number) + })) + url_rewrite = optional(object({ + host = optional(string) + path_prefix = optional(string) + })) + weighted_backend_services = optional(map(object({ + weight = number + header_action = optional(object({ + request_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + request_remove = optional(list(string)) + response_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + response_remove = optional(list(string)) + })) + }))) + })) + url_redirect = optional(object({ + host = optional(string) + https = optional(bool) + path = optional(string) + prefix = optional(string) + response_code = optional(string) + strip_query = optional(bool) + })) + }))) + route_rules = optional(list(object({ + priority = number + service = optional(string) + header_action = optional(object({ + request_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + request_remove = optional(list(string)) + response_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + response_remove = optional(list(string)) + })) + match_rules = optional(list(object({ + ignore_case = optional(bool, false) + headers = optional(list(object({ + name = string + invert_match = optional(bool, false) + type = optional(string, "present") # exact, prefix, suffix, regex, present, range + value = optional(string) + range_value = optional(object({ + end = string + start = string + })) + }))) + metadata_filters = optional(list(object({ + labels = map(string) + match_all = bool # MATCH_ANY, MATCH_ALL + }))) + path = optional(object({ + value = string + type = optional(string, "prefix") # full, prefix, regex + })) + query_params = optional(list(object({ + name = string + value = string + type = optional(string, "present") # exact, present, regex + }))) + }))) + route_action = optional(object({ + request_mirror_backend = optional(string) + cors_policy = optional(object({ + allow_credentials = optional(bool) + allow_headers = optional(string) + allow_methods = optional(string) + allow_origin_regexes = list(string) + allow_origins = list(string) + disabled = optional(bool) + expose_headers = optional(string) + max_age = optional(string) + })) + fault_injection_policy = optional(object({ + abort = optional(object({ + percentage = number + status = number + })) + delay = optional(object({ + fixed = object({ + seconds = number + nanos = number + }) + percentage = number + })) + })) + retry_policy = optional(object({ + num_retries = number + retry_conditions = optional(list(string)) + per_try_timeout = optional(object({ + seconds = number + nanos = optional(number) + })) + })) + timeout = optional(object({ + seconds = number + nanos = optional(number) + })) + url_rewrite = optional(object({ + host = optional(string) + path_prefix = optional(string) + })) + weighted_backend_services = optional(map(object({ + weight = number + header_action = optional(object({ + request_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + request_remove = optional(list(string)) + response_add = optional(map(object({ + value = string + replace = optional(bool, true) + }))) + response_remove = optional(list(string)) + })) + }))) + })) + url_redirect = optional(object({ + host = optional(string) + https = optional(bool) + path = optional(string) + prefix = optional(string) + response_code = optional(string) + strip_query = optional(bool) + })) + }))) + }))) + test = optional(list(object({ + host = string + path = string + service = string + description = optional(string) + }))) + }) + default = { + default_service = "default" + } +} diff --git a/modules/net-lb-app-ext-regional/variables.tf b/modules/net-lb-app-ext-regional/variables.tf new file mode 100644 index 00000000..85a00340 --- /dev/null +++ b/modules/net-lb-app-ext-regional/variables.tf @@ -0,0 +1,191 @@ +/** + * Copyright 2024 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +variable "address" { + description = "Optional IP address used for the forwarding rule." + type = string + default = null +} + +variable "description" { + description = "Optional description used for resources." + type = string + default = "Terraform managed." +} + +variable "group_configs" { + description = "Optional unmanaged groups to create. Can be referenced in backends via key or outputs." + type = map(object({ + zone = string + instances = optional(list(string)) + named_ports = optional(map(number), {}) + project_id = optional(string) + })) + default = {} + nullable = false +} + +variable "https_proxy_config" { + description = "HTTPS proxy connfiguration." + type = object({ + certificate_map = optional(string) + quic_override = optional(string) + ssl_policy = optional(string) + }) + default = {} + nullable = false +} + +variable "labels" { + description = "Labels set on resources." + type = map(string) + default = {} +} + +variable "name" { + description = "Load balancer name." + type = string +} + +variable "neg_configs" { + description = "Optional network endpoint groups to create. Can be referenced in backends via key or outputs." + type = map(object({ + description = optional(string) + cloudfunction = optional(object({ + region = string + target_function = optional(string) + target_urlmask = optional(string) + })) + cloudrun = optional(object({ + region = string + target_service = optional(object({ + name = string + tag = optional(string) + })) + target_urlmask = optional(string) + })) + gce = optional(object({ + network = string + subnetwork = string + zone = string + # default_port = optional(number) + endpoints = optional(map(object({ + instance = string + ip_address = string + port = number + }))) + })) + hybrid = optional(object({ + network = string + zone = string + # re-enable once provider properly support this + # default_port = optional(number) + endpoints = optional(map(object({ + ip_address = string + port = number + }))) + })) + psc = optional(object({ + region = string + target_service = string + network = optional(string) + subnetwork = optional(string) + })) + })) + default = {} + nullable = false + validation { + condition = alltrue([ + for k, v in var.neg_configs : ( + (try(v.cloudfunction, null) == null ? 0 : 1) + + (try(v.cloudrun, null) == null ? 0 : 1) + + (try(v.gce, null) == null ? 0 : 1) + + (try(v.hybrid, null) == null ? 0 : 1) + + (try(v.psc, null) == null ? 0 : 1) == 1 + ) + ]) + error_message = "Only one type of NEG can be configured at a time." + } + validation { + condition = alltrue([ + for k, v in var.neg_configs : ( + v.cloudrun == null + ? true + : v.cloudrun.target_urlmask != null || v.cloudrun.target_service != null + ) + ]) + error_message = "Cloud Run NEGs need either target service or target urlmask defined." + } + validation { + condition = alltrue([ + for k, v in var.neg_configs : ( + v.cloudfunction == null + ? true + : v.cloudfunction.target_urlmask != null || v.cloudfunction.target_function != null + ) + ]) + error_message = "Cloud Function NEGs need either target function or target urlmask defined." + } +} + +variable "ports" { + description = "Optional ports for HTTP load balancer, valid ports are 80 and 8080." + type = list(string) + default = null +} + +variable "project_id" { + description = "Project id." + type = string +} + +variable "protocol" { + description = "Protocol supported by this load balancer." + type = string + default = "HTTP" + nullable = false + validation { + condition = ( + var.protocol == null || var.protocol == "HTTP" || var.protocol == "HTTPS" + ) + error_message = "Protocol must be HTTP or HTTPS" + } +} + +variable "region" { + description = "Region where the load balancer is created." + type = string +} + +variable "ssl_certificates" { + description = "SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates." + type = object({ + certificate_ids = optional(list(string), []) + create_configs = optional(map(object({ + certificate = string + private_key = string + })), {}) + }) + default = {} + nullable = false +} + + +variable "vpc" { + description = "VPC-level configuration." + type = string + nullable = false +} diff --git a/modules/net-lb-app-ext-regional/versions.tf b/modules/net-lb-app-ext-regional/versions.tf new file mode 100644 index 00000000..5ec74cff --- /dev/null +++ b/modules/net-lb-app-ext-regional/versions.tf @@ -0,0 +1,27 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +terraform { + required_version = ">= 1.5.1" + required_providers { + google = { + source = "hashicorp/google" + version = ">= 5.10.0, < 6.0.0" # tftest + } + google-beta = { + source = "hashicorp/google-beta" + version = ">= 5.10.0, < 6.0.0" # tftest + } + } +} diff --git a/tests/fixtures/ssl-certificate.tf b/tests/fixtures/ssl-certificate.tf new file mode 100644 index 00000000..99c1fd43 --- /dev/null +++ b/tests/fixtures/ssl-certificate.tf @@ -0,0 +1,32 @@ +# Copyright 2024 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +resource "tls_private_key" "default" { + algorithm = "RSA" + rsa_bits = 2048 +} + +resource "tls_self_signed_cert" "default" { + private_key_pem = tls_private_key.default.private_key_pem + subject { + common_name = "example.com" + organization = "ACME Examples, Inc" + } + validity_period_hours = 720 + allowed_uses = [ + "key_encipherment", + "digital_signature", + "server_auth", + ] +} From 4e6d65b4664bb222f37b441823e0e194eadc059a Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Fri, 5 Jan 2024 17:30:34 +0100 Subject: [PATCH 12/13] Update README.md --- modules/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/README.md b/modules/README.md index b4740f8e..195265fd 100644 --- a/modules/README.md +++ b/modules/README.md @@ -48,10 +48,10 @@ These modules are used in the examples included in this repository. If you are u - [Firewall policy](./net-firewall-policy) - [External Application Load Balancer](./net-lb-app-ext/) - [External Passthrough Network Load Balancer](./net-lb-ext) +- [External Regional Application Load Balancer](./net-lb-app-ext-regional/) - [Internal Application Load Balancer](./net-lb-app-int) - [Internal Passthrough Network Load Balancer](./net-lb-int) - [Internal Proxy Network Load Balancer](./net-lb-proxy-int) -- [Internal ] - [NAT](./net-cloudnat) - [Service Directory](./service-directory) - [VPC](./net-vpc) From 6fbcf717d0a05dd69451ea0ac370b534ad8295a3 Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Fri, 5 Jan 2024 17:31:51 +0100 Subject: [PATCH 13/13] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4caa7e22..a2215d12 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ The current list of modules supports most of the core foundational and networkin Currently available modules: - **foundational** - [billing account](./modules/billing-account), [Cloud Identity group](./modules/cloud-identity-group/), [folder](./modules/folder), [service accounts](./modules/iam-service-account), [logging bucket](./modules/logging-bucket), [organization](./modules/organization), [project](./modules/project), [projects-data-source](./modules/projects-data-source) -- **networking** - [DNS](./modules/dns), [DNS Response Policy](./modules/dns-response-policy/), [Cloud Endpoints](./modules/endpoints), [address reservation](./modules/net-address), [NAT](./modules/net-cloudnat), [VLAN Attachment](./modules/net-vlan-attachment/), [External Application LB](./modules/net-lb-app-ext/), [External Passthrough Network LB](./modules/net-lb-ext), [Firewall policy](./modules/net-firewall-policy), [Internal Application LB](./modules/net-lb-app-int), [Internal Passthrough Network LB](./modules/net-lb-int), [Internal Proxy Network LB](./modules/net-lb-proxy-int), [IPSec over Interconnect](./modules/net-ipsec-over-interconnect), [VPC](./modules/net-vpc), [VPC firewall](./modules/net-vpc-firewall), [VPC peering](./modules/net-vpc-peering), [VPN dynamic](./modules/net-vpn-dynamic), [HA VPN](./modules/net-vpn-ha), [VPN static](./modules/net-vpn-static), [Service Directory](./modules/service-directory), [Secure Web Proxy](./modules/net-swp) +- **networking** - [DNS](./modules/dns), [DNS Response Policy](./modules/dns-response-policy/), [Cloud Endpoints](./modules/endpoints), [address reservation](./modules/net-address), [NAT](./modules/net-cloudnat), [VLAN Attachment](./modules/net-vlan-attachment/), [External Application LB](./modules/net-lb-app-ext/), [External Passthrough Network LB](./modules/net-lb-ext), [External Regional Application Load Balancer](./modules/net-lb-app-ext-regional/), [Firewall policy](./modules/net-firewall-policy), [Internal Application LB](./modules/net-lb-app-int), [Internal Passthrough Network LB](./modules/net-lb-int), [Internal Proxy Network LB](./modules/net-lb-proxy-int), [IPSec over Interconnect](./modules/net-ipsec-over-interconnect), [VPC](./modules/net-vpc), [VPC firewall](./modules/net-vpc-firewall), [VPC peering](./modules/net-vpc-peering), [VPN dynamic](./modules/net-vpn-dynamic), [HA VPN](./modules/net-vpn-ha), [VPN static](./modules/net-vpn-static), [Service Directory](./modules/service-directory), [Secure Web Proxy](./modules/net-swp) - **compute** - [VM/VM group](./modules/compute-vm), [MIG](./modules/compute-mig), [COS container](./modules/cloud-config-container/cos-generic-metadata/) (coredns, mysql, onprem, squid), [GKE cluster](./modules/gke-cluster-standard), [GKE hub](./modules/gke-hub), [GKE nodepool](./modules/gke-nodepool), [GCVE private cloud](./modules/gcve-private-cloud) - **data** - [BigQuery dataset](./modules/bigquery-dataset), [Bigtable instance](./modules/bigtable-instance), [Dataplex](./modules/dataplex), [Dataplex DataScan](./modules/dataplex-datascan/), [Cloud SQL instance](./modules/cloudsql-instance), [Data Catalog Policy Tag](./modules/data-catalog-policy-tag), [Datafusion](./modules/datafusion), [Dataproc](./modules/dataproc), [GCS](./modules/gcs), [Pub/Sub](./modules/pubsub) - **development** - [API Gateway](./modules/api-gateway), [Apigee](./modules/apigee), [Artifact Registry](./modules/artifact-registry), [Container Registry](./modules/container-registry), [Cloud Source Repository](./modules/source-repository), [Workstation cluster](./modules/workstation-cluster)