zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into agutta-patch-1

This commit is contained in:
agutta 2022-12-20 09:35:04 -06:00 committed by GitHub
parent a128333223 ba8d14afb5
commit e8f556d084
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 68 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
modules/cloudsql-instance/README.md
View File

@ -146,28 +146,29 @@ module "db" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [database_version](variables.tf#L49) | Database type and version to create. | <code>string</code> | ✓ | |
| [name](variables.tf#L102) | Name of primary instance. | <code>string</code> | ✓ | |
| [network](variables.tf#L107) | VPC self link where the instances will be deployed. Private Service Networking must be enabled and configured in this VPC. | <code>string</code> | ✓ | |
| [project_id](variables.tf#L128) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
| [region](variables.tf#L133) | Region of the primary instance. | <code>string</code> | ✓ | |
| [tier](variables.tf#L153) | The machine type to use for the instances. | <code>string</code> | ✓ | |
| [authorized_networks](variables.tf#L17) | Map of NAME=>CIDR_RANGE to allow to connect to the database(s). | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [availability_type](variables.tf#L23) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>&#34;ZONAL&#34;</code> |
| [backup_configuration](variables.tf#L29) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object&#40;&#123;&#10; enabled &#61; bool&#10; binary_log_enabled &#61; bool&#10; start_time &#61; string&#10; location &#61; string&#10; log_retention_days &#61; number&#10; retention_count &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; enabled &#61; false&#10; binary_log_enabled &#61; false&#10; start_time &#61; &#34;23:00&#34;&#10; location &#61; null&#10; log_retention_days &#61; 7&#10; retention_count &#61; 7&#10;&#125;">&#123;&#8230;&#125;</code> |
| [databases](variables.tf#L54) | Databases to create once the primary instance is created. | <code>list&#40;string&#41;</code> | | <code>null</code> |
| [deletion_protection](variables.tf#L60) | Allow terraform to delete instances. | <code>bool</code> | | <code>false</code> |
| [disk_size](variables.tf#L66) | Disk size in GB. Set to null to enable autoresize. | <code>number</code> | | <code>null</code> |
| [disk_type](variables.tf#L72) | The type of data disk: `PD_SSD` or `PD_HDD`. | <code>string</code> | | <code>&#34;PD_SSD&#34;</code> |
| [encryption_key_name](variables.tf#L78) | The full path to the encryption key used for the CMEK disk encryption of the primary instance. | <code>string</code> | | <code>null</code> |
| [flags](variables.tf#L84) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [ipv4_enabled](variables.tf#L90) | Add a public IP address to database instance. | <code>bool</code> | | <code>false</code> |
| [labels](variables.tf#L96) | Labels to be attached to all instances. | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [postgres_client_certificates](variables.tf#L112) | Map of cert keys connect to the application(s) using public IP. | <code>list&#40;string&#41;</code> | | <code>null</code> |
| [prefix](variables.tf#L118) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
| [replicas](variables.tf#L138) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map&#40;object&#40;&#123;&#10; region &#61; string&#10; encryption_key_name &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [root_password](variables.tf#L147) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> | | <code>null</code> |
| [users](variables.tf#L158) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [database_version](variables.tf#L58) | Database type and version to create. | <code>string</code> | ✓ | |
| [name](variables.tf#L111) | Name of primary instance. | <code>string</code> | ✓ | |
| [network](variables.tf#L116) | VPC self link where the instances will be deployed. Private Service Networking must be enabled and configured in this VPC. | <code>string</code> | ✓ | |
| [project_id](variables.tf#L137) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
| [region](variables.tf#L142) | Region of the primary instance. | <code>string</code> | ✓ | |
| [tier](variables.tf#L162) | The machine type to use for the instances. | <code>string</code> | ✓ | |
| [allocated_ip_ranges](variables.tf#L17) | (Optional)The name of the allocated ip range for the private ip CloudSQL instance. For example: \"google-managed-services-default\". If set, the instance ip will be created in the allocated range. The range name must comply with RFC 1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z?. | <code title="object&#40;&#123;&#10; primary &#61; optional&#40;string&#41;&#10; replica &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [authorized_networks](variables.tf#L26) | Map of NAME=>CIDR_RANGE to allow to connect to the database(s). | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [availability_type](variables.tf#L32) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>&#34;ZONAL&#34;</code> |
| [backup_configuration](variables.tf#L38) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object&#40;&#123;&#10; enabled &#61; bool&#10; binary_log_enabled &#61; bool&#10; start_time &#61; string&#10; location &#61; string&#10; log_retention_days &#61; number&#10; retention_count &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; enabled &#61; false&#10; binary_log_enabled &#61; false&#10; start_time &#61; &#34;23:00&#34;&#10; location &#61; null&#10; log_retention_days &#61; 7&#10; retention_count &#61; 7&#10;&#125;">&#123;&#8230;&#125;</code> |
| [databases](variables.tf#L63) | Databases to create once the primary instance is created. | <code>list&#40;string&#41;</code> | | <code>null</code> |
| [deletion_protection](variables.tf#L69) | Allow terraform to delete instances. | <code>bool</code> | | <code>false</code> |
| [disk_size](variables.tf#L75) | Disk size in GB. Set to null to enable autoresize. | <code>number</code> | | <code>null</code> |
| [disk_type](variables.tf#L81) | The type of data disk: `PD_SSD` or `PD_HDD`. | <code>string</code> | | <code>&#34;PD_SSD&#34;</code> |
| [encryption_key_name](variables.tf#L87) | The full path to the encryption key used for the CMEK disk encryption of the primary instance. | <code>string</code> | | <code>null</code> |
| [flags](variables.tf#L93) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [ipv4_enabled](variables.tf#L99) | Add a public IP address to database instance. | <code>bool</code> | | <code>false</code> |
| [labels](variables.tf#L105) | Labels to be attached to all instances. | <code>map&#40;string&#41;</code> | | <code>null</code> |
| [postgres_client_certificates](variables.tf#L121) | Map of cert keys connect to the application(s) using public IP. | <code>list&#40;string&#41;</code> | | <code>null</code> |
| [prefix](variables.tf#L127) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
| [replicas](variables.tf#L147) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map&#40;object&#40;&#123;&#10; region &#61; string&#10; encryption_key_name &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [root_password](variables.tf#L156) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> | | <code>null</code> |
| [users](variables.tf#L167) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map&#40;string&#41;</code> | | <code>null</code> |
## Outputs

10
modules/cloudsql-instance/main.tf
View File

@ -61,8 +61,9 @@ resource "google_sql_database_instance" "primary" {
user_labels = var.labels
ip_configuration {
ipv4_enabled = var.ipv4_enabled
private_network = var.network
ipv4_enabled = var.ipv4_enabled
private_network = var.network
allocated_ip_range = var.allocated_ip_ranges.primary
dynamic "authorized_networks" {
for_each = var.authorized_networks != null ? var.authorized_networks : {}
iterator = network
@ -126,8 +127,9 @@ resource "google_sql_database_instance" "replicas" {
user_labels = var.labels
ip_configuration {
ipv4_enabled = var.ipv4_enabled
private_network = var.network
ipv4_enabled = var.ipv4_enabled
private_network = var.network
allocated_ip_range = var.allocated_ip_ranges.replica
dynamic "authorized_networks" {
for_each = var.authorized_networks != null ? var.authorized_networks : {}
iterator = network

9
modules/cloudsql-instance/variables.tf
View File

@ -14,6 +14,15 @@
* limitations under the License.
*/
variable "allocated_ip_ranges" {
description = "(Optional)The name of the allocated ip range for the private ip CloudSQL instance. For example: \"google-managed-services-default\". If set, the instance ip will be created in the allocated range. The range name must comply with RFC 1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z?."
type = object({
primary = optional(string)
replica = optional(string)
})
default = {}
nullable = false
}
variable "authorized_networks" {
description = "Map of NAME=>CIDR_RANGE to allow to connect to the database(s)."
type = map(string)

5
modules/gke-cluster/main.tf
View File

@ -15,6 +15,11 @@
*/
resource "google_container_cluster" "cluster" {
lifecycle {
ignore_changes = [
node_config[0].boot_disk_kms_key
]
}
provider = google-beta
project = var.project_id
name = var.name

2
modules/gke-cluster/variables.tf
View File

@ -225,4 +225,4 @@ variable "vpc_config" {
master_authorized_ranges = optional(map(string))
})
nullable = false
}
}

23
modules/net-vpc-firewall/README.md
View File

@ -143,7 +143,7 @@ module "firewall" {
}
default_rules_config = { disabled = true }
}
# tftest modules=1 resources=1 files=lbs,cidrs
# tftest modules=1 resources=3 files=lbs,cidrs
```
```yaml
@ -151,7 +151,7 @@ module "firewall" {
ingress:
allow-healthchecks:
description: Allow ingress from healthchecks.
ranges:
source_ranges:
- healthchecks
targets: ["lb-backends"]
rules:
@ -159,6 +159,25 @@ ingress:
ports:
- 80
- 443
allow-service-1-to-service-2:
description: Allow ingress from service-1 SA
targets: ["service-2"]
use_service_accounts: true
sources:
- service-1@my-project.iam.gserviceaccount.com
rules:
- protocol: tcp
ports:
- 80
- 443
egress:
block-telnet:
description: block outbound telnet
deny: true
rules:
- protocol: tcp
ports:
- 23
```
```yaml

4
modules/net-vpc-firewall/main.tf
View File

@ -29,12 +29,12 @@ locals {
deny = try(rule.deny, false)
rules = try(rule.rules, [{ protocol = "all" }])
description = try(rule.description, null)
destination_ranges = try(rule.ranges, null)
destination_ranges = try(rule.destination_ranges, null)
direction = upper(direction)
disabled = try(rule.disabled, null)
enable_logging = try(rule.enable_logging, null)
priority = try(rule.priority, 1000)
source_ranges = try(rule.ranges, null)
source_ranges = try(rule.source_ranges, null)
sources = try(rule.sources, null)
targets = try(rule.targets, null)
use_service_accounts = try(rule.use_service_accounts, false)

2
tests/modules/net_vpc_firewall/fixture/config/firewall/load_balancers.yaml
View File

@ -15,7 +15,7 @@
ingress:
allow-healthchecks:
description: Allow ingress from healthchecks.
ranges:
source_ranges:
- healthchecks
targets: ["lb-backends"]
rules: