* Fix DNS E2E test + add one to net-lb-app-int-cross-region * Update README.md * Fix inventory for tests * Fix tests * Fix number of resources --------- Co-authored-by: Julio Castillo <jccb@google.com> |
||
---|---|---|
.. | ||
README.md | ||
backend-service.tf | ||
groups.tf | ||
health-check.tf | ||
main.tf | ||
outputs.tf | ||
urlmap.tf | ||
variables-backend-service.tf | ||
variables-health-check.tf | ||
variables-urlmap.tf | ||
variables.tf | ||
versions.tf |
README.md
Internal Application Load Balancer Module
This module allows managing Cross-regional Internal HTTP/HTTPS Load Balancers (L7 ILBs). It's designed to expose the full configuration of the underlying resources, and to facilitate common usage patterns by providing sensible defaults, and optionally managing prerequisite resources like health checks, instance groups, etc.
Due to the complexity of the underlying resources, changes to the configuration that involve recreation of resources are best applied in stages, starting by disabling the configuration in the urlmap that references the resources that need recreation, then doing the same for the backend service, etc.
Examples
Minimal Example
An HTTP ILB with a backend service pointing to a GCE instance group:
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
group = module.compute-mig.group_manager.instance_group
}]
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
(var.region) = var.subnet.self_link
}
}
}
# tftest modules=3 resources=7 fixtures=fixtures/compute-mig.tf e2e
An HTTPS ILB needs a few additional fields:
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig-ew1"
}, {
group = "projects/myprj/zones/europe-west4-a/instanceGroups/my-ig-ew4"
}]
}
}
protocol = "HTTPS"
https_proxy_config = {
certificate_manager_certificates = [
"projects/myprj/locations/global/certificates/certificate"
]
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=6
Cross-project backend services
When using Shared VPC, this module also allows configuring cross-project backend services:
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = "prj-host"
backend_service_configs = {
default = {
project_id = "prj-svc"
backends = [{
group = "projects/prj-svc/zones/europe-west1-a/instanceGroups/my-ig-ew1"
}, {
group = "projects/prj-svc/zones/europe-west4-a/instanceGroups/my-ig-ew4"
}]
}
}
health_check_configs = {
default = {
project_id = "prj-svc"
http = {
port_specification = "USE_SERVING_PORT"
}
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=6
Health Checks
You can leverage externally defined health checks for backend services, or have the module create them for you. By default a simple HTTP health check is created, and used in backend services.
Health check configuration is controlled via the health_check_configs
variable, which behaves in a similar way to other LB modules in this repository.
Defining different health checks from the default is very easy. You can for example replace the default HTTP health check with a TCP one and reference it in you backend service:
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig-ew1"
}, {
group = "projects/myprj/zones/europe-west4-a/instanceGroups/my-ig-ew4"
}]
health_checks = ["custom-tcp"]
}
}
health_check_configs = {
custom-tcp = {
tcp = { port = 80 }
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=6
To leverage existing health checks without having the module create them, simply pass their self links to backend services and set the health_check_configs
variable to an empty map:
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig-ew1"
}, {
group = "projects/myprj/zones/europe-west4-a/instanceGroups/my-ig-ew4"
}]
health_checks = ["projects/myprj/global/healthChecks/custom"]
}
}
health_check_configs = {}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=5
Instance Groups
The module can optionally create unmanaged instance groups, which can then be referred to in backends via their key:
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
port_name = "http"
backends = [
{ group = "europe-west1" },
{ group = "europe-west4" },
]
}
}
group_configs = {
europe-west1 = {
zone = "europe-west1-b"
instances = [
"projects/myprj/zones/europe-west1-b/instances/vm-a"
]
named_ports = { http = 80 }
}
europe-west4 = {
zone = "europe-west4-a"
instances = [
"projects/myprj/zones/europe-west1-b/instances/vm-b"
]
named_ports = { http = 80 }
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=8
Network Endpoint Groups (NEGs)
Network Endpoint Groups (NEGs) can be used as backends, by passing their id as the backend group in a backends service configuration:
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
balancing_mode = "RATE"
group = "projects/myprj/zones/europe-west1-a/networkEndpointGroups/my-neg-ew1"
max_rate = {
per_endpoint = 1
}
}, {
balancing_mode = "RATE"
group = "projects/myprj/zones/europe-west4-a/networkEndpointGroups/my-neg-ew4"
max_rate = {
per_endpoint = 1
}
}]
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=6
Similarly to instance groups, NEGs can also be managed by this module which supports GCE, hybrid, serverless and Private Service Connect NEGs:
Zonal NEG creation
resource "google_compute_address" "address_ew1" {
project = var.project_id
name = "neg-test-ew1"
subnetwork = var.subnet1.self_link
address_type = "INTERNAL"
address = "10.0.0.10"
region = "europe-west1"
}
resource "google_compute_address" "address_ew4" {
project = var.project_id
name = "neg-test-ew4"
subnetwork = var.subnet2.self_link
address_type = "INTERNAL"
address = "10.0.0.11"
region = "europe-west4"
}
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
balancing_mode = "RATE"
group = "my-neg-ew1"
max_rate = {
per_endpoint = 1
}
}, {
balancing_mode = "RATE"
group = "my-neg-ew4"
max_rate = {
per_endpoint = 1
}
}]
}
}
neg_configs = {
my-neg-ew1 = {
gce = {
zone = "europe-west1-b"
endpoints = {
e-0 = {
instance = "test-ew1"
ip_address = google_compute_address.address_ew1.address
port = 80
}
}
}
}
my-neg-ew4 = {
gce = {
zone = "europe-west4-b"
endpoints = {
e-0 = {
instance = "test-ew4"
ip_address = google_compute_address.address_ew4.address
port = 80
}
}
}
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=12
Hybrid NEG creation
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
balancing_mode = "RATE"
group = "neg-ew1"
max_rate = {
per_endpoint = 1
}
}, {
balancing_mode = "RATE"
group = "neg-ew4"
max_rate = {
per_endpoint = 1
}
}]
}
}
neg_configs = {
neg-ew1 = {
hybrid = {
zone = "europe-west1-b"
endpoints = {
e-0-ew1 = {
ip_address = "10.0.0.10"
port = 80
}
}
}
}
neg-ew4 = {
hybrid = {
zone = "europe-west4-b"
endpoints = {
e-0-ew4 = {
ip_address = "10.0.0.20"
port = 80
}
}
}
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet1.self_link
}
}
}
# tftest modules=1 resources=10
Serverless NEG creation
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
group = "neg"
}]
health_checks = []
}
}
health_check_configs = {}
neg_configs = {
neg-ew1 = {
cloudrun = {
region = "europe-west1"
target_service = {
name = "my-run-service-ew1"
}
}
}
neg-ew4 = {
cloudrun = {
region = "europe-west4"
target_service = {
name = "my-run-service-ew4"
}
}
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=7
Private Service Connect NEG creation
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
group = "neg-ew1"
}, {
group = "neg-ew4"
}]
health_checks = []
}
}
health_check_configs = {}
neg_configs = {
neg-ew1 = {
psc = {
region = "europe-west1"
target_service = "europe-west1-cloudkms.googleapis.com"
}
}
neg-ew4 = {
psc = {
region = "europe-west4"
target_service = "europe-west4-cloudkms.googleapis.com"
}
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=7
URL Map
The module exposes the full URL map resource configuration, with some minor changes to the interface to decrease verbosity, and support for aliasing backend services via keys.
The default URL map configuration sets the default
backend service as the default service for the load balancer as a convenience. Just override the urlmap_config
variable to change the default behaviour:
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-test"
project_id = var.project_id
backend_service_configs = {
default = {
backends = [{
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig-1-ew1"
}, {
group = "projects/myprj/zones/europe-west4-a/instanceGroups/my-ig-1-ew4"
}]
}
video = {
backends = [{
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig-2-ew1"
}, {
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig-2-ew4"
}]
}
}
urlmap_config = {
default_service = "default"
host_rules = [{
hosts = ["*"]
path_matcher = "pathmap"
}]
path_matchers = {
pathmap = {
default_service = "default"
path_rules = [{
paths = ["/video", "/video/*"]
service = "video"
}]
}
}
}
vpc_config = {
network = var.vpc.self_link
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=7
Complex example
This example mixes group and NEG backends, and shows how to set HTTPS for specific backends.
module "ilb-l7" {
source = "./fabric/modules/net-lb-app-int-cross-region"
name = "ilb-l7-test-0"
project_id = "prj-gce"
backend_service_configs = {
default = {
backends = [
{ group = "nginx-ew1" },
{ group = "nginx-ew4" },
]
}
gce-neg = {
backends = [{
balancing_mode = "RATE"
group = "neg-nginx-ew1"
max_rate = {
per_endpoint = 1
}
}, {
balancing_mode = "RATE"
group = "neg-nginx-ew4"
max_rate = {
per_endpoint = 1
}
}]
}
home = {
backends = [{
balancing_mode = "RATE"
group = "neg-home-hello-ew1"
max_rate = {
per_endpoint = 1
}
}, {
balancing_mode = "RATE"
group = "neg-home-hello-ew4"
max_rate = {
per_endpoint = 1
}
}]
health_checks = ["neg"]
locality_lb_policy = "ROUND_ROBIN"
protocol = "HTTPS"
}
}
group_configs = {
nginx-ew1 = {
zone = "europe-west1-b"
instances = [
"projects/prj-gce/zones/europe-west1-b/instances/nginx-ew1"
]
named_ports = { http = 80 }
}
nginx-ew4 = {
zone = "europe-west4-b"
instances = [
"projects/prj-gce/zones/europe-west4-b/instances/nginx-ew4"
]
named_ports = { http = 80 }
}
}
health_check_configs = {
default = {
http = {
port = 80
}
}
neg = {
https = {
host = "hello.home.example.com"
port = 443
}
}
}
neg_configs = {
neg-nginx-ew1 = {
gce = {
zone = "europe-west1-c"
endpoints = {
e-0 = {
instance = "nginx-ew1-c"
ip_address = "10.24.32.26"
port = 80
}
}
}
}
neg-nginx-ew4 = {
gce = {
zone = "europe-west4-c"
endpoints = {
e-0 = {
instance = "nginx-ew4-c"
ip_address = "10.34.32.26"
port = 80
}
}
}
}
neg-home-hello-ew1 = {
hybrid = {
zone = "europe-west1-b"
endpoints = {
e-0 = {
ip_address = "192.168.0.3"
port = 443
}
}
}
}
neg-home-hello-ew4 = {
hybrid = {
zone = "europe-west4-b"
endpoints = {
e-0 = {
ip_address = "192.168.1.3"
port = 443
}
}
}
}
}
urlmap_config = {
default_service = "default"
host_rules = [
{
hosts = ["*"]
path_matcher = "gce"
},
{
hosts = ["hello.home.example.com"]
path_matcher = "home"
}
]
path_matchers = {
gce = {
default_service = "default"
path_rules = [
{
paths = ["/gce-neg", "/gce-neg/*"]
service = "gce-neg"
}
]
}
home = {
default_service = "home"
}
}
}
vpc_config = {
network = "projects/prj-host/global/networks/shared-vpc"
subnetworks = {
europe-west1 = var.subnet1.self_link
europe-west4 = var.subnet2.self_link
}
}
}
# tftest modules=1 resources=19
Files
name | description | resources |
---|---|---|
backend-service.tf | Backend service resources. | google_compute_backend_service |
groups.tf | None | google_compute_instance_group |
health-check.tf | Health check resource. | google_compute_health_check |
main.tf | Module-level locals and resources. | google_compute_global_forwarding_rule · google_compute_network_endpoint · google_compute_network_endpoint_group · google_compute_region_network_endpoint_group · google_compute_target_http_proxy · google_compute_target_https_proxy |
outputs.tf | Module outputs. | |
urlmap.tf | URL map resources. | google_compute_url_map |
variables-backend-service.tf | Backend services variables. | |
variables-health-check.tf | Health check variable. | |
variables-urlmap.tf | URLmap variable. | |
variables.tf | Module variables. | |
versions.tf | Version pins. |
Variables
name | description | type | required | default |
---|---|---|---|---|
name | Load balancer name. | string |
✓ | |
project_id | Project id. | string |
✓ | |
vpc_config | VPC-level configuration. | object({…}) |
✓ | |
addresses | Optional IP address used for the forwarding rule. | map(string) |
null |
|
backend_service_configs | Backend service level configuration. | map(object({…})) |
{} |
|
description | Optional description used for resources. | string |
"Terraform managed." |
|
group_configs | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | map(object({…})) |
{} |
|
health_check_configs | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) |
{…} |
|
https_proxy_config | HTTPS proxy connfiguration. | object({…}) |
{} |
|
labels | Labels set on resources. | map(string) |
{} |
|
neg_configs | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) |
{} |
|
network_tier_premium | Use premium network tier. Defaults to true. | bool |
true |
|
ports | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) |
null |
|
protocol | Protocol supported by this load balancer. | string |
"HTTP" |
|
service_directory_registration | Service directory namespace and service used to register this load balancer. | object({…}) |
null |
|
urlmap_config | The URL map configuration. | object({…}) |
{…} |
Outputs
name | description | sensitive |
---|---|---|
addresses | Forwarding rule address. | |
backend_service_ids | Backend service resources. | |
backend_service_names | Backend service resource names. | |
forwarding_rules | Forwarding rule resource. | |
group_ids | Autogenerated instance group ids. | |
health_check_ids | Autogenerated health check ids. | |
ids | Fully qualified forwarding rule ids. | |
neg_ids | Autogenerated network endpoint group ids. | |
psc_neg_ids | Autogenerated PSC network endpoint group ids. | |
regional_neg_ids | Autogenerated regional network endpoint group ids. |