History

Simone Ruffilli 6d89b88149 versions.tf maintenance + copyright notice bump (#1782 ) * Bump copyright notice to 2023 * Delete versions.tf on blueprints * Pin provider to major version 5 * Remove comment * Fix lint * fix bq-ml blueprint readme --------- Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com> Co-authored-by: Julio Castillo <jccb@google.com>		2023-10-20 18:17:47 +02:00
..
assets	versions.tf maintenance + copyright notice bump (#1782 )	2023-10-20 18:17:47 +02:00
README.md	Fix dnssec keys lookup (#1728 )	2023-10-03 21:37:21 +02:00
diagram.png	Rename examples folder to blueprints	2022-09-09 16:38:43 +02:00
main.tf	Refactoring of dns module	2023-07-19 12:57:44 +02:00
outputs.tf	Rename examples folder to blueprints	2022-09-09 16:38:43 +02:00
variables.tf	Rename examples folder to blueprints	2022-09-09 16:38:43 +02:00

README.md

Calling a private Cloud Function from On-premises

This example shows how to invoke a private Google Cloud Function from the on-prem environment via a Private Service Connect endpoint.

According to the documentation, only requests from VPC networks in the same project or VPC Service Controls perimeter are allowed to call a private Cloud Function. That's the reason why a Private Service Connect endpoint is needed in this architecture.

The Terraform script in this folder will create two projects connected via VPN: one to simulate the on-prem environment and another containing the Cloud Function and the Private Service Connect endpoint.

The "on-prem" project contains a small VM that can be used to test the accessibility to the private Cloud Function:

curl https://YOUR_REGION-YOUR_PROJECT_ID.cloudfunctions.net/YOUR_FUNCTION_NAME

Variables

name	description	type	required	default
project_id	Project id.	`string`	✓
ip_ranges	IP ranges used for the VPCs.	`object({…})`		`{…}`
name	Name used for new resources.	`string`		`"cf-via-psc"`
project_create	If non null, creates project instead of using an existing one.	`object({…})`		`null`
psc_endpoint	IP used for the Private Service Connect endpoint, it must not overlap with the hub_ip_range.	`string`		`"172.16.32.1"`
region	Region where the resources will be created.	`string`		`"europe-west1"`

Outputs

name	description	sensitive
function_url	URL of the Cloud Function.

Test

module "test" {
  source = "./fabric/blueprints/networking/private-cloud-function-from-onprem/"
  project_create = {
    billing_account_id = "123456-ABCDEF-123456"
    parent             = "folders/1234567890"
  }
  project_id = "test-project"
}
# tftest modules=11 resources=44