cloud-foundation-fabric/modules/service-directory

Google Cloud Service Directory Module

This module allows managing a single Service Directory namespace, including multiple services, endpoints and IAM bindings at the namespace and service levels.

It can be used in conjunction with the DNS module to create [service-directory based DNS zones](https://cloud.google.com/service-directory/docs/configuring-service-directory-zone, offloading IAM control of A and SRV records at the namespace or service level to Service Directory. The last examples shows how to wire the two modules together.

Examples

Namespace with IAM

module "service-directory" {
  source      = "./modules/service-directory"
  project_id  = "my-project"
  location    = "europe-west1"
  name        = "sd-1"
  iam = {
    "roles/servicedirectory.editor" = [
      "serviceAccount:namespace-editor@example.com"
    ]
  }
}
# tftest:modules=1:resources=2

Services with IAM and endpoints

module "service-directory" {
  source      = "./modules/service-directory"
  project_id  = "my-project"
  location    = "europe-west1"
  name        = "sd-1"
  services = {
    one = {
      endpoints = ["first", "second"]
      metadata  = null
    }
  }
  service_iam = {
    one = {
      "roles/servicedirectory.editor" = [
        "serviceAccount:service-editor.example.com"
      ]
    }
  }
  endpoint_config = {
    "one/first"  = { address = "127.0.0.1", port = 80, metadata = {} }
    "one/second" = { address = "127.0.0.2", port = 80, metadata = {} }
  }
}
# tftest:modules=1:resources=5

DNS based zone

Wiring a service directory namespace to a private DNS zone allows querying the namespace, and delegating control of DNS records at the namespace or service level. This effectively allows fine grained ACL control of Cloud DNS zones.

module "service-directory" {
  source      = "./modules/service-directory"
  project_id  = "my-project"
  location    = "europe-west1"
  name       = "apps"
  iam = {
    "roles/servicedirectory.editor" = [
      "serviceAccount:namespace-editor@example.com"
    ]
  }
  services = {
    app1 = { endpoints = ["one"], metadata = null }
  }
  endpoint_config = {
    "app1/one" = { address = "127.0.0.1", port = 80, metadata = {} }
  }
}

module "dns-sd" {
  source                      = "./modules/dns"
  project_id                  = "my-project"
  type                        = "service-directory"
  name                        = "apps"
  domain                      = "apps.example.org."
  client_networks             = [var.vpc.self_link]
  service_directory_namespace = module.service-directory.id
}
# tftest:modules=2:resources=5

Variables

name	description	type	required	default
location	Namespace location.	string	✓
name	Namespace name.	string	✓
project_id	Project used for resources.	string	✓
endpoint_config	Map of endpoint attributes, keys are in service/endpoint format.	map(object({...}))		{}
iam	IAM bindings for namespace, in {ROLE => [MEMBERS]} format.	map(list(string))		{}
labels	Labels.	map(string)		{}
service_iam	IAM bindings for services, in {SERVICE => {ROLE => [MEMBERS]}} format.	map(map(list(string)))		{}
services	Service configuration, using service names as keys.	map(object({...}))		{}

Outputs

name	description	sensitive
endpoints	Endpoint resources.
id	Namespace id (short name).
name	Namespace name (long name).
namespace	Namespace resource.
service_id	Service ids (short names).
service_names	Service ids (long names).
services	Service resources.