789328ff5a
* bump provider versions to 5.0.0 * fix cloud run, logging and vpc-sc * Fix secret manager * fix gke nodepool * fix gke multitenant stage and blueprint * Moving alloydb module to experimental. * Add project to bare resources in examples * tfdoc * fix svpc blueprint test * Revert "fix svpc blueprint test" This reverts commit 14f02659098070136e64ead600580dd52c23c339. * Fix GKE peering project * Disable tests in alloydb module * Bring back secret ids in secret manager tests * Remove duplicate key * last push --------- Co-authored-by: Julio Castillo <jccb@google.com> |
||
---|---|---|
.. | ||
README.md | ||
main.tf | ||
outputs.tf | ||
variables.tf | ||
versions.tf |
README.md
Google Cloud Service Directory Module
This module allows managing a single Service Directory namespace, including multiple services, endpoints and IAM bindings at the namespace and service levels.
It can be used in conjunction with the DNS module to create [service-directory based DNS zones](https://cloud.google.com/service-directory/docs/configuring-service-directory-zone, offloading IAM control of A
and SRV
records at the namespace or service level to Service Directory. The last examples shows how to wire the two modules together.
Examples
Namespace with IAM
module "service-directory" {
source = "./fabric/modules/service-directory"
project_id = "my-project"
location = "europe-west1"
name = "sd-1"
iam = {
"roles/servicedirectory.editor" = [
"serviceAccount:namespace-editor@example.com"
]
}
}
# tftest modules=1 resources=2 inventory=simple.yaml
Services with IAM and endpoints
module "service-directory" {
source = "./fabric/modules/service-directory"
project_id = "my-project"
location = "europe-west1"
name = "sd-1"
services = {
one = {
endpoints = ["first", "second"]
metadata = null
}
}
service_iam = {
one = {
"roles/servicedirectory.editor" = [
"serviceAccount:service-editor.example.com"
]
}
}
endpoint_config = {
"one/first" = { address = "127.0.0.1", port = 80, metadata = {} }
"one/second" = { address = "127.0.0.2", port = 80, metadata = {} }
}
}
# tftest modules=1 resources=5 inventory=services.yaml
DNS based zone
Wiring a service directory namespace to a private DNS zone allows querying the namespace, and delegating control of DNS records at the namespace or service level. This effectively allows fine grained ACL control of Cloud DNS zones.
module "service-directory" {
source = "./fabric/modules/service-directory"
project_id = "my-project"
location = "europe-west1"
name = "apps"
iam = {
"roles/servicedirectory.editor" = [
"serviceAccount:namespace-editor@example.com"
]
}
services = {
app1 = { endpoints = ["one"], metadata = null }
}
endpoint_config = {
"app1/one" = { address = "127.0.0.1", port = 80, metadata = {} }
}
}
module "dns-sd" {
source = "./fabric/modules/dns"
project_id = "my-project"
name = "apps"
zone_config = {
domain = "apps.example.org."
private = {
client_networks = [var.vpc.self_link]
service_directory_namespace = module.service-directory.id
}
}
}
# tftest modules=2 resources=6 inventory=dns.yaml
Variables
name | description | type | required | default |
---|---|---|---|---|
location | Namespace location. | string |
✓ | |
name | Namespace name. | string |
✓ | |
project_id | Project used for resources. | string |
✓ | |
endpoint_config | Map of endpoint attributes, keys are in service/endpoint format. | map(object({…})) |
{} |
|
iam | IAM bindings for namespace, in {ROLE => [MEMBERS]} format. | map(list(string)) |
{} |
|
labels | Labels. | map(string) |
{} |
|
service_iam | IAM bindings for services, in {SERVICE => {ROLE => [MEMBERS]}} format. | map(map(list(string))) |
{} |
|
services | Service configuration, using service names as keys. | map(object({…})) |
{} |
Outputs
name | description | sensitive |
---|---|---|
endpoints | Endpoint resources. | |
id | Fully qualified namespace id. | |
name | Namespace name. | |
namespace | Namespace resource. | |
service_id | Service ids (short names). | |
service_names | Service ids (long names). | |
services | Service resources. |