624 lines
39 KiB
Markdown
624 lines
39 KiB
Markdown
# Internal (HTTP/S) Load Balancer Module
|
|
|
|
This module allows managing Internal HTTP/HTTPS Load Balancers (L7 ILBs). It's designed to expose the full configuration of the underlying resources, and to facilitate common usage patterns by providing sensible defaults, and optionally managing prerequisite resources like health checks, instance groups, etc.
|
|
|
|
Due to the complexity of the underlying resources, changes to the configuration that involve recreation of resources are best applied in stages, starting by disabling the configuration in the urlmap that references the resources that neeed recreation, then doing the same for the backend service, etc.
|
|
|
|
## Examples
|
|
|
|
- [Minimal Example](#minimal-example)
|
|
- [Cross-project Backend Services](#cross-project-backend-services)
|
|
- [Health Checks](#health-checks)
|
|
- [Instance Groups](#instance-groups)
|
|
- [Network Endpoint Groups](#network-endpoint-groups-negs)
|
|
- [URL Map](#url-map)
|
|
- [SSL Certificates](#ssl-certificates)
|
|
- [Complex Example](#complex-example)
|
|
|
|
### Minimal Example
|
|
|
|
An HTTP ILB with a backend service pointing to a GCE instance group:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
|
|
}]
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=5
|
|
```
|
|
|
|
An HTTPS ILB needs a few additional fields:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
|
|
}]
|
|
}
|
|
}
|
|
protocol = "HTTPS"
|
|
ssl_certificates = {
|
|
certificate_ids = [
|
|
"projects/myprj/regions/europe-west1/sslCertificates/my-cert"
|
|
]
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=5
|
|
```
|
|
|
|
### Cross-project backend services
|
|
|
|
When using Shared VPC, this module also allows configuring [cross-project backend services](https://cloud.google.com/load-balancing/docs/l7-internal/l7-internal-shared-vpc#cross-project):
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = "prj-host"
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
project_id = "prj-svc"
|
|
backends = [{
|
|
group = "projects/prj-svc/zones/europe-west1-a/instanceGroups/my-ig"
|
|
}]
|
|
}
|
|
}
|
|
health_check_configs = {
|
|
default = {
|
|
project_id = "prj-svc"
|
|
http = {
|
|
port_specification = "USE_SERVING_PORT"
|
|
}
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=5
|
|
```
|
|
|
|
### Health Checks
|
|
|
|
You can leverage externally defined health checks for backend services, or have the module create them for you. By default a simple HTTP health check is created, and used in backend services.
|
|
|
|
Health check configuration is controlled via the `health_check_configs` variable, which behaves in a similar way to other LB modules in this repository.
|
|
|
|
Defining different health checks fromt he default is very easy. You can for example replace the default HTTP health check with a TCP one and reference it in you backend service:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
|
|
}]
|
|
health_checks = ["custom-tcp"]
|
|
}
|
|
}
|
|
health_check_configs = {
|
|
custom-tcp = {
|
|
tcp = { port = 80 }
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=5
|
|
```
|
|
|
|
To leverage existing health checks without having the module create them, simply pass their self links to backend services and set the `health_check_configs` variable to an empty map:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
|
|
}]
|
|
health_checks = ["projects/myprj/global/healthChecks/custom"]
|
|
}
|
|
}
|
|
health_check_configs = {}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=4
|
|
```
|
|
|
|
### Instance Groups
|
|
|
|
The module can optionally create unmanaged instance groups, which can then be referred to in backends via their key:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
port_name = "http"
|
|
backends = [
|
|
{ group = "default" }
|
|
]
|
|
}
|
|
}
|
|
group_configs = {
|
|
default = {
|
|
zone = "europe-west1-b"
|
|
instances = [
|
|
"projects/myprj/zones/europe-west1-b/instances/vm-a"
|
|
]
|
|
named_ports = { http = 80 }
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=6
|
|
```
|
|
|
|
### Network Endpoint Groups (NEGs)
|
|
|
|
Network Endpoint Groups (NEGs) can be used as backends, by passing their id as the backend group in a backends service configuration:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
balancing_mode = "RATE"
|
|
group = "projects/myprj/zones/europe-west1-a/networkEndpointGroups/my-neg"
|
|
max_rate = { per_endpoint = 1 }
|
|
}]
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=5
|
|
```
|
|
|
|
Similarly to instance groups, NEGs can also be managed by this module which supports GCE, hybrid, and serverless NEGs:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
balancing_mode = "RATE"
|
|
group = "my-neg"
|
|
max_rate = { per_endpoint = 1 }
|
|
}]
|
|
}
|
|
}
|
|
neg_configs = {
|
|
my-neg = {
|
|
gce = {
|
|
zone = "europe-west1-b"
|
|
endpoints = [{
|
|
instance = "test-1"
|
|
ip_address = "10.0.0.10"
|
|
port = 80
|
|
}]
|
|
}
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=7
|
|
```
|
|
|
|
Hybrid NEGs are also supported:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
balancing_mode = "RATE"
|
|
group = "my-neg"
|
|
max_rate = { per_endpoint = 1 }
|
|
}]
|
|
}
|
|
}
|
|
neg_configs = {
|
|
my-neg = {
|
|
hybrid = {
|
|
zone = "europe-west1-b"
|
|
endpoints = [{
|
|
ip_address = "10.0.0.10"
|
|
port = 80
|
|
}]
|
|
}
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=7
|
|
```
|
|
|
|
As are serverless NEGs for Cloud Run:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
balancing_mode = "RATE"
|
|
group = "my-neg"
|
|
max_rate = { per_endpoint = 1 }
|
|
}]
|
|
}
|
|
}
|
|
neg_configs = {
|
|
my-neg = {
|
|
cloudrun = {
|
|
region = "europe-west1"
|
|
target_service = {
|
|
name = "my-run-service"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=6
|
|
```
|
|
|
|
### URL Map
|
|
|
|
The module exposes the full URL map resource configuration, with some minor changes to the interface to decrease verbosity, and support for aliasing backend services via keys.
|
|
|
|
The default URL map configuration sets the `default` backend service as the default service for the load balancer as a convenience. Just override the `urlmap_config` variable to change the default behaviour:
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
|
|
}]
|
|
}
|
|
video = {
|
|
backends = [{
|
|
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig-2"
|
|
}]
|
|
}
|
|
}
|
|
urlmap_config = {
|
|
default_service = "default"
|
|
host_rules = [{
|
|
hosts = ["*"]
|
|
path_matcher = "pathmap"
|
|
}]
|
|
path_matchers = {
|
|
pathmap = {
|
|
default_service = "default"
|
|
path_rules = [{
|
|
paths = ["/video", "/video/*"]
|
|
service = "video"
|
|
}]
|
|
}
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
|
|
# tftest modules=1 resources=6
|
|
```
|
|
|
|
### SSL Certificates
|
|
|
|
Similarly to health checks, SSL certificates can also be created by the module. In this example we are using private key and certificate resources so that the example test only depends on Terraform providers, but in real use those can be replaced by external files.
|
|
|
|
```hcl
|
|
|
|
resource "tls_private_key" "default" {
|
|
algorithm = "RSA"
|
|
rsa_bits = 4096
|
|
}
|
|
|
|
resource "tls_self_signed_cert" "default" {
|
|
private_key_pem = tls_private_key.default.private_key_pem
|
|
subject {
|
|
common_name = "example.com"
|
|
organization = "ACME Examples, Inc"
|
|
}
|
|
validity_period_hours = 720
|
|
allowed_uses = [
|
|
"key_encipherment",
|
|
"digital_signature",
|
|
"server_auth",
|
|
]
|
|
}
|
|
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-test"
|
|
project_id = var.project_id
|
|
region = "europe-west1"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
|
|
}]
|
|
}
|
|
}
|
|
health_check_configs = {
|
|
default = {
|
|
https = { port = 443 }
|
|
}
|
|
}
|
|
protocol = "HTTPS"
|
|
ssl_certificates = {
|
|
create_configs = {
|
|
default = {
|
|
# certificate and key could also be read via file() from external files
|
|
certificate = tls_self_signed_cert.default.cert_pem
|
|
private_key = tls_private_key.default.private_key_pem
|
|
}
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
}
|
|
}
|
|
# tftest modules=1 resources=8
|
|
```
|
|
|
|
### Complex example
|
|
|
|
This example mixes group and NEG backends, and shows how to set HTTPS for specific backends.
|
|
|
|
```hcl
|
|
module "ilb-l7" {
|
|
source = "./fabric/modules/net-ilb-l7"
|
|
name = "ilb-l7-test-0"
|
|
project_id = "prj-gce"
|
|
region = "europe-west8"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ group = "nginx-ew8-b" },
|
|
{ group = "nginx-ew8-c" },
|
|
]
|
|
}
|
|
gce-neg = {
|
|
backends = [{
|
|
balancing_mode = "RATE"
|
|
group = "neg-nginx-ew8-c"
|
|
max_rate = { per_endpoint = 1 }
|
|
}]
|
|
}
|
|
home = {
|
|
backends = [{
|
|
balancing_mode = "RATE"
|
|
group = "neg-home-hello"
|
|
max_rate = {
|
|
per_endpoint = 1
|
|
}
|
|
}]
|
|
health_checks = ["neg"]
|
|
locality_lb_policy = "ROUND_ROBIN"
|
|
protocol = "HTTPS"
|
|
}
|
|
}
|
|
group_configs = {
|
|
nginx-ew8-b = {
|
|
zone = "europe-west8-b"
|
|
instances = [
|
|
"projects/prj-gce/zones/europe-west8-b/instances/nginx-ew8-b"
|
|
]
|
|
named_ports = { http = 80 }
|
|
}
|
|
nginx-ew8-c = {
|
|
zone = "europe-west8-c"
|
|
instances = [
|
|
"projects/prj-gce/zones/europe-west8-c/instances/nginx-ew8-c"
|
|
]
|
|
named_ports = { http = 80 }
|
|
}
|
|
}
|
|
health_check_configs = {
|
|
default = {
|
|
http = {
|
|
port = 80
|
|
}
|
|
}
|
|
neg = {
|
|
https = {
|
|
host = "hello.home.example.com"
|
|
port = 443
|
|
}
|
|
}
|
|
}
|
|
neg_configs = {
|
|
neg-nginx-ew8-c = {
|
|
gce = {
|
|
zone = "europe-west8-c"
|
|
endpoints = [{
|
|
instance = "nginx-ew8-c"
|
|
ip_address = "10.24.32.26"
|
|
port = 80
|
|
}]
|
|
}
|
|
}
|
|
neg-home-hello = {
|
|
hybrid = {
|
|
zone = "europe-west8-b"
|
|
endpoints = [{
|
|
ip_address = "192.168.0.3"
|
|
port = 443
|
|
}]
|
|
}
|
|
}
|
|
}
|
|
urlmap_config = {
|
|
default_service = "default"
|
|
host_rules = [
|
|
{
|
|
hosts = ["*"]
|
|
path_matcher = "gce"
|
|
},
|
|
{
|
|
hosts = ["hello.home.example.com"]
|
|
path_matcher = "home"
|
|
}
|
|
]
|
|
path_matchers = {
|
|
gce = {
|
|
default_service = "default"
|
|
path_rules = [
|
|
{
|
|
paths = ["/gce-neg", "/gce-neg/*"]
|
|
service = "gce-neg"
|
|
}
|
|
]
|
|
}
|
|
home = {
|
|
default_service = "home"
|
|
}
|
|
}
|
|
}
|
|
vpc_config = {
|
|
network = "projects/prj-host/global/networks/shared-vpc"
|
|
subnetwork = "projects/prj-host/regions/europe-west8/subnetworks/gce"
|
|
}
|
|
}
|
|
# tftest modules=1 resources=14
|
|
```
|
|
|
|
<!-- TFDOC OPTS files:1 -->
|
|
<!-- BEGIN TFDOC -->
|
|
|
|
## Files
|
|
|
|
| name | description | resources |
|
|
|---|---|---|
|
|
| [backend-service.tf](./backend-service.tf) | Backend service resources. | <code>google_compute_region_backend_service</code> |
|
|
| [health-check.tf](./health-check.tf) | Health check resource. | <code>google_compute_health_check</code> |
|
|
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_compute_forwarding_rule</code> · <code>google_compute_instance_group</code> · <code>google_compute_network_endpoint</code> · <code>google_compute_network_endpoint_group</code> · <code>google_compute_region_network_endpoint_group</code> · <code>google_compute_region_ssl_certificate</code> · <code>google_compute_region_target_http_proxy</code> · <code>google_compute_region_target_https_proxy</code> |
|
|
| [outputs.tf](./outputs.tf) | Module outputs. | <code>
|
|
value = google_compute_forwarding_rule.default
|
|
}
|
|
|
|
output </code> |
|
|
| [urlmap.tf](./urlmap.tf) | URL map resources. | <code>google_compute_region_url_map</code> |
|
|
| [variables-backend-service.tf](./variables-backend-service.tf) | Backend services variables. | |
|
|
| [variables-health-check.tf](./variables-health-check.tf) | Health check variable. | |
|
|
| [variables-urlmap.tf](./variables-urlmap.tf) | URLmap variable. | |
|
|
| [variables.tf](./variables.tf) | Module variables. | |
|
|
| [versions.tf](./versions.tf) | Version pins. | |
|
|
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [name](variables.tf#L54) | Load balancer name. | <code>string</code> | ✓ | |
|
|
| [project_id](variables.tf#L126) | Project id. | <code>string</code> | ✓ | |
|
|
| [region](variables.tf#L150) | The region where to allocate the ILB resources. | <code>string</code> | ✓ | |
|
|
| [vpc_config](variables.tf#L177) | VPC-level configuration. | <code title="object({ network = string subnetwork = string })">object({…})</code> | ✓ | |
|
|
| [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | <code>string</code> | | <code>null</code> |
|
|
| [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | <code title="map(object({ affinity_cookie_ttl_sec = optional(number) connection_draining_timeout_sec = optional(number) health_checks = optional(list(string), ["default"]) locality_lb_policy = optional(string) log_sample_rate = optional(number) port_name = optional(string) project_id = optional(string) protocol = optional(string) session_affinity = optional(string) timeout_sec = optional(number) backends = list(object({ group = string balancing_mode = optional(string, "UTILIZATION") capacity_scaler = optional(number, 1) description = optional(string, "Terraform managed.") failover = optional(bool, false) max_connections = optional(object({ per_endpoint = optional(number) per_group = optional(number) per_instance = optional(number) })) max_rate = optional(object({ per_endpoint = optional(number) per_group = optional(number) per_instance = optional(number) })) max_utilization = optional(number) })) circuit_breakers = optional(object({ max_connections = optional(number) max_pending_requests = optional(number) max_requests = optional(number) max_requests_per_connection = optional(number) max_retries = optional(number) connect_timeout = optional(object({ seconds = number nanos = optional(number) })) })) connection_tracking = optional(object({ idle_timeout_sec = optional(number) persist_conn_on_unhealthy = optional(string) track_per_session = optional(bool) })) consistent_hash = optional(object({ http_header_name = optional(string) minimum_ring_size = optional(number) http_cookie = optional(object({ name = optional(string) path = optional(string) ttl = optional(object({ seconds = number nanos = optional(number) })) })) })) enable_subsetting = optional(bool) failover_config = optional(object({ disable_conn_drain = optional(bool) drop_traffic_if_unhealthy = optional(bool) ratio = optional(number) })) iap_config = optional(object({ oauth2_client_id = string oauth2_client_secret = string oauth2_client_secret_sha256 = optional(string) })) outlier_detection = optional(object({ consecutive_errors = optional(number) consecutive_gateway_failure = optional(number) enforcing_consecutive_errors = optional(number) enforcing_consecutive_gateway_failure = optional(number) enforcing_success_rate = optional(number) max_ejection_percent = optional(number) success_rate_minimum_hosts = optional(number) success_rate_request_volume = optional(number) success_rate_stdev_factor = optional(number) base_ejection_time = optional(object({ seconds = number nanos = optional(number) })) interval = optional(object({ seconds = number nanos = optional(number) })) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [description](variables.tf#L23) | Optional description used for resources. | <code>string</code> | | <code>"Terraform managed."</code> |
|
|
| [global_access](variables.tf#L30) | Allow client access from all regions. | <code>bool</code> | | <code>null</code> |
|
|
| [group_configs](variables.tf#L36) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | <code title="map(object({ zone = string instances = optional(list(string), []) named_ports = optional(map(number), {}) project_id = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | <code title="map(object({ check_interval_sec = optional(number) description = optional(string, "Terraform managed.") enable_logging = optional(bool, false) healthy_threshold = optional(number) project_id = optional(string) timeout_sec = optional(number) unhealthy_threshold = optional(number) grpc = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT service_name = optional(string) })) http = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) http2 = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) https = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) tcp = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request = optional(string) response = optional(string) })) ssl = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request = optional(string) response = optional(string) })) }))">map(object({…}))</code> | | <code title="{ default = { http = { port_specification = "USE_SERVING_PORT" } } }">{…}</code> |
|
|
| [labels](variables.tf#L48) | Labels set on resources. | <code>map(string)</code> | | <code>{}</code> |
|
|
| [neg_configs](variables.tf#L59) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | <code title="map(object({ project_id = optional(string) cloudrun = optional(object({ region = string target_service = optional(object({ name = string tag = optional(string) })) target_urlmask = optional(string) })) gce = optional(object({ zone = string network = optional(string) subnetwork = optional(string) endpoints = optional(list(object({ instance = string ip_address = string port = number }))) })) hybrid = optional(object({ zone = string network = optional(string) endpoints = optional(list(object({ ip_address = string port = number }))) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [network_tier_premium](variables.tf#L119) | Use premium network tier. Defaults to true. | <code>bool</code> | | <code>true</code> |
|
|
| [ports](variables.tf#L131) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | <code>list(string)</code> | | <code>null</code> |
|
|
| [protocol](variables.tf#L137) | Protocol supported by this load balancer. | <code>string</code> | | <code>"HTTP"</code> |
|
|
| [service_directory_registration](variables.tf#L155) | Service directory namespace and service used to register this load balancer. | <code title="object({ namespace = string service = string })">object({…})</code> | | <code>null</code> |
|
|
| [ssl_certificates](variables.tf#L164) | SSL target proxy certificates (only if protocol is HTTPS). | <code title="object({ certificate_ids = optional(list(string), []) create_configs = optional(map(object({ certificate = string private_key = string })), {}) })">object({…})</code> | | <code>{}</code> |
|
|
| [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | <code title="object({ default_service = optional(string) default_url_redirect = optional(object({ host = optional(string) https = optional(bool) path = optional(string) prefix = optional(string) response_code = optional(string) strip_query = optional(bool) })) host_rules = optional(list(object({ hosts = list(string) path_matcher = string description = optional(string) }))) path_matchers = optional(map(object({ description = optional(string) default_service = optional(string) default_url_redirect = optional(object({ host = optional(string) https = optional(bool) path = optional(string) prefix = optional(string) response_code = optional(string) strip_query = optional(bool) })) path_rules = optional(list(object({ paths = list(string) service = optional(string) route_action = optional(object({ request_mirror_backend = optional(string) cors_policy = optional(object({ allow_credentials = optional(bool) allow_headers = optional(string) allow_methods = optional(string) allow_origin_regexes = list(string) allow_origins = list(string) disabled = optional(bool) expose_headers = optional(string) max_age = optional(string) })) fault_injection_policy = optional(object({ abort = optional(object({ percentage = number status = number })) delay = optional(object({ fixed = object({ seconds = number nanos = number }) percentage = number })) })) retry_policy = optional(object({ num_retries = number retry_conditions = optional(list(string)) per_try_timeout = optional(object({ seconds = number nanos = optional(number) })) })) timeout = optional(object({ seconds = number nanos = optional(number) })) url_rewrite = optional(object({ host = optional(string) path_prefix = optional(string) })) weighted_backend_services = optional(map(object({ weight = number header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) }))) })) url_redirect = optional(object({ host = optional(string) https = optional(bool) path = optional(string) prefix = optional(string) response_code = optional(string) strip_query = optional(bool) })) }))) route_rules = optional(list(object({ priority = number service = optional(string) header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) match_rules = optional(list(object({ ignore_case = optional(bool, false) headers = optional(list(object({ name = string invert_match = optional(bool, false) type = optional(string, "present") # exact, prefix, suffix, regex, present, range value = optional(string) range_value = optional(object({ end = string start = string })) }))) metadata_filters = optional(list(object({ labels = map(string) match_all = bool # MATCH_ANY, MATCH_ALL }))) path = optional(object({ value = string type = optional(string, "prefix") # full, prefix, regex })) query_params = optional(list(object({ name = string value = string type = optional(string, "present") # exact, present, regex }))) }))) route_action = optional(object({ request_mirror_backend = optional(string) cors_policy = optional(object({ allow_credentials = optional(bool) allow_headers = optional(string) allow_methods = optional(string) allow_origin_regexes = list(string) allow_origins = list(string) disabled = optional(bool) expose_headers = optional(string) max_age = optional(string) })) fault_injection_policy = optional(object({ abort = optional(object({ percentage = number status = number })) delay = optional(object({ fixed = object({ seconds = number nanos = number }) percentage = number })) })) retry_policy = optional(object({ num_retries = number retry_conditions = optional(list(string)) per_try_timeout = optional(object({ seconds = number nanos = optional(number) })) })) timeout = optional(object({ seconds = number nanos = optional(number) })) url_rewrite = optional(object({ host = optional(string) path_prefix = optional(string) })) weighted_backend_services = optional(map(object({ weight = number header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) }))) })) url_redirect = optional(object({ host = optional(string) https = optional(bool) path = optional(string) prefix = optional(string) response_code = optional(string) strip_query = optional(bool) })) }))) }))) test = optional(list(object({ host = string path = string service = string description = optional(string) }))) })">object({…})</code> | | <code title="{ default_service = "default" }">{…}</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [address](outputs.tf#L17) | Forwarding rule address. | |
|
|
| [backend_service_ids](outputs.tf#L22) | Backend service resources. | |
|
|
| [forwarding_rule](outputs.tf#L29) | Forwarding rule resource | |
|
|
| [group_ids](outputs.tf#L34) | Autogenerated instance group ids. | |
|
|
| [health_check_ids](outputs.tf#L41) | Autogenerated health check ids. | |
|
|
| [neg_ids](outputs.tf#L48) | Autogenerated network endpoint group ids. | |
|
|
|
|
<!-- END TFDOC -->
|