916 lines
59 KiB
Markdown
916 lines
59 KiB
Markdown
# External Application Load Balancer Module
|
|
|
|
This module allows managing Global HTTP/HTTPS Classic Load Balancers (GLBs). It's designed to expose the full configuration of the underlying resources, and to facilitate common usage patterns by providing sensible defaults, and optionally managing prerequisite resources like health checks, instance groups, etc.
|
|
|
|
Due to the complexity of the underlying resources, changes to the configuration that involve recreation of resources are best applied in stages, starting by disabling the configuration in the urlmap that references the resources that need recreation, then doing the same for the backend service, etc.
|
|
|
|
## Examples
|
|
|
|
<!-- BEGIN TOC -->
|
|
- [Examples](#examples)
|
|
- [Minimal HTTP Example](#minimal-http-example)
|
|
- [Minimal HTTPS examples](#minimal-https-examples)
|
|
- [HTTP backends](#http-backends)
|
|
- [HTTPS backends](#https-backends)
|
|
- [HTTP to HTTPS redirect](#http-to-https-redirect)
|
|
- [Classic vs Non-classic](#classic-vs-non-classic)
|
|
- [Health Checks](#health-checks)
|
|
- [Backend Types and Management](#backend-types-and-management)
|
|
- [Instance Groups](#instance-groups)
|
|
- [Managed Instance Groups](#managed-instance-groups)
|
|
- [Storage Buckets](#storage-buckets)
|
|
- [Network Endpoint Groups (NEGs)](#network-endpoint-groups-negs)
|
|
- [Zonal NEG creation](#zonal-neg-creation)
|
|
- [Hybrid NEG creation](#hybrid-neg-creation)
|
|
- [Internet NEG creation](#internet-neg-creation)
|
|
- [Private Service Connect NEG creation](#private-service-connect-neg-creation)
|
|
- [Serverless NEG creation](#serverless-neg-creation)
|
|
- [URL Map](#url-map)
|
|
- [SSL Certificates](#ssl-certificates)
|
|
- [Complex example](#complex-example)
|
|
- [Files](#files)
|
|
- [Variables](#variables)
|
|
- [Outputs](#outputs)
|
|
- [Fixtures](#fixtures)
|
|
<!-- END TOC -->
|
|
|
|
### Minimal HTTP Example
|
|
|
|
An HTTP load balancer with a backend service pointing to a GCE instance group:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = module.compute-mig-b.group.id },
|
|
{ backend = module.compute-mig-c.group.id },
|
|
]
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-bc.tf inventory=minimal-http.yaml e2e
|
|
```
|
|
|
|
### Minimal HTTPS examples
|
|
|
|
#### HTTP backends
|
|
|
|
An HTTPS load balancer needs a certificate and backends can be HTTP or HTTPS. This is an example With HTTP backends and a managed certificate:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = module.compute-mig-b.group.id },
|
|
{ backend = module.compute-mig-c.group.id },
|
|
]
|
|
protocol = "HTTP"
|
|
}
|
|
}
|
|
protocol = "HTTPS"
|
|
ssl_certificates = {
|
|
managed_configs = {
|
|
default = {
|
|
domains = ["glb-test-0.example.org"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf inventory=http-backends.yaml e2e
|
|
```
|
|
|
|
#### HTTPS backends
|
|
|
|
For HTTPS backends the backend service protocol needs to be set to `HTTPS`. The port name if omitted is inferred from the protocol, in this case it is set internally to `https`. The health check also needs to be set to https. This is a complete example:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = module.compute-mig-b.group.id },
|
|
{ backend = module.compute-mig-c.group.id },
|
|
]
|
|
protocol = "HTTPS"
|
|
}
|
|
}
|
|
health_check_configs = {
|
|
default = {
|
|
https = {
|
|
port_specification = "USE_SERVING_PORT"
|
|
}
|
|
}
|
|
}
|
|
protocol = "HTTPS"
|
|
ssl_certificates = {
|
|
managed_configs = {
|
|
default = {
|
|
domains = ["glb-test-0.example.org"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf inventory=https-backends.yaml e2e
|
|
```
|
|
|
|
#### HTTP to HTTPS redirect
|
|
|
|
Redirect is implemented via an additional HTTP load balancer with a custom URL map, similarly to how it's done via the GCP Console. The address shared by the two load balancers needs to be reserved.
|
|
|
|
```hcl
|
|
module "addresses" {
|
|
source = "./fabric/modules/net-address"
|
|
project_id = var.project_id
|
|
global_addresses = {
|
|
"glb-test-0" = {}
|
|
}
|
|
}
|
|
|
|
module "glb-test-0-redirect" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0-redirect"
|
|
address = (
|
|
module.addresses.global_addresses["glb-test-0"].address
|
|
)
|
|
health_check_configs = {}
|
|
urlmap_config = {
|
|
description = "URL redirect for glb-test-0."
|
|
default_url_redirect = {
|
|
https = true
|
|
response_code = "MOVED_PERMANENTLY_DEFAULT"
|
|
}
|
|
}
|
|
}
|
|
|
|
module "glb-test-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
use_classic_version = false
|
|
address = (
|
|
module.addresses.global_addresses["glb-test-0"].address
|
|
)
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = module.compute-mig-b.group.id },
|
|
]
|
|
protocol = "HTTP"
|
|
}
|
|
}
|
|
protocol = "HTTPS"
|
|
ssl_certificates = {
|
|
managed_configs = {
|
|
default = {
|
|
domains = ["glb-test.example.com"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# tftest modules=5 resources=14 fixtures=fixtures/compute-mig-bc.tf inventory=http-https-redirect.yaml e2e
|
|
```
|
|
|
|
### Classic vs Non-classic
|
|
|
|
The module uses a classic Global Load Balancer by default. To use the non-classic version set the `use_classic_version` variable to `false` as in the following example, note that the module is not enforcing feature sets between the two versions:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
use_classic_version = false
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = module.compute-mig-b.group.id },
|
|
{ backend = module.compute-mig-c.group.id },
|
|
]
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-bc.tf inventory=classic-vs-non-classic.yaml e2e
|
|
```
|
|
|
|
### Health Checks
|
|
|
|
You can leverage externally defined health checks for backend services, or have the module create them for you.
|
|
|
|
By default a simple HTTP health check named `default` is created and used in backend services. If you need to override the default, simply define your own health check using the same key (`default`). For more complex configurations you can define your own health checks and reference them via keys in the backend service configurations.
|
|
|
|
Health checks created by this module are controlled via the `health_check_configs` variable, which behaves in a similar way to other LB modules in this repository. This is an example that overrides the default health check configuration using a TCP health check:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
backend = module.compute-mig-b.group.id
|
|
}]
|
|
# no need to reference the hc explicitly when using the `default` key
|
|
# health_checks = ["default"]
|
|
}
|
|
}
|
|
health_check_configs = {
|
|
default = {
|
|
tcp = { port = 80 }
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=9 fixtures=fixtures/compute-mig-bc.tf inventory=health-check-1.yaml e2e
|
|
```
|
|
|
|
To leverage existing health checks without having the module create them, simply pass their self links to backend services and set the `health_check_configs` variable to an empty map:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
backend = module.compute-mig-b.group.id
|
|
}]
|
|
health_checks = ["projects/${var.project_id}/global/healthChecks/custom"]
|
|
}
|
|
}
|
|
health_check_configs = {}
|
|
}
|
|
# tftest modules=3 resources=8 fixtures=fixtures/compute-mig-bc.tf inventory=health-check-2.yaml
|
|
```
|
|
|
|
### Backend Types and Management
|
|
|
|
#### Instance Groups
|
|
|
|
The module can optionally create unmanaged instance groups, which can then be referred to in backends via their key. This is the simple HTTP example above but with instance group creation managed by the module:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = "default-b" }
|
|
]
|
|
}
|
|
}
|
|
group_configs = {
|
|
default-b = {
|
|
zone = "${var.region}-b"
|
|
instances = [
|
|
module.compute-mig-b.id
|
|
]
|
|
named_ports = { http = 80 }
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf inventory=instance-groups.yaml e2e
|
|
```
|
|
|
|
#### Managed Instance Groups
|
|
|
|
This example shows how to use the module with a manage instance group as backend:
|
|
|
|
```hcl
|
|
module "win-template" {
|
|
source = "./fabric/modules/compute-vm"
|
|
project_id = var.project_id
|
|
zone = "${var.region}-a"
|
|
name = "win-template"
|
|
instance_type = "n2d-standard-2"
|
|
create_template = true
|
|
boot_disk = {
|
|
initialize_params = {
|
|
image = "projects/windows-cloud/global/images/windows-server-2019-dc-v20221214"
|
|
size = 70
|
|
}
|
|
}
|
|
network_interfaces = [{
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
nat = false
|
|
addresses = null
|
|
}]
|
|
}
|
|
|
|
module "win-mig" {
|
|
source = "./fabric/modules/compute-mig"
|
|
project_id = var.project_id
|
|
location = "${var.region}-a"
|
|
name = "win-mig"
|
|
instance_template = module.win-template.template.self_link
|
|
autoscaler_config = {
|
|
max_replicas = 3
|
|
min_replicas = 1
|
|
cooldown_period = 30
|
|
scaling_signals = {
|
|
cpu_utilization = {
|
|
target = 0.80
|
|
}
|
|
}
|
|
}
|
|
named_ports = {
|
|
http = 80
|
|
}
|
|
}
|
|
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = module.win-mig.group_manager.instance_group }
|
|
]
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=8 inventory=managed-instance-groups.yaml e2e
|
|
```
|
|
|
|
#### Storage Buckets
|
|
|
|
GCS bucket backends can also be managed and used in this module in a similar way to regular backend services.Multiple GCS bucket backends can be defined and referenced in URL maps by their keys (or self links if defined externally) together with regular backend services, [an example is provided later in this document](#complex-example). This is a simple example that defines a GCS backend as the default for the URL map:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_buckets_config = {
|
|
default = {
|
|
bucket_name = var.bucket
|
|
}
|
|
}
|
|
# with a single GCS backend the implied default health check is not needed
|
|
health_check_configs = {}
|
|
}
|
|
# tftest modules=1 resources=4 inventory=storage.yaml e2e
|
|
```
|
|
|
|
#### Network Endpoint Groups (NEGs)
|
|
|
|
Supported Network Endpoint Groups (NEGs) can also be used as backends. Similarly to groups, you can pass a self link for existing NEGs or have the module manage them for you. A simple example using an existing zonal NEG:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{
|
|
backend = "myneg-b"
|
|
balancing_mode = "RATE"
|
|
max_rate = { per_endpoint = 10 }
|
|
}
|
|
]
|
|
}
|
|
}
|
|
neg_configs = {
|
|
myneg-b = {
|
|
hybrid = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
zone = "${var.region}-b"
|
|
endpoints = {}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=6 inventory=network-endpoint-groups.yaml e2e
|
|
```
|
|
|
|
#### Zonal NEG creation
|
|
|
|
This example shows how to create and manage zonal NEGs using GCE VMs as endpoints:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{
|
|
backend = "neg-0"
|
|
balancing_mode = "RATE"
|
|
max_rate = { per_endpoint = 10 }
|
|
}
|
|
]
|
|
}
|
|
}
|
|
neg_configs = {
|
|
neg-0 = {
|
|
gce = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
zone = "${var.region}-b"
|
|
endpoints = {
|
|
e-0 = {
|
|
instance = "my-ig-b"
|
|
ip_address = module.compute-mig-b.internal_ip
|
|
port = 80
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=11 fixtures=fixtures/compute-mig-bc.tf inventory=zonal-neg-creation.yaml e2e
|
|
```
|
|
|
|
#### Hybrid NEG creation
|
|
|
|
This example shows how to create and manage hybrid NEGs:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{
|
|
backend = "neg-0"
|
|
balancing_mode = "RATE"
|
|
max_rate = { per_endpoint = 10 }
|
|
}
|
|
]
|
|
}
|
|
}
|
|
neg_configs = {
|
|
neg-0 = {
|
|
hybrid = {
|
|
network = var.vpc.self_link
|
|
zone = "${var.region}-b"
|
|
endpoints = {
|
|
e-0 = {
|
|
ip_address = "10.0.0.10"
|
|
port = 80
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=7 inventory=hybrid-neg.yaml e2e
|
|
```
|
|
|
|
#### Internet NEG creation
|
|
|
|
This example shows how to create and manage internet NEGs:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = "neg-0" }
|
|
]
|
|
health_checks = []
|
|
}
|
|
}
|
|
# with a single internet NEG the implied default health check is not needed
|
|
health_check_configs = {}
|
|
neg_configs = {
|
|
neg-0 = {
|
|
internet = {
|
|
use_fqdn = true
|
|
endpoints = {
|
|
e-0 = {
|
|
destination = "www.example.org"
|
|
port = 80
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=6 inventory=internet-neg.yaml e2e
|
|
```
|
|
|
|
#### Private Service Connect NEG creation
|
|
|
|
The module supports managing PSC NEGs if the non-classic version of the load balancer is used:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
use_classic_version = false
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = "neg-0" }
|
|
]
|
|
health_checks = []
|
|
}
|
|
}
|
|
# with a single PSC NEG the implied default health check is not needed
|
|
health_check_configs = {}
|
|
neg_configs = {
|
|
neg-0 = {
|
|
psc = {
|
|
region = var.region
|
|
target_service = "${var.region}-cloudkms.googleapis.com"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=5
|
|
```
|
|
|
|
#### Serverless NEG creation
|
|
|
|
The module supports managing Serverless NEGs for Cloud Run and Cloud Function. This is an example of a Cloud Run NEG:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = "neg-0" }
|
|
]
|
|
health_checks = []
|
|
}
|
|
}
|
|
# with a single serverless NEG the implied default health check is not needed
|
|
health_check_configs = {}
|
|
neg_configs = {
|
|
neg-0 = {
|
|
cloudrun = {
|
|
region = var.region
|
|
target_service = {
|
|
name = "hello"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=5 inventory=serverless-neg.yaml e2e
|
|
```
|
|
|
|
Serverless NEGs don't use the port name but it should be set to `http`. An HTTPS frontend requires the protocol to be set to `HTTPS`, and the port name field will infer this value if omitted so you need to set it explicitly:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = "neg-0" }
|
|
]
|
|
health_checks = []
|
|
port_name = "http"
|
|
}
|
|
}
|
|
# with a single serverless NEG the implied default health check is not needed
|
|
health_check_configs = {}
|
|
neg_configs = {
|
|
neg-0 = {
|
|
cloudrun = {
|
|
region = var.region
|
|
target_service = {
|
|
name = "hello"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
protocol = "HTTPS"
|
|
ssl_certificates = {
|
|
managed_configs = {
|
|
default = {
|
|
domains = ["glb-test-0.example.org"]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=1 resources=6 inventory=https-sneg.yaml e2e
|
|
```
|
|
|
|
### URL Map
|
|
|
|
The module exposes the full URL map resource configuration, with some minor changes to the interface to decrease verbosity, and support for aliasing backend services via keys.
|
|
|
|
The default URL map configuration sets the `default` backend service as the default service for the load balancer as a convenience. Just override the `urlmap_config` variable to change the default behaviour:
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [{
|
|
backend = module.compute-mig-b.group.id
|
|
}]
|
|
}
|
|
other = {
|
|
backends = [{
|
|
backend = module.compute-mig-c.group.id
|
|
}]
|
|
}
|
|
}
|
|
urlmap_config = {
|
|
default_service = "default"
|
|
host_rules = [{
|
|
hosts = ["*"]
|
|
path_matcher = "pathmap"
|
|
}]
|
|
path_matchers = {
|
|
pathmap = {
|
|
default_service = "default"
|
|
path_rules = [{
|
|
paths = ["/other", "/other/*"]
|
|
service = "other"
|
|
}]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# tftest modules=3 resources=10 fixtures=fixtures/compute-mig-bc.tf inventory=url-map.yaml e2e
|
|
```
|
|
|
|
### SSL Certificates
|
|
|
|
The module also allows managing managed and self-managed SSL certificates via the `ssl_certificates` variable. Any certificate defined there will be added to the HTTPS proxy resource.
|
|
|
|
THe [HTTPS example above](#minimal-https-examples) shows how to configure manage certificated, the following example shows how to use an unmanaged (or self managed) certificate. The example uses Terraform resource for the key and certificate so that the we don't depend on external files when running tests, in real use the key and certificate are generally provided via external files read by the Terraform `file()` function.
|
|
|
|
```hcl
|
|
resource "tls_private_key" "default" {
|
|
algorithm = "RSA"
|
|
rsa_bits = 2048
|
|
}
|
|
|
|
resource "tls_self_signed_cert" "default" {
|
|
private_key_pem = tls_private_key.default.private_key_pem
|
|
subject {
|
|
common_name = "example.com"
|
|
organization = "ACME Examples, Inc"
|
|
}
|
|
validity_period_hours = 720
|
|
allowed_uses = [
|
|
"key_encipherment",
|
|
"digital_signature",
|
|
"server_auth",
|
|
]
|
|
}
|
|
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = module.compute-mig-b.group.id },
|
|
{ backend = module.compute-mig-c.group.id },
|
|
]
|
|
protocol = "HTTP"
|
|
}
|
|
}
|
|
protocol = "HTTPS"
|
|
ssl_certificates = {
|
|
create_configs = {
|
|
default = {
|
|
# certificate and key could also be read via file() from external files
|
|
certificate = tls_self_signed_cert.default.cert_pem
|
|
private_key = tls_private_key.default.private_key_pem
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=12 fixtures=fixtures/compute-mig-bc.tf inventory=ssl-certificates.yaml e2e
|
|
```
|
|
|
|
### Complex example
|
|
|
|
This example mixes group and NEG backends, and shows how to set HTTPS for specific backends.
|
|
|
|
```hcl
|
|
module "glb-0" {
|
|
source = "./fabric/modules/net-lb-app-ext"
|
|
project_id = var.project_id
|
|
name = "glb-test-0"
|
|
backend_buckets_config = {
|
|
gcs-0 = {
|
|
bucket_name = var.bucket
|
|
}
|
|
}
|
|
backend_service_configs = {
|
|
default = {
|
|
backends = [
|
|
{ backend = "group-zone-b" },
|
|
{ backend = "group-zone-c" },
|
|
]
|
|
}
|
|
neg-gce-0 = {
|
|
backends = [{
|
|
balancing_mode = "RATE"
|
|
backend = "neg-zone-c"
|
|
max_rate = { per_endpoint = 10 }
|
|
}]
|
|
}
|
|
neg-hybrid-0 = {
|
|
backends = [{
|
|
balancing_mode = "RATE"
|
|
backend = "neg-hello"
|
|
max_rate = { per_endpoint = 10 }
|
|
}]
|
|
health_checks = ["neg"]
|
|
protocol = "HTTPS"
|
|
}
|
|
}
|
|
group_configs = {
|
|
group-zone-b = {
|
|
zone = "${var.region}-b"
|
|
instances = [
|
|
module.compute-mig-b.id
|
|
]
|
|
named_ports = { http = 80 }
|
|
}
|
|
group-zone-c = {
|
|
zone = "${var.region}-c"
|
|
instances = [
|
|
module.compute-mig-c.id
|
|
]
|
|
named_ports = { http = 80 }
|
|
}
|
|
}
|
|
health_check_configs = {
|
|
default = {
|
|
http = {
|
|
port = 80
|
|
}
|
|
}
|
|
neg = {
|
|
https = {
|
|
host = "hello.example.com"
|
|
port = 443
|
|
}
|
|
}
|
|
}
|
|
neg_configs = {
|
|
neg-zone-c = {
|
|
gce = {
|
|
network = var.vpc.self_link
|
|
subnetwork = var.subnet.self_link
|
|
zone = "${var.region}-c"
|
|
endpoints = {
|
|
e-0 = {
|
|
instance = "my-ig-c"
|
|
ip_address = module.compute-mig-c.internal_ip
|
|
port = 80
|
|
}
|
|
}
|
|
}
|
|
}
|
|
neg-hello = {
|
|
hybrid = {
|
|
network = var.vpc.self_link
|
|
zone = "${var.region}-b"
|
|
endpoints = {
|
|
e-0 = {
|
|
ip_address = "192.168.0.3"
|
|
port = 443
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
urlmap_config = {
|
|
default_service = "default"
|
|
host_rules = [
|
|
{
|
|
hosts = ["*"]
|
|
path_matcher = "gce"
|
|
},
|
|
{
|
|
hosts = ["hello.example.com"]
|
|
path_matcher = "hello"
|
|
},
|
|
{
|
|
hosts = ["static.example.com"]
|
|
path_matcher = "static"
|
|
}
|
|
]
|
|
path_matchers = {
|
|
gce = {
|
|
default_service = "default"
|
|
path_rules = [
|
|
{
|
|
paths = ["/gce-neg", "/gce-neg/*"]
|
|
service = "neg-gce-0"
|
|
}
|
|
]
|
|
}
|
|
hello = {
|
|
default_service = "neg-hybrid-0"
|
|
}
|
|
static = {
|
|
default_service = "gcs-0"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
# tftest modules=3 resources=19 fixtures=fixtures/compute-mig-bc.tf inventory=complex-example.yaml e2e
|
|
```
|
|
|
|
<!-- TFDOC OPTS files:1 -->
|
|
<!-- BEGIN TFDOC -->
|
|
## Files
|
|
|
|
| name | description | resources |
|
|
|---|---|---|
|
|
| [backend-service.tf](./backend-service.tf) | Backend service resources. | <code>google_compute_backend_service</code> |
|
|
| [backends.tf](./backends.tf) | Backend groups and backend buckets resources. | <code>google_compute_backend_bucket</code> |
|
|
| [groups.tf](./groups.tf) | None | <code>google_compute_instance_group</code> |
|
|
| [health-check.tf](./health-check.tf) | Health check resource. | <code>google_compute_health_check</code> |
|
|
| [main.tf](./main.tf) | Module-level locals and resources. | <code>google_compute_global_forwarding_rule</code> · <code>google_compute_managed_ssl_certificate</code> · <code>google_compute_ssl_certificate</code> · <code>google_compute_target_http_proxy</code> · <code>google_compute_target_https_proxy</code> |
|
|
| [negs.tf](./negs.tf) | NEG resources. | <code>google_compute_global_network_endpoint</code> · <code>google_compute_global_network_endpoint_group</code> · <code>google_compute_network_endpoint</code> · <code>google_compute_network_endpoint_group</code> · <code>google_compute_region_network_endpoint_group</code> |
|
|
| [outputs.tf](./outputs.tf) | Module outputs. | |
|
|
| [urlmap.tf](./urlmap.tf) | URL map resources. | <code>google_compute_url_map</code> |
|
|
| [variables-backend-service.tf](./variables-backend-service.tf) | Backend services variables. | |
|
|
| [variables-health-check.tf](./variables-health-check.tf) | Health check variable. | |
|
|
| [variables-urlmap.tf](./variables-urlmap.tf) | URLmap variable. | |
|
|
| [variables.tf](./variables.tf) | Module variables. | |
|
|
| [versions.tf](./versions.tf) | Version pins. | |
|
|
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [name](variables.tf#L91) | Load balancer name. | <code>string</code> | ✓ | |
|
|
| [project_id](variables.tf#L193) | Project id. | <code>string</code> | ✓ | |
|
|
| [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | <code>string</code> | | <code>null</code> |
|
|
| [backend_buckets_config](variables.tf#L23) | Backend buckets configuration. | <code title="map(object({ bucket_name = string compression_mode = optional(string) custom_response_headers = optional(list(string)) description = optional(string) edge_security_policy = optional(string) enable_cdn = optional(bool) cdn_policy = optional(object({ bypass_cache_on_request_headers = optional(list(string)) cache_mode = optional(string) client_ttl = optional(number) default_ttl = optional(number) max_ttl = optional(number) negative_caching = optional(bool) request_coalescing = optional(bool) serve_while_stale = optional(number) signed_url_cache_max_age_sec = optional(number) cache_key_policy = optional(object({ include_http_headers = optional(list(string)) query_string_whitelist = optional(list(string)) })) negative_caching_policy = optional(object({ code = optional(number) ttl = optional(number) })) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | <code title="map(object({ affinity_cookie_ttl_sec = optional(number) compression_mode = optional(string) connection_draining_timeout_sec = optional(number) custom_request_headers = optional(list(string)) custom_response_headers = optional(list(string)) enable_cdn = optional(bool) health_checks = optional(list(string), ["default"]) log_sample_rate = optional(number) port_name = optional(string) project_id = optional(string) protocol = optional(string) security_policy = optional(string) session_affinity = optional(string) timeout_sec = optional(number) backends = list(object({ backend = string balancing_mode = optional(string, "UTILIZATION") capacity_scaler = optional(number, 1) description = optional(string, "Terraform managed.") failover = optional(bool, false) max_connections = optional(object({ per_endpoint = optional(number) per_group = optional(number) per_instance = optional(number) })) max_rate = optional(object({ per_endpoint = optional(number) per_group = optional(number) per_instance = optional(number) })) max_utilization = optional(number) })) cdn_policy = optional(object({ cache_mode = optional(string) client_ttl = optional(number) default_ttl = optional(number) max_ttl = optional(number) negative_caching = optional(bool) serve_while_stale = optional(number) signed_url_cache_max_age_sec = optional(number) cache_key_policy = optional(object({ include_host = optional(bool) include_named_cookies = optional(list(string)) include_protocol = optional(bool) include_query_string = optional(bool) query_string_blacklist = optional(list(string)) query_string_whitelist = optional(list(string)) })) negative_caching_policy = optional(object({ code = optional(number) ttl = optional(number) })) })) circuit_breakers = optional(object({ max_connections = optional(number) max_pending_requests = optional(number) max_requests = optional(number) max_requests_per_connection = optional(number) max_retries = optional(number) connect_timeout = optional(object({ seconds = number nanos = optional(number) })) })) consistent_hash = optional(object({ http_header_name = optional(string) minimum_ring_size = optional(number) http_cookie = optional(object({ name = optional(string) path = optional(string) ttl = optional(object({ seconds = number nanos = optional(number) })) })) })) iap_config = optional(object({ oauth2_client_id = string oauth2_client_secret = string oauth2_client_secret_sha256 = optional(string) })) outlier_detection = optional(object({ consecutive_errors = optional(number) consecutive_gateway_failure = optional(number) enforcing_consecutive_errors = optional(number) enforcing_consecutive_gateway_failure = optional(number) enforcing_success_rate = optional(number) max_ejection_percent = optional(number) success_rate_minimum_hosts = optional(number) success_rate_request_volume = optional(number) success_rate_stdev_factor = optional(number) base_ejection_time = optional(object({ seconds = number nanos = optional(number) })) interval = optional(object({ seconds = number nanos = optional(number) })) })) security_settings = optional(object({ client_tls_policy = string subject_alt_names = list(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [description](variables.tf#L56) | Optional description used for resources. | <code>string</code> | | <code>"Terraform managed."</code> |
|
|
| [group_configs](variables.tf#L62) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | <code title="map(object({ zone = string instances = optional(list(string)) named_ports = optional(map(number), {}) project_id = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | <code title="map(object({ check_interval_sec = optional(number) description = optional(string, "Terraform managed.") enable_logging = optional(bool, false) healthy_threshold = optional(number) project_id = optional(string) timeout_sec = optional(number) unhealthy_threshold = optional(number) grpc = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT service_name = optional(string) })) http = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) http2 = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) https = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) tcp = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request = optional(string) response = optional(string) })) ssl = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request = optional(string) response = optional(string) })) }))">map(object({…}))</code> | | <code title="{ default = { http = { port_specification = "USE_SERVING_PORT" } } }">{…}</code> |
|
|
| [https_proxy_config](variables.tf#L74) | HTTPS proxy connfiguration. | <code title="object({ certificate_map = optional(string) quic_override = optional(string) ssl_policy = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
| [labels](variables.tf#L85) | Labels set on resources. | <code>map(string)</code> | | <code>{}</code> |
|
|
| [neg_configs](variables.tf#L96) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | <code title="map(object({ description = optional(string) cloudfunction = optional(object({ region = string target_function = optional(string) target_urlmask = optional(string) })) cloudrun = optional(object({ region = string target_service = optional(object({ name = string tag = optional(string) })) target_urlmask = optional(string) })) gce = optional(object({ network = string subnetwork = string zone = string endpoints = optional(map(object({ instance = string ip_address = string port = number }))) })) hybrid = optional(object({ network = string zone = string endpoints = optional(map(object({ ip_address = string port = number }))) })) internet = optional(object({ use_fqdn = optional(bool, true) endpoints = optional(map(object({ destination = string port = number }))) })) psc = optional(object({ region = string target_service = string network = optional(string) subnetwork = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [ports](variables.tf#L187) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | <code>list(string)</code> | | <code>null</code> |
|
|
| [protocol](variables.tf#L198) | Protocol supported by this load balancer. | <code>string</code> | | <code>"HTTP"</code> |
|
|
| [ssl_certificates](variables.tf#L211) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | <code title="object({ certificate_ids = optional(list(string), []) create_configs = optional(map(object({ certificate = string private_key = string })), {}) managed_configs = optional(map(object({ domains = list(string) description = optional(string) })), {}) })">object({…})</code> | | <code>{}</code> |
|
|
| [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | <code title="object({ default_route_action = optional(object({ request_mirror_backend = optional(string) cors_policy = optional(object({ allow_credentials = optional(bool) allow_headers = optional(string) allow_methods = optional(string) allow_origin_regexes = list(string) allow_origins = list(string) disabled = optional(bool) expose_headers = optional(string) max_age = optional(string) })) fault_injection_policy = optional(object({ abort = optional(object({ percentage = number status = number })) delay = optional(object({ fixed = object({ seconds = number nanos = number }) percentage = number })) })) retry_policy = optional(object({ num_retries = number retry_conditions = optional(list(string)) per_try_timeout = optional(object({ seconds = number nanos = optional(number) })) })) timeout = optional(object({ seconds = number nanos = optional(number) })) url_rewrite = optional(object({ host = optional(string) path_prefix = optional(string) })) weighted_backend_services = optional(map(object({ weight = number header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) }))) })) default_service = optional(string) default_url_redirect = optional(object({ host = optional(string) https = optional(bool) path = optional(string) prefix = optional(string) response_code = optional(string) strip_query = optional(bool, false) })) header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) host_rules = optional(list(object({ hosts = list(string) path_matcher = string description = optional(string) }))) path_matchers = optional(map(object({ description = optional(string) default_route_action = optional(object({ request_mirror_backend = optional(string) cors_policy = optional(object({ allow_credentials = optional(bool) allow_headers = optional(string) allow_methods = optional(string) allow_origin_regexes = list(string) allow_origins = list(string) disabled = optional(bool) expose_headers = optional(string) max_age = optional(string) })) fault_injection_policy = optional(object({ abort = optional(object({ percentage = number status = number })) delay = optional(object({ fixed = object({ seconds = number nanos = number }) percentage = number })) })) retry_policy = optional(object({ num_retries = number retry_conditions = optional(list(string)) per_try_timeout = optional(object({ seconds = number nanos = optional(number) })) })) timeout = optional(object({ seconds = number nanos = optional(number) })) url_rewrite = optional(object({ host = optional(string) path_prefix = optional(string) })) weighted_backend_services = optional(map(object({ weight = number header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) }))) })) default_service = optional(string) default_url_redirect = optional(object({ host = optional(string) https = optional(bool) path = optional(string) prefix = optional(string) response_code = optional(string) strip_query = optional(bool) })) header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) path_rules = optional(list(object({ paths = list(string) service = optional(string) route_action = optional(object({ request_mirror_backend = optional(string) cors_policy = optional(object({ allow_credentials = optional(bool) allow_headers = optional(string) allow_methods = optional(string) allow_origin_regexes = list(string) allow_origins = list(string) disabled = optional(bool) expose_headers = optional(string) max_age = optional(string) })) fault_injection_policy = optional(object({ abort = optional(object({ percentage = number status = number })) delay = optional(object({ fixed = object({ seconds = number nanos = number }) percentage = number })) })) retry_policy = optional(object({ num_retries = number retry_conditions = optional(list(string)) per_try_timeout = optional(object({ seconds = number nanos = optional(number) })) })) timeout = optional(object({ seconds = number nanos = optional(number) })) url_rewrite = optional(object({ host = optional(string) path_prefix = optional(string) })) weighted_backend_services = optional(map(object({ weight = number header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) }))) })) url_redirect = optional(object({ host = optional(string) https = optional(bool) path = optional(string) prefix = optional(string) response_code = optional(string) strip_query = optional(bool) })) }))) route_rules = optional(list(object({ priority = number service = optional(string) header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) match_rules = optional(list(object({ ignore_case = optional(bool, false) headers = optional(list(object({ name = string invert_match = optional(bool, false) type = optional(string, "present") # exact, prefix, suffix, regex, present, range value = optional(string) range_value = optional(object({ end = string start = string })) }))) metadata_filters = optional(list(object({ labels = map(string) match_all = bool # MATCH_ANY, MATCH_ALL }))) path = optional(object({ value = string type = optional(string, "prefix") # full, prefix, regex })) query_params = optional(list(object({ name = string value = string type = optional(string, "present") # exact, present, regex }))) }))) route_action = optional(object({ request_mirror_backend = optional(string) cors_policy = optional(object({ allow_credentials = optional(bool) allow_headers = optional(string) allow_methods = optional(string) allow_origin_regexes = list(string) allow_origins = list(string) disabled = optional(bool) expose_headers = optional(string) max_age = optional(string) })) fault_injection_policy = optional(object({ abort = optional(object({ percentage = number status = number })) delay = optional(object({ fixed = object({ seconds = number nanos = number }) percentage = number })) })) retry_policy = optional(object({ num_retries = number retry_conditions = optional(list(string)) per_try_timeout = optional(object({ seconds = number nanos = optional(number) })) })) timeout = optional(object({ seconds = number nanos = optional(number) })) url_rewrite = optional(object({ host = optional(string) path_prefix = optional(string) })) weighted_backend_services = optional(map(object({ weight = number header_action = optional(object({ request_add = optional(map(object({ value = string replace = optional(bool, true) }))) request_remove = optional(list(string)) response_add = optional(map(object({ value = string replace = optional(bool, true) }))) response_remove = optional(list(string)) })) }))) })) url_redirect = optional(object({ host = optional(string) https = optional(bool) path = optional(string) prefix = optional(string) response_code = optional(string) strip_query = optional(bool) })) }))) }))) test = optional(list(object({ host = string path = string service = string description = optional(string) }))) })">object({…})</code> | | <code title="{ default_service = "default" }">{…}</code> |
|
|
| [use_classic_version](variables.tf#L228) | Use classic Global Load Balancer. | <code>bool</code> | | <code>true</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [address](outputs.tf#L17) | Forwarding rule address. | |
|
|
| [backend_service_ids](outputs.tf#L22) | Backend service resources. | |
|
|
| [backend_service_names](outputs.tf#L29) | Backend service resource names. | |
|
|
| [forwarding_rule](outputs.tf#L36) | Forwarding rule resource. | |
|
|
| [global_neg_ids](outputs.tf#L41) | Autogenerated global network endpoint group ids. | |
|
|
| [group_ids](outputs.tf#L48) | Autogenerated instance group ids. | |
|
|
| [health_check_ids](outputs.tf#L55) | Autogenerated health check ids. | |
|
|
| [id](outputs.tf#L62) | Fully qualified forwarding rule id. | |
|
|
| [neg_ids](outputs.tf#L67) | Autogenerated network endpoint group ids. | |
|
|
| [psc_neg_ids](outputs.tf#L74) | Autogenerated PSC network endpoint group ids. | |
|
|
| [serverless_neg_ids](outputs.tf#L81) | Autogenerated serverless network endpoint group ids. | |
|
|
|
|
## Fixtures
|
|
|
|
- [compute-mig-bc.tf](../../tests/fixtures/compute-mig-bc.tf)
|
|
<!-- END TFDOC -->
|