add cmek option for cloud_run_v2 (#2177)
add cmek option for cloud_run_v2 service and job
This commit is contained in:
Saleh Elnagar
GitHub
parent
f25701d79c
commit
136d74db4e
|
|
@ -8,6 +8,7 @@ Cloud Run Services and Jobs, with support for IAM roles and Eventarc trigger cre
|
|||
- [Mounting secrets as volumes](#mounting-secrets-as-volumes)
|
||||
- [Beta features](#beta-features)
|
||||
- [VPC Access Connector](#vpc-access-connector)
|
||||
- [Using Customer-Managed Encryption Key](#using-customer-managed-encryption-key)
|
||||
- [Eventarc triggers](#eventarc-triggers)
|
||||
- [PubSub](#pubsub)
|
||||
- [Audit logs](#audit-logs)
|
||||
|
|
@ -185,6 +186,26 @@ module "cloud_run" {
|
|||
# tftest modules=4 resources=40 fixtures=fixtures/shared-vpc.tf inventory=service-vpc-access-connector-create-sharedvpc.yaml e2e
|
||||
```
|
||||
|
||||
### Using Customer-Managed Encryption Key
|
||||
|
||||
Deploy a Cloud Run service with environment variables encrypted using a Customer-Managed Encryption Key. Ensure you specify the encryption_key with the full resource identifier of your Cloud KMS CryptoKey. This setup adds an extra layer of security by utilizing your own encryption keys.
|
||||
|
||||
```hcl
|
||||
module "cloud_run" {
|
||||
source = "./fabric/modules/cloud-run-v2"
|
||||
project_id = var.project_id
|
||||
region = var.region
|
||||
name = "hello"
|
||||
encryption_key = var.kms_key.id
|
||||
containers = {
|
||||
hello = {
|
||||
image = "us-docker.pkg.dev/cloudrun/container/hello"
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=1 e2e
|
||||
```
|
||||
|
||||
### Eventarc triggers
|
||||
|
||||
#### PubSub
|
||||
|
|
@ -370,21 +391,22 @@ module "cloud_run" {
|
|||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [name](variables.tf#L147) | Name used for Cloud Run service. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L162) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L167) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L153) | Name used for Cloud Run service. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L168) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L173) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [containers](variables.tf#L17) | Containers in name => attributes format. | <code title="map(object({ image = string command = optional(list(string)) args = optional(list(string)) env = optional(map(string)) env_from_key = optional(map(object({ secret = string version = string }))) liveness_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) ports = optional(map(object({ container_port = optional(number) name = optional(string) }))) resources = optional(object({ limits = optional(object({ cpu = string memory = string })) cpu_idle = optional(bool) startup_cpu_boost = optional(bool) })) startup_probe = optional(object({ grpc = optional(object({ port = optional(number) service = optional(string) })) http_get = optional(object({ http_headers = optional(map(string)) path = optional(string) })) tcp_socket = optional(object({ port = optional(number) })) failure_threshold = optional(number) initial_delay_seconds = optional(number) period_seconds = optional(number) timeout_seconds = optional(number) })) volume_mounts = optional(map(string)) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [create_job](variables.tf#L77) | Create Cloud Run Job instead of Service. | <code>bool</code> | | <code>false</code> |
|
||||
| [eventarc_triggers](variables.tf#L83) | Event arc triggers for different sources. | <code title="object({ audit_log = optional(map(object({ method = string service = string }))) pubsub = optional(map(string)) service_account_email = optional(string) service_account_create = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L101) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress](variables.tf#L107) | Ingress settings. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L124) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [launch_stage](variables.tf#L130) | The launch stage as defined by Google Cloud Platform Launch Stages. | <code>string</code> | | <code>null</code> |
|
||||
| [prefix](variables.tf#L152) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [revision](variables.tf#L172) | Revision template configurations. | <code title="object({ name = optional(string) gen2_execution_environment = optional(bool) max_concurrency = optional(number) max_instance_count = optional(number) min_instance_count = optional(number) vpc_access = optional(object({ connector = optional(string) egress = optional(string) subnet = optional(string) tags = optional(list(string)) })) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L199) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L205) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [volumes](variables.tf#L211) | Named volumes in containers in name => attributes format. | <code title="map(object({ secret = optional(object({ name = string default_mode = optional(string) path = optional(string) version = optional(string) mode = optional(string) })) cloud_sql_instances = optional(list(string)) empty_dir_size = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [encryption_key](variables.tf#L83) | The full resource name of the Cloud KMS CryptoKey. | <code>string</code> | | <code>null</code> |
|
||||
| [eventarc_triggers](variables.tf#L89) | Event arc triggers for different sources. | <code title="object({ audit_log = optional(map(object({ method = string service = string }))) pubsub = optional(map(string)) service_account_email = optional(string) service_account_create = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L107) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress](variables.tf#L113) | Ingress settings. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L130) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [launch_stage](variables.tf#L136) | The launch stage as defined by Google Cloud Platform Launch Stages. | <code>string</code> | | <code>null</code> |
|
||||
| [prefix](variables.tf#L158) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [revision](variables.tf#L178) | Revision template configurations. | <code title="object({ name = optional(string) gen2_execution_environment = optional(bool) max_concurrency = optional(number) max_instance_count = optional(number) min_instance_count = optional(number) vpc_access = optional(object({ connector = optional(string) egress = optional(string) subnet = optional(string) tags = optional(list(string)) })) timeout = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L205) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L211) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [volumes](variables.tf#L217) | Named volumes in containers in name => attributes format. | <code title="map(object({ secret = optional(object({ name = string default_mode = optional(string) path = optional(string) version = optional(string) mode = optional(string) })) cloud_sql_instances = optional(list(string)) empty_dir_size = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [vpc_connector_create](variables-vpcconnector.tf#L17) | Populate this to create a Serverless VPC Access connector. | <code title="object({ ip_cidr_range = optional(string) machine_type = optional(string) name = optional(string) network = optional(string) instances = optional(object({ max = optional(number) min = optional(number) }), {}) throughput = optional(object({ max = optional(number, 1000) # workaround for a wrong default in provider min = optional(number) }), {}) subnet = optional(object({ name = optional(string) project_id = optional(string) }), {}) })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
|
|
|||
|
|
@ -24,6 +24,7 @@ resource "google_cloud_run_v2_job" "job" {
|
|||
launch_stage = var.launch_stage
|
||||
template {
|
||||
template {
|
||||
encryption_key = var.encryption_key
|
||||
dynamic "vpc_access" {
|
||||
for_each = local.connector == null ? [] : [""]
|
||||
content {
|
||||
|
|
|
|||
|
|
@ -25,7 +25,8 @@ resource "google_cloud_run_v2_service" "service" {
|
|||
launch_stage = var.launch_stage
|
||||
|
||||
template {
|
||||
revision = local.revision_name
|
||||
encryption_key = var.encryption_key
|
||||
revision = local.revision_name
|
||||
execution_environment = (
|
||||
var.revision.gen2_execution_environment == true
|
||||
? "EXECUTION_ENVIRONMENT_GEN2" : "EXECUTION_ENVIRONMENT_GEN1"
|
||||
|
|
|
|||
|
|
@ -80,6 +80,12 @@ variable "create_job" {
|
|||
default = false
|
||||
}
|
||||
|
||||
variable "encryption_key" {
|
||||
description = "The full resource name of the Cloud KMS CryptoKey."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "eventarc_triggers" {
|
||||
description = "Event arc triggers for different sources."
|
||||
type = object({
|
||||
|
|
|
|||
Loading…
Reference in New Issue