16 KiB
Cloud Function Module (v2)
Cloud Function management, with support for IAM roles, optional bucket creation and bundle via GCS URI, local zip, or local source folder.
TODO
- add support for
source_repository
Examples
HTTP trigger
This deploys a Cloud Function with an HTTP endpoint, using a pre-existing GCS bucket for deployment, setting the service account to the Cloud Function default one, and delegating access control to the containing project.
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets/"
}
}
# tftest modules=1 resources=2
PubSub and non-HTTP triggers
Other trigger types other than HTTP are configured via the trigger_config
variable. This example shows a PubSub trigger via Eventarc:
module "trigger-service-account" {
source = "./fabric/modules/iam-service-account"
project_id = "my-project"
name = "sa-cloudfunction"
iam_project_roles = {
"my-project" = [
"roles/run.invoker"
]
}
}
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets/"
}
trigger_config = {
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = "local.my-topic"
service_account_email = module.trigger-service-account.email
}
}
# tftest modules=2 resources=4
Ensure that pubsub service identity (service-[project number]@gcp-sa-pubsub.iam.gserviceaccount.com
has roles/iam.serviceAccountTokenCreator
as documented here.
Controlling HTTP access
To allow anonymous access to the function, grant the roles/run.invoker
role to the special allUsers
identifier. Use specific identities (service accounts, groups, etc.) instead of allUsers
to only allow selective access. The Cloud Run role needs to be used as explained in the gcloud documentation.
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets/"
}
iam = {
"roles/run.invoker" = ["allUsers"]
}
}
# tftest modules=1 resources=3 inventory=iam.yaml
GCS bucket creation
You can have the module auto-create the GCS bucket used for deployment via the bucket_config
variable. Setting bucket_config.location
to null
will also use the function region for GCS.
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
prefix = "my-prefix"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bucket_config = {
lifecycle_delete_age_days = 1
}
bundle_config = {
path = "fabric/assets/"
}
}
# tftest modules=1 resources=3 inventory=bucket-creation.yaml
Service account management
To use a custom service account managed by the module, set service_account_create
to true
and leave service_account
set to null
value (default).
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets/"
}
service_account_create = true
}
# tftest modules=1 resources=3
To use an externally managed service account, pass its email in service_account
and leave service_account_create
to false
(the default).
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets/"
}
service_account = "non-existent@serice.account.email"
}
# tftest modules=1 resources=2
Custom bundle config
The Cloud Function bundle can be configured via the bundle_config
variable. The only mandatory argument is bundle_config.path
which can point to:
- a GCS URI of a ZIP archive
- a local path to a ZIP archive
- a local path to a source folder
When a GCS URI or a local zip file are used, a change in their names will trigger redeployment. When a local source folder is used a ZIP archive will be automatically generated and its internally derived checksum will drive redeployment. You can optionally control its name and exclusions via the attributes in bundle_config.folder_options
.
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets/"
folder_options = {
archive_path = "bundle.zip"
excludes = ["__pycache__"]
}
}
}
# tftest modules=1 resources=2
Private Cloud Build Pool
This deploys a Cloud Function with an HTTP endpoint, using a pre-existing GCS bucket for deployment using a pre existing private Cloud Build worker pool.
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http"
bucket_name = "test-cf-bundles"
build_worker_pool = "projects/my-project/locations/europe-west1/workerPools/my_build_worker_pool"
bundle_config = {
path = "fabric/assets/"
}
}
# tftest modules=1 resources=2
Multiple Cloud Functions within project
When deploying multiple functions via local folders do not reuse bundle_config.archive_path
between instances as the result is undefined. Default archive_path
creates file in /tmp
folder using project Id and function name to avoid name conflicts.
module "cf-http-one" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http-one"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets"
}
}
module "cf-http-two" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http-two"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets"
}
}
# tftest modules=2 resources=4 inventory=multiple_functions.yaml
Mounting secrets from Secret Manager
This provides the latest value of the secret var_secret
as VARIABLE_SECRET
environment variable and three values of path_secret
mounted in filesystem:
/app/secret/first
contains version 1/app/secret/second
contains version 2/app/secret/latest
contains latest version of the secret
module "cf-http" {
source = "./fabric/modules/cloud-function-v2"
project_id = "my-project"
region = var.region
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
path = "fabric/assets/"
}
secrets = {
VARIABLE_SECRET = {
is_volume = false
project_id = 1234567890
secret = "var_secret"
versions = [
"latest"
]
}
"/app/secret" = {
is_volume = true
project_id = 1234567890
secret = "path_secret"
versions = [
"1:first",
"2:second",
"latest:latest"
]
}
}
}
# tftest modules=1 resources=2 inventory=secrets.yaml
Variables
name | description | type | required | default |
---|---|---|---|---|
bucket_name | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | string |
✓ | |
bundle_config | Cloud function source. Path can point to a GCS object URI, or a local path. A local path to a zip archive will generate a GCS object using its basename, a folder will be zipped and the GCS object name inferred when not specified. | object({…}) |
✓ | |
name | Name used for cloud function and associated resources. | string |
✓ | |
project_id | Project id used for all resources. | string |
✓ | |
region | Region used for all resources. | string |
✓ | |
bucket_config | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) |
null |
|
build_service_account | Build service account email. | string |
null |
|
build_worker_pool | Build worker pool, in projects//locations//workerPools/<POOL_NAME> format. | string |
null |
|
description | Optional description. | string |
"Terraform managed." |
|
docker_repository_id | User managed repository created in Artifact Registry. | string |
null |
|
environment_variables | Cloud function environment variables. | map(string) |
{} |
|
function_config | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | object({…}) |
{…} |
|
iam | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) |
{} |
|
ingress_settings | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string |
null |
|
kms_key | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | string |
null |
|
labels | Resource labels. | map(string) |
{} |
|
prefix | Optional prefix used for resource names. | string |
null |
|
secrets | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) |
{} |
|
service_account | Service account email. Unused if service account is auto-created. | string |
null |
|
service_account_create | Auto-create service account. | bool |
false |
|
trigger_config | Function trigger configuration. Leave null for HTTP trigger. | object({…}) |
null |
|
vpc_connector | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) |
null |
|
vpc_connector_config | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) |
null |
Outputs
name | description | sensitive |
---|---|---|
bucket | Bucket resource (only if auto-created). | |
bucket_name | Bucket name. | |
function | Cloud function resources. | |
function_name | Cloud function name. | |
id | Fully qualified function id. | |
service_account | Service account resource. | |
service_account_email | Service account email. | |
service_account_iam_email | Service account email. | |
trigger_service_account | Service account resource. | |
trigger_service_account_email | Service account email. | |
trigger_service_account_iam_email | Service account email. | |
uri | Cloud function service uri. | |
vpc_connector | VPC connector resource if created. |