From 3cad63285fb128e0e8d9955eb4067da990672fbc Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Fri, 24 Jul 2020 08:55:58 +0200 Subject: [PATCH] Add support for vpc connector and ingress settings to cloud-function (#116) * add support for ingress/egress/vpc connector to cloud function * refactor vpc connector support * refactor ingress settings support * fix vpc connector value * fix vpc connector value --- modules/cloud-function/README.md | 7 ++--- modules/cloud-function/main.tf | 25 ++++++++++++++++++ modules/cloud-function/outputs.tf | 5 ++++ modules/cloud-function/variables.tf | 41 ++++++++++++++++++++++------- 4 files changed, 65 insertions(+), 13 deletions(-) diff --git a/modules/cloud-function/README.md b/modules/cloud-function/README.md index 9114b9eba..ca9848f42 100644 --- a/modules/cloud-function/README.md +++ b/modules/cloud-function/README.md @@ -6,8 +6,6 @@ The GCS object used for deployment uses a hash of the bundle zip contents in its ## TODO -- [ ] add support for `ingress_settings` -- [ ] add support for `vpc_connector` and `vpc_connector_egress_settings` - [ ] add support for `source_repository` ## Examples @@ -138,15 +136,17 @@ module "cf-http" { | project_id | Project id used for all resources. | string | ✓ | | | *bucket_config* | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({...}) | | null | | *environment_variables* | Cloud function environment variables. | map(string) | | {} | -| *function_config* | Cloud function configuration. | object({...}) | | ... | +| *function_config* | Cloud function configuration. | object({...}) | | ... | | *iam_members* | Map of member lists used to set authoritative bindings, keyed by role. Ignored for template use. | map(list(string)) | | {} | | *iam_roles* | List of roles used to set authoritative bindings. Ignored for template use. | list(string) | | [] | +| *ingress_settings* | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY. | string | | null | | *labels* | Resource labels | map(string) | | {} | | *prefix* | Optional prefix used for resource names. | string | | null | | *region* | Region used for all resources. | string | | europe-west1 | | *service_account* | Service account email. Unused if service account is auto-created. | string | | null | | *service_account_create* | Auto-create service account. | bool | | false | | *trigger_config* | Function trigger configuration. Leave null for HTTP trigger. | object({...}) | | null | +| *vpc_connector_config* | VPC connector configuration. Set `create_config` attributes to trigger creation. | object({...}) | | null | ## Outputs @@ -159,4 +159,5 @@ module "cf-http" { | service_account | Service account resource. | | | service_account_email | Service account email. | | | service_account_iam_email | Service account email. | | +| vpc_connector | VPC connector resource if created. | | diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index a668a8bcc..224247655 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -34,8 +34,27 @@ locals { ) : var.service_account ) + vpc_connector = ( + var.vpc_connector_config == null + ? null + : ( + var.vpc_connector_config.create_config == null + ? var.vpc_connector_config.name + : google_vpc_access_connector.connector.0.id + ) + ) } +resource "google_vpc_access_connector" "connector" { + count = try(var.vpc_connector_config.create_config, null) != null ? 1 : 0 + project = var.project_id + name = var.vpc_connector_config.name + region = var.region + ip_cidr_range = var.vpc_connector_config.create_config.ip_cidr_range + network = var.vpc_connector_config.create_config.network +} + + resource "google_cloudfunctions_function" "function" { project = var.project_id region = var.region @@ -52,6 +71,12 @@ resource "google_cloudfunctions_function" "function" { source_archive_object = google_storage_bucket_object.bundle.name labels = var.labels trigger_http = var.trigger_config == null ? true : null + ingress_settings = var.ingress_settings + + vpc_connector = local.vpc_connector + vpc_connector_egress_settings = try( + var.vpc_connector_config.egress_settings, null + ) dynamic event_trigger { for_each = var.trigger_config == null ? [] : [""] diff --git a/modules/cloud-function/outputs.tf b/modules/cloud-function/outputs.tf index 43e0eda7f..b5b646f1d 100644 --- a/modules/cloud-function/outputs.tf +++ b/modules/cloud-function/outputs.tf @@ -53,3 +53,8 @@ output "service_account_iam_email" { local.service_account_email == null ? "" : local.service_account_email ]) } + +output "vpc_connector" { + description = "VPC connector resource if created." + value = try(google_vpc_access_connector.connector.0.id, null) +} diff --git a/modules/cloud-function/variables.tf b/modules/cloud-function/variables.tf index 83c8c048a..eea9131fd 100644 --- a/modules/cloud-function/variables.tf +++ b/modules/cloud-function/variables.tf @@ -57,21 +57,29 @@ variable "iam_roles" { variable "function_config" { description = "Cloud function configuration." type = object({ - entry_point = string - instances = number - memory = number - runtime = string - timeout = number + entry_point = string + ingress_settings = string + instances = number + memory = number + runtime = string + timeout = number }) default = { - entry_point = "main" - instances = 1 - memory = 256 - runtime = "python37" - timeout = 180 + entry_point = "main" + ingress_settings = null + instances = 1 + memory = 256 + runtime = "python37" + timeout = 180 } } +variable "ingress_settings" { + description = "Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL and ALLOW_INTERNAL_ONLY." + type = string + default = null +} + variable "labels" { description = "Resource labels" type = map(string) @@ -121,3 +129,16 @@ variable "trigger_config" { }) default = null } + +variable "vpc_connector_config" { + description = "VPC connector configuration. Set `create_config` attributes to trigger creation." + type = object({ + egress_settings = string + name = string + create_config = object({ + ip_cidr_range = string + network = string + }) + }) + default = null +}