From 3e0810dfefa8b894d5cb7d170356ca0e7b8fa4ac Mon Sep 17 00:00:00 2001 From: kovagoadam Date: Mon, 28 Jul 2025 10:27:55 +0200 Subject: [PATCH] Add support for cross project NEGs (#3215) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Added cross project NEG support * Made neg_configs variable same as in net-lb-app-int * Added support for cross-project negs in net-lb-app-ext-regional module --------- Co-authored-by: Ludovico Magnocavallo Co-authored-by: Ludovico Magnocavallo Co-authored-by: Julio Castillo Co-authored-by: Wiktor Niesiobędzki --- modules/net-lb-app-ext-regional/README.md | 16 ++++++++-------- modules/net-lb-app-ext-regional/negs.tf | 6 +++++- modules/net-lb-app-ext-regional/variables.tf | 1 + modules/net-lb-app-ext/README.md | 10 +++++----- modules/net-lb-app-ext/negs.tf | 6 +++++- modules/net-lb-app-ext/variables.tf | 1 + 6 files changed, 25 insertions(+), 15 deletions(-) diff --git a/modules/net-lb-app-ext-regional/README.md b/modules/net-lb-app-ext-regional/README.md index 91ef62951..ed47fd8d5 100644 --- a/modules/net-lb-app-ext-regional/README.md +++ b/modules/net-lb-app-ext-regional/README.md @@ -799,9 +799,9 @@ For deploying changes to load balancer configuration please refer to [net-lb-app | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [name](variables.tf#L61) | Load balancer name. | string | ✓ | | -| [project_id](variables.tf#L186) | Project id. | string | ✓ | | -| [region](variables.tf#L204) | Region where the load balancer is created. | string | ✓ | | -| [vpc](variables.tf#L224) | VPC-level configuration. | string | ✓ | | +| [project_id](variables.tf#L187) | Project id. | string | ✓ | | +| [region](variables.tf#L205) | Region where the load balancer is created. | string | ✓ | | +| [vpc](variables.tf#L225) | VPC-level configuration. | string | ✓ | | | [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null | | [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} | | [description](variables.tf#L23) | Optional description used for resources. | string | | "Terraform managed." | @@ -809,11 +809,11 @@ For deploying changes to load balancer configuration please refer to [net-lb-app | [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) | | {…} | | [https_proxy_config](variables.tf#L41) | HTTPS proxy connfiguration. | object({…}) | | {} | | [labels](variables.tf#L55) | Labels set on resources. | map(string) | | {} | -| [neg_configs](variables.tf#L66) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | -| [network_tier_standard](variables.tf#L169) | Use standard network tier. | bool | | true | -| [ports](variables.tf#L176) | Optional ports for HTTP load balancer. | list(string) | | null | -| [protocol](variables.tf#L191) | Protocol supported by this load balancer. | string | | "HTTP" | -| [ssl_certificates](variables.tf#L209) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | +| [neg_configs](variables.tf#L66) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [network_tier_standard](variables.tf#L170) | Use standard network tier. | bool | | true | +| [ports](variables.tf#L177) | Optional ports for HTTP load balancer. | list(string) | | null | +| [protocol](variables.tf#L192) | Protocol supported by this load balancer. | string | | "HTTP" | +| [ssl_certificates](variables.tf#L210) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | | [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | ## Outputs diff --git a/modules/net-lb-app-ext-regional/negs.tf b/modules/net-lb-app-ext-regional/negs.tf index 0123987e9..4ec75c6bc 100644 --- a/modules/net-lb-app-ext-regional/negs.tf +++ b/modules/net-lb-app-ext-regional/negs.tf @@ -151,7 +151,11 @@ resource "google_compute_region_network_endpoint_group" "psc" { resource "google_compute_region_network_endpoint_group" "serverless" { for_each = local.neg_regional_serverless - project = var.project_id + project = ( + each.value.project_id == null + ? var.project_id + : each.value.project_id + ) region = try( each.value.cloudrun.region, each.value.cloudfunction.region, null ) diff --git a/modules/net-lb-app-ext-regional/variables.tf b/modules/net-lb-app-ext-regional/variables.tf index e9575effe..3389e8c52 100644 --- a/modules/net-lb-app-ext-regional/variables.tf +++ b/modules/net-lb-app-ext-regional/variables.tf @@ -66,6 +66,7 @@ variable "name" { variable "neg_configs" { description = "Optional network endpoint groups to create. Can be referenced in backends via key or outputs." type = map(object({ + project_id = optional(string) description = optional(string) cloudfunction = optional(object({ region = string diff --git a/modules/net-lb-app-ext/README.md b/modules/net-lb-app-ext/README.md index 0de289679..dcdb57da3 100644 --- a/modules/net-lb-app-ext/README.md +++ b/modules/net-lb-app-ext/README.md @@ -1063,7 +1063,7 @@ After provisioning this change, and verifying that the new certificate is provis | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [name](variables.tf#L110) | Load balancer name. | string | ✓ | | -| [project_id](variables.tf#L206) | Project id. | string | ✓ | | +| [project_id](variables.tf#L207) | Project id. | string | ✓ | | | [backend_buckets_config](variables.tf#L17) | Backend buckets configuration. | map(object({…})) | | {} | | [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) })) | | {} | | [description](variables.tf#L50) | Optional description used for resources. | string | | "Terraform managed." | @@ -1072,11 +1072,11 @@ After provisioning this change, and verifying that the new certificate is provis | [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) | | {…} | | [https_proxy_config](variables.tf#L89) | HTTPS proxy connfiguration. | object({…}) | | {} | | [labels](variables.tf#L104) | Labels set on resources. | map(string) | | {} | -| [neg_configs](variables.tf#L115) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | -| [protocol](variables.tf#L211) | Protocol supported by this load balancer. | string | | "HTTP" | -| [ssl_certificates](variables.tf#L224) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | +| [neg_configs](variables.tf#L115) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [protocol](variables.tf#L212) | Protocol supported by this load balancer. | string | | "HTTP" | +| [ssl_certificates](variables.tf#L225) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | | [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | -| [use_classic_version](variables.tf#L242) | Use classic Global Load Balancer. | bool | | true | +| [use_classic_version](variables.tf#L243) | Use classic Global Load Balancer. | bool | | true | ## Outputs diff --git a/modules/net-lb-app-ext/negs.tf b/modules/net-lb-app-ext/negs.tf index 290866c6f..ec161a305 100644 --- a/modules/net-lb-app-ext/negs.tf +++ b/modules/net-lb-app-ext/negs.tf @@ -138,7 +138,11 @@ resource "google_compute_region_network_endpoint_group" "psc" { resource "google_compute_region_network_endpoint_group" "serverless" { for_each = local.neg_regional_serverless - project = var.project_id + project = ( + each.value.project_id == null + ? var.project_id + : each.value.project_id + ) region = try( each.value.cloudrun.region, each.value.cloudfunction.region, null ) diff --git a/modules/net-lb-app-ext/variables.tf b/modules/net-lb-app-ext/variables.tf index 55723d80b..7f0642d73 100644 --- a/modules/net-lb-app-ext/variables.tf +++ b/modules/net-lb-app-ext/variables.tf @@ -115,6 +115,7 @@ variable "name" { variable "neg_configs" { description = "Optional network endpoint groups to create. Can be referenced in backends via key or outputs." type = map(object({ + project_id = optional(string) description = optional(string) cloudfunction = optional(object({ region = string