Added an example of a Nginx reverse proxy cluster using RMIGs.

modules/cloud-config-container/cos-generic-metadata/README.md

@@ -64,7 +64,7 @@ module "cos-envoy" {
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
 | [container_image](variables.tf#L42) | Container image. | <code>string</code> | ✓ |  |
-| [authenticate_gcr](variables.tf#L118) | Setup docker to pull images from private GCR. Requires at least one user since the token is stored in the home of the first user defined. | <code>bool</code> |  | <code>false</code> |
+| [authenticate_gcr](variables.tf#L124) | Setup docker to pull images from private GCR. Requires at least one user since the token is stored in the home of the first user defined. | <code>bool</code> |  | <code>false</code> |
 | [boot_commands](variables.tf#L17) | List of cloud-init `bootcmd`s. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
 | [cloud_config](variables.tf#L23) | Cloud config template path. If provided, takes precedence over all other arguments. | <code>string</code> |  | <code>null</code> |
 | [config_variables](variables.tf#L29) | Additional variables used to render the template passed via `cloud_config`. | <code>map&#40;any&#41;</code> |  | <code>&#123;&#125;</code> |
@@ -76,6 +76,7 @@ module "cos-envoy" {
 | [file_defaults](variables.tf#L74) | Default owner and permissions for files. | <code title="object&#40;&#123;&#10;  owner       &#61; string&#10;  permissions &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  owner       &#61; &#34;root&#34;&#10;  permissions &#61; &#34;0644&#34;&#10;&#125;">&#123;&#8230;&#125;</code> |
 | [files](variables.tf#L86) | Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null. | <code title="map&#40;object&#40;&#123;&#10;  content     &#61; string&#10;  owner       &#61; string&#10;  permissions &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [gcp_logging](variables.tf#L96) | Should container logs be sent to Google Cloud Logging. | <code>bool</code> |  | <code>true</code> |
+| [run_as_first_user](variables.tf#L118) | Run as the first user if users are specified. | <code>bool</code> |  | <code>true</code> |
 | [run_commands](variables.tf#L102) | List of cloud-init `runcmd`s. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
 | [users](variables.tf#L108) | List of usernames to be created. If provided, first user will be used to run the container. | <code title="list&#40;object&#40;&#123;&#10;  username &#61; string,&#10;  uid      &#61; number,&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code title="&#91;&#10;&#93;">&#91;&#8230;&#93;</code> |
 

modules/cloud-config-container/cos-generic-metadata/cloud-config.yaml

@@ -49,7 +49,7 @@ write_files:
       ExecStartPre=/usr/bin/docker-credential-gcr configure-docker
       %{~ endif ~}
       ExecStart=/usr/bin/docker run --rm --name=${container_name} \
-      %{~ if length(users) > 0 ~}
+      %{~ if length(users) > 0 && run_as_first_user ~}
         --user=${users[0].uid} \
       %{~ endif ~}
       %{~ if docker_logging ~}

modules/cloud-config-container/cos-generic-metadata/main.tf

@@ -28,6 +28,7 @@ locals {
     run_commands      = var.run_commands
     users             = var.users
     authenticate_gcr  = var.authenticate_gcr
+    run_as_first_user = var.run_as_first_user
   }))
   files = {
     for path, attrs in var.files : path => {

modules/cloud-config-container/cos-generic-metadata/variables.tf

@@ -115,6 +115,12 @@ variable "users" {
   ]
 }
 
+variable "run_as_first_user" {
+  description = "Run as the first user if users are specified."
+  type        = bool
+  default     = true
+}
+
 variable "authenticate_gcr" {
   description = "Setup docker to pull images from private GCR. Requires at least one user since the token is stored in the home of the first user defined."
   type        = bool