diff --git a/README.md b/README.md index 510881094..ad08c2d8e 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ Currently available modules: - **AI** - [AI Applications](./modules/ai-applications/README.md) - **development** - [API Gateway](./modules/api-gateway), [Apigee](./modules/apigee), [Artifact Registry](./modules/artifact-registry), [Cloud Build V2 Connection](./modules/cloud-build-v2-connection), [Container Registry](./modules/container-registry), [Cloud Source Repository](./modules/source-repository), [Cloud Deploy](./modules/cloud-deploy), [Secure Source Manager instance](./modules/secure-source-manager-instance), [Workstation cluster](./modules/workstation-cluster) - **security** - [Binauthz](./modules/binauthz/), [Certificate Authority Service (CAS)](./modules/certificate-authority-service), [KMS](./modules/kms), [SecretManager](./modules/secret-manager), [VPC Service Control](./modules/vpc-sc), [Certificate Manager](./modules/certificate-manager/) -- **serverless** - [Cloud Function v1](./modules/cloud-function-v1), [Cloud Function v2](./modules/cloud-function-v2), [Cloud Run](./modules/cloud-run), [Cloud Run v2](./modules/cloud-run-v2) +- **serverless** - [Cloud Function v1](./modules/cloud-function-v1), [Cloud Function v2](./modules/cloud-function-v2), [Cloud Run v2](./modules/cloud-run-v2) For more information and usage examples see each module's README file. diff --git a/modules/README.md b/modules/README.md index bfc52ae56..01bcae038 100644 --- a/modules/README.md +++ b/modules/README.md @@ -132,5 +132,4 @@ These modules are used in the examples included in this repository. If you are u - [Cloud Functions v1](./cloud-function-v1) - [Cloud Functions v2](./cloud-function-v2) -- [Cloud Run](./cloud-run) - [Cloud Run v2](./cloud-run-v2) diff --git a/modules/cloud-run/README.md b/modules/cloud-run/README.md deleted file mode 100644 index 09d8c9556..000000000 --- a/modules/cloud-run/README.md +++ /dev/null @@ -1,460 +0,0 @@ -# Cloud Run Module - -Cloud Run management, with support for IAM roles, revision annotations and optional Eventarc trigger creation. - - -- [IAM and environment variables](#iam-and-environment-variables) -- [Mounting secrets as volumes](#mounting-secrets-as-volumes) -- [Revision annotations](#revision-annotations) -- [Second generation execution environment](#second-generation-execution-environment) -- [VPC Access Connector creation](#vpc-access-connector-creation) -- [Traffic split](#traffic-split) -- [Eventarc triggers](#eventarc-triggers) - - [PubSub](#pubsub) - - [Audit logs](#audit-logs) - - [Using custom service accounts for triggers](#using-custom-service-accounts-for-triggers) -- [Service account](#service-account) -- [Tag bindings](#tag-bindings) -- [Variables](#variables) -- [Outputs](#outputs) - - -## IAM and environment variables - -IAM bindings support the usual syntax. Container environment values can be declared as key-value strings or as references to Secret Manager secrets. Both can be combined as long as there's no duplication of keys: - -```hcl - -module "secret-manager" { - source = "./fabric/modules/secret-manager" - project_id = var.project_id - secrets = { - credentials = { - iam = { - "roles/secretmanager.secretAccessor" = [ - module.cloud_run.service_account_iam_email - ] - } - } - } -} - -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - env = { - VAR1 = "VALUE1" - VAR2 = "VALUE2" - } - env_from = { - SECRET1 = { - name = module.secret-manager.ids["credentials"] - key = "latest" - } - } - } - } - iam = { - "roles/run.invoker" = ["allUsers"] - } - service_account_create = true -} -# tftest modules=2 resources=5 inventory=simple.yaml e2e skip-tofu -``` - -## Mounting secrets as volumes - -```hcl -module "secret-manager" { - source = "./fabric/modules/secret-manager" - project_id = var.project_id - secrets = { - credentials = { - iam = { - "roles/secretmanager.secretAccessor" = [ - module.cloud_run.service_account_iam_email - ] - } - versions = { - v1 = { data = "foo bar baz" } - } - } - } -} - - -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - name = "hello" - region = var.region - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - volume_mounts = { - "credentials" = "/credentials" - } - } - } - service_account_create = true - volumes = { - credentials = { - name = module.secret-manager.secrets["credentials"].name - secret_name = "credentials" # TODO: module.secret-manager.secrets["credentials"].name - items = { - latest = { path = "v1.txt" } - } - } - } -} -# tftest modules=2 resources=5 inventory=secrets.yaml e2e skip-tofu -``` - -## Revision annotations - -Annotations can be specified via the `revision_annotations` variable: - -```hcl -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - revision_annotations = { - autoscaling = { - max_scale = 10 - min_scale = 1 - } - cloudsql_unstances = ["sql-0", "sql-1"] - vpcaccess_connector = "foo" - vpcaccess_egress = "all-traffic" - } -} -# tftest modules=1 resources=1 inventory=revision-annotations.yaml -``` - -## Second generation execution environment - -Second generation execution environment (gen2) can be enabled by setting the `gen2_execution_environment` variable to true: - -```hcl -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - gen2_execution_environment = true -} -# tftest modules=1 resources=1 inventory=gen2.yaml e2e -``` - -## VPC Access Connector creation - -If creation of a [VPC Access Connector](https://cloud.google.com/vpc/docs/serverless-vpc-access) is required, use the `vpc_connector_create` variable which also support optional attributes for number of instances, machine type, and throughput (not shown here). The annotation to use the connector will be added automatically. - -```hcl -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - vpc_connector_create = { - ip_cidr_range = "10.10.10.0/28" - throughput = { - max = 300 - min = 200 - } - vpc_self_link = var.vpc.self_link - } -} -# tftest modules=1 resources=2 inventory=connector.yaml e2e -``` - -Note that if you are using Shared VPC you need to specify a subnet: - -```hcl -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - vpc_connector_create = { - subnet = { - name = "subnet-vpc-access" - project_id = "host-project" - } - } -} -# tftest modules=1 resources=2 inventory=connector-shared.yaml -``` - -## Traffic split - -This deploys a Cloud Run service with traffic split between two revisions. - -```hcl -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - revision_name = "green" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - traffic = { - blue = { percent = 25 } - green = { percent = 75 } - } -} -# tftest modules=1 resources=1 inventory=traffic.yaml -``` - -## Eventarc triggers - -### PubSub - -This deploys a Cloud Run service that will be triggered when messages are published to Pub/Sub topics. - -```hcl -module "pubsub" { - source = "./fabric/modules/pubsub" - project_id = var.project_id - name = "pubsub_sink" -} - -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - eventarc_triggers = { - pubsub = { - topic-1 = module.pubsub.id - } - } -} -# tftest modules=2 resources=3 inventory=eventarc.yaml e2e -``` - -### Audit logs - -This deploys a Cloud Run service that will be triggered when specific log events are written to Google Cloud audit logs. - -```hcl -module "sa" { - source = "./fabric/modules/iam-service-account" - project_id = var.project_id - name = "eventarc-trigger" - iam_project_roles = { - (var.project_id) = ["roles/eventarc.eventReceiver"] - } -} - -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - eventarc_triggers = { - audit_log = { - setiampolicy = { - method = "SetIamPolicy" - service = "cloudresourcemanager.googleapis.com" - } - } - service_account_email = module.sa.email - } - iam = { - "roles/run.invoker" = [module.sa.iam_email] - } -} -# tftest modules=2 resources=5 inventory=audit-logs.yaml -``` - -### Using custom service accounts for triggers - -By default `Compute default service account` is used to trigger Cloud Run. If you want to use custom Service Account you can either provide your own in `eventarc_triggers.service_account_email` or set `eventarc_triggers.service_account_create` to true and service account named `tf-cr-trigger-${var.name}` will be created with `roles/run.invoker` granted on this Cloud Run service. - -For example using provided service account refer to [Audit logs](#audit-logs) example. - -Example using automatically created service account: - -```hcl -module "pubsub" { - source = "./fabric/modules/pubsub" - project_id = var.project_id - name = "pubsub_sink" -} - -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - eventarc_triggers = { - pubsub = { - topic-1 = module.pubsub.id - } - service_account_create = true - } -} -# tftest modules=2 resources=5 inventory=trigger-service-account.yaml e2e -``` - -## Service account - -To use a custom service account managed by the module, set `service_account_create` to `true` and leave `service_account` set to `null` value (default). - -```hcl -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - service_account_create = true -} -# tftest modules=1 resources=2 inventory=service-account.yaml e2e -``` - -To use an externally managed service account, pass its email in `service_account` and leave `service_account_create` to `false` (the default). - -```hcl -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - service_account = var.service_account.email -} -# tftest modules=1 resources=1 inventory=service-account-external.yaml e2e -``` - -## Tag bindings - -Refer to the [Creating and managing tags](https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing) documentation for details on usage. - -```hcl -module "org" { - source = "./fabric/modules/organization" - organization_id = var.organization_id - tags = { - environment = { - description = "Environment specification." - values = { - dev = {} - prod = {} - sandbox = {} - } - } - } -} - -module "cloud_run" { - source = "./fabric/modules/cloud-run" - project_id = var.project_id - region = var.region - name = "hello" - containers = { - hello = { - image = "us-docker.pkg.dev/cloudrun/container/hello" - } - } - tag_bindings = { - env-sandbox = module.org.tag_values["environment/sandbox"].id - } -} -# tftest modules=2 resources=6 -``` - -## Variables - -| name | description | type | required | default | -|---|---|:---:|:---:|:---:| -| [name](variables.tf#L144) | Name used for cloud run service. | string | ✓ | | -| [project_id](variables.tf#L159) | Project id used for all resources. | string | ✓ | | -| [region](variables.tf#L164) | Region used for all resources. | string | ✓ | | -| [container_concurrency](variables.tf#L18) | Maximum allowed in-flight (concurrent) requests per container of the revision. | string | | null | -| [containers](variables.tf#L24) | Containers in arbitrary key => attributes format. | map(object({…})) | | {} | -| [eventarc_triggers](variables.tf#L91) | Event arc triggers for different sources. | object({…}) | | {} | -| [gen2_execution_environment](variables.tf#L113) | Use second generation execution environment. | bool | | false | -| [iam](variables.tf#L119) | IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | -| [ingress_settings](variables.tf#L125) | Ingress settings. | string | | null | -| [labels](variables.tf#L138) | Resource labels. | map(string) | | {} | -| [prefix](variables.tf#L149) | Optional prefix used for resource names. | string | | null | -| [revision_annotations](variables.tf#L169) | Configure revision template annotations. | object({…}) | | {} | -| [revision_name](variables.tf#L184) | Revision name. | string | | null | -| [service_account](variables.tf#L190) | Service account email. Unused if service account is auto-created. | string | | null | -| [service_account_create](variables.tf#L196) | Auto-create service account. | bool | | false | -| [startup_cpu_boost](variables.tf#L202) | Enable startup cpu boost. | bool | | false | -| [tag_bindings](variables.tf#L208) | Tag bindings for this service, in key => tag value id format. | map(string) | | {} | -| [timeout_seconds](variables.tf#L215) | Maximum duration the instance is allowed for responding to a request. | number | | null | -| [traffic](variables.tf#L221) | Traffic steering configuration. If revision name is null the latest revision will be used. | map(object({…})) | | {} | -| [volumes](variables.tf#L232) | Named volumes in containers in name => attributes format. | map(object({…})) | | {} | -| [vpc_connector_create](variables.tf#L246) | Populate this to create a VPC connector. You can then refer to it in the template annotations. | object({…}) | | null | - -## Outputs - -| name | description | sensitive | -|---|---|:---:| -| [id](outputs.tf#L18) | Fully qualified service id. | | -| [invoke_command](outputs.tf#L23) | Command to invoke Cloud Run Service / submit job. | | -| [service](outputs.tf#L32) | Cloud Run service. | | -| [service_account](outputs.tf#L37) | Service account resource. | | -| [service_account_email](outputs.tf#L42) | Service account email. | | -| [service_account_iam_email](outputs.tf#L47) | Service account email. | | -| [service_name](outputs.tf#L55) | Cloud Run service name. | | -| [vpc_connector](outputs.tf#L61) | VPC connector resource if created. | | - diff --git a/modules/cloud-run/main.tf b/modules/cloud-run/main.tf deleted file mode 100644 index f9c859a48..000000000 --- a/modules/cloud-run/main.tf +++ /dev/null @@ -1,409 +0,0 @@ -/** - * Copyright 2023 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -locals { - _vpcaccess_annotation = ( - local.vpc_connector_create - ? merge({ - "run.googleapis.com/vpc-access-connector" = google_vpc_access_connector.connector[0].id - }, - var.revision_annotations.vpcaccess_egress == null ? { - # if creating a vpc connector and no explicit annotation is given, - # add "private-ranges-only" annotation to prevent permanent diff - "run.googleapis.com/vpc-access-egress" = "private-ranges-only" - } : { - "run.googleapis.com/vpc-access-egress" = ( - var.revision_annotations.vpcaccess_egress - ) - }, - ) - : ( - var.revision_annotations.vpcaccess_connector == null - ? {} - : { - "run.googleapis.com/vpc-access-connector" = ( - var.revision_annotations.vpcaccess_connector - ) - } - ) - ) - annotations = merge( - var.ingress_settings == null ? {} : { - "run.googleapis.com/ingress" = var.ingress_settings - }, - ) - prefix = var.prefix == null ? "" : "${var.prefix}-" - revision_annotations = merge( - try(var.revision_annotations.autoscaling, null) == null ? {} : { - "autoscaling.knative.dev/maxScale" = ( - var.revision_annotations.autoscaling.max_scale - ) - }, - try(var.revision_annotations.autoscaling.min_scale, null) == null ? {} : { - "autoscaling.knative.dev/minScale" = ( - var.revision_annotations.autoscaling.min_scale - ) - }, - length(var.revision_annotations.cloudsql_instances) == 0 ? {} : { - "run.googleapis.com/cloudsql-instances" = ( - join(",", var.revision_annotations.cloudsql_instances) - ) - }, - local._vpcaccess_annotation, - var.revision_annotations.vpcaccess_egress == null ? {} : { - "run.googleapis.com/vpc-access-egress" = ( - var.revision_annotations.vpcaccess_egress - ) - }, - var.gen2_execution_environment ? { - "run.googleapis.com/execution-environment" = "gen2" - } : {}, - var.startup_cpu_boost ? { - "run.googleapis.com/startup-cpu-boost" = "true" - } : {}, - ) - revision_name = ( - try(var.revision_name, null) == null - ? null - : "${var.name}-${var.revision_name}" - ) - service_account_email = ( - var.service_account_create - ? ( - length(google_service_account.service_account) > 0 - ? google_service_account.service_account[0].email - : null - ) - : var.service_account - ) - trigger_sa_create = try( - var.eventarc_triggers.service_account_create, false - ) - trigger_sa_email = ( - local.trigger_sa_create ? - google_service_account.trigger_service_account[0].email - : try(var.eventarc_triggers.service_account_email, null) - ) - vpc_connector_create = var.vpc_connector_create != null -} - -resource "google_vpc_access_connector" "connector" { - count = local.vpc_connector_create ? 1 : 0 - project = var.project_id - name = ( - var.vpc_connector_create.name != null - ? var.vpc_connector_create.name - : var.name - ) - region = var.region - ip_cidr_range = var.vpc_connector_create.ip_cidr_range - network = var.vpc_connector_create.vpc_self_link - machine_type = var.vpc_connector_create.machine_type - max_instances = var.vpc_connector_create.instances.max - max_throughput = var.vpc_connector_create.throughput.max - min_instances = var.vpc_connector_create.instances.min - min_throughput = var.vpc_connector_create.throughput.min - dynamic "subnet" { - for_each = alltrue([for k, v in var.vpc_connector_create.subnet : (v == null)]) ? [] : [""] - content { - name = var.vpc_connector_create.subnet.name - project_id = var.vpc_connector_create.subnet.project_id - } - } -} - -resource "google_cloud_run_service" "service" { - provider = google-beta - project = var.project_id - location = var.region - name = "${local.prefix}${var.name}" - - template { - spec { - container_concurrency = var.container_concurrency - service_account_name = local.service_account_email - timeout_seconds = var.timeout_seconds - dynamic "containers" { - for_each = var.containers - content { - image = containers.value.image - args = containers.value.args - command = containers.value.command - dynamic "env" { - for_each = containers.value.env - content { - name = env.key - value = env.value - } - } - dynamic "env" { - for_each = containers.value.env_from_key - content { - name = env.key - value_from { - secret_key_ref { - key = env.value.key - name = env.value.name - } - } - } - } - dynamic "liveness_probe" { - for_each = containers.value.liveness_probe == null ? [] : [""] - content { - failure_threshold = containers.value.liveness_probe.failure_threshold - initial_delay_seconds = containers.value.liveness_probe.initial_delay_seconds - period_seconds = containers.value.liveness_probe.period_seconds - timeout_seconds = containers.value.liveness_probe.timeout_seconds - dynamic "grpc" { - for_each = ( - containers.value.liveness_probe.action.grpc == null ? [] : [""] - ) - content { - port = containers.value.liveness_probe.action.grpc.port - service = containers.value.liveness_probe.action.grpc.service - } - } - dynamic "http_get" { - for_each = ( - containers.value.liveness_probe.action.http_get == null ? [] : [""] - ) - content { - path = containers.value.liveness_probe.action.http_get.path - dynamic "http_headers" { - for_each = ( - containers.value.liveness_probe.action.http_get.http_headers - ) - content { - name = http_headers.key - value = http_headers.value - } - } - } - } - } - } - dynamic "ports" { - for_each = containers.value.ports - content { - container_port = ports.value.container_port - name = ports.value.name - protocol = ports.value.protocol - } - } - dynamic "resources" { - for_each = containers.value.resources == null ? [] : [""] - content { - limits = containers.value.resources.limits - requests = containers.value.resources.requests - } - } - dynamic "startup_probe" { - for_each = containers.value.startup_probe == null ? [] : [""] - content { - failure_threshold = containers.value.startup_probe.failure_threshold - initial_delay_seconds = containers.value.startup_probe.initial_delay_seconds - period_seconds = containers.value.startup_probe.period_seconds - timeout_seconds = containers.value.startup_probe.timeout_seconds - dynamic "grpc" { - for_each = ( - containers.value.startup_probe.action.grpc == null ? [] : [""] - ) - content { - port = containers.value.startup_probe.action.grpc.port - service = containers.value.startup_probe.action.grpc.service - } - } - dynamic "http_get" { - for_each = ( - containers.value.startup_probe.action.http_get == null ? [] : [""] - ) - content { - path = containers.value.startup_probe.action.http_get.path - dynamic "http_headers" { - for_each = ( - containers.value.startup_probe.action.http_get.http_headers - ) - content { - name = http_headers.key - value = http_headers.value - } - } - } - } - dynamic "tcp_socket" { - for_each = ( - containers.value.startup_probe.action.tcp_socket == null ? [] : [""] - ) - content { - port = containers.value.startup_probe.action.tcp_socket.port - } - } - } - } - dynamic "volume_mounts" { - for_each = containers.value.volume_mounts - content { - name = volume_mounts.key - mount_path = volume_mounts.value - } - } - } - } - dynamic "volumes" { - for_each = var.volumes - content { - name = volumes.key - secret { - secret_name = volumes.value.secret_name - default_mode = volumes.value.default_mode - dynamic "items" { - for_each = volumes.value.items - content { - key = items.key - path = items.value.path - mode = items.value.mode - } - } - } - } - } - } - metadata { - name = local.revision_name - annotations = local.revision_annotations - } - } - - metadata { - annotations = local.annotations - labels = var.labels - } - - dynamic "traffic" { - for_each = var.traffic - content { - percent = traffic.value.percent - latest_revision = traffic.value.latest == true - revision_name = ( - traffic.value.latest == true - ? null - : "${var.name}-${traffic.key}" - ) - tag = traffic.value.tag - } - } - - lifecycle { - ignore_changes = [ - metadata[0].annotations["run.googleapis.com/operation-id"], - template[0].metadata[0].labels["run.googleapis.com/startupProbeType"] - ] - } -} - -resource "google_cloud_run_service_iam_binding" "binding" { - for_each = var.iam - project = google_cloud_run_service.service.project - location = google_cloud_run_service.service.location - service = google_cloud_run_service.service.name - role = each.key - members = ( - each.key != "roles/run.invoker" || !local.trigger_sa_create - ? each.value - # if invoker role is present and we create trigger sa, add it as member - : concat( - each.value, ["serviceAccount:${local.trigger_sa_email}"] - ) - ) -} - -resource "google_cloud_run_service_iam_member" "default" { - # if authoritative invoker role is not present and we create trigger sa - # use additive binding to grant it the role - count = ( - lookup(var.iam, "roles/run.invoker", null) == null && - local.trigger_sa_create - ) ? 1 : 0 - project = google_cloud_run_service.service.project - location = google_cloud_run_service.service.location - service = google_cloud_run_service.service.name - role = "roles/run.invoker" - member = "serviceAccount:${local.trigger_sa_email}" -} - -resource "google_service_account" "service_account" { - count = var.service_account_create ? 1 : 0 - project = var.project_id - account_id = "tf-cr-${var.name}" - display_name = "Terraform Cloud Run ${var.name}." -} - -resource "google_eventarc_trigger" "audit_log_triggers" { - for_each = var.eventarc_triggers.audit_log - name = "${local.prefix}audit-log-${each.key}" - location = google_cloud_run_service.service.location - project = google_cloud_run_service.service.project - matching_criteria { - attribute = "type" - value = "google.cloud.audit.log.v1.written" - } - matching_criteria { - attribute = "serviceName" - value = each.value.service - } - matching_criteria { - attribute = "methodName" - value = each.value.method - } - destination { - cloud_run_service { - service = google_cloud_run_service.service.name - region = google_cloud_run_service.service.location - } - } - service_account = local.trigger_sa_email -} - -resource "google_eventarc_trigger" "pubsub_triggers" { - for_each = var.eventarc_triggers.pubsub - name = "${local.prefix}pubsub-${each.key}" - location = google_cloud_run_service.service.location - project = google_cloud_run_service.service.project - matching_criteria { - attribute = "type" - value = "google.cloud.pubsub.topic.v1.messagePublished" - } - transport { - pubsub { - topic = each.value - } - } - destination { - cloud_run_service { - service = google_cloud_run_service.service.name - region = google_cloud_run_service.service.location - } - } - service_account = local.trigger_sa_email -} - -resource "google_service_account" "trigger_service_account" { - count = local.trigger_sa_create ? 1 : 0 - project = var.project_id - account_id = "tf-cr-trigger-${var.name}" - display_name = "Terraform trigger for Cloud Run ${var.name}." -} diff --git a/modules/cloud-run/outputs.tf b/modules/cloud-run/outputs.tf deleted file mode 100644 index dcca33374..000000000 --- a/modules/cloud-run/outputs.tf +++ /dev/null @@ -1,64 +0,0 @@ - -/** - * Copyright 2022 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -output "id" { - description = "Fully qualified service id." - value = google_cloud_run_service.service.id -} - -output "invoke_command" { - description = "Command to invoke Cloud Run Service / submit job." - value = <<-EOT - curl -H "Authorization: bearer $(gcloud auth print-identity-token)" \ - ${google_cloud_run_service.service.status[0].url} \ - -X POST -d 'data' - EOT -} - -output "service" { - description = "Cloud Run service." - value = google_cloud_run_service.service -} - -output "service_account" { - description = "Service account resource." - value = try(google_service_account.service_account[0], null) -} - -output "service_account_email" { - description = "Service account email." - value = local.service_account_email -} - -output "service_account_iam_email" { - description = "Service account email." - value = join("", [ - "serviceAccount:", - local.service_account_email == null ? "" : local.service_account_email - ]) -} - -output "service_name" { - description = "Cloud Run service name." - value = google_cloud_run_service.service.name -} - - -output "vpc_connector" { - description = "VPC connector resource if created." - value = try(google_vpc_access_connector.connector[0].id, null) -} diff --git a/modules/cloud-run/tags.tf b/modules/cloud-run/tags.tf deleted file mode 100644 index c988ed650..000000000 --- a/modules/cloud-run/tags.tf +++ /dev/null @@ -1,24 +0,0 @@ -/** - * Copyright 2023 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -resource "google_tags_location_tag_binding" "binding" { - for_each = var.tag_bindings - parent = ( - "//run.googleapis.com/projects/${var.project_id}/locations/europe-west1/services/${google_cloud_run_service.service.name}" - ) - tag_value = each.value - location = var.region -} diff --git a/modules/cloud-run/variables.tf b/modules/cloud-run/variables.tf deleted file mode 100644 index 197864505..000000000 --- a/modules/cloud-run/variables.tf +++ /dev/null @@ -1,267 +0,0 @@ - -/** - * Copyright 2022 Google LLC - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -variable "container_concurrency" { - description = "Maximum allowed in-flight (concurrent) requests per container of the revision." - type = string - default = null -} - -variable "containers" { - description = "Containers in arbitrary key => attributes format." - type = map(object({ - image = string - args = optional(list(string)) - command = optional(list(string)) - env = optional(map(string), {}) - env_from_key = optional(map(object({ - key = string - name = string - })), {}) - liveness_probe = optional(object({ - action = object({ - grpc = optional(object({ - port = optional(number) - service = optional(string) - })) - http_get = optional(object({ - http_headers = optional(map(string), {}) - path = optional(string) - })) - }) - failure_threshold = optional(number) - initial_delay_seconds = optional(number) - period_seconds = optional(number) - timeout_seconds = optional(number) - })) - ports = optional(map(object({ - container_port = optional(number) - name = optional(string) - protocol = optional(string) - })), {}) - resources = optional(object({ - limits = optional(object({ - cpu = string - memory = string - })) - requests = optional(object({ - cpu = string - memory = string - })) - })) - startup_probe = optional(object({ - action = object({ - grpc = optional(object({ - port = optional(number) - service = optional(string) - })) - http_get = optional(object({ - http_headers = optional(map(string), {}) - path = optional(string) - })) - tcp_socket = optional(object({ - port = optional(number) - })) - }) - failure_threshold = optional(number) - initial_delay_seconds = optional(number) - period_seconds = optional(number) - timeout_seconds = optional(number) - })) - volume_mounts = optional(map(string), {}) - })) - default = {} - nullable = false -} - -variable "eventarc_triggers" { - description = "Event arc triggers for different sources." - type = object({ - audit_log = optional(map(object({ - method = string - service = string - })), {}) - pubsub = optional(map(string), {}) - service_account_email = optional(string) - service_account_create = optional(bool, false) - }) - default = {} - validation { - condition = ( - var.eventarc_triggers.service_account_email == null && length(var.eventarc_triggers.audit_log) == 0 - ) || ( - var.eventarc_triggers.service_account_email != null - ) - error_message = "service_account_email is required if providing audit_log" - } -} - -variable "gen2_execution_environment" { - description = "Use second generation execution environment." - type = bool - default = false -} - -variable "iam" { - description = "IAM bindings for Cloud Run service in {ROLE => [MEMBERS]} format." - type = map(list(string)) - default = {} -} - -variable "ingress_settings" { - description = "Ingress settings." - type = string - default = null - validation { - condition = contains( - ["all", "internal", "internal-and-cloud-load-balancing"], - coalesce(var.ingress_settings, "all") - ) - error_message = "Ingress settings can be one of 'all', 'internal', 'internal-and-cloud-load-balancing'." - } -} - -variable "labels" { - description = "Resource labels." - type = map(string) - default = {} -} - -variable "name" { - description = "Name used for cloud run service." - type = string -} - -variable "prefix" { - description = "Optional prefix used for resource names." - type = string - default = null - validation { - condition = var.prefix != "" - error_message = "Prefix cannot be empty, please use null instead." - } -} - -variable "project_id" { - description = "Project id used for all resources." - type = string -} - -variable "region" { - description = "Region used for all resources." - type = string -} - -variable "revision_annotations" { - description = "Configure revision template annotations." - type = object({ - autoscaling = optional(object({ - max_scale = number - min_scale = number - })) - cloudsql_instances = optional(list(string), []) - vpcaccess_connector = optional(string) - vpcaccess_egress = optional(string) - }) - default = {} - nullable = false -} - -variable "revision_name" { - description = "Revision name." - type = string - default = null -} - -variable "service_account" { - description = "Service account email. Unused if service account is auto-created." - type = string - default = null -} - -variable "service_account_create" { - description = "Auto-create service account." - type = bool - default = false -} - -variable "startup_cpu_boost" { - description = "Enable startup cpu boost." - type = bool - default = false -} - -variable "tag_bindings" { - description = "Tag bindings for this service, in key => tag value id format." - type = map(string) - nullable = false - default = {} -} - -variable "timeout_seconds" { - description = "Maximum duration the instance is allowed for responding to a request." - type = number - default = null -} - -variable "traffic" { - description = "Traffic steering configuration. If revision name is null the latest revision will be used." - type = map(object({ - percent = number - latest = optional(bool) - tag = optional(string) - })) - default = {} - nullable = false -} - -variable "volumes" { - description = "Named volumes in containers in name => attributes format." - type = map(object({ - secret_name = string - default_mode = optional(string) - items = optional(map(object({ - path = string - mode = optional(string) - }))) - })) - default = {} - nullable = false -} - -variable "vpc_connector_create" { - description = "Populate this to create a VPC connector. You can then refer to it in the template annotations." - type = object({ - ip_cidr_range = optional(string) - vpc_self_link = optional(string) - machine_type = optional(string) - name = optional(string) - instances = optional(object({ - max = optional(number) - min = optional(number) - }), {}) - throughput = optional(object({ - max = optional(number) - min = optional(number) - }), {}) - subnet = optional(object({ - name = optional(string) - project_id = optional(string) - }), {}) - }) - default = null -} diff --git a/modules/cloud-run/versions.tf b/modules/cloud-run/versions.tf deleted file mode 100644 index c4fb24b4d..000000000 --- a/modules/cloud-run/versions.tf +++ /dev/null @@ -1,35 +0,0 @@ -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Fabric release: v45.0.0 - -terraform { - required_version = ">= 1.12.2" - required_providers { - google = { - source = "hashicorp/google" - version = ">= 7.6.0, < 8.0.0" # tftest - } - google-beta = { - source = "hashicorp/google-beta" - version = ">= 7.6.0, < 8.0.0" # tftest - } - } - provider_meta "google" { - module_name = "google-pso-tool/cloud-foundation-fabric/modules/cloud-run:v45.0.0-tf" - } - provider_meta "google-beta" { - module_name = "google-pso-tool/cloud-foundation-fabric/modules/cloud-run:v45.0.0-tf" - } -} diff --git a/modules/cloud-run/versions.tofu b/modules/cloud-run/versions.tofu deleted file mode 100644 index a76af1c41..000000000 --- a/modules/cloud-run/versions.tofu +++ /dev/null @@ -1,35 +0,0 @@ -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Fabric release: v45.0.0 - -terraform { - required_version = ">= 1.10.0" - required_providers { - google = { - source = "hashicorp/google" - version = ">= 7.6.0, < 8.0.0" # tftest - } - google-beta = { - source = "hashicorp/google-beta" - version = ">= 7.6.0, < 8.0.0" # tftest - } - } - provider_meta "google" { - module_name = "google-pso-tool/cloud-foundation-fabric/modules/cloud-run:v45.0.0-tofu" - } - provider_meta "google-beta" { - module_name = "google-pso-tool/cloud-foundation-fabric/modules/cloud-run:v45.0.0-tofu" - } -} diff --git a/tests/modules/cloud_run/examples/audit-logs.yaml b/tests/modules/cloud_run/examples/audit-logs.yaml deleted file mode 100644 index 3f8635cf3..000000000 --- a/tests/modules/cloud_run/examples/audit-logs.yaml +++ /dev/null @@ -1,93 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - annotations: null - generation: 0 - labels: null - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - volumes: [] - timeouts: null - module.cloud_run.google_cloud_run_service_iam_binding.binding["roles/run.invoker"]: - condition: [] - location: europe-west8 - members: - - serviceAccount:eventarc-trigger@project-id.iam.gserviceaccount.com - project: project-id - role: roles/run.invoker - service: hello - module.cloud_run.google_eventarc_trigger.audit_log_triggers["setiampolicy"]: - channel: null - destination: - - cloud_run_service: - - path: null - region: europe-west8 - service: hello - labels: null - location: europe-west8 - matching_criteria: - - attribute: methodName - operator: '' - value: SetIamPolicy - - attribute: serviceName - operator: '' - value: cloudresourcemanager.googleapis.com - - attribute: type - operator: '' - value: google.cloud.audit.log.v1.written - name: audit-log-setiampolicy - project: project-id - service_account: eventarc-trigger@project-id.iam.gserviceaccount.com - timeouts: null - module.sa.google_project_iam_member.project-roles["project-id-roles/eventarc.eventReceiver"]: - condition: [] - project: project-id - role: roles/eventarc.eventReceiver - module.sa.google_service_account.service_account[0]: - account_id: eventarc-trigger - create_ignore_already_exists: null - description: null - disabled: false - display_name: Terraform-managed. - project: project-id - timeouts: null - -counts: - google_cloud_run_service: 1 - google_cloud_run_service_iam_binding: 1 - google_eventarc_trigger: 1 - google_project_iam_member: 1 - google_service_account: 1 - modules: 2 - resources: 5 - -outputs: {} diff --git a/tests/modules/cloud_run/examples/connector-shared.yaml b/tests/modules/cloud_run/examples/connector-shared.yaml deleted file mode 100644 index abf86a014..000000000 --- a/tests/modules/cloud_run/examples/connector-shared.yaml +++ /dev/null @@ -1,49 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - {} - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - volumes: [] - module.cloud_run.google_vpc_access_connector.connector[0]: - ip_cidr_range: null - machine_type: e2-micro - name: hello - project: project-id - region: europe-west8 - subnet: - - name: subnet-vpc-access - project_id: host-project - -counts: - google_cloud_run_service: 1 - google_vpc_access_connector: 1 diff --git a/tests/modules/cloud_run/examples/connector.yaml b/tests/modules/cloud_run/examples/connector.yaml deleted file mode 100644 index 3e0a52646..000000000 --- a/tests/modules/cloud_run/examples/connector.yaml +++ /dev/null @@ -1,48 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - {} - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - volumes: [] - module.cloud_run.google_vpc_access_connector.connector[0]: - ip_cidr_range: 10.10.10.0/28 - machine_type: e2-micro - name: hello - network: projects/xxx/global/networks/aaa - project: project-id - region: europe-west8 - subnet: [] - -counts: - google_cloud_run_service: 1 - google_vpc_access_connector: 1 diff --git a/tests/modules/cloud_run/examples/eventarc.yaml b/tests/modules/cloud_run/examples/eventarc.yaml deleted file mode 100644 index d7c8ef9e2..000000000 --- a/tests/modules/cloud_run/examples/eventarc.yaml +++ /dev/null @@ -1,75 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - annotations: null - generation: 0 - labels: null - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - volumes: [] - timeouts: null - module.cloud_run.google_eventarc_trigger.pubsub_triggers["topic-1"]: - channel: null - destination: - - cloud_run_service: - - path: null - region: europe-west8 - service: hello - labels: null - location: europe-west8 - matching_criteria: - - attribute: type - operator: '' - value: google.cloud.pubsub.topic.v1.messagePublished - name: pubsub-topic-1 - project: project-id - service_account: null - timeouts: null - transport: - - pubsub: - - topic: projects/project-id/topics/pubsub_sink - module.pubsub.google_pubsub_topic.default: - kms_key_name: null - labels: null - message_retention_duration: null - name: pubsub_sink - project: project-id - timeouts: null - -counts: - google_cloud_run_service: 1 - google_eventarc_trigger: 1 - google_pubsub_topic: 1 - modules: 2 - resources: 3 - -outputs: {} diff --git a/tests/modules/cloud_run/examples/gen2.yaml b/tests/modules/cloud_run/examples/gen2.yaml deleted file mode 100644 index 1f0a4eaa9..000000000 --- a/tests/modules/cloud_run/examples/gen2.yaml +++ /dev/null @@ -1,40 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - {} - name: hello - project: project-id - template: - - metadata: - - annotations: - run.googleapis.com/execution-environment: gen2 - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - volumes: [] - -counts: - google_cloud_run_service: 1 diff --git a/tests/modules/cloud_run/examples/revision-annotations.yaml b/tests/modules/cloud_run/examples/revision-annotations.yaml deleted file mode 100644 index a1e8617fd..000000000 --- a/tests/modules/cloud_run/examples/revision-annotations.yaml +++ /dev/null @@ -1,43 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - {} - name: hello - project: project-id - template: - - metadata: - - annotations: - autoscaling.knative.dev/maxScale: '10' - autoscaling.knative.dev/minScale: '1' - run.googleapis.com/vpc-access-connector: foo - run.googleapis.com/vpc-access-egress: all-traffic - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - volumes: [] - -counts: - google_cloud_run_service: 1 diff --git a/tests/modules/cloud_run/examples/secrets.yaml b/tests/modules/cloud_run/examples/secrets.yaml deleted file mode 100644 index 3c80a9c7b..000000000 --- a/tests/modules/cloud_run/examples/secrets.yaml +++ /dev/null @@ -1,108 +0,0 @@ -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# yamllint disable rule:line-length -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - annotations: null - effective_labels: - goog-terraform-provisioned: 'true' - generation: 0 - labels: null - terraform_labels: - goog-terraform-provisioned: 'true' - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: - - mount_path: /credentials - name: credentials - working_dir: null - node_selector: null - service_account_name: tf-cr-hello@project-id.iam.gserviceaccount.com - volumes: - - csi: [] - empty_dir: [] - name: credentials - nfs: [] - secret: - - default_mode: null - items: - - key: latest - mode: null - path: v1.txt - secret_name: credentials - timeouts: null - module.cloud_run.google_service_account.service_account[0]: - account_id: tf-cr-hello - create_ignore_already_exists: null - description: null - disabled: false - display_name: Terraform Cloud Run hello. - email: tf-cr-hello@project-id.iam.gserviceaccount.com - member: serviceAccount:tf-cr-hello@project-id.iam.gserviceaccount.com - project: project-id - timeouts: null - module.secret-manager.google_secret_manager_secret.default["credentials"]: - annotations: null - deletion_protection: false - effective_labels: - goog-terraform-provisioned: 'true' - labels: null - project: project-id - replication: - - auto: - - customer_managed_encryption: [] - user_managed: [] - rotation: [] - secret_id: credentials - tags: null - terraform_labels: - goog-terraform-provisioned: 'true' - timeouts: null - topics: [] - ttl: null - version_aliases: null - version_destroy_ttl: null - ? module.secret-manager.google_secret_manager_secret_iam_binding.authoritative["credentials.roles/secretmanager.secretAccessor"] - : condition: [] - members: - - serviceAccount:tf-cr-hello@project-id.iam.gserviceaccount.com - role: roles/secretmanager.secretAccessor - module.secret-manager.google_secret_manager_secret_version.default["credentials/v1"]: - deletion_policy: DELETE - enabled: true - is_secret_data_base64: false - secret_data: foo bar baz - secret_data_wo: null - secret_data_wo_version: 0 - timeouts: null -counts: - google_cloud_run_service: 1 - google_secret_manager_secret: 1 - google_secret_manager_secret_iam_binding: 1 - google_service_account: 1 diff --git a/tests/modules/cloud_run/examples/service-account-external.yaml b/tests/modules/cloud_run/examples/service-account-external.yaml deleted file mode 100644 index fc049369e..000000000 --- a/tests/modules/cloud_run/examples/service-account-external.yaml +++ /dev/null @@ -1,40 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - {} - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - service_account_name: sa1@sa.example - volumes: [] - -counts: - google_cloud_run_service: 1 diff --git a/tests/modules/cloud_run/examples/service-account.yaml b/tests/modules/cloud_run/examples/service-account.yaml deleted file mode 100644 index 58b4bd771..000000000 --- a/tests/modules/cloud_run/examples/service-account.yaml +++ /dev/null @@ -1,46 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - {} - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - volumes: [] - module.cloud_run.google_service_account.service_account[0]: - account_id: tf-cr-hello - description: null - disabled: false - display_name: Terraform Cloud Run hello. - project: project-id - -counts: - google_cloud_run_service: 1 - google_service_account: 1 diff --git a/tests/modules/cloud_run/examples/simple.yaml b/tests/modules/cloud_run/examples/simple.yaml deleted file mode 100644 index bcf2e1f9d..000000000 --- a/tests/modules/cloud_run/examples/simple.yaml +++ /dev/null @@ -1,102 +0,0 @@ -# Copyright 2025 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# yamllint disable rule:line-length -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - annotations: null - effective_labels: - goog-terraform-provisioned: 'true' - generation: 0 - labels: null - terraform_labels: - goog-terraform-provisioned: 'true' - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: - - name: VAR1 - value: VALUE1 - value_from: [] - - name: VAR2 - value: VALUE2 - value_from: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - node_selector: null - service_account_name: tf-cr-hello@project-id.iam.gserviceaccount.com - volumes: [] - timeouts: null - module.cloud_run.google_cloud_run_service_iam_binding.binding["roles/run.invoker"]: - condition: [] - location: europe-west8 - members: - - allUsers - project: project-id - role: roles/run.invoker - service: hello - module.cloud_run.google_service_account.service_account[0]: - account_id: tf-cr-hello - create_ignore_already_exists: null - description: null - disabled: false - display_name: Terraform Cloud Run hello. - email: tf-cr-hello@project-id.iam.gserviceaccount.com - member: serviceAccount:tf-cr-hello@project-id.iam.gserviceaccount.com - project: project-id - timeouts: null - module.secret-manager.google_secret_manager_secret.default["credentials"]: - annotations: null - deletion_protection: false - effective_labels: - goog-terraform-provisioned: 'true' - labels: null - project: project-id - replication: - - auto: - - customer_managed_encryption: [] - user_managed: [] - rotation: [] - secret_id: credentials - tags: null - terraform_labels: - goog-terraform-provisioned: 'true' - timeouts: null - topics: [] - ttl: null - version_aliases: null - version_destroy_ttl: null - ? module.secret-manager.google_secret_manager_secret_iam_binding.authoritative["credentials.roles/secretmanager.secretAccessor"] - : condition: [] - members: - - serviceAccount:tf-cr-hello@project-id.iam.gserviceaccount.com - role: roles/secretmanager.secretAccessor -counts: - google_cloud_run_service: 1 - google_cloud_run_service_iam_binding: 1 - google_secret_manager_secret: 1 - google_secret_manager_secret_iam_binding: 1 - google_service_account: 1 diff --git a/tests/modules/cloud_run/examples/traffic.yaml b/tests/modules/cloud_run/examples/traffic.yaml deleted file mode 100644 index df20f5eea..000000000 --- a/tests/modules/cloud_run/examples/traffic.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - traffic: - - latest_revision: false - percent: 25 - revision_name: hello-blue - tag: null - - latest_revision: false - percent: 75 - revision_name: hello-green - tag: null - -counts: - google_cloud_run_service: 1 diff --git a/tests/modules/cloud_run/examples/trigger-service-account.yaml b/tests/modules/cloud_run/examples/trigger-service-account.yaml deleted file mode 100644 index ca15d9fbe..000000000 --- a/tests/modules/cloud_run/examples/trigger-service-account.yaml +++ /dev/null @@ -1,90 +0,0 @@ -# Copyright 2023 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -values: - module.cloud_run.google_cloud_run_service.service: - autogenerate_revision_name: false - location: europe-west8 - metadata: - - annotations: null - generation: 0 - labels: null - name: hello - project: project-id - template: - - metadata: - - {} - spec: - - containers: - - args: null - command: null - env: [] - env_from: [] - image: us-docker.pkg.dev/cloudrun/container/hello - liveness_probe: [] - volume_mounts: [] - working_dir: null - volumes: [] - timeouts: null - module.cloud_run.google_cloud_run_service_iam_member.default[0]: - condition: [] - location: europe-west8 - project: project-id - role: roles/run.invoker - service: hello - module.cloud_run.google_eventarc_trigger.pubsub_triggers["topic-1"]: - channel: null - destination: - - cloud_run_service: - - path: null - region: europe-west8 - service: hello - labels: null - location: europe-west8 - matching_criteria: - - attribute: type - operator: '' - value: google.cloud.pubsub.topic.v1.messagePublished - name: pubsub-topic-1 - project: project-id - timeouts: null - transport: - - pubsub: - - topic: projects/project-id/topics/pubsub_sink - module.cloud_run.google_service_account.trigger_service_account[0]: - account_id: tf-cr-trigger-hello - create_ignore_already_exists: null - description: null - disabled: false - display_name: Terraform trigger for Cloud Run hello. - project: project-id - timeouts: null - module.pubsub.google_pubsub_topic.default: - kms_key_name: null - labels: null - message_retention_duration: null - name: pubsub_sink - project: project-id - timeouts: null - -counts: - google_cloud_run_service: 1 - google_cloud_run_service_iam_member: 1 - google_eventarc_trigger: 1 - google_pubsub_topic: 1 - google_service_account: 1 - modules: 2 - resources: 5 - -outputs: {}