Add Direct VPC Egress support to modules/cloud-function-v2 (#3567)
Fixes #3561
This commit is contained in:
Julio Castillo
@@ -15,6 +15,7 @@ Cloud Function management, with support for IAM roles, optional bucket creation
|
||||
- [Multiple Cloud Functions within project](#multiple-cloud-functions-within-project)
|
||||
- [Mounting secrets from Secret Manager](#mounting-secrets-from-secret-manager)
|
||||
- [VPC Access Connector](#vpc-access-connector)
|
||||
- [Direct VPC Egress](#direct-vpc-egress)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
- [Fixtures](#fixtures)
|
||||
@@ -405,6 +406,30 @@ module "cf_http" {
|
||||
}
|
||||
# tftest fixtures=fixtures/shared-vpc.tf inventory=service-vpc-access-connector-create-sharedvpc.yaml
|
||||
```
|
||||
|
||||
### Direct VPC Egress
|
||||
|
||||
You can also configure Direct VPC Egress instead of using a VPC Access Connector.
|
||||
|
||||
```hcl
|
||||
module "cf_http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = var.project_id
|
||||
region = var.region
|
||||
name = "direct-vpc-egress"
|
||||
bucket_name = var.bucket
|
||||
bundle_config = {
|
||||
path = "assets/sample-function/"
|
||||
}
|
||||
direct_vpc_egress = {
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
tags = ["tag1", "tag2"]
|
||||
mode = "VPC_EGRESS_ALL_TRAFFIC"
|
||||
}
|
||||
}
|
||||
# tftest inventory=direct-vpc-egress.yaml
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
@@ -412,27 +437,28 @@ module "cf_http" {
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [bucket_name](variables.tf#L27) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L51) | Cloud function source. Path can point to a GCS object URI, or a local path. A local path to a zip archive will generate a GCS object using its basename, a folder will be zipped and the GCS object name inferred when not specified. | <code title="object({ path = string folder_options = optional(object({ archive_path = optional(string) excludes = optional(list(string)) }), {}) })">object({…})</code> | ✓ | |
|
||||
| [name](variables.tf#L167) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L182) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L187) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L185) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L200) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L205) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object({ force_destroy = optional(bool) lifecycle_delete_age_days = optional(number) location = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [build_environment_variables](variables.tf#L33) | A set of key/value environment variable pairs available during build time. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [build_service_account](variables.tf#L39) | Build service account email. | <code>string</code> | | <code>null</code> |
|
||||
| [build_worker_pool](variables.tf#L45) | Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format. | <code>string</code> | | <code>null</code> |
|
||||
| [context](variables.tf#L84) | Context-specific interpolations. | <code title="object({ condition_vars = optional(map(map(string)), {}) # not needed here? cidr_ranges = optional(map(string), {}) custom_roles = optional(map(string), {}) iam_principals = optional(map(string), {}) kms_keys = optional(map(string), {}) locations = optional(map(string), {}) networks = optional(map(string), {}) project_ids = optional(map(string), {}) subnets = optional(map(string), {}) tag_values = optional(map(string), {}) # not needed here? })">object({…})</code> | | <code>{}</code> |
|
||||
| [description](variables.tf#L102) | Optional description. | <code>string</code> | | <code>"Terraform managed."</code> |
|
||||
| [docker_repository_id](variables.tf#L108) | User managed repository created in Artifact Registry. | <code>string</code> | | <code>null</code> |
|
||||
| [environment_variables](variables.tf#L114) | Cloud function environment variables. | <code>map(string)</code> | | <code title="{ LOG_EXECUTION_ID = "true" }">{…}</code> |
|
||||
| [function_config](variables.tf#L122) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code title="object({ binary_authorization_policy = optional(string) entry_point = optional(string, "main") instance_count = optional(number, 1) memory_mb = optional(number, 256) # Memory in MB cpu = optional(string, "0.166") runtime = optional(string, "python310") timeout_seconds = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instance_count = 1 memory_mb = 256 cpu = "0.166" runtime = "python310" timeout_seconds = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L143) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L149) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [kms_key](variables.tf#L155) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L161) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L172) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L192) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = string secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [direct_vpc_egress](variables.tf#L108) | Direct VPC egress configuration. | <code title="object({ mode = string network = string subnetwork = string tags = optional(list(string)) })">object({…})</code> | | <code>null</code> |
|
||||
| [docker_repository_id](variables.tf#L126) | User managed repository created in Artifact Registry. | <code>string</code> | | <code>null</code> |
|
||||
| [environment_variables](variables.tf#L132) | Cloud function environment variables. | <code>map(string)</code> | | <code title="{ LOG_EXECUTION_ID = "true" }">{…}</code> |
|
||||
| [function_config](variables.tf#L140) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code title="object({ binary_authorization_policy = optional(string) entry_point = optional(string, "main") instance_count = optional(number, 1) memory_mb = optional(number, 256) # Memory in MB cpu = optional(string, "0.166") runtime = optional(string, "python310") timeout_seconds = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instance_count = 1 memory_mb = 256 cpu = "0.166" runtime = "python310" timeout_seconds = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L161) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L167) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [kms_key](variables.tf#L173) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L179) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L190) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L210) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = string secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account_config](variables-serviceaccount.tf#L17) | Service account configurations. | <code title="object({ create = optional(bool, true) display_name = optional(string) email = optional(string) name = optional(string) roles = optional(list(string), [ "roles/logging.logWriter", "roles/monitoring.metricWriter" ]) })">object({…})</code> | | <code>{}</code> |
|
||||
| [trigger_config](variables.tf#L204) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event_type = string pubsub_topic = optional(string) region = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = optional(string) })), []) service_account_email = optional(string) service_account_create = optional(bool, false) retry_policy = optional(string, "RETRY_POLICY_DO_NOT_RETRY") # default to avoid permadiff })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L222) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ name = optional(string) egress_settings = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [trigger_config](variables.tf#L222) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event_type = string pubsub_topic = optional(string) region = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = optional(string) })), []) service_account_email = optional(string) service_account_create = optional(bool, false) retry_policy = optional(string, "RETRY_POLICY_DO_NOT_RETRY") # default to avoid permadiff })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L240) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ name = optional(string) egress_settings = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [vpc_connector_create](variables-vpcconnector.tf#L17) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = optional(string) machine_type = optional(string) name = optional(string) network = optional(string) instances = optional(object({ max = optional(number) min = optional(number) }), {} ) throughput = optional(object({ max = optional(number) min = optional(number) }), {} ) subnet = optional(object({ name = optional(string) project_id = optional(string) }), {}) })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
@@ -105,6 +105,22 @@ resource "google_cloudfunctions2_function" "function" {
|
||||
timeout_seconds = var.function_config.timeout_seconds
|
||||
vpc_connector = local.vpc_connector
|
||||
vpc_connector_egress_settings = var.vpc_connector.egress_settings
|
||||
direct_vpc_egress = try(var.direct_vpc_egress.mode, null)
|
||||
|
||||
dynamic "direct_vpc_network_interface" {
|
||||
for_each = var.direct_vpc_egress == null ? [] : [""]
|
||||
content {
|
||||
network = lookup(
|
||||
local.ctx.networks, var.direct_vpc_egress.network,
|
||||
var.direct_vpc_egress.network
|
||||
)
|
||||
subnetwork = lookup(
|
||||
local.ctx.subnets, var.direct_vpc_egress.subnetwork,
|
||||
var.direct_vpc_egress.subnetwork
|
||||
)
|
||||
tags = var.direct_vpc_egress.tags
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "secret_environment_variables" {
|
||||
for_each = { for k, v in var.secrets : k => v if !v.is_volume }
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
* Copyright 2025 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -105,6 +105,24 @@ variable "description" {
|
||||
default = "Terraform managed."
|
||||
}
|
||||
|
||||
variable "direct_vpc_egress" {
|
||||
description = "Direct VPC egress configuration."
|
||||
type = object({
|
||||
mode = string
|
||||
network = string
|
||||
subnetwork = string
|
||||
tags = optional(list(string))
|
||||
})
|
||||
default = null
|
||||
validation {
|
||||
condition = var.direct_vpc_egress == null || contains(
|
||||
["VPC_EGRESS_ALL_TRAFFIC", "VPC_EGRESS_PRIVATE_RANGES_ONLY"],
|
||||
try(var.direct_vpc_egress.mode, "")
|
||||
)
|
||||
error_message = "Direct VPC egress mode must be one of VPC_EGRESS_ALL_TRAFFIC, VPC_EGRESS_PRIVATE_RANGES_ONLY."
|
||||
}
|
||||
}
|
||||
|
||||
variable "docker_repository_id" {
|
||||
description = "User managed repository created in Artifact Registry."
|
||||
type = string
|
||||
|
||||
Reference in New Issue
Block a user