Cloud function CMEK key support (#2270)
* Added support to kms key * Updated doc * Fix variable description. * Updated README * Cloud function v2 integration with kms * Fix variables description --------- Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>
This commit is contained in:
luigi-bitonti
@@ -16,6 +16,7 @@ The GCS object used for deployment uses a hash of the bundle zip contents in its
|
||||
- [Private Cloud Build Pool](#private-cloud-build-pool)
|
||||
- [Multiple Cloud Functions within project](#multiple-cloud-functions-within-project)
|
||||
- [Mounting secrets from Secret Manager](#mounting-secrets-from-secret-manager)
|
||||
- [Using CMEK to encrypt function resources](#using-cmek-to-encrypt-function-resources)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
<!-- END TOC -->
|
||||
@@ -258,6 +259,28 @@ module "cf-http" {
|
||||
}
|
||||
# tftest modules=1 resources=2 inventory=secrets.yaml
|
||||
```
|
||||
|
||||
### Using CMEK to encrypt function resources
|
||||
This encrypt bucket _gcf-sources-*_ with the provided kms key. The repository has to be encrypted with the same kms key.
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v1"
|
||||
project_id = "my-project"
|
||||
region = "europe-west1"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
kms_key = "projects/my-project/locations/europe-west1/keyRings/mykeyring/cryptoKeys/mykey"
|
||||
repository_settings = {
|
||||
repository = "projects/my-project/locations/europe-west1/repositories/myrepo"
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
@@ -265,9 +288,9 @@ module "cf-http" {
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L44) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | <code title="object({ source_dir = string output_path = optional(string) excludes = optional(list(string)) })">object({…})</code> | ✓ | |
|
||||
| [name](variables.tf#L109) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L124) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L129) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L115) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L130) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L135) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object({ location = optional(string) lifecycle_delete_age_days = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [build_environment_variables](variables.tf#L32) | A set of key/value environment variable pairs available during build time. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [build_worker_pool](variables.tf#L38) | Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format. | <code>string</code> | | <code>null</code> |
|
||||
@@ -277,14 +300,16 @@ module "cf-http" {
|
||||
| [https_security_level](variables.tf#L85) | The security level for the function: Allowed values are SECURE_ALWAYS, SECURE_OPTIONAL. | <code>string</code> | | <code>null</code> |
|
||||
| [iam](variables.tf#L91) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L97) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L103) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L114) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L134) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L146) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L152) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L158) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event = string resource = string retry = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L168) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L178) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
| [kms_key](variables.tf#L103) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository field that was created with the same KMS crypto key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L109) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L120) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [repository_settings](variables.tf#L140) | Docker Registry to use for storing the function's Docker images and specific repository. If kms_key is provided, the repository must have already been encrypted with the key. | <code title="object({ registry = optional(string) repository = optional(string) })">object({…})</code> | | <code title="{ registry = "ARTIFACT_REGISTRY" }">{…}</code> |
|
||||
| [secrets](variables.tf#L151) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L163) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L169) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L175) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event = string resource = string retry = optional(bool) })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L185) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L195) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -41,6 +41,7 @@ locals {
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
resource "google_vpc_access_connector" "connector" {
|
||||
count = try(var.vpc_connector.create, false) == false ? 0 : 1
|
||||
project = var.project_id
|
||||
@@ -67,12 +68,13 @@ resource "google_cloudfunctions_function" "function" {
|
||||
labels = var.labels
|
||||
trigger_http = var.trigger_config == null ? true : null
|
||||
https_trigger_security_level = var.https_security_level == null ? "SECURE_ALWAYS" : var.https_security_level
|
||||
|
||||
ingress_settings = var.ingress_settings
|
||||
build_worker_pool = var.build_worker_pool
|
||||
build_environment_variables = var.build_environment_variables
|
||||
|
||||
vpc_connector = local.vpc_connector
|
||||
ingress_settings = var.ingress_settings
|
||||
build_worker_pool = var.build_worker_pool
|
||||
build_environment_variables = var.build_environment_variables
|
||||
kms_key_name = var.kms_key
|
||||
docker_registry = try(var.repository_settings.registry, "ARTIFACT_REGISTRY")
|
||||
docker_repository = try(var.repository_settings.repository, null)
|
||||
vpc_connector = local.vpc_connector
|
||||
vpc_connector_egress_settings = try(
|
||||
var.vpc_connector.egress_settings, null
|
||||
)
|
||||
|
||||
@@ -100,6 +100,12 @@ variable "ingress_settings" {
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "kms_key" {
|
||||
description = "Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository field that was created with the same KMS crypto key."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "labels" {
|
||||
description = "Resource labels."
|
||||
type = map(string)
|
||||
@@ -131,6 +137,17 @@ variable "region" {
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "repository_settings" {
|
||||
description = "Docker Registry to use for storing the function's Docker images and specific repository. If kms_key is provided, the repository must have already been encrypted with the key."
|
||||
type = object({
|
||||
registry = optional(string)
|
||||
repository = optional(string)
|
||||
})
|
||||
default = {
|
||||
registry = "ARTIFACT_REGISTRY"
|
||||
}
|
||||
}
|
||||
|
||||
variable "secrets" {
|
||||
description = "Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format."
|
||||
type = map(object({
|
||||
|
||||
@@ -281,9 +281,9 @@ module "cf-http" {
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L38) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | <code title="object({ source_dir = string output_path = optional(string) excludes = optional(list(string)) })">object({…})</code> | ✓ | |
|
||||
| [name](variables.tf#L103) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L118) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L123) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L109) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L124) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L129) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object({ location = optional(string) lifecycle_delete_age_days = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [build_worker_pool](variables.tf#L32) | Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format. | <code>string</code> | | <code>null</code> |
|
||||
| [description](variables.tf#L47) | Optional description. | <code>string</code> | | <code>"Terraform managed."</code> |
|
||||
@@ -292,14 +292,15 @@ module "cf-http" {
|
||||
| [function_config](variables.tf#L65) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code title="object({ entry_point = optional(string, "main") instance_count = optional(number, 1) memory_mb = optional(number, 256) # Memory in MB cpu = optional(string, "0.166") runtime = optional(string, "python310") timeout_seconds = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instance_count = 1 memory_mb = 256 cpu = "0.166" runtime = "python310" timeout_seconds = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L85) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L91) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L97) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L108) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L128) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L140) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L146) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L152) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event_type = string pubsub_topic = optional(string) region = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = optional(string) })), []) service_account_email = optional(string) service_account_create = optional(bool, false) retry_policy = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L170) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L180) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
| [kms_key](variables.tf#L97) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L103) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L114) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L134) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L146) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L152) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L158) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event_type = string pubsub_topic = optional(string) region = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = optional(string) })), []) service_account_email = optional(string) service_account_create = optional(bool, false) retry_policy = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L176) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L186) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -59,11 +59,12 @@ resource "google_vpc_access_connector" "connector" {
|
||||
}
|
||||
|
||||
resource "google_cloudfunctions2_function" "function" {
|
||||
provider = google-beta
|
||||
project = var.project_id
|
||||
location = var.region
|
||||
name = "${local.prefix}${var.name}"
|
||||
description = var.description
|
||||
provider = google-beta
|
||||
project = var.project_id
|
||||
location = var.region
|
||||
name = "${local.prefix}${var.name}"
|
||||
description = var.description
|
||||
kms_key_name = var.kms_key
|
||||
build_config {
|
||||
worker_pool = var.build_worker_pool
|
||||
runtime = var.function_config.runtime
|
||||
|
||||
@@ -94,6 +94,12 @@ variable "ingress_settings" {
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "kms_key" {
|
||||
description = "Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "labels" {
|
||||
description = "Resource labels."
|
||||
type = map(string)
|
||||
|
||||
Reference in New Issue
Block a user