feat(cloud-function-v2): add support for auto_update_policy (#3881)
Co-authored-by: Julio Castillo <jccb@google.com> Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>
This commit is contained in:
Vijay Kumar Singh
committed by
GitHub
GitHub
parent
0a22ef3a6f
commit
a727a2ea02
@@ -16,6 +16,7 @@ Cloud Function management, with support for IAM roles, optional bucket creation
|
||||
- [Mounting secrets from Secret Manager](#mounting-secrets-from-secret-manager)
|
||||
- [VPC Access Connector](#vpc-access-connector)
|
||||
- [Direct VPC Egress](#direct-vpc-egress)
|
||||
- [Update Strategies](#update-strategies)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
- [Fixtures](#fixtures)
|
||||
@@ -430,6 +431,32 @@ module "cf_http" {
|
||||
}
|
||||
# tftest inventory=direct-vpc-egress.yaml
|
||||
```
|
||||
|
||||
## Update Strategies
|
||||
|
||||
Cloud Functions v2 supports applying security updates to the underlying runtime automatically (`automatic_update_policy`) or only upon deployment (`on_deploy_update_policy`).
|
||||
|
||||
These two policies are mutually exclusive and are exposed via the `function_config.automatic_update_policy` and `function_config.on_deploy_update_policy` boolean fields. Set at most one of these to `true`. If neither is provided, the provider defaults apply.
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = var.project_id
|
||||
region = var.region
|
||||
name = "test-cf-http"
|
||||
bucket_name = var.bucket
|
||||
bundle_config = {
|
||||
path = "assets/sample-function/"
|
||||
}
|
||||
function_config = {
|
||||
automatic_update_policy = true
|
||||
}
|
||||
depends_on = [
|
||||
google_project_iam_member.bucket_default_compute_account_grant,
|
||||
]
|
||||
}
|
||||
# tftest inventory=automatic-update-policy.yaml fixtures=fixtures/functions-default-sa-iam-grants.tf
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
@@ -437,9 +464,9 @@ module "cf_http" {
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [bucket_name](variables.tf#L27) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L51) | Cloud function source. Path can point to a GCS object URI, or a local path. A local path to a zip archive will generate a GCS object using its basename, a folder will be zipped and the GCS object name inferred when not specified. | <code>object({…})</code> | ✓ | |
|
||||
| [name](variables.tf#L186) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L201) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L206) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L189) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L204) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L209) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [build_environment_variables](variables.tf#L33) | A set of key/value environment variable pairs available during build time. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [build_service_account](variables.tf#L39) | Build service account email. | <code>string</code> | | <code>null</code> |
|
||||
@@ -449,16 +476,16 @@ module "cf_http" {
|
||||
| [direct_vpc_egress](variables.tf#L108) | Direct VPC egress configuration. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [docker_repository_id](variables.tf#L126) | User managed repository created in Artifact Registry. | <code>string</code> | | <code>null</code> |
|
||||
| [environment_variables](variables.tf#L132) | Cloud function environment variables. | <code>map(string)</code> | | <code>{…}</code> |
|
||||
| [function_config](variables.tf#L140) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code>object({…})</code> | | <code>{…}</code> |
|
||||
| [iam](variables.tf#L162) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L168) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [kms_key](variables.tf#L174) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L180) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L191) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L211) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [function_config](variables.tf#L140) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code>object({…})</code> | | <code>{}</code> |
|
||||
| [iam](variables.tf#L165) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L171) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [kms_key](variables.tf#L177) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L183) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L194) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L214) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code>map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account_config](variables-serviceaccount.tf#L17) | Service account configurations. | <code>object({…})</code> | | <code>{}</code> |
|
||||
| [trigger_config](variables.tf#L223) | Function trigger configuration. Leave null for HTTP trigger. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L241) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code>object({…})</code> | | <code>{}</code> |
|
||||
| [trigger_config](variables.tf#L226) | Function trigger configuration. Leave null for HTTP trigger. | <code>object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L244) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code>object({…})</code> | | <code>{}</code> |
|
||||
| [vpc_connector_create](variables-vpcconnector.tf#L17) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code>object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
@@ -58,6 +58,17 @@ resource "google_cloudfunctions2_function" "function" {
|
||||
entry_point = var.function_config.entry_point
|
||||
environment_variables = var.build_environment_variables
|
||||
docker_repository = var.docker_repository_id
|
||||
|
||||
dynamic "automatic_update_policy" {
|
||||
for_each = try(var.function_config.automatic_update_policy, null) == true ? [""] : []
|
||||
content {}
|
||||
}
|
||||
|
||||
dynamic "on_deploy_update_policy" {
|
||||
for_each = try(var.function_config.on_deploy_update_policy, null) == true ? [""] : []
|
||||
content {}
|
||||
}
|
||||
|
||||
source {
|
||||
storage_source {
|
||||
bucket = local.bucket
|
||||
|
||||
@@ -140,22 +140,25 @@ variable "environment_variables" {
|
||||
variable "function_config" {
|
||||
description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout."
|
||||
type = object({
|
||||
automatic_update_policy = optional(bool)
|
||||
binary_authorization_policy = optional(string)
|
||||
cpu = optional(string, "0.166")
|
||||
entry_point = optional(string, "main")
|
||||
instance_count = optional(number, 1)
|
||||
max_instance_request_concurrency = optional(number)
|
||||
memory_mb = optional(number, 256) # Memory in MB
|
||||
cpu = optional(string, "0.166")
|
||||
on_deploy_update_policy = optional(bool)
|
||||
runtime = optional(string, "python310")
|
||||
timeout_seconds = optional(number, 180)
|
||||
})
|
||||
default = {
|
||||
entry_point = "main"
|
||||
instance_count = 1
|
||||
memory_mb = 256
|
||||
cpu = "0.166"
|
||||
runtime = "python310"
|
||||
timeout_seconds = 180
|
||||
default = {}
|
||||
nullable = false
|
||||
validation {
|
||||
condition = !(
|
||||
coalesce(var.function_config.automatic_update_policy, false) &&
|
||||
coalesce(var.function_config.on_deploy_update_policy, false)
|
||||
)
|
||||
error_message = "Cannot set both automatic_update_policy and on_deploy_update_policy to true."
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user