kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'master' into apigee

Browse Source
This commit is contained in:
Julio Castillo
2022-11-17 00:47:05 +01:00
committed by GitHub
parent 3501d20785 4d4bcb23a9
commit bb8c62c6ec
12 changed files with 264 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf
View File

@@ -79,19 +79,18 @@ module "cf" {
name = var.name
bucket_name = "${var.name}-${random_pet.random.id}"
bucket_config = {
location = var.region
lifecycle_delete_age = null
location = var.region
}
bundle_config = {
source_dir = "cf"
output_path = var.bundle_path
excludes = null
}
service_account = module.service-account.email
trigger_config = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
retry = null
v1 = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
}
}
}

21
blueprints/cloud-operations/network-dashboard/main.tf
View File

@@ -137,15 +137,13 @@ module "cloud-function" {
name = "network-dashboard-cloud-function"
bucket_name = "${local.monitoring_project}-network-dashboard-bucket"
bucket_config = {
location = var.region
lifecycle_delete_age = null
location = var.region
}
region = var.region
bundle_config = {
source_dir = "cloud-function"
output_path = "cloud-function.zip"
excludes = null
}
function_config = {
@@ -153,7 +151,7 @@ module "cloud-function" {
entry_point = "main"
runtime = "python39"
instances = 1
memory = 256 # Memory in MB
memory_mb = 256
}
@@ -169,10 +167,17 @@ module "cloud-function" {
# Internal only doesn't seem to work with CFv2:
ingress_settings = var.cf_version == "V2" ? "ALLOW_ALL" : "ALLOW_INTERNAL_ONLY"
trigger_config = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
retry = null
trigger_config = var.cf_version == "V2" ? {
v2 = {
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = module.pubsub.topic.id
service_account_create = true
}
} : {
v1 = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
}
}
}

11
blueprints/cloud-operations/quota-monitoring/main.tf
View File

@@ -52,13 +52,11 @@ module "cf" {
name = var.name
bucket_name = "${var.name}-${random_pet.random.id}"
bucket_config = {
location = var.region
lifecycle_delete_age = null
location = var.region
}
bundle_config = {
source_dir = "cf"
output_path = var.bundle_path
excludes = null
}
# https://github.com/hashicorp/terraform-provider-archive/issues/40
# https://issuetracker.google.com/issues/155215191
@@ -68,9 +66,10 @@ module "cf" {
}
service_account_create = true
trigger_config = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
retry = null
v1 = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
}
}
}

23
blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf
View File

@@ -91,19 +91,18 @@ module "cf" {
name = var.name
bucket_name = "${var.name}-${random_pet.random.id}"
bucket_config = {
location = var.region
lifecycle_delete_age = null
location = var.region
}
bundle_config = {
source_dir = "cf"
output_path = var.bundle_path
excludes = null
}
service_account = module.service-account.email
trigger_config = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
retry = null
v1 = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
}
}
}
@@ -115,8 +114,8 @@ module "cffile" {
name = var.name_cffile
bucket_name = "${var.name_cffile}-${random_pet.random.id}"
bucket_config = {
location = var.region
lifecycle_delete_age = null
location = var.region
lifecycle_delete_age_days = null
}
bundle_config = {
source_dir = "cffile"
@@ -125,9 +124,11 @@ module "cffile" {
}
service_account = module.service-account.email
trigger_config = {
event = "google.pubsub.topic.publish"
resource = module.pubsub_file.topic.id
retry = null
v1 = {
event = "google.pubsub.topic.publish"
resource = module.pubsub_file.topic.id
retry = null
}
}
}

20
blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf
View File

@@ -114,29 +114,28 @@ module "cf-restarter" {
region = var.region
bucket_name = "cf-bundle-bucket-${random_pet.random.id}"
bucket_config = {
location = var.region
lifecycle_delete_age = null
location = var.region
}
bundle_config = {
source_dir = "${path.module}/function/restarter"
output_path = "restarter.zip"
excludes = []
}
service_account = module.service-account-restarter.email
function_config = {
entry_point = "RestartInstance"
ingress_settings = null
instances = 1
memory = 256
instance_count = 1
memory_mb = 256
runtime = "go116"
timeout = 300
}
trigger_config = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
retry = null
v1 = {
event = "google.pubsub.topic.publish"
resource = module.pubsub.topic.id
}
}
}
@@ -151,15 +150,14 @@ module "cf-healthchecker" {
bundle_config = {
source_dir = "${path.module}/function/healthchecker"
output_path = "healthchecker.zip"
excludes = []
}
service_account = module.service-account-healthchecker.email
function_config = {
entry_point = "HealthCheck"
ingress_settings = null
instances = 1
memory = 256
instance_count = 1
memory_mb = 256
runtime = "go116"
timeout = 300
}

4
blueprints/networking/private-cloud-function-from-onprem/main.tf
View File

@@ -195,11 +195,9 @@ module "function-hello" {
bundle_config = {
source_dir = "${path.module}/assets"
output_path = "bundle.zip"
excludes = null
}
bucket_config = {
location = var.region
lifecycle_delete_age = null
location = var.region
}
iam = {
"roles/cloudfunctions.invoker" = ["allUsers"]

4
blueprints/serverless/api-gateway/main.tf
View File

@@ -70,8 +70,8 @@ module "functions" {
region = each.value
ingress_settings = "ALLOW_ALL"
bucket_config = {
location = null
lifecycle_delete_age = 1
location = null
lifecycle_delete_age_days = 1
}
bundle_config = {
source_dir = "${path.module}/function"

132
modules/cloud-function/README.md
View File

@@ -21,12 +21,27 @@ module "cf-http" {
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
source_dir = "fabric/assets/"
output_path = "bundle.zip"
excludes = null
}
}
# tftest skip
# tftest modules=1 resources=2
```
Analogous example using 2nd generation Cloud Functions
```hcl
module "cf-http" {
source = "./fabric/modules/cloud-function"
v2 = true
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "fabric/assets/"
output_path = "bundle.zip"
}
}
# tftest modules=1 resources=2
```
### PubSub and non-HTTP triggers
@@ -35,24 +50,61 @@ Other trigger types other than HTTP are configured via the `trigger_config` vari
```hcl
module "cf-http" {
source = "./fabric/modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
source = "./fabric/modules/cloud-function"
project_id = "my-project"
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
source_dir = "fabric/assets/"
output_path = "bundle.zip"
excludes = null
}
trigger_config = {
event = "google.pubsub.topic.publish"
resource = local.my-topic
retry = null
v1 = {
event = "google.pubsub.topic.publish"
resource = "local.my-topic"
}
}
}
# tftest skip
# tftest modules=1 resources=2
```
Cloud Functions 2nd gen support only [Eventarc](https://cloud.google.com/eventarc/docs) and uses separate structure
to configure:
```hcl
module "trigger-service-account" {
source = "./fabric/modules/iam-service-account"
project_id = "my-project"
name = "sa-cloudfunction"
iam_project_roles = {
"my-project" = [
"roles/run.invoker"
]
}
}
module "cf-http" {
source = "./fabric/modules/cloud-function"
project_id = "my-project"
v2 = true
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "fabric/assets/"
output_path = "bundle.zip"
}
trigger_config = {
v2 = {
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
pubsub_topic = "local.my-topic"
service_account_email = module.trigger-service-account.email
}
}
}
# tftest modules=2 resources=4
```
Ensure that pubsub robo-account `service-%s@gcp-sa-pubsub.iam.gserviceaccount.com` has `roles/iam.serviceAccountTokenCreatator`
as documented [here](https://cloud.google.com/eventarc/docs/roles-permissions#pubsub-topic)
### Controlling HTTP access
To allow anonymous access to the function, grant the `roles/cloudfunctions.invoker` role to the special `allUsers` identifier. Use specific identities (service accounts, groups, etc.) instead of `allUsers` to only allow selective access.
@@ -64,15 +116,14 @@ module "cf-http" {
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
source_dir = "fabric/assets/"
output_path = "bundle.zip"
excludes = null
}
iam = {
"roles/cloudfunctions.invoker" = ["allUsers"]
}
}
# tftest skip
# tftest modules=1 resources=3
```
### GCS bucket creation
@@ -86,16 +137,13 @@ module "cf-http" {
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bucket_config = {
location = null
lifecycle_delete_age = 1
lifecycle_delete_age_days = 1
}
bundle_config = {
source_dir = "my-cf-source-folder"
output_path = "bundle.zip"
excludes = null
source_dir = "fabric/assets/"
}
}
# tftest skip
# tftest modules=1 resources=3
```
### Service account management
@@ -109,13 +157,12 @@ module "cf-http" {
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
source_dir = "fabric/assets/"
output_path = "bundle.zip"
excludes = null
}
service_account_create = true
}
# tftest skip
# tftest modules=1 resources=3
```
To use an externally managed service account, pass its email in `service_account` and leave `service_account_create` to `false` (the default).
@@ -127,13 +174,12 @@ module "cf-http" {
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
source_dir = "fabric/assets/"
output_path = "bundle.zip"
excludes = null
}
service_account = local.service_account_email
service_account = "non-existent@serice.account.email"
}
# tftest skip
# tftest modules=1 resources=2
```
### Custom bundle config
@@ -147,12 +193,12 @@ module "cf-http" {
name = "test-cf-http"
bucket_name = "test-cf-bundles"
bundle_config = {
source_dir = "my-cf-source-folder"
source_dir = "fabric/assets"
output_path = "bundle.zip"
excludes = ["__pycache__"]
}
}
# tftest skip
# tftest modules=1 resources=2
```
### Private Cloud Build Pool
@@ -167,12 +213,11 @@ module "cf-http" {
bucket_name = "test-cf-bundles"
build_worker_pool = "projects/my-project/locations/europe-west1/workerPools/my_build_worker_pool"
bundle_config = {
source_dir = "my-cf-source-folder"
source_dir = "fabric/assets"
output_path = "bundle.zip"
excludes = null
}
}
# tftest skip
# tftest modules=1 resources=2
```
<!-- BEGIN TFDOC -->
@@ -181,14 +226,14 @@ module "cf-http" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | <code title="object&#40;&#123;&#10; source_dir &#61; string&#10; output_path &#61; string&#10; excludes &#61; list&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ | |
| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | <code title="object&#40;&#123;&#10; source_dir &#61; string&#10; output_path &#61; optional&#40;string, &#34;&#47;tmp&#47;bundle.zip&#34;&#41;&#10; excludes &#61; optional&#40;list&#40;string&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ | |
| [name](variables.tf#L94) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
| [project_id](variables.tf#L109) | Project id used for all resources. | <code>string</code> | ✓ | |
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object&#40;&#123;&#10; location &#61; string&#10; lifecycle_delete_age &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object&#40;&#123;&#10; location &#61; optional&#40;string&#41;&#10; lifecycle_delete_age_days &#61; optional&#40;number&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [build_worker_pool](variables.tf#L31) | Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format | <code>string</code> | | <code>null</code> |
| [description](variables.tf#L46) | Optional description. | <code>string</code> | | <code>&#34;Terraform managed.&#34;</code> |
| [environment_variables](variables.tf#L52) | Cloud function environment variables. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
| [function_config](variables.tf#L58) | Cloud function configuration. | <code title="object&#40;&#123;&#10; entry_point &#61; string&#10; instances &#61; number&#10; memory &#61; number &#35; Memory in MB&#10; runtime &#61; string&#10; timeout &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; entry_point &#61; &#34;main&#34;&#10; instances &#61; 1&#10; memory &#61; 256&#10; runtime &#61; &#34;python37&#34;&#10; timeout &#61; 180&#10;&#125;">&#123;&#8230;&#125;</code> |
| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | <code title="object&#40;&#123;&#10; entry_point &#61; optional&#40;string, &#34;main&#34;&#41;&#10; instance_count &#61; optional&#40;number, 1&#41;&#10; memory_mb &#61; optional&#40;number, 256&#41; &#35; Memory in MB&#10; runtime &#61; optional&#40;string, &#34;python310&#34;&#41;&#10; timeout_seconds &#61; optional&#40;number, 180&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code title="&#123;&#10; entry_point &#61; &#34;main&#34;&#10; instance_count &#61; 1&#10; memory_mb &#61; 256&#10; runtime &#61; &#34;python310&#34;&#10; timeout_seconds &#61; 180&#10;&#125;">&#123;&#8230;&#125;</code> |
| [iam](variables.tf#L76) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [ingress_settings](variables.tf#L82) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
| [labels](variables.tf#L88) | Resource labels. | <code>map&#40;string&#41;</code> | | <code>&#123;&#125;</code> |
@@ -197,10 +242,10 @@ module "cf-http" {
| [secrets](variables.tf#L120) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map&#40;object&#40;&#123;&#10; is_volume &#61; bool&#10; project_id &#61; number&#10; secret &#61; string&#10; versions &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [service_account](variables.tf#L132) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
| [service_account_create](variables.tf#L138) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object&#40;&#123;&#10; event &#61; string&#10; resource &#61; string&#10; retry &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [v2](variables.tf#L173) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | <code>bool</code> | | <code>false</code> |
| [vpc_connector](variables.tf#L154) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object&#40;&#123;&#10; create &#61; bool&#10; name &#61; string&#10; egress_settings &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [vpc_connector_config](variables.tf#L164) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object&#40;&#123;&#10; ip_cidr_range &#61; string&#10; network &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object&#40;&#123;&#10; v1 &#61; optional&#40;object&#40;&#123;&#10; event &#61; string&#10; resource &#61; string&#10; retry &#61; optional&#40;bool&#41;&#10; &#125;&#41;&#41;,&#10; v2 &#61; optional&#40;object&#40;&#123;&#10; region &#61; optional&#40;string&#41;&#10; event_type &#61; optional&#40;string&#41;&#10; pubsub_topic &#61; optional&#40;string&#41;&#10; event_filters &#61; optional&#40;list&#40;object&#40;&#123;&#10; attribute &#61; string&#10; value &#61; string&#10; operator &#61; string&#10; &#125;&#41;&#41;&#41;&#10; service_account_email &#61; optional&#40;string&#41;&#10; service_account_create &#61; optional&#40;bool&#41;&#10; retry_policy &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123; v1 &#61; null, v2 &#61; null &#125;</code> |
| [v2](variables.tf#L192) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | <code>bool</code> | | <code>false</code> |
| [vpc_connector](variables.tf#L173) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object&#40;&#123;&#10; create &#61; bool&#10; name &#61; string&#10; egress_settings &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
| [vpc_connector_config](variables.tf#L183) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object&#40;&#123;&#10; ip_cidr_range &#61; string&#10; network &#61; string&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>null</code> |
## Outputs
@@ -213,7 +258,10 @@ module "cf-http" {
| [service_account](outputs.tf#L42) | Service account resource. | |
| [service_account_email](outputs.tf#L47) | Service account email. | |
| [service_account_iam_email](outputs.tf#L52) | Service account email. | |
| [trigger_service_account](outputs.tf#L60) | Service account resource. | |
| [trigger_service_account_email](outputs.tf#L65) | Service account email. | |
| [trigger_service_account_iam_email](outputs.tf#L70) | Service account email. | |
| [uri](outputs.tf#L38) | Cloud function service uri. | |
| [vpc_connector](outputs.tf#L60) | VPC connector resource if created. | |
| [vpc_connector](outputs.tf#L78) | VPC connector resource if created. | |
<!-- END TFDOC -->

105
modules/cloud-function/main.tf
View File

@@ -29,15 +29,12 @@ locals {
? google_cloudfunctions2_function.function[0]
: google_cloudfunctions_function.function[0]
)
prefix = var.prefix == null ? "" : "${var.prefix}-"
service_account_email = (
var.service_account_create
? (
length(google_service_account.service_account) > 0
? google_service_account.service_account[0].email
: null
)
: var.service_account
prefix = var.prefix == null ? "" : "${var.prefix}-"
service_account_email = var.service_account_create ? google_service_account.service_account[0].email : var.service_account
trigger_service_account_email = (
coalesce(try(var.trigger_config.v2.service_account_create, false), false)
? google_service_account.trigger_service_account[0].email
: null
)
vpc_connector = (
var.vpc_connector == null
@@ -66,18 +63,19 @@ resource "google_cloudfunctions_function" "function" {
name = "${local.prefix}${var.name}"
description = var.description
runtime = var.function_config.runtime
available_memory_mb = var.function_config.memory
max_instances = var.function_config.instances
timeout = var.function_config.timeout
available_memory_mb = var.function_config.memory_mb
max_instances = var.function_config.instance_count
timeout = var.function_config.timeout_seconds
entry_point = var.function_config.entry_point
environment_variables = var.environment_variables
service_account_email = local.service_account_email
source_archive_bucket = local.bucket
source_archive_object = google_storage_bucket_object.bundle.name
labels = var.labels
trigger_http = var.trigger_config == null ? true : null
ingress_settings = var.ingress_settings
build_worker_pool = var.build_worker_pool
trigger_http = var.trigger_config.v1 == null ? true : null
ingress_settings = var.ingress_settings
build_worker_pool = var.build_worker_pool
vpc_connector = local.vpc_connector
vpc_connector_egress_settings = try(
@@ -85,14 +83,14 @@ resource "google_cloudfunctions_function" "function" {
)
dynamic "event_trigger" {
for_each = var.trigger_config == null ? [] : [""]
for_each = var.trigger_config.v1 == null ? [] : [""]
content {
event_type = var.trigger_config.event
resource = var.trigger_config.resource
event_type = var.trigger_config.v1.event
resource = var.trigger_config.v1.resource
dynamic "failure_policy" {
for_each = var.trigger_config.retry == null ? [] : [""]
for_each = var.trigger_config.v1.retry == null ? [] : [""]
content {
retry = var.trigger_config.retry
retry = var.trigger_config.v1.retry
}
}
}
@@ -126,7 +124,6 @@ resource "google_cloudfunctions_function" "function" {
}
}
}
}
resource "google_cloudfunctions2_function" "function" {
@@ -148,11 +145,30 @@ resource "google_cloudfunctions2_function" "function" {
}
}
}
dynamic "event_trigger" {
for_each = var.trigger_config.v2 == null ? [] : [""]
content {
trigger_region = var.trigger_config.v2.region
event_type = var.trigger_config.v2.event_type
pubsub_topic = var.trigger_config.v2.pubsub_topic
dynamic "event_filters" {
for_each = var.trigger_config.v2.event_filters == null ? [] : var.trigger_config.v2.event_filters
iterator = event_filter
content {
attribute = event_filter.attribute
value = event_filter.value
operator = event_filter.operator
}
}
service_account_email = var.trigger_config.v2.service_account_email
retry_policy = var.trigger_config.v2.retry_policy
}
}
service_config {
max_instance_count = var.function_config.instances
max_instance_count = var.function_config.instance_count
min_instance_count = 0
available_memory = "${var.function_config.memory}M"
timeout_seconds = var.function_config.timeout
available_memory = "${var.function_config.memory_mb}M"
timeout_seconds = var.function_config.timeout_seconds
environment_variables = var.environment_variables
ingress_settings = var.ingress_settings
all_traffic_on_latest_revision = true
@@ -194,7 +210,7 @@ resource "google_cloudfunctions2_function" "function" {
}
resource "google_cloudfunctions_function_iam_binding" "default" {
for_each = var.iam
for_each = !var.v2 ? var.iam : {}
project = var.project_id
region = var.region
cloud_function = local.function.name
@@ -202,6 +218,15 @@ resource "google_cloudfunctions_function_iam_binding" "default" {
members = each.value
}
resource "google_cloudfunctions2_function_iam_binding" "default" {
for_each = var.v2 ? var.iam : {}
project = var.project_id
location = google_cloudfunctions2_function.function[0].location
cloud_function = local.function.name
role = each.key
members = each.value
}
resource "google_storage_bucket" "bucket" {
count = var.bucket_config == null ? 0 : 1
project = var.project_id
@@ -215,18 +240,18 @@ resource "google_storage_bucket" "bucket" {
labels = var.labels
dynamic "lifecycle_rule" {
for_each = var.bucket_config.lifecycle_delete_age == null ? [] : [""]
for_each = var.bucket_config.lifecycle_delete_age_days == null ? [] : [""]
content {
action { type = "Delete" }
condition {
age = var.bucket_config.lifecycle_delete_age
age = var.bucket_config.lifecycle_delete_age_days
with_state = "ARCHIVED"
}
}
}
dynamic "versioning" {
for_each = var.bucket_config.lifecycle_delete_age == null ? [] : [""]
for_each = var.bucket_config.lifecycle_delete_age_days == null ? [] : [""]
content {
enabled = true
}
@@ -240,13 +265,9 @@ resource "google_storage_bucket_object" "bundle" {
}
data "archive_file" "bundle" {
type = "zip"
source_dir = var.bundle_config.source_dir
output_path = (
var.bundle_config.output_path == null
? "/tmp/bundle.zip"
: var.bundle_config.output_path
)
type = "zip"
source_dir = var.bundle_config.source_dir
output_path = var.bundle_config.output_path
output_file_mode = "0666"
excludes = var.bundle_config.excludes
}
@@ -257,3 +278,17 @@ resource "google_service_account" "service_account" {
account_id = "tf-cf-${var.name}"
display_name = "Terraform Cloud Function ${var.name}."
}
resource "google_service_account" "trigger_service_account" {
count = coalesce(try(var.trigger_config.v2.service_account_create, false), false) ? 1 : 0
project = var.project_id
account_id = "tf-cf-trigger-${var.name}"
display_name = "Terraform trigger for Cloud Function ${var.name}."
}
resource "google_project_iam_member" "trigger_iam" {
count = coalesce(try(var.trigger_config.v2.service_account_create, false), false) ? 1 : 0
project = var.project_id
member = "serviceAccount:${google_service_account.trigger_service_account[0].email}"
role = "roles/run.invoker"
}

18
modules/cloud-function/outputs.tf
View File

@@ -57,6 +57,24 @@ output "service_account_iam_email" {
])
}
output "trigger_service_account" {
description = "Service account resource."
value = try(google_service_account.trigger_service_account[0], null)
}
output "trigger_service_account_email" {
description = "Service account email."
value = local.trigger_service_account_email
}
output "trigger_service_account_iam_email" {
description = "Service account email."
value = join("", [
"serviceAccount:",
local.trigger_service_account_email == null ? "" : local.trigger_service_account_email
])
}
output "vpc_connector" {
description = "VPC connector resource if created."
value = try(google_vpc_access_connector.connector.0.id, null)

57
modules/cloud-function/variables.tf
View File

@@ -17,8 +17,8 @@
variable "bucket_config" {
description = "Enable and configure auto-created bucket. Set fields to null to use defaults."
type = object({
location = string
lifecycle_delete_age = number
location = optional(string)
lifecycle_delete_age_days = optional(number)
})
default = null
}
@@ -38,8 +38,8 @@ variable "bundle_config" {
description = "Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null."
type = object({
source_dir = string
output_path = string
excludes = list(string)
output_path = optional(string, "/tmp/bundle.zip")
excludes = optional(list(string))
})
}
@@ -56,20 +56,20 @@ variable "environment_variables" {
}
variable "function_config" {
description = "Cloud function configuration."
description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout"
type = object({
entry_point = string
instances = number
memory = number # Memory in MB
runtime = string
timeout = number
entry_point = optional(string, "main")
instance_count = optional(number, 1)
memory_mb = optional(number, 256) # Memory in MB
runtime = optional(string, "python310")
timeout_seconds = optional(number, 180)
})
default = {
entry_point = "main"
instances = 1
memory = 256
runtime = "python37"
timeout = 180
entry_point = "main"
instance_count = 1
memory_mb = 256
runtime = "python310"
timeout_seconds = 180
}
}
@@ -144,11 +144,30 @@ variable "service_account_create" {
variable "trigger_config" {
description = "Function trigger configuration. Leave null for HTTP trigger."
type = object({
event = string
resource = string
retry = bool
v1 = optional(object({
event = string
resource = string
retry = optional(bool)
})),
v2 = optional(object({
region = optional(string)
event_type = optional(string)
pubsub_topic = optional(string)
event_filters = optional(list(object({
attribute = string
value = string
operator = string
})))
service_account_email = optional(string)
service_account_create = optional(bool)
retry_policy = optional(string)
}))
})
default = null
default = { v1 = null, v2 = null }
validation {
condition = !(var.trigger_config.v1 != null && var.trigger_config.v2 != null)
error_message = "Provide configuration for only one generation - either v1 or v2"
}
}
variable "vpc_connector" {

2
tests/modules/cloud_function_v2/test_plan.py
View File

@@ -29,6 +29,6 @@ def test_resource_count(resources):
def test_iam(resources):
"Test IAM binding resources."
bindings = [r['values'] for r in resources if r['type']
== 'google_cloudfunctions_function_iam_binding']
== 'google_cloudfunctions2_function_iam_binding']
assert len(bindings) == 1
assert bindings[0]['role'] == 'roles/cloudfunctions.invoker'