Split Cloud Function module in separate v1 and v2 modules (#1450)
* split v1 * v2 * blueprints * remove _http
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
604ca5afd8
commit
bd3296bc46
254
modules/cloud-function-v2/README.md
Normal file
254
modules/cloud-function-v2/README.md
Normal file
@@ -0,0 +1,254 @@
|
||||
# Cloud Function Module (v2)
|
||||
|
||||
Cloud Function management, with support for IAM roles and optional bucket creation.
|
||||
|
||||
The GCS object used for deployment uses a hash of the bundle zip contents in its name, which ensures change tracking and avoids recreating the function if the GCS object is deleted and needs recreating.
|
||||
|
||||
## TODO
|
||||
|
||||
- [ ] add support for `source_repository`
|
||||
|
||||
## Examples
|
||||
|
||||
### HTTP trigger
|
||||
|
||||
This deploys a Cloud Function with an HTTP endpoint, using a pre-existing GCS bucket for deployment, setting the service account to the Cloud Function default one, and delegating access control to the containing project.
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
### PubSub and non-HTTP triggers
|
||||
|
||||
Other trigger types other than HTTP are configured via the `trigger_config` variable. This example shows a PubSub trigger via [Eventarc](https://cloud.google.com/eventarc/docs):
|
||||
|
||||
```hcl
|
||||
module "trigger-service-account" {
|
||||
source = "./fabric/modules/iam-service-account"
|
||||
project_id = "my-project"
|
||||
name = "sa-cloudfunction"
|
||||
iam_project_roles = {
|
||||
"my-project" = [
|
||||
"roles/run.invoker"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
trigger_config = {
|
||||
event_type = "google.cloud.pubsub.topic.v1.messagePublished"
|
||||
pubsub_topic = "local.my-topic"
|
||||
service_account_email = module.trigger-service-account.email
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=4
|
||||
```
|
||||
|
||||
Ensure that pubsub service identity (`service-[project number]@gcp-sa-pubsub.iam.gserviceaccount.com` has `roles/iam.serviceAccountTokenCreator`
|
||||
as documented [here](https://cloud.google.com/eventarc/docs/roles-permissions#pubsub-topic).
|
||||
|
||||
### Controlling HTTP access
|
||||
|
||||
To allow anonymous access to the function, grant the `roles/cloudfunctions.invoker` role to the special `allUsers` identifier. Use specific identities (service accounts, groups, etc.) instead of `allUsers` to only allow selective access.
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
iam = {
|
||||
"roles/cloudfunctions.invoker" = ["allUsers"]
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=3 inventory=iam.yaml
|
||||
```
|
||||
|
||||
### GCS bucket creation
|
||||
|
||||
You can have the module auto-create the GCS bucket used for deployment via the `bucket_config` variable. Setting `bucket_config.location` to `null` will also use the function region for GCS.
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bucket_config = {
|
||||
lifecycle_delete_age_days = 1
|
||||
}
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets/"
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=3
|
||||
```
|
||||
|
||||
### Service account management
|
||||
|
||||
To use a custom service account managed by the module, set `service_account_create` to `true` and leave `service_account` set to `null` value (default).
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
service_account_create = true
|
||||
}
|
||||
# tftest modules=1 resources=3
|
||||
```
|
||||
|
||||
To use an externally managed service account, pass its email in `service_account` and leave `service_account_create` to `false` (the default).
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets/"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
service_account = "non-existent@serice.account.email"
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
### Custom bundle config
|
||||
|
||||
In order to help prevent `archive_zip.output_md5` from changing cross platform (e.g. Cloud Build vs your local development environment), you'll have to make sure that the files included in the zip are always the same.
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets"
|
||||
output_path = "bundle.zip"
|
||||
excludes = ["__pycache__"]
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
### Private Cloud Build Pool
|
||||
|
||||
This deploys a Cloud Function with an HTTP endpoint, using a pre-existing GCS bucket for deployment using a pre existing private Cloud Build worker pool.
|
||||
|
||||
```hcl
|
||||
module "cf-http" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http"
|
||||
bucket_name = "test-cf-bundles"
|
||||
build_worker_pool = "projects/my-project/locations/europe-west1/workerPools/my_build_worker_pool"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets"
|
||||
output_path = "bundle.zip"
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
### Multiple Cloud Functions within project
|
||||
|
||||
When deploying multiple functions do not reuse `bundle_config.output_path` between instances as the result is undefined. Default `output_path` creates file in `/tmp` folder using project Id and function name to avoid name conflicts.
|
||||
|
||||
```hcl
|
||||
module "cf-http-one" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http-one"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets"
|
||||
}
|
||||
}
|
||||
|
||||
module "cf-http-two" {
|
||||
source = "./fabric/modules/cloud-function-v2"
|
||||
project_id = "my-project"
|
||||
name = "test-cf-http-two"
|
||||
bucket_name = "test-cf-bundles"
|
||||
bundle_config = {
|
||||
source_dir = "fabric/assets"
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=4 inventory=multiple_functions.yaml
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
|
||||
## Variables
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | <code title="object({ source_dir = string output_path = optional(string) excludes = optional(list(string)) })">object({…})</code> | ✓ | |
|
||||
| [name](variables.tf#L96) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L111) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object({ location = optional(string) lifecycle_delete_age_days = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [build_worker_pool](variables.tf#L31) | Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format. | <code>string</code> | | <code>null</code> |
|
||||
| [description](variables.tf#L46) | Optional description. | <code>string</code> | | <code>"Terraform managed."</code> |
|
||||
| [environment_variables](variables.tf#L52) | Cloud function environment variables. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code title="object({ entry_point = optional(string, "main") instance_count = optional(number, 1) memory_mb = optional(number, 256) # Memory in MB cpu = optional(string, "0.166") runtime = optional(string, "python310") timeout_seconds = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instance_count = 1 memory_mb = 256 cpu = "0.166" runtime = "python310" timeout_seconds = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L78) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L84) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L90) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L101) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [region](variables.tf#L116) | Region used for all resources. | <code>string</code> | | <code>"europe-west1"</code> |
|
||||
| [secrets](variables.tf#L122) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = number secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L134) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L140) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L146) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event_type = string pubsub_topic = optional(string) region = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = string })), []) service_account_email = optional(string) service_account_create = optional(bool, false) retry_policy = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L164) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = bool name = string egress_settings = string })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector_config](variables.tf#L174) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
| name | description | sensitive |
|
||||
|---|---|:---:|
|
||||
| [bucket](outputs.tf#L17) | Bucket resource (only if auto-created). | |
|
||||
| [bucket_name](outputs.tf#L24) | Bucket name. | |
|
||||
| [function](outputs.tf#L29) | Cloud function resources. | |
|
||||
| [function_name](outputs.tf#L34) | Cloud function name. | |
|
||||
| [id](outputs.tf#L39) | Fully qualified function id. | |
|
||||
| [service_account](outputs.tf#L44) | Service account resource. | |
|
||||
| [service_account_email](outputs.tf#L49) | Service account email. | |
|
||||
| [service_account_iam_email](outputs.tf#L54) | Service account email. | |
|
||||
| [trigger_service_account](outputs.tf#L62) | Service account resource. | |
|
||||
| [trigger_service_account_email](outputs.tf#L67) | Service account email. | |
|
||||
| [trigger_service_account_iam_email](outputs.tf#L72) | Service account email. | |
|
||||
| [uri](outputs.tf#L80) | Cloud function service uri. | |
|
||||
| [vpc_connector](outputs.tf#L85) | VPC connector resource if created. | |
|
||||
|
||||
<!-- END TFDOC -->
|
||||
222
modules/cloud-function-v2/main.tf
Normal file
222
modules/cloud-function-v2/main.tf
Normal file
@@ -0,0 +1,222 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
locals {
|
||||
bucket = (
|
||||
var.bucket_name != null
|
||||
? var.bucket_name
|
||||
: (
|
||||
length(google_storage_bucket.bucket) > 0
|
||||
? google_storage_bucket.bucket[0].name
|
||||
: null
|
||||
)
|
||||
)
|
||||
prefix = var.prefix == null ? "" : "${var.prefix}-"
|
||||
service_account_email = (
|
||||
var.service_account_create
|
||||
? google_service_account.service_account[0].email
|
||||
: var.service_account
|
||||
)
|
||||
trigger_service_account_email = (
|
||||
try(var.trigger_config.service_account_create, false)
|
||||
? google_service_account.trigger_service_account[0].email
|
||||
: null
|
||||
)
|
||||
vpc_connector = (
|
||||
var.vpc_connector == null
|
||||
? null
|
||||
: (
|
||||
try(var.vpc_connector.create, false) == false
|
||||
? var.vpc_connector.name
|
||||
: google_vpc_access_connector.connector.0.id
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
resource "google_vpc_access_connector" "connector" {
|
||||
count = try(var.vpc_connector.create, false) == true ? 1 : 0
|
||||
project = var.project_id
|
||||
name = var.vpc_connector.name
|
||||
region = var.region
|
||||
ip_cidr_range = var.vpc_connector_config.ip_cidr_range
|
||||
network = var.vpc_connector_config.network
|
||||
}
|
||||
|
||||
resource "google_cloudfunctions2_function" "function" {
|
||||
provider = google-beta
|
||||
project = var.project_id
|
||||
location = var.region
|
||||
name = "${local.prefix}${var.name}"
|
||||
description = var.description
|
||||
build_config {
|
||||
worker_pool = var.build_worker_pool
|
||||
runtime = var.function_config.runtime
|
||||
entry_point = var.function_config.entry_point
|
||||
environment_variables = var.environment_variables
|
||||
source {
|
||||
storage_source {
|
||||
bucket = local.bucket
|
||||
object = google_storage_bucket_object.bundle.name
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "event_trigger" {
|
||||
for_each = var.trigger_config == null ? [] : [""]
|
||||
content {
|
||||
event_type = var.trigger_config.event_type
|
||||
pubsub_topic = var.trigger_config.pubsub_topic
|
||||
trigger_region = (
|
||||
var.trigger_config.region == null
|
||||
? var.region
|
||||
: var.trigger_config.region
|
||||
)
|
||||
dynamic "event_filters" {
|
||||
for_each = var.trigger_config.event_filters
|
||||
iterator = event_filter
|
||||
content {
|
||||
attribute = event_filter.attribute
|
||||
value = event_filter.value
|
||||
operator = event_filter.operator
|
||||
}
|
||||
}
|
||||
service_account_email = var.trigger_config.service_account_email
|
||||
retry_policy = var.trigger_config.retry_policy
|
||||
}
|
||||
}
|
||||
service_config {
|
||||
max_instance_count = var.function_config.instance_count
|
||||
min_instance_count = 0
|
||||
available_memory = "${var.function_config.memory_mb}M"
|
||||
available_cpu = var.function_config.cpu
|
||||
timeout_seconds = var.function_config.timeout_seconds
|
||||
environment_variables = var.environment_variables
|
||||
ingress_settings = var.ingress_settings
|
||||
all_traffic_on_latest_revision = true
|
||||
service_account_email = local.service_account_email
|
||||
vpc_connector = local.vpc_connector
|
||||
vpc_connector_egress_settings = try(
|
||||
var.vpc_connector.egress_settings, null)
|
||||
|
||||
dynamic "secret_environment_variables" {
|
||||
for_each = { for k, v in var.secrets : k => v if !v.is_volume }
|
||||
iterator = secret
|
||||
content {
|
||||
key = secret.key
|
||||
project_id = secret.value.project_id
|
||||
secret = secret.value.secret
|
||||
version = try(secret.value.versions.0, "latest")
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "secret_volumes" {
|
||||
for_each = { for k, v in var.secrets : k => v if v.is_volume }
|
||||
iterator = secret
|
||||
content {
|
||||
mount_path = secret.key
|
||||
project_id = secret.value.project_id
|
||||
secret = secret.value.secret
|
||||
dynamic "versions" {
|
||||
for_each = secret.value.versions
|
||||
iterator = version
|
||||
content {
|
||||
path = split(":", version)[1]
|
||||
version = split(":", version)[0]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
labels = var.labels
|
||||
}
|
||||
|
||||
resource "google_cloudfunctions2_function_iam_binding" "default" {
|
||||
for_each = var.iam
|
||||
project = var.project_id
|
||||
location = google_cloudfunctions2_function.function.location
|
||||
cloud_function = google_cloudfunctions2_function.function.name
|
||||
role = each.key
|
||||
members = each.value
|
||||
}
|
||||
|
||||
resource "google_storage_bucket" "bucket" {
|
||||
count = var.bucket_config == null ? 0 : 1
|
||||
project = var.project_id
|
||||
name = "${local.prefix}${var.bucket_name}"
|
||||
uniform_bucket_level_access = true
|
||||
location = (
|
||||
var.bucket_config.location == null
|
||||
? var.region
|
||||
: var.bucket_config.location
|
||||
)
|
||||
labels = var.labels
|
||||
|
||||
dynamic "lifecycle_rule" {
|
||||
for_each = var.bucket_config.lifecycle_delete_age_days == null ? [] : [""]
|
||||
content {
|
||||
action { type = "Delete" }
|
||||
condition {
|
||||
age = var.bucket_config.lifecycle_delete_age_days
|
||||
with_state = "ARCHIVED"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "versioning" {
|
||||
for_each = var.bucket_config.lifecycle_delete_age_days == null ? [] : [""]
|
||||
content {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_storage_bucket_object" "bundle" {
|
||||
name = "bundle-${data.archive_file.bundle.output_md5}.zip"
|
||||
bucket = local.bucket
|
||||
source = data.archive_file.bundle.output_path
|
||||
}
|
||||
|
||||
data "archive_file" "bundle" {
|
||||
type = "zip"
|
||||
source_dir = var.bundle_config.source_dir
|
||||
output_path = coalesce(var.bundle_config.output_path, "/tmp/bundle-${var.project_id}-${var.name}.zip")
|
||||
output_file_mode = "0644"
|
||||
excludes = var.bundle_config.excludes
|
||||
}
|
||||
|
||||
resource "google_service_account" "service_account" {
|
||||
count = var.service_account_create ? 1 : 0
|
||||
project = var.project_id
|
||||
account_id = "tf-cf-${var.name}"
|
||||
display_name = "Terraform Cloud Function ${var.name}."
|
||||
}
|
||||
|
||||
resource "google_service_account" "trigger_service_account" {
|
||||
count = (
|
||||
try(var.trigger_config.service_account_create, false) == true ? 1 : 0
|
||||
)
|
||||
project = var.project_id
|
||||
account_id = "tf-cf-trigger-${var.name}"
|
||||
display_name = "Terraform trigger for Cloud Function ${var.name}."
|
||||
}
|
||||
|
||||
resource "google_project_iam_member" "trigger_iam" {
|
||||
count = (
|
||||
try(var.trigger_config.service_account_create, false) == true ? 1 : 0
|
||||
)
|
||||
project = var.project_id
|
||||
member = "serviceAccount:${google_service_account.trigger_service_account[0].email}"
|
||||
role = "roles/run.invoker"
|
||||
}
|
||||
88
modules/cloud-function-v2/outputs.tf
Normal file
88
modules/cloud-function-v2/outputs.tf
Normal file
@@ -0,0 +1,88 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
output "bucket" {
|
||||
description = "Bucket resource (only if auto-created)."
|
||||
value = try(
|
||||
var.bucket_config == null ? null : google_storage_bucket.bucket.0, null
|
||||
)
|
||||
}
|
||||
|
||||
output "bucket_name" {
|
||||
description = "Bucket name."
|
||||
value = local.bucket
|
||||
}
|
||||
|
||||
output "function" {
|
||||
description = "Cloud function resources."
|
||||
value = google_cloudfunctions2_function.function
|
||||
}
|
||||
|
||||
output "function_name" {
|
||||
description = "Cloud function name."
|
||||
value = google_cloudfunctions2_function.function.name
|
||||
}
|
||||
|
||||
output "id" {
|
||||
description = "Fully qualified function id."
|
||||
value = google_cloudfunctions2_function.function.id
|
||||
}
|
||||
|
||||
output "service_account" {
|
||||
description = "Service account resource."
|
||||
value = try(google_service_account.service_account[0], null)
|
||||
}
|
||||
|
||||
output "service_account_email" {
|
||||
description = "Service account email."
|
||||
value = local.service_account_email
|
||||
}
|
||||
|
||||
output "service_account_iam_email" {
|
||||
description = "Service account email."
|
||||
value = join("", [
|
||||
"serviceAccount:",
|
||||
local.service_account_email == null ? "" : local.service_account_email
|
||||
])
|
||||
}
|
||||
|
||||
output "trigger_service_account" {
|
||||
description = "Service account resource."
|
||||
value = try(google_service_account.trigger_service_account[0], null)
|
||||
}
|
||||
|
||||
output "trigger_service_account_email" {
|
||||
description = "Service account email."
|
||||
value = local.trigger_service_account_email
|
||||
}
|
||||
|
||||
output "trigger_service_account_iam_email" {
|
||||
description = "Service account email."
|
||||
value = join("", [
|
||||
"serviceAccount:",
|
||||
local.trigger_service_account_email == null ? "" : local.trigger_service_account_email
|
||||
])
|
||||
}
|
||||
|
||||
output "uri" {
|
||||
description = "Cloud function service uri."
|
||||
value = google_cloudfunctions2_function.function.service_config[0].uri
|
||||
}
|
||||
|
||||
output "vpc_connector" {
|
||||
description = "VPC connector resource if created."
|
||||
value = try(google_vpc_access_connector.connector.0.id, null)
|
||||
}
|
||||
183
modules/cloud-function-v2/variables.tf
Normal file
183
modules/cloud-function-v2/variables.tf
Normal file
@@ -0,0 +1,183 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
variable "bucket_config" {
|
||||
description = "Enable and configure auto-created bucket. Set fields to null to use defaults."
|
||||
type = object({
|
||||
location = optional(string)
|
||||
lifecycle_delete_age_days = optional(number)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "bucket_name" {
|
||||
description = "Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null."
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "build_worker_pool" {
|
||||
description = "Build worker pool, in projects/<PROJECT-ID>/locations/<REGION>/workerPools/<POOL_NAME> format."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "bundle_config" {
|
||||
description = "Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null."
|
||||
type = object({
|
||||
source_dir = string
|
||||
output_path = optional(string)
|
||||
excludes = optional(list(string))
|
||||
})
|
||||
}
|
||||
|
||||
variable "description" {
|
||||
description = "Optional description."
|
||||
type = string
|
||||
default = "Terraform managed."
|
||||
}
|
||||
|
||||
variable "environment_variables" {
|
||||
description = "Cloud function environment variables."
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "function_config" {
|
||||
description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout."
|
||||
type = object({
|
||||
entry_point = optional(string, "main")
|
||||
instance_count = optional(number, 1)
|
||||
memory_mb = optional(number, 256) # Memory in MB
|
||||
cpu = optional(string, "0.166")
|
||||
runtime = optional(string, "python310")
|
||||
timeout_seconds = optional(number, 180)
|
||||
})
|
||||
default = {
|
||||
entry_point = "main"
|
||||
instance_count = 1
|
||||
memory_mb = 256
|
||||
cpu = "0.166"
|
||||
runtime = "python310"
|
||||
timeout_seconds = 180
|
||||
}
|
||||
}
|
||||
|
||||
variable "iam" {
|
||||
description = "IAM bindings for topic in {ROLE => [MEMBERS]} format."
|
||||
type = map(list(string))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "ingress_settings" {
|
||||
description = "Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY ."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "labels" {
|
||||
description = "Resource labels."
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "name" {
|
||||
description = "Name used for cloud function and associated resources."
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "prefix" {
|
||||
description = "Optional prefix used for resource names."
|
||||
type = string
|
||||
default = null
|
||||
validation {
|
||||
condition = var.prefix != ""
|
||||
error_message = "Prefix cannot be empty, please use null instead."
|
||||
}
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
description = "Project id used for all resources."
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region used for all resources."
|
||||
type = string
|
||||
default = "europe-west1"
|
||||
}
|
||||
|
||||
variable "secrets" {
|
||||
description = "Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format."
|
||||
type = map(object({
|
||||
is_volume = bool
|
||||
project_id = number
|
||||
secret = string
|
||||
versions = list(string)
|
||||
}))
|
||||
nullable = false
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "service_account" {
|
||||
description = "Service account email. Unused if service account is auto-created."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "service_account_create" {
|
||||
description = "Auto-create service account."
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "trigger_config" {
|
||||
description = "Function trigger configuration. Leave null for HTTP trigger."
|
||||
type = object({
|
||||
event_type = string
|
||||
pubsub_topic = optional(string)
|
||||
region = optional(string)
|
||||
event_filters = optional(list(object({
|
||||
attribute = string
|
||||
value = string
|
||||
operator = string
|
||||
})), [])
|
||||
service_account_email = optional(string)
|
||||
service_account_create = optional(bool, false)
|
||||
retry_policy = optional(string)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "vpc_connector" {
|
||||
description = "VPC connector configuration. Set create to 'true' if a new connector needs to be created."
|
||||
type = object({
|
||||
create = bool
|
||||
name = string
|
||||
egress_settings = string
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "vpc_connector_config" {
|
||||
description = "VPC connector network configuration. Must be provided if new VPC connector is being created."
|
||||
type = object({
|
||||
ip_cidr_range = string
|
||||
network = string
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
||||
|
||||
29
modules/cloud-function-v2/versions.tf
Normal file
29
modules/cloud-function-v2/versions.tf
Normal file
@@ -0,0 +1,29 @@
|
||||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# https://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
terraform {
|
||||
required_version = ">= 1.4.4"
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = ">= 4.69.0" # tftest
|
||||
}
|
||||
google-beta = {
|
||||
source = "hashicorp/google-beta"
|
||||
version = ">= 4.69.0" # tftest
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user