MIG and ILB modules (#61)

* preliminary net-ilb module, untested * outputs * fix basic mistakes, add initial test * test variable defaults on all resources * README stub * net-ilb module fixes and example * compute-vm module fixes * fix test * remove mig from compute vm module * split out mig from compute-vm (untested) * split out mig from compute-vm (untested) * fix mig versions * small fixes and examples for mig module * Update README.md * Update README.md * switch mig to using a single variable for both region and zone
2020-04-30 17:08:18 +02:00
parent 5088ed61ff
commit be3c461cf9
21 changed files with 1459 additions and 333 deletions
--- a/modules/net-ilb/README.md
+++ b/modules/net-ilb/README.md
@@ -0,0 +1,110 @@
+# Internal Load Balancer Module
+
+This module allows managing a GCE Internal Load Balancer and integrates the forwarding rule, regional backend, and optional health check resources. It's designed to be a simple match for the [`compute-vm`](../compute-vm) module, which can be used to manage instance templates and instance groups.
+
+## Issues
+
+TODO(ludoo): check if this is still the case after splitting out MIG from compute-vm
+
+There are some corner cases (eg when switching the instance template from internal service account to an externally managed one) where Terraform raises a cycle error on apply. In these situations, run successive applies targeting resources used in the template first then the template itself, and the cycle should be fixed.
+
+One other issue is a `Provider produced inconsistent final plan` error which is sometimes raised when switching template version. This seems to be related to this [open provider issue](https://github.com/terraform-providers/terraform-provider-google/issues/3937), but it's relatively harmless since the resource is updated, and subsequent applies raise no errors.
+
+## Example
+
+This example spins up a simple HTTP server and combines four modules:
+
+- [`nginx`](../cloud-config-container/nginx) from the `cloud-config-container` collection, to manage instance configuration
+- [`compute-vm`](../compute-vm) to manage the instance template and unmanaged instance group
+- this module to create an Internal Load Balancer in front of the managed instance group
+
+Note that the example uses the GCE default service account. You might want to create an ad-hoc service account by combining the [`iam-service-accounts`](../iam-service-accounts) module, or by having the GCE VM module create one for you. In both cases, remember to set at least logging write permissions for the service account, or the container on the instances won't be able to start.
+
+```hcl
+module "cos-nginx" {
+  source = "./modules/cloud-config-container/nginx"
+}
+
+module "instance-group" {
+  source     = "./modules/compute-vm"
+  project_id = "my-project"
+  region     = "europe-west1"
+  zone       = "europe-west1-b"
+  name       = "ilb-test"
+  network_interfaces = [{
+    network    = local.network_self_link,
+    subnetwork = local.subnetwork_self_link,
+    nat        = false,
+    addresses  = null
+  }]
+  boot_disk = {
+    image = "projects/cos-cloud/global/images/family/cos-stable"
+    type  = "pd-ssd"
+    size  = 10
+  }
+  tags                   = ["http-server", "ssh"]
+  metadata = {
+    user-data = module.cos-nginx.cloud_config
+  }
+  group = {}
+}
+
+module "ilb" {
+  source        = "./modules/net-ilb"
+  project_id    = "my-project"
+  region        = "europe-west1"
+  name          = "ilb-test"
+  service_label = "ilb-test"
+  network       = local.network_self_link
+  subnetwork    = local.subnetwork_self_link
+  ports         = [80]
+  backends = [{
+    failover       = false
+    group          = module.instance-group.group.self_link
+    balancing_mode = "CONNECTION"
+  }]
+  health_check_config = {
+    type = "http", check = { port = 80 }, config = {}, logging = true
+  }
+}
+
+```
+
+<!-- BEGIN TFDOC -->
+## Variables
+
+| name | description | type | required | default |
+|---|---|:---: |:---:|:---:|
+| backends | Load balancer backends, balancing mode is one of 'CONNECTION' or 'UTILIZATION'. | <code title="list&#40;object&#40;&#123;&#10;failover       &#61; bool&#10;group          &#61; string&#10;balancing_mode &#61; string&#10;&#125;&#41;&#41;">list(object({...}))</code> | ✓ |  |
+| name | Name used for all resources. | <code title="">string</code> | ✓ |  |
+| network | Network used for resources. | <code title="">string</code> | ✓ |  |
+| project_id | Project id where resources will be created. | <code title="">string</code> | ✓ |  |
+| region | GCP region. | <code title="">string</code> | ✓ |  |
+| subnetwork | Subnetwork used for the forwarding rule. | <code title="">string</code> | ✓ |  |
+| *address* | Optional IP address used for the forwarding rule. | <code title="">string</code> |  | <code title="">null</code> |
+| *backend_config* | Optional backend configuration. | <code title="object&#40;&#123;&#10;session_affinity                &#61; string&#10;timeout_sec                     &#61; number&#10;connection_draining_timeout_sec &#61; number&#10;&#125;&#41;">object({...})</code> |  | <code title="">null</code> |
+| *failover_config* | Optional failover configuration. | <code title="object&#40;&#123;&#10;disable_connection_drain  &#61; bool&#10;drop_traffic_if_unhealthy &#61; bool&#10;ratio                     &#61; number&#10;&#125;&#41;">object({...})</code> |  | <code title="">null</code> |
+| *global_access* | Global access, defaults to false if not set. | <code title="">bool</code> |  | <code title="">null</code> |
+| *health_check* | Name of existing health check to use, disables auto-created health check. | <code title="">string</code> |  | <code title="">null</code> |
+| *health_check_config* | Configuration of the auto-created helth check. | <code title="object&#40;&#123;&#10;type &#61; string      &#35; http https tcp ssl http2&#10;check  &#61; map&#40;any&#41;    &#35; actual health check block attributes&#10;config &#61; map&#40;number&#41; &#35; interval, thresholds, timeout&#10;&#125;&#41;">object({...})</code> |  | <code title="&#123;&#10;type &#61; &#34;http&#34;&#10;check &#61; &#123;&#10;port_specification &#61; &#34;USE_SERVING_PORT&#34;&#10;&#125;&#10;config &#61; &#123;&#125;&#10;&#125;">...</code> |
+| *labels* | Labels set on resources. | <code title="map&#40;string&#41;">map(string)</code> |  | <code title="">{}</code> |
+| *log_sample_rate* | Set a value between 0 and 1 to enable logging for resources, and set the sampling rate for backend logging. | <code title="">number</code> |  | <code title="">null</code> |
+| *ports* | Comma-separated ports, leave null to use all ports. | <code title="list&#40;string&#41;">list(string)</code> |  | <code title="">null</code> |
+| *protocol* | IP protocol used, defaults to TCP. | <code title="">string</code> |  | <code title="">TCP</code> |
+| *service_label* | Optional prefix of the fully qualified forwarding rule name. | <code title="">string</code> |  | <code title="">null</code> |
+
+## Outputs
+
+| name | description | sensitive |
+|---|---|:---:|
+| backend | Backend resource. |  |
+| backend_id | Backend id. |  |
+| backend_self_link | Backend self link. |  |
+| forwarding_rule | Forwarding rule resource. |  |
+| forwarding_rule_address | Forwarding rule address. |  |
+| forwarding_rule_id | Forwarding rule id. |  |
+| forwarding_rule_self_link | Forwarding rule self link. |  |
+| health_check | Auto-created health-check resource. |  |
+| health_check_self_id | Auto-created health-check self id. |  |
+| health_check_self_link | Auto-created health-check self link. |  |
+<!-- END TFDOC -->
--- a/modules/net-ilb/main.tf
+++ b/modules/net-ilb/main.tf
@@ -0,0 +1,191 @@
+/**
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+locals {
+  health_check = (
+    var.health_check == null
+    ? try(google_compute_health_check.default.0.self_link, null)
+    : var.health_check
+  )
+}
+
+resource "google_compute_forwarding_rule" "default" {
+  provider              = google-beta
+  project               = var.project_id
+  name                  = var.name
+  description           = "Terraform managed."
+  load_balancing_scheme = "INTERNAL"
+  region                = var.region
+  network               = var.network
+  subnetwork            = var.subnetwork
+  ip_address            = var.address
+  ip_protocol           = var.protocol # TCP | UDP
+  ports                 = var.ports    # "nnnnn" or "nnnnn,nnnnn,nnnnn" max 5
+  service_label         = var.service_label
+  all_ports             = var.ports == null ? true : null
+  allow_global_access   = var.global_access
+  backend_service       = google_compute_region_backend_service.default.self_link
+  # is_mirroring_collector = false
+  labels = var.labels
+}
+
+resource "google_compute_region_backend_service" "default" {
+  provider              = google-beta
+  project               = var.project_id
+  name                  = var.name
+  description           = "Terraform managed."
+  load_balancing_scheme = "INTERNAL"
+  region                = var.region
+  network               = var.network
+  health_checks         = [local.health_check]
+  protocol              = var.protocol
+
+  session_affinity                = try(var.backend_config.session_affinity, null)
+  timeout_sec                     = try(var.backend_config.timeout_sec, null)
+  connection_draining_timeout_sec = try(var.backend_config.connection_draining_timeout_sec, null)
+
+  dynamic backend {
+    for_each = { for b in var.backends : b.group => b }
+    iterator = backend
+    content {
+      balancing_mode = backend.value.balancing_mode
+      description    = "Terraform managed."
+      failover       = backend.value.failover
+      group          = backend.key
+    }
+  }
+
+  dynamic failover_policy {
+    for_each = var.failover_config == null ? [] : [var.failover_config]
+    iterator = config
+    content {
+      disable_connection_drain_on_failover = config.value.disable_connection_drain
+      drop_traffic_if_unhealthy            = config.value.drop_traffic_if_unhealthy
+      failover_ratio                       = config.value.ratio
+    }
+  }
+
+}
+
+resource "google_compute_health_check" "default" {
+  provider    = google-beta
+  count       = var.health_check == null ? 1 : 0
+  project     = var.project_id
+  name        = var.name
+  description = "Terraform managed."
+
+  check_interval_sec  = try(var.health_check_config.config.check_interval_sec, null)
+  healthy_threshold   = try(var.health_check_config.config.healthy_threshold, null)
+  timeout_sec         = try(var.health_check_config.config.timeout_sec, null)
+  unhealthy_threshold = try(var.health_check_config.config.unhealthy_threshold, null)
+
+  dynamic http_health_check {
+    for_each = (
+      try(var.health_check_config.type, null) == "http"
+      ? [var.health_check_config.check]
+      : []
+    )
+    iterator = check
+    content {
+      host               = try(check.value.host, null)
+      port               = try(check.value.port, null)
+      port_name          = try(check.value.port_name, null)
+      port_specification = try(check.value.port_specification, null)
+      proxy_header       = try(check.value.proxy_header, null)
+      request_path       = try(check.value.request_path, null)
+      response           = try(check.value.response, null)
+    }
+  }
+
+  dynamic https_health_check {
+    for_each = (
+      try(var.health_check_config.type, null) == "https"
+      ? [var.health_check_config.check]
+      : []
+    )
+    iterator = check
+    content {
+      host               = try(check.value.host, null)
+      port               = try(check.value.port, null)
+      port_name          = try(check.value.port_name, null)
+      port_specification = try(check.value.port_specification, null)
+      proxy_header       = try(check.value.proxy_header, null)
+      request_path       = try(check.value.request_path, null)
+      response           = try(check.value.response, null)
+    }
+  }
+
+  dynamic tcp_health_check {
+    for_each = (
+      try(var.health_check_config.type, null) == "tcp"
+      ? [var.health_check_config.check]
+      : []
+    )
+    iterator = check
+    content {
+      port               = try(check.value.port, null)
+      port_name          = try(check.value.port_name, null)
+      port_specification = try(check.value.port_specification, null)
+      proxy_header       = try(check.value.proxy_header, null)
+      request            = try(check.value.request, null)
+      response           = try(check.value.response, null)
+    }
+  }
+
+  dynamic ssl_health_check {
+    for_each = (
+      try(var.health_check_config.type, null) == "ssl"
+      ? [var.health_check_config.check]
+      : []
+    )
+    iterator = check
+    content {
+      port               = try(check.value.port, null)
+      port_name          = try(check.value.port_name, null)
+      port_specification = try(check.value.port_specification, null)
+      proxy_header       = try(check.value.proxy_header, null)
+      request            = try(check.value.request, null)
+      response           = try(check.value.response, null)
+    }
+  }
+
+  dynamic http2_health_check {
+    for_each = (
+      try(var.health_check_config.type, null) == "http2"
+      ? [var.health_check_config.check]
+      : []
+    )
+    iterator = check
+    content {
+      host               = try(check.value.host, null)
+      port               = try(check.value.port, null)
+      port_name          = try(check.value.port_name, null)
+      port_specification = try(check.value.port_specification, null)
+      proxy_header       = try(check.value.proxy_header, null)
+      request_path       = try(check.value.request_path, null)
+      response           = try(check.value.response, null)
+    }
+  }
+
+  dynamic log_config {
+    for_each = try(var.health_check_config.logging, false) ? [""] : []
+    content {
+      enable = true
+    }
+  }
+
+}
--- a/modules/net-ilb/outputs.tf
+++ b/modules/net-ilb/outputs.tf
@@ -0,0 +1,65 @@
+/**
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "backend" {
+  description = "Backend resource."
+  value       = google_compute_region_backend_service.default
+}
+
+output "backend_id" {
+  description = "Backend id."
+  value       = google_compute_region_backend_service.default.id
+}
+
+output "backend_self_link" {
+  description = "Backend self link."
+  value       = google_compute_region_backend_service.default.self_link
+}
+
+output "forwarding_rule" {
+  description = "Forwarding rule resource."
+  value       = google_compute_forwarding_rule.default
+}
+
+output "forwarding_rule_address" {
+  description = "Forwarding rule address."
+  value       = google_compute_forwarding_rule.default.ip_address
+}
+
+output "forwarding_rule_id" {
+  description = "Forwarding rule id."
+  value       = google_compute_forwarding_rule.default.id
+}
+
+output "forwarding_rule_self_link" {
+  description = "Forwarding rule self link."
+  value       = google_compute_forwarding_rule.default.self_link
+}
+
+output "health_check" {
+  description = "Auto-created health-check resource."
+  value       = try(google_compute_health_check.default.0, {})
+}
+
+output "health_check_self_id" {
+  description = "Auto-created health-check self id."
+  value       = try(google_compute_health_check.default.0.id, null)
+}
+
+output "health_check_self_link" {
+  description = "Auto-created health-check self link."
+  value       = try(google_compute_health_check.default.0.self_link, null)
+}
--- a/modules/net-ilb/variables.tf
+++ b/modules/net-ilb/variables.tf
@@ -0,0 +1,129 @@
+/**
+ * Copyright 2020 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "address" {
+  description = "Optional IP address used for the forwarding rule."
+  type        = string
+  default     = null
+}
+
+variable "backends" {
+  description = "Load balancer backends, balancing mode is one of 'CONNECTION' or 'UTILIZATION'."
+  type = list(object({
+    failover       = bool
+    group          = string
+    balancing_mode = string
+  }))
+}
+
+variable "backend_config" {
+  description = "Optional backend configuration."
+  type = object({
+    session_affinity                = string
+    timeout_sec                     = number
+    connection_draining_timeout_sec = number
+  })
+  default = null
+}
+
+variable "failover_config" {
+  description = "Optional failover configuration."
+  type = object({
+    disable_connection_drain  = bool
+    drop_traffic_if_unhealthy = bool
+    ratio                     = number
+  })
+  default = null
+}
+
+variable "global_access" {
+  description = "Global access, defaults to false if not set."
+  type        = bool
+  default     = null
+}
+
+variable "health_check" {
+  description = "Name of existing health check to use, disables auto-created health check."
+  type        = string
+  default     = null
+}
+
+variable "health_check_config" {
+  description = "Configuration of the auto-created helth check."
+  type = object({
+    type    = string      # http https tcp ssl http2
+    check   = map(any)    # actual health check block attributes
+    config  = map(number) # interval, thresholds, timeout
+    logging = bool
+  })
+  default = {
+    type = "http"
+    check = {
+      port_specification = "USE_SERVING_PORT"
+    }
+    config  = {}
+    logging = false
+  }
+}
+
+variable "labels" {
+  description = "Labels set on resources."
+  type        = map(string)
+  default     = {}
+}
+
+variable "name" {
+  description = "Name used for all resources."
+  type        = string
+}
+
+variable "network" {
+  description = "Network used for resources."
+  type        = string
+}
+
+variable "project_id" {
+  description = "Project id where resources will be created."
+  type        = string
+}
+
+variable "ports" {
+  description = "Comma-separated ports, leave null to use all ports."
+  type        = list(string)
+  default     = null
+}
+
+variable "protocol" {
+  description = "IP protocol used, defaults to TCP."
+  type        = string
+  default     = "TCP"
+}
+
+variable "region" {
+  description = "GCP region."
+  type        = string
+}
+
+variable "service_label" {
+  description = "Optional prefix of the fully qualified forwarding rule name."
+  type        = string
+  default     = null
+}
+
+variable "subnetwork" {
+  description = "Subnetwork used for the forwarding rule."
+  type        = string
+}