From c81bc84e3a7e5ad17127c87af59ac0bce8b50635 Mon Sep 17 00:00:00 2001 From: apichick Date: Tue, 9 Jul 2024 07:36:06 +0200 Subject: [PATCH] Added certificate_manager_certificates to app load balancers (#2415) * Added forward_proxy_uri to apigee environments in apigee-x-foundations blueprint * Added certificate_manager_certificates to app load balancers --- modules/net-lb-app-ext-regional/README.md | 20 +++++++-------- modules/net-lb-app-ext-regional/main.tf | 19 +++++++------- modules/net-lb-app-ext-regional/variables.tf | 7 +++--- modules/net-lb-app-ext/README.md | 18 +++++++------- modules/net-lb-app-ext/main.tf | 21 ++++++++-------- modules/net-lb-app-ext/variables.tf | 9 ++++--- modules/net-lb-app-int/README.md | 26 ++++++++++---------- modules/net-lb-app-int/main.tf | 17 +++++++------ modules/net-lb-app-int/variables.tf | 3 ++- 9 files changed, 72 insertions(+), 68 deletions(-) diff --git a/modules/net-lb-app-ext-regional/README.md b/modules/net-lb-app-ext-regional/README.md index c50055e70..e198feab1 100644 --- a/modules/net-lb-app-ext-regional/README.md +++ b/modules/net-lb-app-ext-regional/README.md @@ -719,21 +719,21 @@ For deploying changes to load balancer configuration please refer to [net-lb-app | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [name](variables.tf#L58) | Load balancer name. | string | ✓ | | -| [project_id](variables.tf#L150) | Project id. | string | ✓ | | -| [region](variables.tf#L168) | Region where the load balancer is created. | string | ✓ | | -| [vpc](variables.tf#L187) | VPC-level configuration. | string | ✓ | | +| [name](variables.tf#L59) | Load balancer name. | string | ✓ | | +| [project_id](variables.tf#L151) | Project id. | string | ✓ | | +| [region](variables.tf#L169) | Region where the load balancer is created. | string | ✓ | | +| [vpc](variables.tf#L188) | VPC-level configuration. | string | ✓ | | | [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null | | [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} | | [description](variables.tf#L23) | Optional description used for resources. | string | | "Terraform managed." | | [group_configs](variables.tf#L29) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | | [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) | | {…} | -| [https_proxy_config](variables.tf#L41) | HTTPS proxy connfiguration. | object({…}) | | {} | -| [labels](variables.tf#L52) | Labels set on resources. | map(string) | | {} | -| [neg_configs](variables.tf#L63) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | -| [ports](variables.tf#L144) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | -| [protocol](variables.tf#L155) | Protocol supported by this load balancer. | string | | "HTTP" | -| [ssl_certificates](variables.tf#L173) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | +| [https_proxy_config](variables.tf#L41) | HTTPS proxy connfiguration. | object({…}) | | {} | +| [labels](variables.tf#L53) | Labels set on resources. | map(string) | | {} | +| [neg_configs](variables.tf#L64) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [ports](variables.tf#L145) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | +| [protocol](variables.tf#L156) | Protocol supported by this load balancer. | string | | "HTTP" | +| [ssl_certificates](variables.tf#L174) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | | [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | ## Outputs diff --git a/modules/net-lb-app-ext-regional/main.tf b/modules/net-lb-app-ext-regional/main.tf index 2ed202b38..edd486c17 100644 --- a/modules/net-lb-app-ext-regional/main.tf +++ b/modules/net-lb-app-ext-regional/main.tf @@ -74,14 +74,13 @@ resource "google_compute_region_target_http_proxy" "default" { } resource "google_compute_region_target_https_proxy" "default" { - count = var.protocol == "HTTPS" ? 1 : 0 - project = var.project_id - name = var.name - region = var.region - description = var.description - # certificate_map = var.https_proxy_config.certificate_map - # quic_override = var.https_proxy_config.quic_override - ssl_certificates = local.proxy_ssl_certificates - ssl_policy = var.https_proxy_config.ssl_policy - url_map = google_compute_region_url_map.default.id + count = var.protocol == "HTTPS" ? 1 : 0 + project = var.project_id + name = var.name + region = var.region + description = var.description + certificate_manager_certificates = var.https_proxy_config.certificate_manager_certificates + ssl_certificates = local.proxy_ssl_certificates + ssl_policy = var.https_proxy_config.ssl_policy + url_map = google_compute_region_url_map.default.id } diff --git a/modules/net-lb-app-ext-regional/variables.tf b/modules/net-lb-app-ext-regional/variables.tf index 85a003403..fc9527468 100644 --- a/modules/net-lb-app-ext-regional/variables.tf +++ b/modules/net-lb-app-ext-regional/variables.tf @@ -41,9 +41,10 @@ variable "group_configs" { variable "https_proxy_config" { description = "HTTPS proxy connfiguration." type = object({ - certificate_map = optional(string) - quic_override = optional(string) - ssl_policy = optional(string) + certificate_manager_certificates = optional(list(string)) + certificate_map = optional(string) + quic_override = optional(string) + ssl_policy = optional(string) }) default = {} nullable = false diff --git a/modules/net-lb-app-ext/README.md b/modules/net-lb-app-ext/README.md index cb22c2629..eb81460cf 100644 --- a/modules/net-lb-app-ext/README.md +++ b/modules/net-lb-app-ext/README.md @@ -1017,22 +1017,22 @@ After provisioning this change, and verifying that the new certificate is provis | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [name](variables.tf#L92) | Load balancer name. | string | ✓ | | -| [project_id](variables.tf#L194) | Project id. | string | ✓ | | +| [name](variables.tf#L93) | Load balancer name. | string | ✓ | | +| [project_id](variables.tf#L195) | Project id. | string | ✓ | | | [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null | | [backend_buckets_config](variables.tf#L23) | Backend buckets configuration. | map(object({…})) | | {} | | [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} | | [description](variables.tf#L56) | Optional description used for resources. | string | | "Terraform managed." | | [group_configs](variables.tf#L62) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | | [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) | | {…} | -| [https_proxy_config](variables.tf#L74) | HTTPS proxy connfiguration. | object({…}) | | {} | -| [labels](variables.tf#L86) | Labels set on resources. | map(string) | | {} | -| [neg_configs](variables.tf#L97) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | -| [ports](variables.tf#L188) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | -| [protocol](variables.tf#L199) | Protocol supported by this load balancer. | string | | "HTTP" | -| [ssl_certificates](variables.tf#L212) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | +| [https_proxy_config](variables.tf#L74) | HTTPS proxy connfiguration. | object({…}) | | {} | +| [labels](variables.tf#L87) | Labels set on resources. | map(string) | | {} | +| [neg_configs](variables.tf#L98) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [ports](variables.tf#L189) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | +| [protocol](variables.tf#L200) | Protocol supported by this load balancer. | string | | "HTTP" | +| [ssl_certificates](variables.tf#L213) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | | [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | -| [use_classic_version](variables.tf#L229) | Use classic Global Load Balancer. | bool | | true | +| [use_classic_version](variables.tf#L230) | Use classic Global Load Balancer. | bool | | true | ## Outputs diff --git a/modules/net-lb-app-ext/main.tf b/modules/net-lb-app-ext/main.tf index f27e786da..f2680d988 100644 --- a/modules/net-lb-app-ext/main.tf +++ b/modules/net-lb-app-ext/main.tf @@ -76,14 +76,15 @@ resource "google_compute_target_http_proxy" "default" { } resource "google_compute_target_https_proxy" "default" { - count = var.protocol == "HTTPS" ? 1 : 0 - project = var.project_id - name = var.name - description = var.description - certificate_map = var.https_proxy_config.certificate_map - quic_override = var.https_proxy_config.quic_override - ssl_certificates = local.proxy_ssl_certificates - ssl_policy = var.https_proxy_config.ssl_policy - url_map = google_compute_url_map.default.id - server_tls_policy = var.https_proxy_config.mtls_policy + count = var.protocol == "HTTPS" ? 1 : 0 + project = var.project_id + name = var.name + description = var.description + certificate_map = var.https_proxy_config.certificate_map + certificate_manager_certificates = var.https_proxy_config.certificate_manager_certificates + quic_override = var.https_proxy_config.quic_override + ssl_certificates = local.proxy_ssl_certificates + ssl_policy = var.https_proxy_config.ssl_policy + url_map = google_compute_url_map.default.id + server_tls_policy = var.https_proxy_config.mtls_policy } diff --git a/modules/net-lb-app-ext/variables.tf b/modules/net-lb-app-ext/variables.tf index 2b327c8cf..a7528881d 100644 --- a/modules/net-lb-app-ext/variables.tf +++ b/modules/net-lb-app-ext/variables.tf @@ -74,10 +74,11 @@ variable "group_configs" { variable "https_proxy_config" { description = "HTTPS proxy connfiguration." type = object({ - certificate_map = optional(string) - quic_override = optional(string) - ssl_policy = optional(string) - mtls_policy = optional(string) # id of the mTLS policy to use for the target proxy. + certificate_manager_certificates = optional(list(string)) + certificate_map = optional(string) + quic_override = optional(string) + ssl_policy = optional(string) + mtls_policy = optional(string) # id of the mTLS policy to use for the target proxy. }) default = {} nullable = false diff --git a/modules/net-lb-app-int/README.md b/modules/net-lb-app-int/README.md index 0d03472ed..46172cdd2 100644 --- a/modules/net-lb-app-int/README.md +++ b/modules/net-lb-app-int/README.md @@ -738,25 +738,25 @@ For deploying changes to load balancer configuration please refer to [net-lb-app | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [name](variables.tf#L63) | Load balancer name. | string | ✓ | | -| [project_id](variables.tf#L159) | Project id. | string | ✓ | | -| [region](variables.tf#L177) | The region where to allocate the ILB resources. | string | ✓ | | -| [vpc_config](variables.tf#L219) | VPC-level configuration. | object({…}) | ✓ | | +| [name](variables.tf#L64) | Load balancer name. | string | ✓ | | +| [project_id](variables.tf#L160) | Project id. | string | ✓ | | +| [region](variables.tf#L178) | The region where to allocate the ILB resources. | string | ✓ | | +| [vpc_config](variables.tf#L220) | VPC-level configuration. | object({…}) | ✓ | | | [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null | | [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} | | [description](variables.tf#L23) | Optional description used for resources. | string | | "Terraform managed." | | [global_access](variables.tf#L30) | Allow client access from all regions. | bool | | null | | [group_configs](variables.tf#L36) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | | [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) | | {…} | -| [https_proxy_config](variables.tf#L48) | HTTPS proxy configuration. | object({…}) | | {} | -| [labels](variables.tf#L57) | Labels set on resources. | map(string) | | {} | -| [neg_configs](variables.tf#L68) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | -| [network_tier_premium](variables.tf#L146) | Use premium network tier. Defaults to true. | bool | | true | -| [ports](variables.tf#L153) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | -| [protocol](variables.tf#L164) | Protocol supported by this load balancer. | string | | "HTTP" | -| [service_attachment](variables.tf#L182) | PSC service attachment. | object({…}) | | null | -| [service_directory_registration](variables.tf#L197) | Service directory namespace and service used to register this load balancer. | object({…}) | | null | -| [ssl_certificates](variables.tf#L206) | SSL target proxy certificates (only if protocol is HTTPS). | object({…}) | | {} | +| [https_proxy_config](variables.tf#L48) | HTTPS proxy configuration. | object({…}) | | {} | +| [labels](variables.tf#L58) | Labels set on resources. | map(string) | | {} | +| [neg_configs](variables.tf#L69) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [network_tier_premium](variables.tf#L147) | Use premium network tier. Defaults to true. | bool | | true | +| [ports](variables.tf#L154) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | +| [protocol](variables.tf#L165) | Protocol supported by this load balancer. | string | | "HTTP" | +| [service_attachment](variables.tf#L183) | PSC service attachment. | object({…}) | | null | +| [service_directory_registration](variables.tf#L198) | Service directory namespace and service used to register this load balancer. | object({…}) | | null | +| [ssl_certificates](variables.tf#L207) | SSL target proxy certificates (only if protocol is HTTPS). | object({…}) | | {} | | [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | ## Outputs diff --git a/modules/net-lb-app-int/main.tf b/modules/net-lb-app-int/main.tf index 33ea830ea..d056e8be7 100644 --- a/modules/net-lb-app-int/main.tf +++ b/modules/net-lb-app-int/main.tf @@ -108,14 +108,15 @@ resource "google_compute_region_target_http_proxy" "default" { } resource "google_compute_region_target_https_proxy" "default" { - count = var.protocol == "HTTPS" ? 1 : 0 - project = var.project_id - region = var.region - name = var.name - description = var.description - ssl_certificates = local.proxy_ssl_certificates - ssl_policy = var.https_proxy_config.ssl_policy - url_map = google_compute_region_url_map.default.id + count = var.protocol == "HTTPS" ? 1 : 0 + project = var.project_id + region = var.region + name = var.name + description = var.description + ssl_certificates = local.proxy_ssl_certificates + ssl_policy = var.https_proxy_config.ssl_policy + url_map = google_compute_region_url_map.default.id + certificate_manager_certificates = var.https_proxy_config.certificate_manager_certificates } resource "google_compute_service_attachment" "default" { diff --git a/modules/net-lb-app-int/variables.tf b/modules/net-lb-app-int/variables.tf index a28e658c5..d3311fbe3 100644 --- a/modules/net-lb-app-int/variables.tf +++ b/modules/net-lb-app-int/variables.tf @@ -48,7 +48,8 @@ variable "group_configs" { variable "https_proxy_config" { description = "HTTPS proxy configuration." type = object({ - ssl_policy = optional(string) + certificate_manager_certificates = optional(list(string)) + ssl_policy = optional(string) }) default = {} nullable = false