From d4a9cafda4f9bb56d8294f431b43355e75ab1658 Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Wed, 28 May 2025 17:01:42 +0200 Subject: [PATCH] add support for binary authorization policy to cloud function v2 module (#3116) --- modules/cloud-function-v2/README.md | 30 +++++++++++++------------- modules/cloud-function-v2/main.tf | 11 +++++----- modules/cloud-function-v2/variables.tf | 13 +++++------ 3 files changed, 28 insertions(+), 26 deletions(-) diff --git a/modules/cloud-function-v2/README.md b/modules/cloud-function-v2/README.md index 9a2816cf4..dd81edb2a 100644 --- a/modules/cloud-function-v2/README.md +++ b/modules/cloud-function-v2/README.md @@ -311,9 +311,9 @@ module "cf-http" { |---|---|:---:|:---:|:---:| | [bucket_name](variables.tf#L27) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | string | ✓ | | | [bundle_config](variables.tf#L51) | Cloud function source. Path can point to a GCS object URI, or a local path. A local path to a zip archive will generate a GCS object using its basename, a folder will be zipped and the GCS object name inferred when not specified. | object({…}) | ✓ | | -| [name](variables.tf#L148) | Name used for cloud function and associated resources. | string | ✓ | | -| [project_id](variables.tf#L163) | Project id used for all resources. | string | ✓ | | -| [region](variables.tf#L168) | Region used for all resources. | string | ✓ | | +| [name](variables.tf#L149) | Name used for cloud function and associated resources. | string | ✓ | | +| [project_id](variables.tf#L164) | Project id used for all resources. | string | ✓ | | +| [region](variables.tf#L169) | Region used for all resources. | string | ✓ | | | [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | | [build_environment_variables](variables.tf#L33) | A set of key/value environment variable pairs available during build time. | map(string) | | {} | | [build_service_account](variables.tf#L39) | Build service account email. | string | | null | @@ -321,18 +321,18 @@ module "cf-http" { | [description](variables.tf#L84) | Optional description. | string | | "Terraform managed." | | [docker_repository_id](variables.tf#L90) | User managed repository created in Artifact Registry. | string | | null | | [environment_variables](variables.tf#L96) | Cloud function environment variables. | map(string) | | {…} | -| [function_config](variables.tf#L104) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | object({…}) | | {…} | -| [iam](variables.tf#L124) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | -| [ingress_settings](variables.tf#L130) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | -| [kms_key](variables.tf#L136) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | string | | null | -| [labels](variables.tf#L142) | Resource labels. | map(string) | | {} | -| [prefix](variables.tf#L153) | Optional prefix used for resource names. | string | | null | -| [secrets](variables.tf#L173) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | -| [service_account](variables.tf#L185) | Service account email. Unused if service account is auto-created. | string | | null | -| [service_account_create](variables.tf#L191) | Auto-create service account. | bool | | false | -| [trigger_config](variables.tf#L197) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | -| [vpc_connector](variables.tf#L215) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | {} | -| [vpc_connector_config](variables.tf#L226) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | +| [function_config](variables.tf#L104) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | object({…}) | | {…} | +| [iam](variables.tf#L125) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | +| [ingress_settings](variables.tf#L131) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | +| [kms_key](variables.tf#L137) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | string | | null | +| [labels](variables.tf#L143) | Resource labels. | map(string) | | {} | +| [prefix](variables.tf#L154) | Optional prefix used for resource names. | string | | null | +| [secrets](variables.tf#L174) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | +| [service_account](variables.tf#L186) | Service account email. Unused if service account is auto-created. | string | | null | +| [service_account_create](variables.tf#L192) | Auto-create service account. | bool | | false | +| [trigger_config](variables.tf#L198) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | +| [vpc_connector](variables.tf#L216) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | {} | +| [vpc_connector_config](variables.tf#L227) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | ## Outputs diff --git a/modules/cloud-function-v2/main.tf b/modules/cloud-function-v2/main.tf index 68e0e6f8b..c42f81bf1 100644 --- a/modules/cloud-function-v2/main.tf +++ b/modules/cloud-function-v2/main.tf @@ -111,15 +111,16 @@ resource "google_cloudfunctions2_function" "function" { } } service_config { - max_instance_count = var.function_config.instance_count - min_instance_count = 0 - available_memory = "${var.function_config.memory_mb}M" + all_traffic_on_latest_revision = true available_cpu = var.function_config.cpu - timeout_seconds = var.function_config.timeout_seconds + available_memory = "${var.function_config.memory_mb}M" + binary_authorization_policy = var.function_config.binary_authorization_policy environment_variables = var.environment_variables ingress_settings = var.ingress_settings - all_traffic_on_latest_revision = true + max_instance_count = var.function_config.instance_count + min_instance_count = 0 service_account_email = local.service_account_email + timeout_seconds = var.function_config.timeout_seconds vpc_connector = local.vpc_connector vpc_connector_egress_settings = var.vpc_connector.egress_settings diff --git a/modules/cloud-function-v2/variables.tf b/modules/cloud-function-v2/variables.tf index 473a10deb..ebaf3c7eb 100644 --- a/modules/cloud-function-v2/variables.tf +++ b/modules/cloud-function-v2/variables.tf @@ -104,12 +104,13 @@ variable "environment_variables" { variable "function_config" { description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout." type = object({ - entry_point = optional(string, "main") - instance_count = optional(number, 1) - memory_mb = optional(number, 256) # Memory in MB - cpu = optional(string, "0.166") - runtime = optional(string, "python310") - timeout_seconds = optional(number, 180) + binary_authorization_policy = optional(string) + entry_point = optional(string, "main") + instance_count = optional(number, 1) + memory_mb = optional(number, 256) # Memory in MB + cpu = optional(string, "0.166") + runtime = optional(string, "python310") + timeout_seconds = optional(number, 180) }) default = { entry_point = "main"