add support for binary authorization policy to cloud function v2 module (#3116)
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
b9ea8a6c26
commit
d4a9cafda4
@@ -311,9 +311,9 @@ module "cf-http" {
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [bucket_name](variables.tf#L27) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | <code>string</code> | ✓ | |
|
||||
| [bundle_config](variables.tf#L51) | Cloud function source. Path can point to a GCS object URI, or a local path. A local path to a zip archive will generate a GCS object using its basename, a folder will be zipped and the GCS object name inferred when not specified. | <code title="object({ path = string folder_options = optional(object({ archive_path = optional(string) excludes = optional(list(string)) }), {}) })">object({…})</code> | ✓ | |
|
||||
| [name](variables.tf#L148) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L163) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L168) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L149) | Name used for cloud function and associated resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L164) | Project id used for all resources. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L169) | Region used for all resources. | <code>string</code> | ✓ | |
|
||||
| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | <code title="object({ force_destroy = optional(bool) lifecycle_delete_age_days = optional(number) location = optional(string) })">object({…})</code> | | <code>null</code> |
|
||||
| [build_environment_variables](variables.tf#L33) | A set of key/value environment variable pairs available during build time. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [build_service_account](variables.tf#L39) | Build service account email. | <code>string</code> | | <code>null</code> |
|
||||
@@ -321,18 +321,18 @@ module "cf-http" {
|
||||
| [description](variables.tf#L84) | Optional description. | <code>string</code> | | <code>"Terraform managed."</code> |
|
||||
| [docker_repository_id](variables.tf#L90) | User managed repository created in Artifact Registry. | <code>string</code> | | <code>null</code> |
|
||||
| [environment_variables](variables.tf#L96) | Cloud function environment variables. | <code>map(string)</code> | | <code title="{ LOG_EXECUTION_ID = "true" }">{…}</code> |
|
||||
| [function_config](variables.tf#L104) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code title="object({ entry_point = optional(string, "main") instance_count = optional(number, 1) memory_mb = optional(number, 256) # Memory in MB cpu = optional(string, "0.166") runtime = optional(string, "python310") timeout_seconds = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instance_count = 1 memory_mb = 256 cpu = "0.166" runtime = "python310" timeout_seconds = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L124) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L130) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [kms_key](variables.tf#L136) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L142) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L153) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L173) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = string secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L185) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L191) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L197) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event_type = string pubsub_topic = optional(string) region = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = optional(string) })), []) service_account_email = optional(string) service_account_create = optional(bool, false) retry_policy = optional(string, "RETRY_POLICY_DO_NOT_RETRY") # default to avoid permadiff })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L215) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = optional(bool, false) name = optional(string) egress_settings = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [vpc_connector_config](variables.tf#L226) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string instances = optional(object({ max = optional(number) min = optional(number, 2) })) throughput = optional(object({ max = optional(number, 300) min = optional(number, 200) })) })">object({…})</code> | | <code>null</code> |
|
||||
| [function_config](variables.tf#L104) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | <code title="object({ binary_authorization_policy = optional(string) entry_point = optional(string, "main") instance_count = optional(number, 1) memory_mb = optional(number, 256) # Memory in MB cpu = optional(string, "0.166") runtime = optional(string, "python310") timeout_seconds = optional(number, 180) })">object({…})</code> | | <code title="{ entry_point = "main" instance_count = 1 memory_mb = 256 cpu = "0.166" runtime = "python310" timeout_seconds = 180 }">{…}</code> |
|
||||
| [iam](variables.tf#L125) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [ingress_settings](variables.tf#L131) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | <code>string</code> | | <code>null</code> |
|
||||
| [kms_key](variables.tf#L137) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | <code>string</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L143) | Resource labels. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [prefix](variables.tf#L154) | Optional prefix used for resource names. | <code>string</code> | | <code>null</code> |
|
||||
| [secrets](variables.tf#L174) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | <code title="map(object({ is_volume = bool project_id = string secret = string versions = list(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [service_account](variables.tf#L186) | Service account email. Unused if service account is auto-created. | <code>string</code> | | <code>null</code> |
|
||||
| [service_account_create](variables.tf#L192) | Auto-create service account. | <code>bool</code> | | <code>false</code> |
|
||||
| [trigger_config](variables.tf#L198) | Function trigger configuration. Leave null for HTTP trigger. | <code title="object({ event_type = string pubsub_topic = optional(string) region = optional(string) event_filters = optional(list(object({ attribute = string value = string operator = optional(string) })), []) service_account_email = optional(string) service_account_create = optional(bool, false) retry_policy = optional(string, "RETRY_POLICY_DO_NOT_RETRY") # default to avoid permadiff })">object({…})</code> | | <code>null</code> |
|
||||
| [vpc_connector](variables.tf#L216) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | <code title="object({ create = optional(bool, false) name = optional(string) egress_settings = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [vpc_connector_config](variables.tf#L227) | VPC connector network configuration. Must be provided if new VPC connector is being created. | <code title="object({ ip_cidr_range = string network = string instances = optional(object({ max = optional(number) min = optional(number, 2) })) throughput = optional(object({ max = optional(number, 300) min = optional(number, 200) })) })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -111,15 +111,16 @@ resource "google_cloudfunctions2_function" "function" {
|
||||
}
|
||||
}
|
||||
service_config {
|
||||
max_instance_count = var.function_config.instance_count
|
||||
min_instance_count = 0
|
||||
available_memory = "${var.function_config.memory_mb}M"
|
||||
all_traffic_on_latest_revision = true
|
||||
available_cpu = var.function_config.cpu
|
||||
timeout_seconds = var.function_config.timeout_seconds
|
||||
available_memory = "${var.function_config.memory_mb}M"
|
||||
binary_authorization_policy = var.function_config.binary_authorization_policy
|
||||
environment_variables = var.environment_variables
|
||||
ingress_settings = var.ingress_settings
|
||||
all_traffic_on_latest_revision = true
|
||||
max_instance_count = var.function_config.instance_count
|
||||
min_instance_count = 0
|
||||
service_account_email = local.service_account_email
|
||||
timeout_seconds = var.function_config.timeout_seconds
|
||||
vpc_connector = local.vpc_connector
|
||||
vpc_connector_egress_settings = var.vpc_connector.egress_settings
|
||||
|
||||
|
||||
@@ -104,12 +104,13 @@ variable "environment_variables" {
|
||||
variable "function_config" {
|
||||
description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout."
|
||||
type = object({
|
||||
entry_point = optional(string, "main")
|
||||
instance_count = optional(number, 1)
|
||||
memory_mb = optional(number, 256) # Memory in MB
|
||||
cpu = optional(string, "0.166")
|
||||
runtime = optional(string, "python310")
|
||||
timeout_seconds = optional(number, 180)
|
||||
binary_authorization_policy = optional(string)
|
||||
entry_point = optional(string, "main")
|
||||
instance_count = optional(number, 1)
|
||||
memory_mb = optional(number, 256) # Memory in MB
|
||||
cpu = optional(string, "0.166")
|
||||
runtime = optional(string, "python310")
|
||||
timeout_seconds = optional(number, 180)
|
||||
})
|
||||
default = {
|
||||
entry_point = "main"
|
||||
|
||||
Reference in New Issue
Block a user