From dc5a6052be1b890b0a85914a4ef57fb80943efe1 Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Fri, 27 Feb 2026 15:43:46 +0100 Subject: [PATCH] Allow specifying cloudrun target without service name in net-lb-app-int module (#3771) * Allow specifying cloudrun target without service name in net-lb-app-int neg_config * add deprecation comment --- modules/net-lb-app-int/README.md | 93 +++++++++++++++++++++++++---- modules/net-lb-app-int/main.tf | 6 +- modules/net-lb-app-int/variables.tf | 8 ++- 3 files changed, 92 insertions(+), 15 deletions(-) diff --git a/modules/net-lb-app-int/README.md b/modules/net-lb-app-int/README.md index b1a4612b5..782868715 100644 --- a/modules/net-lb-app-int/README.md +++ b/modules/net-lb-app-int/README.md @@ -412,6 +412,79 @@ module "ilb-l7" { # tftest modules=1 resources=5 ``` +For cross-project referencing, both the load balancer and the cloud run projects need to be service projects of the same Shared VPC host. Then specify the Cloud Run project for both the backend service and NEG. + +```hcl +module "ilb-l7" { + source = "./fabric/modules/net-lb-app-int" + name = "ilb-test" + project_id = var.project_id + region = "europe-west1" + backend_service_configs = { + default = { + backends = [{ + group = "my-neg" + }] + health_checks = [] + protocol = "HTTPS" + project_id = "cr-project-id" + } + } + health_check_configs = {} + neg_configs = { + my-neg = { + project_id = "cr-project-id" + cloudrun = { + region = "europe-west1" + target_service = { + name = "my-run-service" + } + } + } + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=5 +``` + +Cloud Run NEGs can also be created via a URL mask, which allows targeting accessing multiple services or revisions. In this case, a tag can be optionally specified to target a specific revision. + +```hcl +module "ilb-l7" { + source = "./fabric/modules/net-lb-app-int" + name = "ilb-test" + project_id = var.project_id + region = "europe-west1" + backend_service_configs = { + default = { + backends = [{ + group = "my-neg" + }] + health_checks = [] + protocol = "HTTPS" + } + } + health_check_configs = {} + neg_configs = { + my-neg = { + cloudrun = { + region = "europe-west1" + target_urlmask = "example.com/" + tag = "my-tag" + } + } + } + vpc_config = { + network = var.vpc.self_link + subnetwork = var.subnet.self_link + } +} +# tftest modules=1 resources=5 +``` + #### Private Service Connect NEG creation ```hcl @@ -853,9 +926,9 @@ For deploying changes to load balancer configuration please refer to [net-lb-app | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [name](variables.tf#L78) | Load balancer name. | string | ✓ | | -| [project_id](variables.tf#L178) | Project id. | string | ✓ | | -| [region](variables.tf#L196) | The region where to allocate the ILB resources. | string | ✓ | | -| [vpc_config](variables.tf#L239) | VPC-level configuration. | object({…}) | ✓ | | +| [project_id](variables.tf#L180) | Project id. | string | ✓ | | +| [region](variables.tf#L198) | The region where to allocate the ILB resources. | string | ✓ | | +| [vpc_config](variables.tf#L241) | VPC-level configuration. | object({…}) | ✓ | | | [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null | | [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} | | [description](variables.tf#L23) | Optional description used for resources. | string | | "Terraform managed." | @@ -865,13 +938,13 @@ For deploying changes to load balancer configuration please refer to [net-lb-app | [http_proxy_config](variables.tf#L50) | HTTP proxy configuration. Only used for non-classic load balancers. | object({…}) | | {} | | [https_proxy_config](variables.tf#L60) | HTTPS proxy configuration. | object({…}) | | {} | | [labels](variables.tf#L72) | Labels set on resources. | map(string) | | {} | -| [neg_configs](variables.tf#L83) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | -| [network_tier_premium](variables.tf#L161) | Use premium network tier. Defaults to true. | bool | | true | -| [ports](variables.tf#L168) | Optional ports for HTTP load balancer. | list(string) | | null | -| [protocol](variables.tf#L183) | Protocol supported by this load balancer. | string | | "HTTP" | -| [service_attachment](variables.tf#L201) | PSC service attachment. | object({…}) | | null | -| [service_directory_registration](variables.tf#L216) | Service directory namespace and service used to register this load balancer. | object({…}) | | null | -| [ssl_certificates](variables.tf#L225) | SSL target proxy certificates (only if protocol is HTTPS). | object({…}) | | {} | +| [neg_configs](variables.tf#L83) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [network_tier_premium](variables.tf#L163) | Use premium network tier. Defaults to true. | bool | | true | +| [ports](variables.tf#L170) | Optional ports for HTTP load balancer. | list(string) | | null | +| [protocol](variables.tf#L185) | Protocol supported by this load balancer. | string | | "HTTP" | +| [service_attachment](variables.tf#L203) | PSC service attachment. | object({…}) | | null | +| [service_directory_registration](variables.tf#L218) | Service directory namespace and service used to register this load balancer. | object({…}) | | null | +| [ssl_certificates](variables.tf#L227) | SSL target proxy certificates (only if protocol is HTTPS). | object({…}) | | {} | | [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | ## Outputs diff --git a/modules/net-lb-app-int/main.tf b/modules/net-lb-app-int/main.tf index ae2fbbbd1..742b59e15 100644 --- a/modules/net-lb-app-int/main.tf +++ b/modules/net-lb-app-int/main.tf @@ -199,8 +199,10 @@ resource "google_compute_region_network_endpoint_group" "default" { description = var.description network_endpoint_type = "SERVERLESS" cloud_run { - service = try(each.value.target_service.name, null) - tag = try(each.value.target_service.tag, null) + service = try(each.value.target_service.name, null) + tag = try( + coalesce(each.value.tag, try(each.value.target_service.tag, null)), null + ) url_mask = each.value.target_urlmask } } diff --git a/modules/net-lb-app-int/variables.tf b/modules/net-lb-app-int/variables.tf index 26a505855..afebd2a12 100644 --- a/modules/net-lb-app-int/variables.tf +++ b/modules/net-lb-app-int/variables.tf @@ -86,12 +86,14 @@ variable "neg_configs" { project_id = optional(string) description = optional(string) cloudrun = optional(object({ - region = string + region = string + tag = optional(string) + target_urlmask = optional(string) target_service = optional(object({ name = string - tag = optional(string) + # TODO: deprecate after one major release + tag = optional(string) })) - target_urlmask = optional(string) })) gce = optional(object({ zone = string