diff --git a/modules/net-lb-app-int-cross-region/README.md b/modules/net-lb-app-int-cross-region/README.md
index a1e4a8766..cf6438980 100644
--- a/modules/net-lb-app-int-cross-region/README.md
+++ b/modules/net-lb-app-int-cross-region/README.md
@@ -18,6 +18,7 @@ Due to the complexity of the underlying resources, changes to the configuration
- [Serverless NEG creation](#serverless-neg-creation)
- [Private Service Connect NEG creation](#private-service-connect-neg-creation)
- [URL Map](#url-map)
+ - [PSC service attachment](#psc-service-attachment)
- [Complex example](#complex-example)
- [Deploying changes to load balancer configurations](#deploying-changes-to-load-balancer-configurations)
- [Recipes](#recipes)
@@ -424,7 +425,9 @@ module "ilb-l7" {
backend_service_configs = {
default = {
backends = [{
- group = "neg"
+ group = "neg-ew1"
+ }, {
+ group = "neg-ew4"
}]
health_checks = []
}
@@ -556,6 +559,71 @@ module "ilb-l7" {
# tftest modules=1 resources=7
```
+### PSC service attachment
+The optional `service_attachment` variable allows [publishing Private Service Connect service](https://cloud.google.com/vpc/docs/configure-private-service-connect-producer) by configuring service attachment for all forwarding rules in every configured region.
+
+```hcl
+module "ilb-l7" {
+ source = "./fabric/modules/net-lb-app-int-cross-region"
+ name = "ilb-test"
+ project_id = var.project_id
+ backend_service_configs = {
+ default = {
+ backends = [{
+ group = "neg-ew1"
+ }, {
+ group = "neg-ew4"
+ }]
+ health_checks = []
+ }
+ }
+ health_check_configs = {}
+ neg_configs = {
+ neg-ew1 = {
+ cloudrun = {
+ region = "europe-west1"
+ target_service = {
+ name = "my-run-service-ew1"
+ }
+ }
+ }
+ neg-ew4 = {
+ cloudrun = {
+ region = "europe-west4"
+ target_service = {
+ name = "my-run-service-ew4"
+ }
+ }
+ }
+ }
+ vpc_config = {
+ network = var.vpc.self_link
+ subnetworks = {
+ europe-west1 = var.subnet1.self_link
+ europe-west4 = var.subnet2.self_link
+ }
+ }
+
+ service_attachment = {
+ nat_subnets = {
+ europe-west1 = [var.subnet_psc_ew1.self_link]
+ europe-west4 = [var.subnet_psc_ew4.self_link]
+ }
+ reconcile_connections = false
+ consumer_accept_lists = {
+ # map of `project_id` => `connection_limit`
+ (var.project_id) = 10
+ }
+ domain_name = {
+ europe-west1 = var.psc_domain_name_ew1
+ europe-west4 = var.psc_domain_name_ew4
+ }
+ }
+}
+# tftest modules=1 resources=9
+```
+
+
### Complex example
This example mixes group and NEG backends, and shows how to set HTTPS for specific backends.
@@ -738,7 +806,7 @@ When deploying changes to load balancer configuration please refer to [net-lb-ap
| [backend-service.tf](./backend-service.tf) | Backend service resources. | google_compute_backend_service |
| [groups.tf](./groups.tf) | None | google_compute_instance_group |
| [health-check.tf](./health-check.tf) | Health check resource. | google_compute_health_check |
-| [main.tf](./main.tf) | Module-level locals and resources. | google_compute_global_forwarding_rule · google_compute_network_endpoint · google_compute_network_endpoint_group · google_compute_region_network_endpoint_group · google_compute_target_http_proxy · google_compute_target_https_proxy |
+| [main.tf](./main.tf) | Module-level locals and resources. | google_compute_global_forwarding_rule · google_compute_network_endpoint · google_compute_network_endpoint_group · google_compute_region_network_endpoint_group · google_compute_service_attachment · google_compute_target_http_proxy · google_compute_target_https_proxy |
| [outputs.tf](./outputs.tf) | Module outputs. | |
| [urlmap.tf](./urlmap.tf) | URL map resources. | google_compute_url_map |
| [variables-backend-service.tf](./variables-backend-service.tf) | Backend services variables. | |
@@ -753,7 +821,7 @@ When deploying changes to load balancer configuration please refer to [net-lb-ap
|---|---|:---:|:---:|:---:|
| [name](variables.tf#L72) | Load balancer name. | string | ✓ | |
| [project_id](variables.tf#L153) | Project id. | string | ✓ | |
-| [vpc_config](variables.tf#L180) | VPC-level configuration. | object({…}) | ✓ | |
+| [vpc_config](variables.tf#L195) | VPC-level configuration. | object({…}) | ✓ | |
| [addresses](variables.tf#L17) | Optional IP address used for the forwarding rule. | map(string) | | null |
| [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} |
| [description](variables.tf#L23) | Optional description used for resources. | string | | "Terraform managed." |
@@ -765,7 +833,8 @@ When deploying changes to load balancer configuration please refer to [net-lb-ap
| [neg_configs](variables.tf#L77) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} |
| [ports](variables.tf#L143) | Optional ports for HTTP load balancer. | list(string) | | null |
| [protocol](variables.tf#L158) | Protocol supported by this load balancer. | string | | "HTTP" |
-| [service_directory_registration](variables.tf#L171) | Service directory namespace and service used to register this load balancer. | object({…}) | | null |
+| [service_attachment](variables.tf#L171) | PSC service attachments. | object({…}) | | null |
+| [service_directory_registration](variables.tf#L186) | Service directory namespace and service used to register this load balancer. | object({…}) | | null |
| [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} |
## Outputs
diff --git a/modules/net-lb-app-int-cross-region/main.tf b/modules/net-lb-app-int-cross-region/main.tf
index 28d00b9a4..0d2eec43f 100644
--- a/modules/net-lb-app-int-cross-region/main.tf
+++ b/modules/net-lb-app-int-cross-region/main.tf
@@ -99,6 +99,37 @@ resource "google_compute_target_https_proxy" "default" {
url_map = google_compute_url_map.default.id
}
+resource "google_compute_service_attachment" "default" {
+ for_each = var.service_attachment == null ? {} : google_compute_global_forwarding_rule.forwarding_rules
+ project = var.project_id
+ region = each.key
+ name = each.value.name
+ description = var.service_attachment.description
+ target_service = each.value.id
+ nat_subnets = var.service_attachment.nat_subnets[each.key]
+ connection_preference = (
+ var.service_attachment.automatic_connection
+ ? "ACCEPT_AUTOMATIC"
+ : "ACCEPT_MANUAL"
+ )
+ consumer_reject_lists = var.service_attachment.consumer_reject_lists
+ domain_names = (
+ var.service_attachment.domain_name == null
+ ? null
+ : [var.service_attachment.domain_name[each.key]]
+ )
+ enable_proxy_protocol = var.service_attachment.enable_proxy_protocol
+ reconcile_connections = var.service_attachment.reconcile_connections
+ dynamic "consumer_accept_lists" {
+ for_each = var.service_attachment.consumer_accept_lists
+ iterator = accept
+ content {
+ project_id_or_num = accept.key
+ connection_limit = accept.value
+ }
+ }
+}
+
resource "google_compute_network_endpoint_group" "default" {
for_each = local.neg_zonal
project = (
diff --git a/modules/net-lb-app-int-cross-region/variables.tf b/modules/net-lb-app-int-cross-region/variables.tf
index ac9471858..02eadbd9d 100644
--- a/modules/net-lb-app-int-cross-region/variables.tf
+++ b/modules/net-lb-app-int-cross-region/variables.tf
@@ -168,6 +168,21 @@ variable "protocol" {
}
}
+variable "service_attachment" {
+ description = "PSC service attachments."
+ type = object({
+ automatic_connection = optional(bool, false)
+ consumer_accept_lists = optional(map(string), {})
+ consumer_reject_lists = optional(list(string))
+ description = optional(string)
+ domain_name = optional(map(string))
+ enable_proxy_protocol = optional(bool, false)
+ nat_subnets = map(list(string))
+ reconcile_connections = optional(bool)
+ })
+ default = null
+}
+
variable "service_directory_registration" {
description = "Service directory namespace and service used to register this load balancer."
type = object({