From de401addcb87ad8f65d25f934f9a981b0177713e Mon Sep 17 00:00:00 2001 From: Sepehr Javid Date: Mon, 22 Dec 2025 10:59:50 +0100 Subject: [PATCH] add service attachments for cross regional load balancer add docs and cleanup add missing toc link in readme add domain_name field in the service attachment docs update variable table with tfdoc.py --- modules/net-lb-app-int-cross-region/README.md | 77 ++++++++++++++++++- modules/net-lb-app-int-cross-region/main.tf | 31 ++++++++ .../net-lb-app-int-cross-region/variables.tf | 15 ++++ 3 files changed, 119 insertions(+), 4 deletions(-) diff --git a/modules/net-lb-app-int-cross-region/README.md b/modules/net-lb-app-int-cross-region/README.md index a1e4a8766..cf6438980 100644 --- a/modules/net-lb-app-int-cross-region/README.md +++ b/modules/net-lb-app-int-cross-region/README.md @@ -18,6 +18,7 @@ Due to the complexity of the underlying resources, changes to the configuration - [Serverless NEG creation](#serverless-neg-creation) - [Private Service Connect NEG creation](#private-service-connect-neg-creation) - [URL Map](#url-map) + - [PSC service attachment](#psc-service-attachment) - [Complex example](#complex-example) - [Deploying changes to load balancer configurations](#deploying-changes-to-load-balancer-configurations) - [Recipes](#recipes) @@ -424,7 +425,9 @@ module "ilb-l7" { backend_service_configs = { default = { backends = [{ - group = "neg" + group = "neg-ew1" + }, { + group = "neg-ew4" }] health_checks = [] } @@ -556,6 +559,71 @@ module "ilb-l7" { # tftest modules=1 resources=7 ``` +### PSC service attachment +The optional `service_attachment` variable allows [publishing Private Service Connect service](https://cloud.google.com/vpc/docs/configure-private-service-connect-producer) by configuring service attachment for all forwarding rules in every configured region. + +```hcl +module "ilb-l7" { + source = "./fabric/modules/net-lb-app-int-cross-region" + name = "ilb-test" + project_id = var.project_id + backend_service_configs = { + default = { + backends = [{ + group = "neg-ew1" + }, { + group = "neg-ew4" + }] + health_checks = [] + } + } + health_check_configs = {} + neg_configs = { + neg-ew1 = { + cloudrun = { + region = "europe-west1" + target_service = { + name = "my-run-service-ew1" + } + } + } + neg-ew4 = { + cloudrun = { + region = "europe-west4" + target_service = { + name = "my-run-service-ew4" + } + } + } + } + vpc_config = { + network = var.vpc.self_link + subnetworks = { + europe-west1 = var.subnet1.self_link + europe-west4 = var.subnet2.self_link + } + } + + service_attachment = { + nat_subnets = { + europe-west1 = [var.subnet_psc_ew1.self_link] + europe-west4 = [var.subnet_psc_ew4.self_link] + } + reconcile_connections = false + consumer_accept_lists = { + # map of `project_id` => `connection_limit` + (var.project_id) = 10 + } + domain_name = { + europe-west1 = var.psc_domain_name_ew1 + europe-west4 = var.psc_domain_name_ew4 + } + } +} +# tftest modules=1 resources=9 +``` + + ### Complex example This example mixes group and NEG backends, and shows how to set HTTPS for specific backends. @@ -738,7 +806,7 @@ When deploying changes to load balancer configuration please refer to [net-lb-ap | [backend-service.tf](./backend-service.tf) | Backend service resources. | google_compute_backend_service | | [groups.tf](./groups.tf) | None | google_compute_instance_group | | [health-check.tf](./health-check.tf) | Health check resource. | google_compute_health_check | -| [main.tf](./main.tf) | Module-level locals and resources. | google_compute_global_forwarding_rule · google_compute_network_endpoint · google_compute_network_endpoint_group · google_compute_region_network_endpoint_group · google_compute_target_http_proxy · google_compute_target_https_proxy | +| [main.tf](./main.tf) | Module-level locals and resources. | google_compute_global_forwarding_rule · google_compute_network_endpoint · google_compute_network_endpoint_group · google_compute_region_network_endpoint_group · google_compute_service_attachment · google_compute_target_http_proxy · google_compute_target_https_proxy | | [outputs.tf](./outputs.tf) | Module outputs. | | | [urlmap.tf](./urlmap.tf) | URL map resources. | google_compute_url_map | | [variables-backend-service.tf](./variables-backend-service.tf) | Backend services variables. | | @@ -753,7 +821,7 @@ When deploying changes to load balancer configuration please refer to [net-lb-ap |---|---|:---:|:---:|:---:| | [name](variables.tf#L72) | Load balancer name. | string | ✓ | | | [project_id](variables.tf#L153) | Project id. | string | ✓ | | -| [vpc_config](variables.tf#L180) | VPC-level configuration. | object({…}) | ✓ | | +| [vpc_config](variables.tf#L195) | VPC-level configuration. | object({…}) | ✓ | | | [addresses](variables.tf#L17) | Optional IP address used for the forwarding rule. | map(string) | | null | | [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} | | [description](variables.tf#L23) | Optional description used for resources. | string | | "Terraform managed." | @@ -765,7 +833,8 @@ When deploying changes to load balancer configuration please refer to [net-lb-ap | [neg_configs](variables.tf#L77) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | | [ports](variables.tf#L143) | Optional ports for HTTP load balancer. | list(string) | | null | | [protocol](variables.tf#L158) | Protocol supported by this load balancer. | string | | "HTTP" | -| [service_directory_registration](variables.tf#L171) | Service directory namespace and service used to register this load balancer. | object({…}) | | null | +| [service_attachment](variables.tf#L171) | PSC service attachments. | object({…}) | | null | +| [service_directory_registration](variables.tf#L186) | Service directory namespace and service used to register this load balancer. | object({…}) | | null | | [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | ## Outputs diff --git a/modules/net-lb-app-int-cross-region/main.tf b/modules/net-lb-app-int-cross-region/main.tf index 28d00b9a4..0d2eec43f 100644 --- a/modules/net-lb-app-int-cross-region/main.tf +++ b/modules/net-lb-app-int-cross-region/main.tf @@ -99,6 +99,37 @@ resource "google_compute_target_https_proxy" "default" { url_map = google_compute_url_map.default.id } +resource "google_compute_service_attachment" "default" { + for_each = var.service_attachment == null ? {} : google_compute_global_forwarding_rule.forwarding_rules + project = var.project_id + region = each.key + name = each.value.name + description = var.service_attachment.description + target_service = each.value.id + nat_subnets = var.service_attachment.nat_subnets[each.key] + connection_preference = ( + var.service_attachment.automatic_connection + ? "ACCEPT_AUTOMATIC" + : "ACCEPT_MANUAL" + ) + consumer_reject_lists = var.service_attachment.consumer_reject_lists + domain_names = ( + var.service_attachment.domain_name == null + ? null + : [var.service_attachment.domain_name[each.key]] + ) + enable_proxy_protocol = var.service_attachment.enable_proxy_protocol + reconcile_connections = var.service_attachment.reconcile_connections + dynamic "consumer_accept_lists" { + for_each = var.service_attachment.consumer_accept_lists + iterator = accept + content { + project_id_or_num = accept.key + connection_limit = accept.value + } + } +} + resource "google_compute_network_endpoint_group" "default" { for_each = local.neg_zonal project = ( diff --git a/modules/net-lb-app-int-cross-region/variables.tf b/modules/net-lb-app-int-cross-region/variables.tf index ac9471858..02eadbd9d 100644 --- a/modules/net-lb-app-int-cross-region/variables.tf +++ b/modules/net-lb-app-int-cross-region/variables.tf @@ -168,6 +168,21 @@ variable "protocol" { } } +variable "service_attachment" { + description = "PSC service attachments." + type = object({ + automatic_connection = optional(bool, false) + consumer_accept_lists = optional(map(string), {}) + consumer_reject_lists = optional(list(string)) + description = optional(string) + domain_name = optional(map(string)) + enable_proxy_protocol = optional(bool, false) + nat_subnets = map(list(string)) + reconcile_connections = optional(bool) + }) + default = null +} + variable "service_directory_registration" { description = "Service directory namespace and service used to register this load balancer." type = object({