Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
a93a78f4e7
commit
ea4c00756b
@@ -30,7 +30,7 @@ The current list of modules supports most of the core foundational and networkin
|
||||
Currently available modules:
|
||||
|
||||
- **foundational** - [billing budget](./modules/billing-budget), [Cloud Identity group](./modules/cloud-identity-group/), [folder](./modules/folder), [service accounts](./modules/iam-service-account), [logging bucket](./modules/logging-bucket), [organization](./modules/organization), [project](./modules/project), [projects-data-source](./modules/projects-data-source)
|
||||
- **networking** - [DNS](./modules/dns), [DNS Response Policy](./modules/dns-response-policy/), [Cloud Endpoints](./modules/endpoints), [address reservation](./modules/net-address), [NAT](./modules/net-cloudnat), [Dedicated VLAN Attachment](./modules/net-dedicated-vlan-attachment/), [Global Load Balancer (classic)](./modules/net-glb/), [L4 ILB](./modules/net-ilb), [L7 ILB](./modules/net-ilb-l7), [IPSec over Interconnect](./modules/net-ipsec-over-interconnect), [VPC](./modules/net-vpc), [VPC firewall](./modules/net-vpc-firewall), [VPC firewall policy](./modules/net-vpc-firewall-policy), [VPC peering](./modules/net-vpc-peering), [VPN dynamic](./modules/net-vpn-dynamic), [HA VPN](./modules/net-vpn-ha), [VPN static](./modules/net-vpn-static), [Service Directory](./modules/service-directory)
|
||||
- **networking** - [DNS](./modules/dns), [DNS Response Policy](./modules/dns-response-policy/), [Cloud Endpoints](./modules/endpoints), [address reservation](./modules/net-address), [NAT](./modules/net-cloudnat), [Dedicated VLAN Attachment](./modules/net-dedicated-vlan-attachment/), [Global Load Balancer (classic)](./modules/net-glb/), [L4 ILB](./modules/net-ilb), [L7 ILB](./modules/net-ilb-l7), [IPSec over Interconnect](./modules/net-ipsec-over-interconnect), [Network LB](./modules/net-nlb), [VPC](./modules/net-vpc), [VPC firewall](./modules/net-vpc-firewall), [VPC firewall policy](./modules/net-vpc-firewall-policy), [VPC peering](./modules/net-vpc-peering), [VPN dynamic](./modules/net-vpn-dynamic), [HA VPN](./modules/net-vpn-ha), [VPN static](./modules/net-vpn-static), [Service Directory](./modules/service-directory)
|
||||
- **compute** - [VM/VM group](./modules/compute-vm), [MIG](./modules/compute-mig), [COS container](./modules/cloud-config-container/cos-generic-metadata/) (coredns, mysql, onprem, squid), [GKE cluster](./modules/gke-cluster-standard), [GKE hub](./modules/gke-hub), [GKE nodepool](./modules/gke-nodepool)
|
||||
- **data** - [AlloyDB instance](./modules/alloydb-instance), [BigQuery dataset](./modules/bigquery-dataset), [Bigtable instance](./modules/bigtable-instance), [Cloud Dataplex](./modules/cloud-dataplex), [Cloud SQL instance](./modules/cloudsql-instance), [Data Catalog Policy Tag](./modules/data-catalog-policy-tag), [Datafusion](./modules/datafusion), [Dataproc](./modules/dataproc), [GCS](./modules/gcs), [Pub/Sub](./modules/pubsub)
|
||||
- **development** - [API Gateway](./modules/api-gateway), [Apigee](./modules/apigee), [Artifact Registry](./modules/artifact-registry), [Container Registry](./modules/container-registry), [Cloud Source Repository](./modules/source-repository)
|
||||
|
||||
@@ -45,10 +45,11 @@ These modules are used in the examples included in this repository. If you are u
|
||||
- [Cloud Endpoints](./endpoints)
|
||||
- [DNS](./dns)
|
||||
- [DNS Response Policy](./dns-response-policy/)
|
||||
- [Global Load Balancer (classic)](./net-glb/)
|
||||
- [Global Load Balancer](./net-glb/)
|
||||
- [L4 ILB](./net-ilb)
|
||||
- [L7 ILB](./net-ilb-l7)
|
||||
- [NAT](./net-cloudnat)
|
||||
- [Network Load Balancer](./net-nlb)
|
||||
- [Service Directory](./service-directory)
|
||||
- [VPC](./net-vpc)
|
||||
- [VPC firewall](./net-vpc-firewall)
|
||||
|
||||
203
modules/net-nlb/README.md
Normal file
203
modules/net-nlb/README.md
Normal file
@@ -0,0 +1,203 @@
|
||||
# Network Load Balancer Module
|
||||
|
||||
This module allows managing a GCE Network Load Balancer and integrates the forwarding rule, regional backend, and optional health check resources. It's designed to be a simple match for the [`compute-vm`](../compute-vm) module, which can be used to manage instance templates and instance groups.
|
||||
|
||||
## Examples
|
||||
|
||||
- [Referencing existing MIGs](#referencing-existing-migs)
|
||||
- [Externally manages instances](#externally-managed-instances)
|
||||
- [End to end example](#end-to-end-example)
|
||||
|
||||
### Referencing existing MIGs
|
||||
|
||||
This example shows how to reference existing Managed Infrastructure Groups (MIGs).
|
||||
|
||||
```hcl
|
||||
module "instance_template" {
|
||||
source = "./fabric/modules/compute-vm"
|
||||
project_id = var.project_id
|
||||
create_template = true
|
||||
name = "vm-test"
|
||||
service_account_create = true
|
||||
zone = "europe-west1-b"
|
||||
|
||||
network_interfaces = [
|
||||
{
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}
|
||||
]
|
||||
|
||||
tags = [
|
||||
"http-server"
|
||||
]
|
||||
}
|
||||
|
||||
module "mig" {
|
||||
source = "./fabric/modules/compute-mig"
|
||||
project_id = var.project_id
|
||||
location = "europe-west1"
|
||||
name = "mig-test"
|
||||
target_size = 1
|
||||
instance_template = module.instance_template.template.self_link
|
||||
}
|
||||
|
||||
module "nlb" {
|
||||
source = "./fabric/modules/net-nlb"
|
||||
project_id = var.project_id
|
||||
region = "europe-west1"
|
||||
name = "nlb-test"
|
||||
vpc_config = {
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}
|
||||
backends = [{
|
||||
group = module.mig.group_manager.instance_group
|
||||
}]
|
||||
health_check_config = {
|
||||
http = {
|
||||
port = 80
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=3 resources=6
|
||||
```
|
||||
|
||||
### Externally managed instances
|
||||
|
||||
This examples shows how to create an NLB by combining externally managed instances (in a custom module or even outside of the current root module) in an unmanaged group. When using internally managed groups, remember to run `terraform apply` each time group instances change.
|
||||
|
||||
```hcl
|
||||
module "nlb" {
|
||||
source = "./fabric/modules/net-nlb"
|
||||
project_id = var.project_id
|
||||
region = "europe-west1"
|
||||
name = "nlb-test"
|
||||
vpc_config = {
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}
|
||||
group_configs = {
|
||||
my-group = {
|
||||
zone = "europe-west1-b"
|
||||
instances = [
|
||||
"instance-1-self-link",
|
||||
"instance-2-self-link"
|
||||
]
|
||||
}
|
||||
}
|
||||
backends = [{
|
||||
group = module.nlb.groups.my-group.self_link
|
||||
}]
|
||||
health_check_config = {
|
||||
http = {
|
||||
port = 80
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=4
|
||||
```
|
||||
|
||||
### End to end example
|
||||
|
||||
This example spins up a simple HTTP server and combines four modules:
|
||||
|
||||
- [`nginx`](../cloud-config-container/nginx) from the `cloud-config-container` collection, to manage instance configuration
|
||||
- [`compute-vm`](../compute-vm) to manage the instance template and unmanaged instance group
|
||||
- this module to create a Network Load Balancer in front of the managed instance group
|
||||
|
||||
Note that the example uses the GCE default service account. You might want to create an ad-hoc service account by combining the [`iam-service-account`](../iam-service-account) module, or by having the GCE VM module create one for you. In both cases, remember to set at least logging write permissions for the service account, or the container on the instances won't be able to start.
|
||||
|
||||
```hcl
|
||||
module "cos-nginx" {
|
||||
source = "./fabric/modules/cloud-config-container/nginx"
|
||||
}
|
||||
|
||||
module "instance-group" {
|
||||
source = "./fabric/modules/compute-vm"
|
||||
for_each = toset(["b", "c"])
|
||||
project_id = var.project_id
|
||||
zone = "europe-west1-${each.key}"
|
||||
name = "nlb-test-${each.key}"
|
||||
network_interfaces = [{
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
nat = false
|
||||
addresses = null
|
||||
}]
|
||||
boot_disk = {
|
||||
initialize_params = {
|
||||
image = "projects/cos-cloud/global/images/family/cos-stable"
|
||||
type = "pd-ssd"
|
||||
size = 10
|
||||
}
|
||||
}
|
||||
tags = ["http-server", "ssh"]
|
||||
metadata = {
|
||||
user-data = module.cos-nginx.cloud_config
|
||||
}
|
||||
group = { named_ports = {} }
|
||||
}
|
||||
|
||||
module "nlb" {
|
||||
source = "./fabric/modules/net-nlb"
|
||||
project_id = var.project_id
|
||||
region = "europe-west1"
|
||||
name = "nlb-test"
|
||||
vpc_config = {
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}
|
||||
ports = [80]
|
||||
backends = [
|
||||
for z, mod in module.instance-group : {
|
||||
group = mod.group.self_link
|
||||
}
|
||||
]
|
||||
health_check_config = {
|
||||
http = {
|
||||
port = 80
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=3 resources=7
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
|
||||
## Variables
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [name](variables.tf#L186) | Name used for all resources. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L197) | Project id where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L213) | GCP region. | <code>string</code> | ✓ | |
|
||||
| [vpc_config](variables.tf#L218) | VPC-level configuration. | <code title="object({ network = string subnetwork = string })">object({…})</code> | ✓ | |
|
||||
| [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | <code>string</code> | | <code>null</code> |
|
||||
| [backend_service_config](variables.tf#L23) | Backend service level configuration. | <code title="object({ connection_draining_timeout_sec = optional(number) connection_tracking = optional(object({ idle_timeout_sec = optional(number) persist_conn_on_unhealthy = optional(string) track_per_session = optional(bool) })) failover_config = optional(object({ disable_conn_drain = optional(bool) drop_traffic_if_unhealthy = optional(bool) ratio = optional(number) })) locality_lb_policy = optional(string) log_sample_rate = optional(number) port_name = optional(string) protocol = optional(string, "UNSPECIFIED") session_affinity = optional(string) timeout_sec = optional(number) })">object({…})</code> | | <code>{}</code> |
|
||||
| [backends](variables.tf#L72) | Load balancer backends, balancing mode is one of 'CONNECTION' or 'UTILIZATION'. | <code title="list(object({ group = string description = optional(string, "Terraform managed.") failover = optional(bool, false) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [description](variables.tf#L83) | Optional description used for resources. | <code>string</code> | | <code>"Terraform managed."</code> |
|
||||
| [group_configs](variables.tf#L89) | Optional unmanaged groups to create. Can be referenced in backends via outputs. | <code title="map(object({ zone = string instances = optional(list(string), []) named_ports = optional(map(number), {}) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [health_check](variables.tf#L100) | Name of existing health check to use, disables auto-created health check. | <code>string</code> | | <code>null</code> |
|
||||
| [health_check_config](variables.tf#L106) | Optional auto-created health check configuration, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | <code title="object({ check_interval_sec = optional(number) description = optional(string, "Terraform managed.") enable_logging = optional(bool, false) healthy_threshold = optional(number) timeout_sec = optional(number) unhealthy_threshold = optional(number) grpc = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT service_name = optional(string) })) http = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) http2 = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) https = optional(object({ host = optional(string) port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request_path = optional(string) response = optional(string) })) tcp = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request = optional(string) response = optional(string) })) ssl = optional(object({ port = optional(number) port_name = optional(string) port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT proxy_header = optional(string) request = optional(string) response = optional(string) })) })">object({…})</code> | | <code title="{ tcp = { port_specification = "USE_SERVING_PORT" } }">{…}</code> |
|
||||
| [labels](variables.tf#L180) | Labels set on resources. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [ports](variables.tf#L191) | Comma-separated ports, leave null to use all ports. | <code>list(string)</code> | | <code>null</code> |
|
||||
| [protocol](variables.tf#L202) | IP protocol used, defaults to TCP. UDP or L3_DEFAULT can also be used. | <code>string</code> | | <code>"TCP"</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
| name | description | sensitive |
|
||||
|---|---|:---:|
|
||||
| [backend_service](outputs.tf#L17) | Backend resource. | |
|
||||
| [backend_service_id](outputs.tf#L22) | Backend id. | |
|
||||
| [backend_service_self_link](outputs.tf#L27) | Backend self link. | |
|
||||
| [forwarding_rule](outputs.tf#L32) | Forwarding rule resource. | |
|
||||
| [forwarding_rule_address](outputs.tf#L37) | Forwarding rule address. | |
|
||||
| [forwarding_rule_self_link](outputs.tf#L42) | Forwarding rule self link. | |
|
||||
| [group_self_links](outputs.tf#L47) | Optional unmanaged instance group self links. | |
|
||||
| [groups](outputs.tf#L54) | Optional unmanaged instance group resources. | |
|
||||
| [health_check](outputs.tf#L59) | Auto-created health-check resource. | |
|
||||
| [health_check_self_id](outputs.tf#L64) | Auto-created health-check self id. | |
|
||||
| [health_check_self_link](outputs.tf#L69) | Auto-created health-check self link. | |
|
||||
| [id](outputs.tf#L74) | Fully qualified forwarding rule id. | |
|
||||
|
||||
<!-- END TFDOC -->
|
||||
33
modules/net-nlb/groups.tf
Normal file
33
modules/net-nlb/groups.tf
Normal file
@@ -0,0 +1,33 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
# tfdoc:file:description Optional instance group resources.
|
||||
|
||||
resource "google_compute_instance_group" "unmanaged" {
|
||||
for_each = var.group_configs
|
||||
project = var.project_id
|
||||
zone = each.value.zone
|
||||
name = each.key
|
||||
description = "Terraform-managed."
|
||||
instances = each.value.instances
|
||||
dynamic "named_port" {
|
||||
for_each = each.value.named_ports
|
||||
content {
|
||||
name = named_port.key
|
||||
port = named_port.value
|
||||
}
|
||||
}
|
||||
}
|
||||
119
modules/net-nlb/health-check.tf
Normal file
119
modules/net-nlb/health-check.tf
Normal file
@@ -0,0 +1,119 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
# tfdoc:file:description Health check resource.
|
||||
|
||||
locals {
|
||||
hc = var.health_check_config
|
||||
hc_grpc = try(local.hc.grpc, null) != null
|
||||
hc_http = try(local.hc.http, null) != null
|
||||
hc_http2 = try(local.hc.http2, null) != null
|
||||
hc_https = try(local.hc.https, null) != null
|
||||
hc_ssl = try(local.hc.ssl, null) != null
|
||||
hc_tcp = try(local.hc.tcp, null) != null
|
||||
}
|
||||
|
||||
resource "google_compute_health_check" "default" {
|
||||
provider = google-beta
|
||||
count = local.hc != null ? 1 : 0
|
||||
project = var.project_id
|
||||
name = var.name
|
||||
description = local.hc.description
|
||||
check_interval_sec = local.hc.check_interval_sec
|
||||
healthy_threshold = local.hc.healthy_threshold
|
||||
timeout_sec = local.hc.timeout_sec
|
||||
unhealthy_threshold = local.hc.unhealthy_threshold
|
||||
|
||||
dynamic "grpc_health_check" {
|
||||
for_each = local.hc_grpc ? [""] : []
|
||||
content {
|
||||
port = local.hc.grpc.port
|
||||
port_name = local.hc.grpc.port_name
|
||||
port_specification = local.hc.grpc.port_specification
|
||||
grpc_service_name = local.hc.grpc.service_name
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "http_health_check" {
|
||||
for_each = local.hc_http ? [""] : []
|
||||
content {
|
||||
host = local.hc.http.host
|
||||
port = local.hc.http.port
|
||||
port_name = local.hc.http.port_name
|
||||
port_specification = local.hc.http.port_specification
|
||||
proxy_header = local.hc.http.proxy_header
|
||||
request_path = local.hc.http.request_path
|
||||
response = local.hc.http.response
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "http2_health_check" {
|
||||
for_each = local.hc_http2 ? [""] : []
|
||||
content {
|
||||
host = local.hc.http.host
|
||||
port = local.hc.http.port
|
||||
port_name = local.hc.http.port_name
|
||||
port_specification = local.hc.http.port_specification
|
||||
proxy_header = local.hc.http.proxy_header
|
||||
request_path = local.hc.http.request_path
|
||||
response = local.hc.http.response
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "https_health_check" {
|
||||
for_each = local.hc_https ? [""] : []
|
||||
content {
|
||||
host = local.hc.https.host
|
||||
port = local.hc.https.port
|
||||
port_name = local.hc.https.port_name
|
||||
port_specification = local.hc.https.port_specification
|
||||
proxy_header = local.hc.https.proxy_header
|
||||
request_path = local.hc.https.request_path
|
||||
response = local.hc.https.response
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "ssl_health_check" {
|
||||
for_each = local.hc_ssl ? [""] : []
|
||||
content {
|
||||
port = local.hc.tcp.port
|
||||
port_name = local.hc.tcp.port_name
|
||||
port_specification = local.hc.tcp.port_specification
|
||||
proxy_header = local.hc.tcp.proxy_header
|
||||
request = local.hc.tcp.request
|
||||
response = local.hc.tcp.response
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "tcp_health_check" {
|
||||
for_each = local.hc_tcp ? [""] : []
|
||||
content {
|
||||
port = local.hc.tcp.port
|
||||
port_name = local.hc.tcp.port_name
|
||||
port_specification = local.hc.tcp.port_specification
|
||||
proxy_header = local.hc.tcp.proxy_header
|
||||
request = local.hc.tcp.request
|
||||
response = local.hc.tcp.response
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "log_config" {
|
||||
for_each = try(local.hc.enable_logging, null) == true ? [""] : []
|
||||
content {
|
||||
enable = true
|
||||
}
|
||||
}
|
||||
}
|
||||
114
modules/net-nlb/main.tf
Normal file
114
modules/net-nlb/main.tf
Normal file
@@ -0,0 +1,114 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
/*
|
||||
|
||||
To configure a network load balancer for IP protocols other than TCP or UDP,
|
||||
you create a forwarding rule with protocol set to L3_DEFAULT. This forwarding
|
||||
rule points to a backend service with protocol set to UNSPECIFIED.
|
||||
|
||||
*/
|
||||
|
||||
locals {
|
||||
bs_conntrack = var.backend_service_config.connection_tracking
|
||||
bs_failover = var.backend_service_config.failover_config
|
||||
health_check = (
|
||||
var.health_check != null
|
||||
? var.health_check
|
||||
: google_compute_health_check.default.0.self_link
|
||||
)
|
||||
}
|
||||
|
||||
resource "google_compute_forwarding_rule" "default" {
|
||||
provider = google-beta
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
name = var.name
|
||||
description = var.description
|
||||
ip_address = var.address
|
||||
ip_protocol = var.protocol
|
||||
backend_service = (
|
||||
google_compute_region_backend_service.default.self_link
|
||||
)
|
||||
load_balancing_scheme = "EXTERNAL"
|
||||
network = var.vpc_config.network
|
||||
subnetwork = var.vpc_config.subnetwork
|
||||
ports = var.ports # "nnnnn" or "nnnnn,nnnnn,nnnnn" max 5
|
||||
all_ports = var.ports == null ? true : null
|
||||
labels = var.labels
|
||||
# is_mirroring_collector = false
|
||||
}
|
||||
|
||||
resource "google_compute_region_backend_service" "default" {
|
||||
provider = google-beta
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
name = var.name
|
||||
description = var.description
|
||||
load_balancing_scheme = "EXTERNAL"
|
||||
protocol = var.backend_service_config.protocol
|
||||
network = var.vpc_config.network
|
||||
health_checks = [local.health_check]
|
||||
connection_draining_timeout_sec = var.backend_service_config.connection_draining_timeout_sec
|
||||
locality_lb_policy = var.backend_service_config.locality_lb_policy
|
||||
port_name = var.backend_service_config.port_name
|
||||
session_affinity = var.backend_service_config.session_affinity
|
||||
timeout_sec = var.backend_service_config.timeout_sec
|
||||
|
||||
dynamic "backend" {
|
||||
for_each = { for b in var.backends : b.group => b }
|
||||
content {
|
||||
balancing_mode = "CONNECTION"
|
||||
description = backend.value.description
|
||||
failover = backend.value.failover
|
||||
group = backend.key
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "connection_tracking_policy" {
|
||||
for_each = local.bs_conntrack == null ? [] : [""]
|
||||
content {
|
||||
connection_persistence_on_unhealthy_backends = (
|
||||
local.bs_conntrack.persist_conn_on_unhealthy != null
|
||||
? local.bs_conntrack.persist_conn_on_unhealthy
|
||||
: null
|
||||
)
|
||||
idle_timeout_sec = local.bs_conntrack.idle_timeout_sec
|
||||
tracking_mode = try(
|
||||
local.bs_conntrack.track_per_session
|
||||
? "PER_SESSION"
|
||||
: "PER_CONNECTION", null
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "failover_policy" {
|
||||
for_each = local.bs_failover == null ? [] : [""]
|
||||
content {
|
||||
disable_connection_drain_on_failover = local.bs_failover.disable_conn_drain
|
||||
drop_traffic_if_unhealthy = local.bs_failover.drop_traffic_if_unhealthy
|
||||
failover_ratio = local.bs_failover.ratio
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "log_config" {
|
||||
for_each = var.backend_service_config.log_sample_rate == null ? [] : [""]
|
||||
content {
|
||||
enable = true
|
||||
sample_rate = var.backend_service_config.log_sample_rate
|
||||
}
|
||||
}
|
||||
}
|
||||
77
modules/net-nlb/outputs.tf
Normal file
77
modules/net-nlb/outputs.tf
Normal file
@@ -0,0 +1,77 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
output "backend_service" {
|
||||
description = "Backend resource."
|
||||
value = google_compute_region_backend_service.default
|
||||
}
|
||||
|
||||
output "backend_service_id" {
|
||||
description = "Backend id."
|
||||
value = google_compute_region_backend_service.default.id
|
||||
}
|
||||
|
||||
output "backend_service_self_link" {
|
||||
description = "Backend self link."
|
||||
value = google_compute_region_backend_service.default.self_link
|
||||
}
|
||||
|
||||
output "forwarding_rule" {
|
||||
description = "Forwarding rule resource."
|
||||
value = google_compute_forwarding_rule.default
|
||||
}
|
||||
|
||||
output "forwarding_rule_address" {
|
||||
description = "Forwarding rule address."
|
||||
value = google_compute_forwarding_rule.default.ip_address
|
||||
}
|
||||
|
||||
output "forwarding_rule_self_link" {
|
||||
description = "Forwarding rule self link."
|
||||
value = google_compute_forwarding_rule.default.self_link
|
||||
}
|
||||
|
||||
output "group_self_links" {
|
||||
description = "Optional unmanaged instance group self links."
|
||||
value = {
|
||||
for k, v in google_compute_instance_group.unmanaged : k => v.self_link
|
||||
}
|
||||
}
|
||||
|
||||
output "groups" {
|
||||
description = "Optional unmanaged instance group resources."
|
||||
value = google_compute_instance_group.unmanaged
|
||||
}
|
||||
|
||||
output "health_check" {
|
||||
description = "Auto-created health-check resource."
|
||||
value = try(google_compute_health_check.default.0, null)
|
||||
}
|
||||
|
||||
output "health_check_self_id" {
|
||||
description = "Auto-created health-check self id."
|
||||
value = try(google_compute_health_check.default.0.id, null)
|
||||
}
|
||||
|
||||
output "health_check_self_link" {
|
||||
description = "Auto-created health-check self link."
|
||||
value = try(google_compute_health_check.default.0.self_link, null)
|
||||
}
|
||||
|
||||
output "id" {
|
||||
description = "Fully qualified forwarding rule id."
|
||||
value = google_compute_forwarding_rule.default.id
|
||||
}
|
||||
225
modules/net-nlb/variables.tf
Normal file
225
modules/net-nlb/variables.tf
Normal file
@@ -0,0 +1,225 @@
|
||||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
variable "address" {
|
||||
description = "Optional IP address used for the forwarding rule."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "backend_service_config" {
|
||||
description = "Backend service level configuration."
|
||||
type = object({
|
||||
connection_draining_timeout_sec = optional(number)
|
||||
connection_tracking = optional(object({
|
||||
idle_timeout_sec = optional(number)
|
||||
persist_conn_on_unhealthy = optional(string)
|
||||
track_per_session = optional(bool)
|
||||
}))
|
||||
failover_config = optional(object({
|
||||
disable_conn_drain = optional(bool)
|
||||
drop_traffic_if_unhealthy = optional(bool)
|
||||
ratio = optional(number)
|
||||
}))
|
||||
locality_lb_policy = optional(string)
|
||||
log_sample_rate = optional(number)
|
||||
port_name = optional(string)
|
||||
protocol = optional(string, "UNSPECIFIED")
|
||||
session_affinity = optional(string)
|
||||
timeout_sec = optional(number)
|
||||
})
|
||||
default = {}
|
||||
nullable = false
|
||||
validation {
|
||||
condition = contains(
|
||||
["TCP", "UDP", "UNSPECIFIED"],
|
||||
coalesce(var.backend_service_config.protocol, "TCP")
|
||||
)
|
||||
error_message = "Protocol can be 'TCP', 'UDP', 'UNSPECIFIED'."
|
||||
}
|
||||
validation {
|
||||
condition = contains(
|
||||
["MAGLEV", "WEIGHTED_MAGLEV"],
|
||||
coalesce(var.backend_service_config.locality_lb_policy, "MAGLEV")
|
||||
)
|
||||
error_message = "Locality LB policy can be 'MAGLEV', 'WEIGHTED_MAGLEV'."
|
||||
}
|
||||
validation {
|
||||
condition = contains(
|
||||
[
|
||||
"NONE", "CLIENT_IP", "CLIENT_IP_NO_DESTINATION",
|
||||
"CLIENT_IP_PORT_PROTO", "CLIENT_IP_PROTO"
|
||||
],
|
||||
coalesce(var.backend_service_config.session_affinity, "NONE")
|
||||
)
|
||||
error_message = "Invalid session affinity value."
|
||||
}
|
||||
}
|
||||
|
||||
variable "backends" {
|
||||
description = "Load balancer backends, balancing mode is one of 'CONNECTION' or 'UTILIZATION'."
|
||||
type = list(object({
|
||||
group = string
|
||||
description = optional(string, "Terraform managed.")
|
||||
failover = optional(bool, false)
|
||||
}))
|
||||
default = []
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "description" {
|
||||
description = "Optional description used for resources."
|
||||
type = string
|
||||
default = "Terraform managed."
|
||||
}
|
||||
|
||||
variable "group_configs" {
|
||||
description = "Optional unmanaged groups to create. Can be referenced in backends via outputs."
|
||||
type = map(object({
|
||||
zone = string
|
||||
instances = optional(list(string), [])
|
||||
named_ports = optional(map(number), {})
|
||||
}))
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "health_check" {
|
||||
description = "Name of existing health check to use, disables auto-created health check."
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "health_check_config" {
|
||||
description = "Optional auto-created health check configuration, use the output self-link to set it in the auto healing policy. Refer to examples for usage."
|
||||
type = object({
|
||||
check_interval_sec = optional(number)
|
||||
description = optional(string, "Terraform managed.")
|
||||
enable_logging = optional(bool, false)
|
||||
healthy_threshold = optional(number)
|
||||
timeout_sec = optional(number)
|
||||
unhealthy_threshold = optional(number)
|
||||
grpc = optional(object({
|
||||
port = optional(number)
|
||||
port_name = optional(string)
|
||||
port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT
|
||||
service_name = optional(string)
|
||||
}))
|
||||
http = optional(object({
|
||||
host = optional(string)
|
||||
port = optional(number)
|
||||
port_name = optional(string)
|
||||
port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT
|
||||
proxy_header = optional(string)
|
||||
request_path = optional(string)
|
||||
response = optional(string)
|
||||
}))
|
||||
http2 = optional(object({
|
||||
host = optional(string)
|
||||
port = optional(number)
|
||||
port_name = optional(string)
|
||||
port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT
|
||||
proxy_header = optional(string)
|
||||
request_path = optional(string)
|
||||
response = optional(string)
|
||||
}))
|
||||
https = optional(object({
|
||||
host = optional(string)
|
||||
port = optional(number)
|
||||
port_name = optional(string)
|
||||
port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT
|
||||
proxy_header = optional(string)
|
||||
request_path = optional(string)
|
||||
response = optional(string)
|
||||
}))
|
||||
tcp = optional(object({
|
||||
port = optional(number)
|
||||
port_name = optional(string)
|
||||
port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT
|
||||
proxy_header = optional(string)
|
||||
request = optional(string)
|
||||
response = optional(string)
|
||||
}))
|
||||
ssl = optional(object({
|
||||
port = optional(number)
|
||||
port_name = optional(string)
|
||||
port_specification = optional(string) # USE_FIXED_PORT USE_NAMED_PORT USE_SERVING_PORT
|
||||
proxy_header = optional(string)
|
||||
request = optional(string)
|
||||
response = optional(string)
|
||||
}))
|
||||
})
|
||||
default = {
|
||||
tcp = {
|
||||
port_specification = "USE_SERVING_PORT"
|
||||
}
|
||||
}
|
||||
validation {
|
||||
condition = (
|
||||
(try(var.health_check_config.grpc, null) == null ? 0 : 1) +
|
||||
(try(var.health_check_config.http, null) == null ? 0 : 1) +
|
||||
(try(var.health_check_config.tcp, null) == null ? 0 : 1) <= 1
|
||||
)
|
||||
error_message = "Only one health check type can be configured at a time."
|
||||
}
|
||||
}
|
||||
|
||||
variable "labels" {
|
||||
description = "Labels set on resources."
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "name" {
|
||||
description = "Name used for all resources."
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "ports" {
|
||||
description = "Comma-separated ports, leave null to use all ports."
|
||||
type = list(string)
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
description = "Project id where resources will be created."
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "protocol" {
|
||||
description = "IP protocol used, defaults to TCP. UDP or L3_DEFAULT can also be used."
|
||||
type = string
|
||||
default = "TCP"
|
||||
nullable = false
|
||||
validation {
|
||||
condition = contains(["L3_DEFAULT", "TCP", "UDP"], var.protocol)
|
||||
error_message = "Allowed values are 'TCP', 'UDP', 'L3_DEFAULT'."
|
||||
}
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "GCP region."
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "vpc_config" {
|
||||
description = "VPC-level configuration."
|
||||
type = object({
|
||||
network = string
|
||||
subnetwork = string
|
||||
})
|
||||
nullable = false
|
||||
}
|
||||
29
modules/net-nlb/versions.tf
Normal file
29
modules/net-nlb/versions.tf
Normal file
@@ -0,0 +1,29 @@
|
||||
# Copyright 2022 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# https://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
terraform {
|
||||
required_version = ">= 1.4.4"
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = ">= 4.60.0" # tftest
|
||||
}
|
||||
google-beta = {
|
||||
source = "hashicorp/google-beta"
|
||||
version = ">= 4.60.0" # tftest
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user