hunfabric/modules/net-lb-proxy-int-cross-region

Cross-region Internal Proxy Network Load Balancer Module

This module allows managing Cross-region Internal Proxy Network Load Balancers (L4 proxy ILBs). It's designed to expose the full configuration of the underlying resources, and to facilitate common usage patterns by providing sensible defaults, and optionally managing prerequisite resources like health checks, network endpoint groups (NEGs), etc.

Important

Cross-region internal proxy Network Load Balancers support Instance Groups (Managed or Unmanaged), zonal NEGs (GCE_VM_IP_PORT), and Hybrid NEGs as backends.

Proxy-only subnets for cross-region load balancers must be created with the purpose set to GLOBAL_MANAGED_PROXY (in the VPC module, set global = true in the subnets_proxy_only configuration).

Examples

• Examples
  • Minimal Example
  • Health Checks
  • Network Endpoint Groups (NEGs)
    • Zonal NEG creation
    • Hybrid NEG creation
• Variables
• Outputs

Minimal Example

An internal TCP proxy cross-region load balancer with a backend service pointing to auto-created zonal NEGs. This example demonstrates the use of the context pattern for symbolic variable interpolation:

module "tcp-proxy-cross-region" {
  source     = "./fabric/modules/net-lb-proxy-int-cross-region"
  name       = "ilb-proxy-test"
  project_id = "$project_ids:my-project"
  port       = 80

  context = {
    project_ids = {
      my-project = var.project_id
    }
    networks = {
      my-vpc = var.vpc.self_link
    }
    subnets = {
      my-subnet-1 = var.subnet1.self_link
      my-subnet-2 = var.subnet2.self_link
    }
  }

  vpc_config = {
    network = "$networks:my-vpc"
    subnetworks = {
      europe-west1 = "$subnets:my-subnet-1"
      europe-west4 = "$subnets:my-subnet-2"
    }
  }

  neg_configs = {
    neg-a = {
      gce = {
        zone       = "europe-west1-b"
        network    = "$networks:my-vpc"
        subnetwork = "$subnets:my-subnet-1"
        endpoints = {
          vm-a = {
            instance   = "my-vm-a"
            ip_address = "10.0.0.2"
            port       = 80
          }
        }
      }
    }
    neg-b = {
      gce = {
        zone       = "europe-west4-a"
        network    = "$networks:my-vpc"
        subnetwork = "$subnets:my-subnet-2"
        endpoints = {
          vm-b = {
            instance   = "my-vm-b"
            ip_address = "10.0.1.2"
            port       = 80
          }
        }
      }
    }
  }

  backend_service_config = {
    backends = [
      {
        group = "neg-a"
        max_connections = {
          per_endpoint = 100
        }
      },
      {
        group = "neg-b"
        max_connections = {
          per_endpoint = 100
        }
      }
    ]
  }
}
# tftest modules=1 resources=9

Health Checks

You can leverage externally defined health checks for backend services, or have the module create them for you. By default a simple TCP health check is created, and used in backend services.

Defining a custom health check:

module "tcp-proxy-cross-region" {
  source     = "./fabric/modules/net-lb-proxy-int-cross-region"
  name       = "ilb-proxy-test"
  project_id = var.project_id
  port       = 80

  vpc_config = {
    network = var.vpc.self_link
    subnetworks = {
      europe-west1 = var.subnet1.self_link
    }
  }

  backend_service_config = {
    backends = [{
      group = "projects/my-project/zones/europe-west1-b/networkEndpointGroups/my-neg"
      max_connections = {
        per_endpoint = 100
      }
    }]
  }

  health_check_config = {
    tcp = {
      port = 8080
    }
  }
}
# tftest modules=1 resources=4

Network Endpoint Groups (NEGs)

Zonal NEG creation

You can have the module create zonal NEGs for you by defining the neg_configs variable:

module "tcp-proxy-cross-region" {
  source     = "./fabric/modules/net-lb-proxy-int-cross-region"
  name       = "ilb-proxy-test"
  project_id = var.project_id
  port       = 80

  vpc_config = {
    network = var.vpc.self_link
    subnetworks = {
      europe-west1 = var.subnet1.self_link
    }
  }

  neg_configs = {
    neg-a = {
      gce = {
        zone       = "europe-west1-b"
        network    = var.vpc.self_link
        subnetwork = var.subnet1.self_link
      }
    }
  }

  backend_service_config = {
    backends = [{
      group = "neg-a"
      max_connections = {
        per_endpoint = 100
      }
    }]
  }
}
# tftest modules=1 resources=5

Hybrid NEG creation

You can also configure hybrid NEGs:

module "tcp-proxy-cross-region" {
  source     = "./fabric/modules/net-lb-proxy-int-cross-region"
  name       = "ilb-proxy-test"
  project_id = var.project_id
  port       = 80

  vpc_config = {
    network = var.vpc.self_link
    subnetworks = {
      europe-west1 = var.subnet1.self_link
    }
  }

  neg_configs = {
    hybrid-a = {
      hybrid = {
        network = var.vpc.self_link
        zone    = "europe-west1-b"
        endpoints = {
          endpoint-1 = {
            ip_address = "10.10.10.1"
            port       = 80
          }
        }
      }
    }
  }

  backend_service_config = {
    backends = [{
      group = "hybrid-a"
      max_connections = {
        per_endpoint = 100
      }
    }]
  }
}
# tftest modules=1 resources=6

Variables

name	description	type	required	default
name	Load balancer name.	string	✓
project_id	Project id.	string	✓
vpc_config	VPC-level configuration.	object({…})	✓
addresses	Optional IP addresses used for the forwarding rules, mapped by subnetwork key.	map(string)		null
backend_service_config	Backend service level configuration.	object({…})		{}
context	Context-specific interpolations.	object({…})		{}
description	Optional description used for resources.	string		"Terraform managed."
group_configs	Optional unmanaged groups to create. Can be referenced in backends via key or outputs.	map(object({…}))		{}
health_check	Name of existing health check to use, disables auto-created health check.	string		null
health_check_config	Optional auto-created health check configurations.	object({…})		{…}
labels	Labels set on resources.	map(string)		{}
neg_configs	Optional network endpoint groups to create. Can be referenced in backends via key or outputs.	map(object({…}))		{}
port	Forwarding rule port. Cross-region internal proxy load balancers support a single port.	number		80
target_proxy_config	Target proxy configuration.	object({…})		{}

Outputs

name	description	sensitive
addresses	Forwarding rule addresses.
backend_service	Backend resource.
backend_service_id	Backend id.
backend_service_self_link	Backend self link.
forwarding_rules	Forwarding rule resources.
group_self_links	Optional unmanaged instance group self links.
groups	Optional unmanaged instance group resources.
health_check	Auto-created health-check resource.
health_check_id	Auto-created health-check id.
health_check_self_link	Auto-created health-check self link.
ids	Fully qualified forwarding rule ids.
neg_ids	Autogenerated network endpoint group ids.
psc_neg_ids	Autogenerated PSC network endpoint group ids.
target_proxy	Target proxy resource.
target_proxy_id	Target proxy id.