hunfabric/modules/net-lb-proxy-int

Internal Proxy Network Load Balancer Module

This module allows managing Internal HTTP/HTTPS Load Balancers (L7 ILBs). It's designed to expose the full configuration of the underlying resources, and to facilitate common usage patterns by providing sensible defaults, and optionally managing prerequisite resources like health checks, instance groups, etc.

Due to the complexity of the underlying resources, changes to the configuration that involve recreation of resources are best applied in stages, starting by disabling the configuration in the urlmap that references the resources that need recreation, then doing the same for the backend service, etc.

Examples

• Examples
  • Minimal Example
  • Health Checks
  • Instance Groups
  • Network Endpoint Groups (NEGs)
    • Zonal NEG creation
    • Hybrid NEG creation
    • Private Service Connect NEG creation
    • Internet NEG creation
• Deploying changes to load balancer configurations
• Files
• Variables
• Outputs

Minimal Example

An Regional internal proxy Network Load Balancer with a backend service pointing to an existing GCE instance group:

module "tcp-proxy" {
  source     = "./fabric/modules/net-lb-proxy-int"
  name       = "ilb-test"
  project_id = var.project_id
  region     = "europe-west1"
  backend_service_config = {
    backends = [{
      group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
    }]
  }
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=4

Health Checks

You can leverage externally defined health checks for backend services, or have the module create them for you. By default a simple TCP health check on port 80 is created, and used in backend services.

Health check configuration is controlled via the health_check_config variable, which behaves in a similar way to other LB modules in this repository.

module "int-tcp-proxy" {
  source     = "./fabric/modules/net-lb-proxy-int"
  name       = "int-tcp-proxy"
  project_id = var.project_id
  region     = "europe-west1"
  backend_service_config = {
    backends = [{
      group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
    }]
  }
  health_check_config = {
    tcp = { port = 80 }
  }
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=4

To leverage an existing health check without having the module create them, simply pass its self link:

module "int-tcp-proxy" {
  source     = "./fabric/modules/net-lb-proxy-int"
  name       = "int-tcp-proxy"
  project_id = var.project_id
  region     = "europe-west1"
  backend_service_config = {
    backends = [{
      group = "projects/myprj/zones/europe-west1-a/instanceGroups/my-ig"
    }]
  }
  health_check = "projects/myprj/global/healthChecks/custom"
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=3

Instance Groups

The module can optionally create unmanaged instance groups, which can then be referred in backends via their key:

module "int-tcp-proxy" {
  source     = "./fabric/modules/net-lb-proxy-int"
  name       = "int-tcp-proxy"
  project_id = var.project_id
  region     = "europe-west1"
  backend_service_config = {
    port_name = "http"
    backends = [
      { group = "default" }
    ]
  }
  group_configs = {
    default = {
      zone = "europe-west1-b"
      instances = [
        "projects/myprj/zones/europe-west1-b/instances/vm-a"
      ]
      named_ports = { http = 80 }
    }
  }
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=5

Network Endpoint Groups (NEGs)

Network Endpoint Groups (NEGs) can be used as backends, by passing their id as the backend group:

module "int-tcp-proxy" {
  source     = "./fabric/modules/net-lb-proxy-int"
  name       = "int-tcp-proxy"
  project_id = var.project_id
  region     = "europe-west1"
  backend_service_config = {
    backends = [{
      group = "projects/myprj/zones/europe-west1-a/networkEndpointGroups/my-neg"
    }]
  }
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=4

Similarly to instance groups, NEGs can also be managed by this module which supports GCE, hybrid and Private Service Connect NEGs:

Zonal NEG creation

resource "google_compute_address" "test" {
  project      = var.project_id
  name         = "neg-test"
  subnetwork   = var.subnet.self_link
  address_type = "INTERNAL"
  address      = "10.0.0.10"
  region       = "europe-west1"
}

module "int-tcp-proxy" {
  source     = "./fabric/modules/net-lb-proxy-int"
  name       = "int-tcp-proxy"
  project_id = var.project_id
  region     = "europe-west1"
  backend_service_config = {
    backends = [{
      group          = "my-neg"
      balancing_mode = "CONNECTION"
      max_connections = {
        per_endpoint = 10
      }
    }]
  }
  neg_configs = {
    my-neg = {
      gce = {
        zone = "europe-west1-b"
        endpoints = {
          e-0 = {
            instance   = "test-1"
            ip_address = google_compute_address.test.address
            # ip_address = "10.0.0.10"
            port = 80
          }
        }
      }
    }
  }
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=7 inventory=zonal-neg.yaml

Hybrid NEG creation

module "int-tcp-proxy" {
  source     = "./fabric/modules/net-lb-proxy-int"
  name       = "int-tcp-proxy"
  project_id = var.project_id
  region     = "europe-west1"
  backend_service_config = {
    backends = [{
      group          = "my-neg"
      balancing_mode = "CONNECTION"
      max_connections = {
        per_endpoint = 10
      }
    }]
  }
  neg_configs = {
    my-neg = {
      hybrid = {
        zone = "europe-west1-b"
        endpoints = {
          e-0 = {
            ip_address = "10.0.0.10"
            port       = 80
          }
        }
      }
    }
  }
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=6

Private Service Connect NEG creation

module "int-tcp-proxy" {
  source     = "./fabric/modules/net-lb-proxy-int"
  name       = "int-tcp-proxy"
  project_id = var.project_id
  region     = "europe-west1"
  backend_service_config = {
    backends = [{
      group          = "my-neg"
      balancing_mode = "CONNECTION"
      max_connections = {
        per_endpoint = 10
      }
    }]
  }
  neg_configs = {
    my-neg = {
      psc = {
        region         = "europe-west1"
        target_service = "europe-west1-cloudkms.googleapis.com"
      }
    }
  }
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=5

Internet NEG creation

This example shows how to create and manage internet NEGs:

module "ilb-l7" {
  source     = "./fabric/modules/net-lb-proxy-int"
  project_id = var.project_id
  name       = "ilb-test"
  region     = var.region
  backend_service_config = {
    backends = [
      { group = "neg-0" }
    ]
    # with a single internet NEG the implied default health check is optional
    health_checks = []
  }
  port = 80
  neg_configs = {
    neg-0 = {
      internet = {
        region   = var.region
        use_fqdn = true
        endpoints = {
          e-0 = {
            destination = "www.example.org"
            port        = 80
          }
        }
      }
    }
  }
  vpc_config = {
    network    = var.vpc.self_link
    subnetwork = var.subnet.self_link
  }
}
# tftest modules=1 resources=6 inventory=internet-neg.yaml e2e

Deploying changes to load balancer configurations

For deploying changes to load balancer configuration please refer to net-lb-app-ext README.md

Files

name	description	resources
backend-service.tf	Backend service resources.	google_compute_region_backend_service
groups.tf	None	google_compute_instance_group
health-check.tf	Health check resource.	google_compute_region_health_check
main.tf	Module-level locals and resources.	google_compute_forwarding_rule · google_compute_network_endpoint · google_compute_network_endpoint_group · google_compute_region_network_endpoint · google_compute_region_network_endpoint_group · google_compute_region_target_tcp_proxy · google_compute_service_attachment
outputs.tf	Module outputs.
variables.tf	Module variables.
versions.tf	Version pins.

Variables

name	description	type	required	default
name	Load balancer name.	string	✓
project_id	Project id.	string	✓
region	The region where to allocate the ILB resources.	string	✓
vpc_config	VPC-level configuration.	object({…})	✓
address	Optional IP address used for the forwarding rule.	string		null
backend_service_config	Backend service level configuration.	object({…})		{}
description	Optional description used for resources.	string		"Terraform managed."
global_access	Allow client access from all regions.	bool		null
group_configs	Optional unmanaged groups to create. Can be referenced in backends via key or outputs.	map(object({…}))		{}
health_check	Name of existing health check to use, disables auto-created health check.	string		null
health_check_config	Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage.	object({…})		{…}
labels	Labels set on resources.	map(string)		{}
neg_configs	Optional network endpoint groups to create. Can be referenced in backends via key or outputs.	map(object({…}))		{}
port	Port.	number		80
service_attachment	PSC service attachment.	object({…})		null

Outputs

name	description	sensitive
address	Forwarding rule address.
backend_service	Backend resource.
backend_service_id	Backend id.
backend_service_self_link	Backend self link.
forwarding_rule	Forwarding rule resource.
group_self_links	Optional unmanaged instance group self links.
groups	Optional unmanaged instance group resources.
health_check	Auto-created health-check resource.
health_check_id	Auto-created health-check id.
health_check_self_link	Auto-created health-check self link.
id	Fully qualified forwarding rule id.
neg_ids	Autogenerated network endpoint group ids.
service_attachment_id	Id of the service attachment.