From 4c99d6e963b03ffc94eb572f6aa2ba9559940a54 Mon Sep 17 00:00:00 2001 From: luigi-bitonti <93377317+luigi-bitonti@users.noreply.github.com> Date: Tue, 14 May 2024 14:56:10 +0200 Subject: [PATCH] Cloud function CMEK key support (#2270) * Added support to kms key * Updated doc * Fix variable description. * Updated README * Cloud function v2 integration with kms * Fix variables description --------- Co-authored-by: Ludovico Magnocavallo --- modules/cloud-function-v1/README.md | 47 ++++++++++++++++++++------ modules/cloud-function-v1/main.tf | 14 ++++---- modules/cloud-function-v1/variables.tf | 17 ++++++++++ modules/cloud-function-v2/README.md | 23 +++++++------ modules/cloud-function-v2/main.tf | 11 +++--- modules/cloud-function-v2/variables.tf | 6 ++++ 6 files changed, 85 insertions(+), 33 deletions(-) diff --git a/modules/cloud-function-v1/README.md b/modules/cloud-function-v1/README.md index 7099946e2d..ebcf0dd0aa 100644 --- a/modules/cloud-function-v1/README.md +++ b/modules/cloud-function-v1/README.md @@ -16,6 +16,7 @@ The GCS object used for deployment uses a hash of the bundle zip contents in its - [Private Cloud Build Pool](#private-cloud-build-pool) - [Multiple Cloud Functions within project](#multiple-cloud-functions-within-project) - [Mounting secrets from Secret Manager](#mounting-secrets-from-secret-manager) + - [Using CMEK to encrypt function resources](#using-cmek-to-encrypt-function-resources) - [Variables](#variables) - [Outputs](#outputs) @@ -258,6 +259,28 @@ module "cf-http" { } # tftest modules=1 resources=2 inventory=secrets.yaml ``` + +### Using CMEK to encrypt function resources +This encrypt bucket _gcf-sources-*_ with the provided kms key. The repository has to be encrypted with the same kms key. + +```hcl +module "cf-http" { + source = "./fabric/modules/cloud-function-v1" + project_id = "my-project" + region = "europe-west1" + name = "test-cf-http" + bucket_name = "test-cf-bundles" + bundle_config = { + source_dir = "fabric/assets" + output_path = "bundle.zip" + } + kms_key = "projects/my-project/locations/europe-west1/keyRings/mykeyring/cryptoKeys/mykey" + repository_settings = { + repository = "projects/my-project/locations/europe-west1/repositories/myrepo" + } +} +# tftest modules=1 resources=2 +``` ## Variables @@ -265,9 +288,9 @@ module "cf-http" { |---|---|:---:|:---:|:---:| | [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | string | ✓ | | | [bundle_config](variables.tf#L44) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…}) | ✓ | | -| [name](variables.tf#L109) | Name used for cloud function and associated resources. | string | ✓ | | -| [project_id](variables.tf#L124) | Project id used for all resources. | string | ✓ | | -| [region](variables.tf#L129) | Region used for all resources. | string | ✓ | | +| [name](variables.tf#L115) | Name used for cloud function and associated resources. | string | ✓ | | +| [project_id](variables.tf#L130) | Project id used for all resources. | string | ✓ | | +| [region](variables.tf#L135) | Region used for all resources. | string | ✓ | | | [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | | [build_environment_variables](variables.tf#L32) | A set of key/value environment variable pairs available during build time. | map(string) | | {} | | [build_worker_pool](variables.tf#L38) | Build worker pool, in projects//locations//workerPools/ format. | string | | null | @@ -277,14 +300,16 @@ module "cf-http" { | [https_security_level](variables.tf#L85) | The security level for the function: Allowed values are SECURE_ALWAYS, SECURE_OPTIONAL. | string | | null | | [iam](variables.tf#L91) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [ingress_settings](variables.tf#L97) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | -| [labels](variables.tf#L103) | Resource labels. | map(string) | | {} | -| [prefix](variables.tf#L114) | Optional prefix used for resource names. | string | | null | -| [secrets](variables.tf#L134) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | -| [service_account](variables.tf#L146) | Service account email. Unused if service account is auto-created. | string | | null | -| [service_account_create](variables.tf#L152) | Auto-create service account. | bool | | false | -| [trigger_config](variables.tf#L158) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | -| [vpc_connector](variables.tf#L168) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | -| [vpc_connector_config](variables.tf#L178) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | +| [kms_key](variables.tf#L103) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository field that was created with the same KMS crypto key. | string | | null | +| [labels](variables.tf#L109) | Resource labels. | map(string) | | {} | +| [prefix](variables.tf#L120) | Optional prefix used for resource names. | string | | null | +| [repository_settings](variables.tf#L140) | Docker Registry to use for storing the function's Docker images and specific repository. If kms_key is provided, the repository must have already been encrypted with the key. | object({…}) | | {…} | +| [secrets](variables.tf#L151) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | +| [service_account](variables.tf#L163) | Service account email. Unused if service account is auto-created. | string | | null | +| [service_account_create](variables.tf#L169) | Auto-create service account. | bool | | false | +| [trigger_config](variables.tf#L175) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | +| [vpc_connector](variables.tf#L185) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | +| [vpc_connector_config](variables.tf#L195) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | ## Outputs diff --git a/modules/cloud-function-v1/main.tf b/modules/cloud-function-v1/main.tf index b57d8431cb..7a7fdc9152 100644 --- a/modules/cloud-function-v1/main.tf +++ b/modules/cloud-function-v1/main.tf @@ -41,6 +41,7 @@ locals { ) } + resource "google_vpc_access_connector" "connector" { count = try(var.vpc_connector.create, false) == false ? 0 : 1 project = var.project_id @@ -67,12 +68,13 @@ resource "google_cloudfunctions_function" "function" { labels = var.labels trigger_http = var.trigger_config == null ? true : null https_trigger_security_level = var.https_security_level == null ? "SECURE_ALWAYS" : var.https_security_level - - ingress_settings = var.ingress_settings - build_worker_pool = var.build_worker_pool - build_environment_variables = var.build_environment_variables - - vpc_connector = local.vpc_connector + ingress_settings = var.ingress_settings + build_worker_pool = var.build_worker_pool + build_environment_variables = var.build_environment_variables + kms_key_name = var.kms_key + docker_registry = try(var.repository_settings.registry, "ARTIFACT_REGISTRY") + docker_repository = try(var.repository_settings.repository, null) + vpc_connector = local.vpc_connector vpc_connector_egress_settings = try( var.vpc_connector.egress_settings, null ) diff --git a/modules/cloud-function-v1/variables.tf b/modules/cloud-function-v1/variables.tf index 73964d0b18..8dc592addd 100644 --- a/modules/cloud-function-v1/variables.tf +++ b/modules/cloud-function-v1/variables.tf @@ -100,6 +100,12 @@ variable "ingress_settings" { default = null } +variable "kms_key" { + description = "Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository field that was created with the same KMS crypto key." + type = string + default = null +} + variable "labels" { description = "Resource labels." type = map(string) @@ -131,6 +137,17 @@ variable "region" { type = string } +variable "repository_settings" { + description = "Docker Registry to use for storing the function's Docker images and specific repository. If kms_key is provided, the repository must have already been encrypted with the key." + type = object({ + registry = optional(string) + repository = optional(string) + }) + default = { + registry = "ARTIFACT_REGISTRY" + } +} + variable "secrets" { description = "Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format." type = map(object({ diff --git a/modules/cloud-function-v2/README.md b/modules/cloud-function-v2/README.md index a5bad718e0..f54dd50aec 100644 --- a/modules/cloud-function-v2/README.md +++ b/modules/cloud-function-v2/README.md @@ -281,9 +281,9 @@ module "cf-http" { |---|---|:---:|:---:|:---:| | [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | string | ✓ | | | [bundle_config](variables.tf#L38) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…}) | ✓ | | -| [name](variables.tf#L103) | Name used for cloud function and associated resources. | string | ✓ | | -| [project_id](variables.tf#L118) | Project id used for all resources. | string | ✓ | | -| [region](variables.tf#L123) | Region used for all resources. | string | ✓ | | +| [name](variables.tf#L109) | Name used for cloud function and associated resources. | string | ✓ | | +| [project_id](variables.tf#L124) | Project id used for all resources. | string | ✓ | | +| [region](variables.tf#L129) | Region used for all resources. | string | ✓ | | | [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | | [build_worker_pool](variables.tf#L32) | Build worker pool, in projects//locations//workerPools/ format. | string | | null | | [description](variables.tf#L47) | Optional description. | string | | "Terraform managed." | @@ -292,14 +292,15 @@ module "cf-http" { | [function_config](variables.tf#L65) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout. | object({…}) | | {…} | | [iam](variables.tf#L85) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [ingress_settings](variables.tf#L91) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | -| [labels](variables.tf#L97) | Resource labels. | map(string) | | {} | -| [prefix](variables.tf#L108) | Optional prefix used for resource names. | string | | null | -| [secrets](variables.tf#L128) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | -| [service_account](variables.tf#L140) | Service account email. Unused if service account is auto-created. | string | | null | -| [service_account_create](variables.tf#L146) | Auto-create service account. | bool | | false | -| [trigger_config](variables.tf#L152) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | -| [vpc_connector](variables.tf#L170) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | -| [vpc_connector_config](variables.tf#L180) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | +| [kms_key](variables.tf#L97) | Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key. | string | | null | +| [labels](variables.tf#L103) | Resource labels. | map(string) | | {} | +| [prefix](variables.tf#L114) | Optional prefix used for resource names. | string | | null | +| [secrets](variables.tf#L134) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | +| [service_account](variables.tf#L146) | Service account email. Unused if service account is auto-created. | string | | null | +| [service_account_create](variables.tf#L152) | Auto-create service account. | bool | | false | +| [trigger_config](variables.tf#L158) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | +| [vpc_connector](variables.tf#L176) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | +| [vpc_connector_config](variables.tf#L186) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | ## Outputs diff --git a/modules/cloud-function-v2/main.tf b/modules/cloud-function-v2/main.tf index c38f863950..24046eada2 100644 --- a/modules/cloud-function-v2/main.tf +++ b/modules/cloud-function-v2/main.tf @@ -59,11 +59,12 @@ resource "google_vpc_access_connector" "connector" { } resource "google_cloudfunctions2_function" "function" { - provider = google-beta - project = var.project_id - location = var.region - name = "${local.prefix}${var.name}" - description = var.description + provider = google-beta + project = var.project_id + location = var.region + name = "${local.prefix}${var.name}" + description = var.description + kms_key_name = var.kms_key build_config { worker_pool = var.build_worker_pool runtime = var.function_config.runtime diff --git a/modules/cloud-function-v2/variables.tf b/modules/cloud-function-v2/variables.tf index af97650fc3..428ba8dba2 100644 --- a/modules/cloud-function-v2/variables.tf +++ b/modules/cloud-function-v2/variables.tf @@ -94,6 +94,12 @@ variable "ingress_settings" { default = null } +variable "kms_key" { + description = "Resource name of a KMS crypto key (managed by the user) used to encrypt/decrypt function resources in key id format. If specified, you must also provide an artifact registry repository using the docker_repository_id field that was created with the same KMS crypto key." + type = string + default = null +} + variable "labels" { description = "Resource labels." type = map(string)