diff --git a/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf b/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf index 7fbe780c82..6fc1948e99 100644 --- a/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf +++ b/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf @@ -79,19 +79,18 @@ module "cf" { name = var.name bucket_name = "${var.name}-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } bundle_config = { source_dir = "cf" output_path = var.bundle_path - excludes = null } service_account = module.service-account.email trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } diff --git a/blueprints/cloud-operations/network-dashboard/main.tf b/blueprints/cloud-operations/network-dashboard/main.tf index 5710f25c1d..e74cabd6e2 100644 --- a/blueprints/cloud-operations/network-dashboard/main.tf +++ b/blueprints/cloud-operations/network-dashboard/main.tf @@ -137,15 +137,13 @@ module "cloud-function" { name = "network-dashboard-cloud-function" bucket_name = "${local.monitoring_project}-network-dashboard-bucket" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } region = var.region bundle_config = { source_dir = "cloud-function" output_path = "cloud-function.zip" - excludes = null } function_config = { @@ -153,7 +151,7 @@ module "cloud-function" { entry_point = "main" runtime = "python39" instances = 1 - memory = 256 # Memory in MB + memory_mb = 256 } @@ -169,10 +167,17 @@ module "cloud-function" { # Internal only doesn't seem to work with CFv2: ingress_settings = var.cf_version == "V2" ? "ALLOW_ALL" : "ALLOW_INTERNAL_ONLY" - trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + trigger_config = var.cf_version == "V2" ? { + v2 = { + event_type = "google.cloud.pubsub.topic.v1.messagePublished" + pubsub_topic = module.pubsub.topic.id + service_account_create = true + } + } : { + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } diff --git a/blueprints/cloud-operations/quota-monitoring/main.tf b/blueprints/cloud-operations/quota-monitoring/main.tf index 13804ba943..fae9af514c 100644 --- a/blueprints/cloud-operations/quota-monitoring/main.tf +++ b/blueprints/cloud-operations/quota-monitoring/main.tf @@ -52,13 +52,11 @@ module "cf" { name = var.name bucket_name = "${var.name}-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } bundle_config = { source_dir = "cf" output_path = var.bundle_path - excludes = null } # https://github.com/hashicorp/terraform-provider-archive/issues/40 # https://issuetracker.google.com/issues/155215191 @@ -68,9 +66,10 @@ module "cf" { } service_account_create = true trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } diff --git a/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf b/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf index 15d479a3b0..1be2d1a983 100644 --- a/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf +++ b/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf @@ -91,19 +91,18 @@ module "cf" { name = var.name bucket_name = "${var.name}-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } bundle_config = { source_dir = "cf" output_path = var.bundle_path - excludes = null } service_account = module.service-account.email trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } @@ -115,8 +114,8 @@ module "cffile" { name = var.name_cffile bucket_name = "${var.name_cffile}-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region + lifecycle_delete_age_days = null } bundle_config = { source_dir = "cffile" @@ -125,9 +124,11 @@ module "cffile" { } service_account = module.service-account.email trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub_file.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub_file.topic.id + retry = null + } } } diff --git a/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf b/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf index 98882b0558..d69dddf2b5 100644 --- a/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf +++ b/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf @@ -114,29 +114,28 @@ module "cf-restarter" { region = var.region bucket_name = "cf-bundle-bucket-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } bundle_config = { source_dir = "${path.module}/function/restarter" output_path = "restarter.zip" - excludes = [] } service_account = module.service-account-restarter.email function_config = { entry_point = "RestartInstance" ingress_settings = null - instances = 1 - memory = 256 + instance_count = 1 + memory_mb = 256 runtime = "go116" timeout = 300 } trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } @@ -151,15 +150,14 @@ module "cf-healthchecker" { bundle_config = { source_dir = "${path.module}/function/healthchecker" output_path = "healthchecker.zip" - excludes = [] } service_account = module.service-account-healthchecker.email function_config = { entry_point = "HealthCheck" ingress_settings = null - instances = 1 - memory = 256 + instance_count = 1 + memory_mb = 256 runtime = "go116" timeout = 300 } diff --git a/blueprints/networking/private-cloud-function-from-onprem/main.tf b/blueprints/networking/private-cloud-function-from-onprem/main.tf index e2f23f1fd6..5824c31939 100644 --- a/blueprints/networking/private-cloud-function-from-onprem/main.tf +++ b/blueprints/networking/private-cloud-function-from-onprem/main.tf @@ -195,11 +195,9 @@ module "function-hello" { bundle_config = { source_dir = "${path.module}/assets" output_path = "bundle.zip" - excludes = null } bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } iam = { "roles/cloudfunctions.invoker" = ["allUsers"] diff --git a/blueprints/serverless/api-gateway/main.tf b/blueprints/serverless/api-gateway/main.tf index 664ee990f4..4fe132eda0 100644 --- a/blueprints/serverless/api-gateway/main.tf +++ b/blueprints/serverless/api-gateway/main.tf @@ -70,8 +70,8 @@ module "functions" { region = each.value ingress_settings = "ALLOW_ALL" bucket_config = { - location = null - lifecycle_delete_age = 1 + location = null + lifecycle_delete_age_days = 1 } bundle_config = { source_dir = "${path.module}/function" diff --git a/modules/cloud-function/README.md b/modules/cloud-function/README.md index 323b33338b..9d8994c04f 100644 --- a/modules/cloud-function/README.md +++ b/modules/cloud-function/README.md @@ -21,38 +21,90 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } } -# tftest skip +# tftest modules=1 resources=2 ``` -### PubSub and non-HTTP triggers - -Other trigger types other than HTTP are configured via the `trigger_config` variable. This example shows a PubSub trigger. - +Analogous example using 2nd generation Cloud Functions ```hcl module "cf-http" { source = "./fabric/modules/cloud-function" + v2 = true project_id = "my-project" name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" + output_path = "bundle.zip" + } +} +# tftest modules=1 resources=2 +``` + +### PubSub and non-HTTP triggers + +Other trigger types other than HTTP are configured via the `trigger_config` variable. This example shows a PubSub trigger. + +```hcl +module "cf-http" { + source = "./fabric/modules/cloud-function" + project_id = "my-project" + name = "test-cf-http" + bucket_name = "test-cf-bundles" + bundle_config = { + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } trigger_config = { - event = "google.pubsub.topic.publish" - resource = local.my-topic - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = "local.my-topic" + } } } -# tftest skip +# tftest modules=1 resources=2 ``` +Cloud Functions 2nd gen support only [Eventarc](https://cloud.google.com/eventarc/docs) and uses separate structure +to configure: +```hcl +module "trigger-service-account" { + source = "./fabric/modules/iam-service-account" + project_id = "my-project" + name = "sa-cloudfunction" + iam_project_roles = { + "my-project" = [ + "roles/run.invoker" + ] + } +} + +module "cf-http" { + source = "./fabric/modules/cloud-function" + project_id = "my-project" + v2 = true + name = "test-cf-http" + bucket_name = "test-cf-bundles" + bundle_config = { + source_dir = "fabric/assets/" + output_path = "bundle.zip" + } + trigger_config = { + v2 = { + event_type = "google.cloud.pubsub.topic.v1.messagePublished" + pubsub_topic = "local.my-topic" + service_account_email = module.trigger-service-account.email + } + } +} +# tftest modules=2 resources=4 +``` +Ensure that pubsub robo-account `service-%s@gcp-sa-pubsub.iam.gserviceaccount.com` has `roles/iam.serviceAccountTokenCreatator` +as documented [here](https://cloud.google.com/eventarc/docs/roles-permissions#pubsub-topic) + ### Controlling HTTP access To allow anonymous access to the function, grant the `roles/cloudfunctions.invoker` role to the special `allUsers` identifier. Use specific identities (service accounts, groups, etc.) instead of `allUsers` to only allow selective access. @@ -64,15 +116,14 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } iam = { "roles/cloudfunctions.invoker" = ["allUsers"] } } -# tftest skip +# tftest modules=1 resources=3 ``` ### GCS bucket creation @@ -86,16 +137,13 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bucket_config = { - location = null - lifecycle_delete_age = 1 + lifecycle_delete_age_days = 1 } bundle_config = { - source_dir = "my-cf-source-folder" - output_path = "bundle.zip" - excludes = null + source_dir = "fabric/assets/" } } -# tftest skip +# tftest modules=1 resources=3 ``` ### Service account management @@ -109,13 +157,12 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } service_account_create = true } -# tftest skip +# tftest modules=1 resources=3 ``` To use an externally managed service account, pass its email in `service_account` and leave `service_account_create` to `false` (the default). @@ -127,13 +174,12 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } - service_account = local.service_account_email + service_account = "non-existent@serice.account.email" } -# tftest skip +# tftest modules=1 resources=2 ``` ### Custom bundle config @@ -147,12 +193,12 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets" output_path = "bundle.zip" excludes = ["__pycache__"] } } -# tftest skip +# tftest modules=1 resources=2 ``` ### Private Cloud Build Pool @@ -167,12 +213,11 @@ module "cf-http" { bucket_name = "test-cf-bundles" build_worker_pool = "projects/my-project/locations/europe-west1/workerPools/my_build_worker_pool" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets" output_path = "bundle.zip" - excludes = null } } -# tftest skip +# tftest modules=1 resources=2 ``` @@ -181,14 +226,14 @@ module "cf-http" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | string | ✓ | | -| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…}) | ✓ | | +| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…}) | ✓ | | | [name](variables.tf#L94) | Name used for cloud function and associated resources. | string | ✓ | | | [project_id](variables.tf#L109) | Project id used for all resources. | string | ✓ | | -| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | +| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | | [build_worker_pool](variables.tf#L31) | Build worker pool, in projects//locations//workerPools/ format | string | | null | | [description](variables.tf#L46) | Optional description. | string | | "Terraform managed." | | [environment_variables](variables.tf#L52) | Cloud function environment variables. | map(string) | | {} | -| [function_config](variables.tf#L58) | Cloud function configuration. | object({…}) | | {…} | +| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | object({…}) | | {…} | | [iam](variables.tf#L76) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [ingress_settings](variables.tf#L82) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | | [labels](variables.tf#L88) | Resource labels. | map(string) | | {} | @@ -197,10 +242,10 @@ module "cf-http" { | [secrets](variables.tf#L120) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | | [service_account](variables.tf#L132) | Service account email. Unused if service account is auto-created. | string | | null | | [service_account_create](variables.tf#L138) | Auto-create service account. | bool | | false | -| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | -| [v2](variables.tf#L173) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | -| [vpc_connector](variables.tf#L154) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | -| [vpc_connector_config](variables.tf#L164) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | +| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | { v1 = null, v2 = null } | +| [v2](variables.tf#L192) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | +| [vpc_connector](variables.tf#L173) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | +| [vpc_connector_config](variables.tf#L183) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | ## Outputs @@ -213,7 +258,10 @@ module "cf-http" { | [service_account](outputs.tf#L42) | Service account resource. | | | [service_account_email](outputs.tf#L47) | Service account email. | | | [service_account_iam_email](outputs.tf#L52) | Service account email. | | +| [trigger_service_account](outputs.tf#L60) | Service account resource. | | +| [trigger_service_account_email](outputs.tf#L65) | Service account email. | | +| [trigger_service_account_iam_email](outputs.tf#L70) | Service account email. | | | [uri](outputs.tf#L38) | Cloud function service uri. | | -| [vpc_connector](outputs.tf#L60) | VPC connector resource if created. | | +| [vpc_connector](outputs.tf#L78) | VPC connector resource if created. | | diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index 280f33c2ca..35dba72942 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -29,15 +29,12 @@ locals { ? google_cloudfunctions2_function.function[0] : google_cloudfunctions_function.function[0] ) - prefix = var.prefix == null ? "" : "${var.prefix}-" - service_account_email = ( - var.service_account_create - ? ( - length(google_service_account.service_account) > 0 - ? google_service_account.service_account[0].email - : null - ) - : var.service_account + prefix = var.prefix == null ? "" : "${var.prefix}-" + service_account_email = var.service_account_create ? google_service_account.service_account[0].email : var.service_account + trigger_service_account_email = ( + coalesce(try(var.trigger_config.v2.service_account_create, false), false) + ? google_service_account.trigger_service_account[0].email + : null ) vpc_connector = ( var.vpc_connector == null @@ -66,18 +63,19 @@ resource "google_cloudfunctions_function" "function" { name = "${local.prefix}${var.name}" description = var.description runtime = var.function_config.runtime - available_memory_mb = var.function_config.memory - max_instances = var.function_config.instances - timeout = var.function_config.timeout + available_memory_mb = var.function_config.memory_mb + max_instances = var.function_config.instance_count + timeout = var.function_config.timeout_seconds entry_point = var.function_config.entry_point environment_variables = var.environment_variables service_account_email = local.service_account_email source_archive_bucket = local.bucket source_archive_object = google_storage_bucket_object.bundle.name labels = var.labels - trigger_http = var.trigger_config == null ? true : null - ingress_settings = var.ingress_settings - build_worker_pool = var.build_worker_pool + trigger_http = var.trigger_config.v1 == null ? true : null + + ingress_settings = var.ingress_settings + build_worker_pool = var.build_worker_pool vpc_connector = local.vpc_connector vpc_connector_egress_settings = try( @@ -85,14 +83,14 @@ resource "google_cloudfunctions_function" "function" { ) dynamic "event_trigger" { - for_each = var.trigger_config == null ? [] : [""] + for_each = var.trigger_config.v1 == null ? [] : [""] content { - event_type = var.trigger_config.event - resource = var.trigger_config.resource + event_type = var.trigger_config.v1.event + resource = var.trigger_config.v1.resource dynamic "failure_policy" { - for_each = var.trigger_config.retry == null ? [] : [""] + for_each = var.trigger_config.v1.retry == null ? [] : [""] content { - retry = var.trigger_config.retry + retry = var.trigger_config.v1.retry } } } @@ -126,7 +124,6 @@ resource "google_cloudfunctions_function" "function" { } } } - } resource "google_cloudfunctions2_function" "function" { @@ -148,11 +145,30 @@ resource "google_cloudfunctions2_function" "function" { } } } + dynamic "event_trigger" { + for_each = var.trigger_config.v2 == null ? [] : [""] + content { + trigger_region = var.trigger_config.v2.region + event_type = var.trigger_config.v2.event_type + pubsub_topic = var.trigger_config.v2.pubsub_topic + dynamic "event_filters" { + for_each = var.trigger_config.v2.event_filters == null ? [] : var.trigger_config.v2.event_filters + iterator = event_filter + content { + attribute = event_filter.attribute + value = event_filter.value + operator = event_filter.operator + } + } + service_account_email = var.trigger_config.v2.service_account_email + retry_policy = var.trigger_config.v2.retry_policy + } + } service_config { - max_instance_count = var.function_config.instances + max_instance_count = var.function_config.instance_count min_instance_count = 0 - available_memory = "${var.function_config.memory}M" - timeout_seconds = var.function_config.timeout + available_memory = "${var.function_config.memory_mb}M" + timeout_seconds = var.function_config.timeout_seconds environment_variables = var.environment_variables ingress_settings = var.ingress_settings all_traffic_on_latest_revision = true @@ -194,7 +210,7 @@ resource "google_cloudfunctions2_function" "function" { } resource "google_cloudfunctions_function_iam_binding" "default" { - for_each = var.iam + for_each = !var.v2 ? var.iam : {} project = var.project_id region = var.region cloud_function = local.function.name @@ -202,6 +218,15 @@ resource "google_cloudfunctions_function_iam_binding" "default" { members = each.value } +resource "google_cloudfunctions2_function_iam_binding" "default" { + for_each = var.v2 ? var.iam : {} + project = var.project_id + location = google_cloudfunctions2_function.function[0].location + cloud_function = local.function.name + role = each.key + members = each.value +} + resource "google_storage_bucket" "bucket" { count = var.bucket_config == null ? 0 : 1 project = var.project_id @@ -215,18 +240,18 @@ resource "google_storage_bucket" "bucket" { labels = var.labels dynamic "lifecycle_rule" { - for_each = var.bucket_config.lifecycle_delete_age == null ? [] : [""] + for_each = var.bucket_config.lifecycle_delete_age_days == null ? [] : [""] content { action { type = "Delete" } condition { - age = var.bucket_config.lifecycle_delete_age + age = var.bucket_config.lifecycle_delete_age_days with_state = "ARCHIVED" } } } dynamic "versioning" { - for_each = var.bucket_config.lifecycle_delete_age == null ? [] : [""] + for_each = var.bucket_config.lifecycle_delete_age_days == null ? [] : [""] content { enabled = true } @@ -240,13 +265,9 @@ resource "google_storage_bucket_object" "bundle" { } data "archive_file" "bundle" { - type = "zip" - source_dir = var.bundle_config.source_dir - output_path = ( - var.bundle_config.output_path == null - ? "/tmp/bundle.zip" - : var.bundle_config.output_path - ) + type = "zip" + source_dir = var.bundle_config.source_dir + output_path = var.bundle_config.output_path output_file_mode = "0666" excludes = var.bundle_config.excludes } @@ -257,3 +278,17 @@ resource "google_service_account" "service_account" { account_id = "tf-cf-${var.name}" display_name = "Terraform Cloud Function ${var.name}." } + +resource "google_service_account" "trigger_service_account" { + count = coalesce(try(var.trigger_config.v2.service_account_create, false), false) ? 1 : 0 + project = var.project_id + account_id = "tf-cf-trigger-${var.name}" + display_name = "Terraform trigger for Cloud Function ${var.name}." +} + +resource "google_project_iam_member" "trigger_iam" { + count = coalesce(try(var.trigger_config.v2.service_account_create, false), false) ? 1 : 0 + project = var.project_id + member = "serviceAccount:${google_service_account.trigger_service_account[0].email}" + role = "roles/run.invoker" +} diff --git a/modules/cloud-function/outputs.tf b/modules/cloud-function/outputs.tf index a4bbcebb4e..5f6e12bef9 100644 --- a/modules/cloud-function/outputs.tf +++ b/modules/cloud-function/outputs.tf @@ -57,6 +57,24 @@ output "service_account_iam_email" { ]) } +output "trigger_service_account" { + description = "Service account resource." + value = try(google_service_account.trigger_service_account[0], null) +} + +output "trigger_service_account_email" { + description = "Service account email." + value = local.trigger_service_account_email +} + +output "trigger_service_account_iam_email" { + description = "Service account email." + value = join("", [ + "serviceAccount:", + local.trigger_service_account_email == null ? "" : local.trigger_service_account_email + ]) +} + output "vpc_connector" { description = "VPC connector resource if created." value = try(google_vpc_access_connector.connector.0.id, null) diff --git a/modules/cloud-function/variables.tf b/modules/cloud-function/variables.tf index 796b230ec7..08e166d937 100644 --- a/modules/cloud-function/variables.tf +++ b/modules/cloud-function/variables.tf @@ -17,8 +17,8 @@ variable "bucket_config" { description = "Enable and configure auto-created bucket. Set fields to null to use defaults." type = object({ - location = string - lifecycle_delete_age = number + location = optional(string) + lifecycle_delete_age_days = optional(number) }) default = null } @@ -38,8 +38,8 @@ variable "bundle_config" { description = "Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null." type = object({ source_dir = string - output_path = string - excludes = list(string) + output_path = optional(string, "/tmp/bundle.zip") + excludes = optional(list(string)) }) } @@ -56,20 +56,20 @@ variable "environment_variables" { } variable "function_config" { - description = "Cloud function configuration." + description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout" type = object({ - entry_point = string - instances = number - memory = number # Memory in MB - runtime = string - timeout = number + entry_point = optional(string, "main") + instance_count = optional(number, 1) + memory_mb = optional(number, 256) # Memory in MB + runtime = optional(string, "python310") + timeout_seconds = optional(number, 180) }) default = { - entry_point = "main" - instances = 1 - memory = 256 - runtime = "python37" - timeout = 180 + entry_point = "main" + instance_count = 1 + memory_mb = 256 + runtime = "python310" + timeout_seconds = 180 } } @@ -144,11 +144,30 @@ variable "service_account_create" { variable "trigger_config" { description = "Function trigger configuration. Leave null for HTTP trigger." type = object({ - event = string - resource = string - retry = bool + v1 = optional(object({ + event = string + resource = string + retry = optional(bool) + })), + v2 = optional(object({ + region = optional(string) + event_type = optional(string) + pubsub_topic = optional(string) + event_filters = optional(list(object({ + attribute = string + value = string + operator = string + }))) + service_account_email = optional(string) + service_account_create = optional(bool) + retry_policy = optional(string) + })) }) - default = null + default = { v1 = null, v2 = null } + validation { + condition = !(var.trigger_config.v1 != null && var.trigger_config.v2 != null) + error_message = "Provide configuration for only one generation - either v1 or v2" + } } variable "vpc_connector" { diff --git a/tests/modules/cloud_function_v2/test_plan.py b/tests/modules/cloud_function_v2/test_plan.py index de5a06a9d5..44b7c27fd2 100644 --- a/tests/modules/cloud_function_v2/test_plan.py +++ b/tests/modules/cloud_function_v2/test_plan.py @@ -29,6 +29,6 @@ def test_resource_count(resources): def test_iam(resources): "Test IAM binding resources." bindings = [r['values'] for r in resources if r['type'] - == 'google_cloudfunctions_function_iam_binding'] + == 'google_cloudfunctions2_function_iam_binding'] assert len(bindings) == 1 assert bindings[0]['role'] == 'roles/cloudfunctions.invoker'