From 303b51a0a99454e978a1dfea05f50c4aa079c2ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Wed, 9 Nov 2022 08:53:23 +0100 Subject: [PATCH 01/10] Add triggers to cloud functions v2 * add `trigger_config_v2` for v2 functions * add optional for objects in variables.tf * make examples in README runnable * add example for Cloud Function v2 * add exapmle for trigger for Cloud Function v2 * remove optional variables from examples with `null` value --- modules/cloud-function/README.md | 109 +++++++++++++++++++--------- modules/cloud-function/main.tf | 30 ++++++-- modules/cloud-function/variables.tf | 41 ++++++++--- 3 files changed, 127 insertions(+), 53 deletions(-) diff --git a/modules/cloud-function/README.md b/modules/cloud-function/README.md index 323b33338b..89faca9cfb 100644 --- a/modules/cloud-function/README.md +++ b/modules/cloud-function/README.md @@ -21,12 +21,27 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } } -# tftest skip +# tftest modules=1 resources=2 +``` + +Analogous example using 2nd generation Cloud Functions +```hcl +module "cf-http" { + source = "./fabric/modules/cloud-function" + v2 = true + project_id = "my-project" + name = "test-cf-http" + bucket_name = "test-cf-bundles" + bundle_config = { + source_dir = "fabric/assets/" + output_path = "bundle.zip" + } +} +# tftest modules=1 resources=2 ``` ### PubSub and non-HTTP triggers @@ -40,19 +55,52 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } trigger_config = { event = "google.pubsub.topic.publish" - resource = local.my-topic - retry = null + resource = "local.my-topic" } } -# tftest skip +# tftest modules=1 resources=2 ``` +Cloud Functions 2nd gen support only [Eventarc](https://cloud.google.com/eventarc/docs) and user separate structure +to configure: +```hcl +module "trigger-service-account" { + source = "./fabric/modules/iam-service-account" + project_id = "my-project" + name = "sa-cloudfunction" + iam_project_roles = { + "my-project" = [ + "roles/run.invoker" + ] + } +} + +module "cf-http" { + source = "./fabric/modules/cloud-function" + project_id = "my-project" + v2 = true + name = "test-cf-http" + bucket_name = "test-cf-bundles" + bundle_config = { + source_dir = "fabric/assets/" + output_path = "bundle.zip" + } + trigger_config_v2 = { + event_type = "google.cloud.pubsub.topic.v1.messagePublished" + pubsub_topic = "local.my-topic" + service_account_email = module.trigger-service-account.email + } +} +# tftest modules=2 resources=4 +``` +Ensure that pubsub robo-account `service-%s@gcp-sa-pubsub.iam.gserviceaccount.com` has `roles/iam.serviceAccountTokenCreatator` +as documented [here](https://cloud.google.com/eventarc/docs/roles-permissions#pubsub-topic) + ### Controlling HTTP access To allow anonymous access to the function, grant the `roles/cloudfunctions.invoker` role to the special `allUsers` identifier. Use specific identities (service accounts, groups, etc.) instead of `allUsers` to only allow selective access. @@ -64,15 +112,14 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } iam = { "roles/cloudfunctions.invoker" = ["allUsers"] } } -# tftest skip +# tftest modules=1 resources=3 ``` ### GCS bucket creation @@ -86,16 +133,13 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bucket_config = { - location = null lifecycle_delete_age = 1 } bundle_config = { - source_dir = "my-cf-source-folder" - output_path = "bundle.zip" - excludes = null + source_dir = "fabric/assets/" } } -# tftest skip +# tftest modules=1 resources=3 ``` ### Service account management @@ -109,13 +153,12 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } service_account_create = true } -# tftest skip +# tftest modules=1 resources=3 ``` To use an externally managed service account, pass its email in `service_account` and leave `service_account_create` to `false` (the default). @@ -127,13 +170,12 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets/" output_path = "bundle.zip" - excludes = null } - service_account = local.service_account_email + service_account = "non-existent@serice.account.email" } -# tftest skip +# tftest modules=1 resources=2 ``` ### Custom bundle config @@ -147,12 +189,12 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets" output_path = "bundle.zip" excludes = ["__pycache__"] } } -# tftest skip +# tftest modules=1 resources=2 ``` ### Private Cloud Build Pool @@ -181,26 +223,27 @@ module "cf-http" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| | [bucket_name](variables.tf#L26) | Name of the bucket that will be used for the function code. It will be created with prefix prepended if bucket_config is not null. | string | ✓ | | -| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…}) | ✓ | | +| [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…}) | ✓ | | | [name](variables.tf#L94) | Name used for cloud function and associated resources. | string | ✓ | | | [project_id](variables.tf#L109) | Project id used for all resources. | string | ✓ | | -| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | +| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | | [build_worker_pool](variables.tf#L31) | Build worker pool, in projects//locations//workerPools/ format | string | | null | | [description](variables.tf#L46) | Optional description. | string | | "Terraform managed." | | [environment_variables](variables.tf#L52) | Cloud function environment variables. | map(string) | | {} | -| [function_config](variables.tf#L58) | Cloud function configuration. | object({…}) | | {…} | +| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | object({…}) | | {…} | | [iam](variables.tf#L76) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [ingress_settings](variables.tf#L82) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | | [labels](variables.tf#L88) | Resource labels. | map(string) | | {} | | [prefix](variables.tf#L99) | Optional prefix used for resource names. | string | | null | | [region](variables.tf#L114) | Region used for all resources. | string | | "europe-west1" | | [secrets](variables.tf#L120) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | -| [service_account](variables.tf#L132) | Service account email. Unused if service account is auto-created. | string | | null | +| [service_account](variables.tf#L132) | Service account email.service_account Unused if service account is auto-created. | string | | null | | [service_account_create](variables.tf#L138) | Auto-create service account. | bool | | false | -| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | -| [v2](variables.tf#L173) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | -| [vpc_connector](variables.tf#L154) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | -| [vpc_connector_config](variables.tf#L164) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | +| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | +| [trigger_config_v2](variables.tf#L154) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | +| [v2](variables.tf#L190) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | +| [vpc_connector](variables.tf#L171) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | +| [vpc_connector_config](variables.tf#L181) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | ## Outputs diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index 280f33c2ca..5a080cedeb 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -126,7 +126,6 @@ resource "google_cloudfunctions_function" "function" { } } } - } resource "google_cloudfunctions2_function" "function" { @@ -148,6 +147,25 @@ resource "google_cloudfunctions2_function" "function" { } } } + dynamic "event_trigger" { + for_each = var.trigger_config_v2 == null ? [] : [""] + content { + trigger_region = var.trigger_config_v2.region + event_type = var.trigger_config_v2.event_type + pubsub_topic = var.trigger_config_v2.pubsub_topic + dynamic "event_filters" { + for_each = var.trigger_config_v2.event_filters + iterator = event_filter + content { + attribute = event_filter.attribute + value = event_filter.value + operator = event_filter.operator + } + } + service_account_email = var.trigger_config_v2.service_account_email + retry_policy = var.trigger_config_v2.retry_policy + } + } service_config { max_instance_count = var.function_config.instances min_instance_count = 0 @@ -240,13 +258,9 @@ resource "google_storage_bucket_object" "bundle" { } data "archive_file" "bundle" { - type = "zip" - source_dir = var.bundle_config.source_dir - output_path = ( - var.bundle_config.output_path == null - ? "/tmp/bundle.zip" - : var.bundle_config.output_path - ) + type = "zip" + source_dir = var.bundle_config.source_dir + output_path = var.bundle_config.output_path output_file_mode = "0666" excludes = var.bundle_config.excludes } diff --git a/modules/cloud-function/variables.tf b/modules/cloud-function/variables.tf index 796b230ec7..d7fa6a22f4 100644 --- a/modules/cloud-function/variables.tf +++ b/modules/cloud-function/variables.tf @@ -17,8 +17,8 @@ variable "bucket_config" { description = "Enable and configure auto-created bucket. Set fields to null to use defaults." type = object({ - location = string - lifecycle_delete_age = number + location = optional(string) + lifecycle_delete_age = optional(number) }) default = null } @@ -38,8 +38,8 @@ variable "bundle_config" { description = "Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null." type = object({ source_dir = string - output_path = string - excludes = list(string) + output_path = optional(string, "/tmp/bundle.zip") + excludes = optional(list(string)) }) } @@ -56,13 +56,13 @@ variable "environment_variables" { } variable "function_config" { - description = "Cloud function configuration." + description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout" type = object({ - entry_point = string - instances = number - memory = number # Memory in MB - runtime = string - timeout = number + entry_point = optional(string, "main") + instances = optional(number, 1) + memory = optional(number, 256) # Memory in MB + runtime = optional(string, "python37") + timeout = optional(number, 180) }) default = { entry_point = "main" @@ -130,7 +130,7 @@ variable "secrets" { } variable "service_account" { - description = "Service account email. Unused if service account is auto-created." + description = "Service account email.service_account Unused if service account is auto-created." type = string default = null } @@ -146,7 +146,24 @@ variable "trigger_config" { type = object({ event = string resource = string - retry = bool + retry = optional(bool) + }) + default = null +} + +variable "trigger_config_v2" { + description = "Function trigger configuration. Leave null for HTTP trigger." + type = object({ + region = optional(string) + event_type = optional(string) + pubsub_topic = optional(string) + event_filters = optional(list(object({ + attribute = string + value = string + operator = string + })), []) + service_account_email = optional(string) + retry_policy = optional(string) }) default = null } From 9e37a915c8ae3a675dfd0815f654a665bd701d21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Sat, 12 Nov 2022 12:34:09 +0100 Subject: [PATCH 02/10] Review fixes. * Refactor trigger_config and trigger_config_v2 into one structure * bump default python version to 3.10 * typo fixes --- .../asset-inventory-feed-remediation/main.tf | 11 ++--- .../network-dashboard/main.tf | 19 ++++--- .../cloud-operations/quota-monitoring/main.tf | 11 ++--- .../main.tf | 19 +++---- .../unmanaged-instances-healthcheck/main.tf | 12 ++--- .../main.tf | 4 +- modules/cloud-function/README.md | 49 ++++++++++--------- modules/cloud-function/main.tf | 26 +++++----- modules/cloud-function/variables.tf | 45 ++++++++--------- 9 files changed, 100 insertions(+), 96 deletions(-) diff --git a/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf b/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf index 7fbe780c82..6fc1948e99 100644 --- a/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf +++ b/blueprints/cloud-operations/asset-inventory-feed-remediation/main.tf @@ -79,19 +79,18 @@ module "cf" { name = var.name bucket_name = "${var.name}-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } bundle_config = { source_dir = "cf" output_path = var.bundle_path - excludes = null } service_account = module.service-account.email trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } diff --git a/blueprints/cloud-operations/network-dashboard/main.tf b/blueprints/cloud-operations/network-dashboard/main.tf index 5710f25c1d..5dd62761a1 100644 --- a/blueprints/cloud-operations/network-dashboard/main.tf +++ b/blueprints/cloud-operations/network-dashboard/main.tf @@ -137,15 +137,13 @@ module "cloud-function" { name = "network-dashboard-cloud-function" bucket_name = "${local.monitoring_project}-network-dashboard-bucket" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } region = var.region bundle_config = { source_dir = "cloud-function" output_path = "cloud-function.zip" - excludes = null } function_config = { @@ -169,10 +167,17 @@ module "cloud-function" { # Internal only doesn't seem to work with CFv2: ingress_settings = var.cf_version == "V2" ? "ALLOW_ALL" : "ALLOW_INTERNAL_ONLY" - trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + trigger_config = var.cf_version == "V2" ? { + v2 = { + event_type = "google.cloud.pubsub.topic.v1.messagePublished" + pubsub_topic = module.pubsub.topic.id + # TODO: service_account_email + } + } : { + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } diff --git a/blueprints/cloud-operations/quota-monitoring/main.tf b/blueprints/cloud-operations/quota-monitoring/main.tf index 13804ba943..fae9af514c 100644 --- a/blueprints/cloud-operations/quota-monitoring/main.tf +++ b/blueprints/cloud-operations/quota-monitoring/main.tf @@ -52,13 +52,11 @@ module "cf" { name = var.name bucket_name = "${var.name}-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } bundle_config = { source_dir = "cf" output_path = var.bundle_path - excludes = null } # https://github.com/hashicorp/terraform-provider-archive/issues/40 # https://issuetracker.google.com/issues/155215191 @@ -68,9 +66,10 @@ module "cf" { } service_account_create = true trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } diff --git a/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf b/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf index 15d479a3b0..4366540572 100644 --- a/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf +++ b/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf @@ -91,19 +91,18 @@ module "cf" { name = var.name bucket_name = "${var.name}-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } bundle_config = { source_dir = "cf" output_path = var.bundle_path - excludes = null } service_account = module.service-account.email trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } @@ -125,9 +124,11 @@ module "cffile" { } service_account = module.service-account.email trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub_file.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub_file.topic.id + retry = null + } } } diff --git a/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf b/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf index 98882b0558..088f8aafaa 100644 --- a/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf +++ b/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf @@ -114,13 +114,11 @@ module "cf-restarter" { region = var.region bucket_name = "cf-bundle-bucket-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } bundle_config = { source_dir = "${path.module}/function/restarter" output_path = "restarter.zip" - excludes = [] } service_account = module.service-account-restarter.email @@ -134,9 +132,10 @@ module "cf-restarter" { } trigger_config = { - event = "google.pubsub.topic.publish" - resource = module.pubsub.topic.id - retry = null + v1 = { + event = "google.pubsub.topic.publish" + resource = module.pubsub.topic.id + } } } @@ -151,7 +150,6 @@ module "cf-healthchecker" { bundle_config = { source_dir = "${path.module}/function/healthchecker" output_path = "healthchecker.zip" - excludes = [] } service_account = module.service-account-healthchecker.email diff --git a/blueprints/networking/private-cloud-function-from-onprem/main.tf b/blueprints/networking/private-cloud-function-from-onprem/main.tf index e2f23f1fd6..5824c31939 100644 --- a/blueprints/networking/private-cloud-function-from-onprem/main.tf +++ b/blueprints/networking/private-cloud-function-from-onprem/main.tf @@ -195,11 +195,9 @@ module "function-hello" { bundle_config = { source_dir = "${path.module}/assets" output_path = "bundle.zip" - excludes = null } bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region } iam = { "roles/cloudfunctions.invoker" = ["allUsers"] diff --git a/modules/cloud-function/README.md b/modules/cloud-function/README.md index 89faca9cfb..eb64cf551d 100644 --- a/modules/cloud-function/README.md +++ b/modules/cloud-function/README.md @@ -50,23 +50,25 @@ Other trigger types other than HTTP are configured via the `trigger_config` vari ```hcl module "cf-http" { - source = "./fabric/modules/cloud-function" - project_id = "my-project" - name = "test-cf-http" - bucket_name = "test-cf-bundles" + source = "./fabric/modules/cloud-function" + project_id = "my-project" + name = "test-cf-http" + bucket_name = "test-cf-bundles" bundle_config = { source_dir = "fabric/assets/" output_path = "bundle.zip" } trigger_config = { - event = "google.pubsub.topic.publish" - resource = "local.my-topic" + v1 = { + event = "google.pubsub.topic.publish" + resource = "local.my-topic" + } } } # tftest modules=1 resources=2 ``` -Cloud Functions 2nd gen support only [Eventarc](https://cloud.google.com/eventarc/docs) and user separate structure +Cloud Functions 2nd gen support only [Eventarc](https://cloud.google.com/eventarc/docs) and uses separate structure to configure: ```hcl module "trigger-service-account" { @@ -81,19 +83,21 @@ module "trigger-service-account" { } module "cf-http" { - source = "./fabric/modules/cloud-function" - project_id = "my-project" - v2 = true - name = "test-cf-http" - bucket_name = "test-cf-bundles" + source = "./fabric/modules/cloud-function" + project_id = "my-project" + v2 = true + name = "test-cf-http" + bucket_name = "test-cf-bundles" bundle_config = { source_dir = "fabric/assets/" output_path = "bundle.zip" } - trigger_config_v2 = { - event_type = "google.cloud.pubsub.topic.v1.messagePublished" - pubsub_topic = "local.my-topic" - service_account_email = module.trigger-service-account.email + trigger_config = { + v2 = { + event_type = "google.cloud.pubsub.topic.v1.messagePublished" + pubsub_topic = "local.my-topic" + service_account_email = module.trigger-service-account.email + } } } # tftest modules=2 resources=4 @@ -230,20 +234,19 @@ module "cf-http" { | [build_worker_pool](variables.tf#L31) | Build worker pool, in projects//locations//workerPools/ format | string | | null | | [description](variables.tf#L46) | Optional description. | string | | "Terraform managed." | | [environment_variables](variables.tf#L52) | Cloud function environment variables. | map(string) | | {} | -| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | object({…}) | | {…} | +| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | object({…}) | | {…} | | [iam](variables.tf#L76) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [ingress_settings](variables.tf#L82) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | | [labels](variables.tf#L88) | Resource labels. | map(string) | | {} | | [prefix](variables.tf#L99) | Optional prefix used for resource names. | string | | null | | [region](variables.tf#L114) | Region used for all resources. | string | | "europe-west1" | | [secrets](variables.tf#L120) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | -| [service_account](variables.tf#L132) | Service account email.service_account Unused if service account is auto-created. | string | | null | +| [service_account](variables.tf#L132) | Service account email. Unused if service account is auto-created. | string | | null | | [service_account_create](variables.tf#L138) | Auto-create service account. | bool | | false | -| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | -| [trigger_config_v2](variables.tf#L154) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | -| [v2](variables.tf#L190) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | -| [vpc_connector](variables.tf#L171) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | -| [vpc_connector_config](variables.tf#L181) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | +| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | +| [v2](variables.tf#L191) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | +| [vpc_connector](variables.tf#L172) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | +| [vpc_connector_config](variables.tf#L182) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | ## Outputs diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index 5a080cedeb..816ed2592f 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -75,7 +75,7 @@ resource "google_cloudfunctions_function" "function" { source_archive_bucket = local.bucket source_archive_object = google_storage_bucket_object.bundle.name labels = var.labels - trigger_http = var.trigger_config == null ? true : null + trigger_http = try(var.trigger_config.v1 == null, true) ? true : null ingress_settings = var.ingress_settings build_worker_pool = var.build_worker_pool @@ -85,14 +85,14 @@ resource "google_cloudfunctions_function" "function" { ) dynamic "event_trigger" { - for_each = var.trigger_config == null ? [] : [""] + for_each = try(var.trigger_config.v1 == null, true) ? [] : [""] content { - event_type = var.trigger_config.event - resource = var.trigger_config.resource + event_type = var.trigger_config.v1.event + resource = var.trigger_config.v1.resource dynamic "failure_policy" { - for_each = var.trigger_config.retry == null ? [] : [""] + for_each = var.trigger_config.v1.retry == null ? [] : [""] content { - retry = var.trigger_config.retry + retry = var.trigger_config.v1.retry } } } @@ -148,13 +148,13 @@ resource "google_cloudfunctions2_function" "function" { } } dynamic "event_trigger" { - for_each = var.trigger_config_v2 == null ? [] : [""] + for_each = try(var.trigger_config.v2 == null, true) ? [] : [""] content { - trigger_region = var.trigger_config_v2.region - event_type = var.trigger_config_v2.event_type - pubsub_topic = var.trigger_config_v2.pubsub_topic + trigger_region = var.trigger_config.v2.region + event_type = var.trigger_config.v2.event_type + pubsub_topic = var.trigger_config.v2.pubsub_topic dynamic "event_filters" { - for_each = var.trigger_config_v2.event_filters + for_each = var.trigger_config.v2.event_filters == null ? [] : var.trigger_config.v2.event_filters iterator = event_filter content { attribute = event_filter.attribute @@ -162,8 +162,8 @@ resource "google_cloudfunctions2_function" "function" { operator = event_filter.operator } } - service_account_email = var.trigger_config_v2.service_account_email - retry_policy = var.trigger_config_v2.retry_policy + service_account_email = var.trigger_config.v2.service_account_email + retry_policy = var.trigger_config.v2.retry_policy } } service_config { diff --git a/modules/cloud-function/variables.tf b/modules/cloud-function/variables.tf index d7fa6a22f4..93d3634a0f 100644 --- a/modules/cloud-function/variables.tf +++ b/modules/cloud-function/variables.tf @@ -61,7 +61,7 @@ variable "function_config" { entry_point = optional(string, "main") instances = optional(number, 1) memory = optional(number, 256) # Memory in MB - runtime = optional(string, "python37") + runtime = optional(string, "python310") timeout = optional(number, 180) }) default = { @@ -130,7 +130,7 @@ variable "secrets" { } variable "service_account" { - description = "Service account email.service_account Unused if service account is auto-created." + description = "Service account email. Unused if service account is auto-created." type = string default = null } @@ -144,28 +144,29 @@ variable "service_account_create" { variable "trigger_config" { description = "Function trigger configuration. Leave null for HTTP trigger." type = object({ - event = string - resource = string - retry = optional(bool) - }) - default = null -} - -variable "trigger_config_v2" { - description = "Function trigger configuration. Leave null for HTTP trigger." - type = object({ - region = optional(string) - event_type = optional(string) - pubsub_topic = optional(string) - event_filters = optional(list(object({ - attribute = string - value = string - operator = string - })), []) - service_account_email = optional(string) - retry_policy = optional(string) + v1 = optional(object({ + event = string + resource = string + retry = optional(bool) + })), + v2 = optional(object({ + region = optional(string) + event_type = optional(string) + pubsub_topic = optional(string) + event_filters = optional(list(object({ + attribute = string + value = string + operator = string + }))) + service_account_email = optional(string) + retry_policy = optional(string) + })) }) default = null + validation { + condition = try(((var.trigger_config.v1 == null) != (var.trigger_config.v2 == null)), var.trigger_config == null) + error_message = "Provide configuration for only one generation - either v1 or v2" + } } variable "vpc_connector" { From 755ff7b1d2fb9aef3627efd19cbd720fa8cddf68 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Tue, 15 Nov 2022 13:35:27 +0100 Subject: [PATCH 03/10] Add trigger service account creation --- .../network-dashboard/main.tf | 6 +-- modules/cloud-function/README.md | 15 ++++--- modules/cloud-function/main.tf | 39 ++++++++++++++++++- modules/cloud-function/outputs.tf | 18 +++++++++ modules/cloud-function/variables.tf | 7 ++-- 5 files changed, 72 insertions(+), 13 deletions(-) diff --git a/blueprints/cloud-operations/network-dashboard/main.tf b/blueprints/cloud-operations/network-dashboard/main.tf index 5dd62761a1..1c5fd58f6d 100644 --- a/blueprints/cloud-operations/network-dashboard/main.tf +++ b/blueprints/cloud-operations/network-dashboard/main.tf @@ -169,9 +169,9 @@ module "cloud-function" { trigger_config = var.cf_version == "V2" ? { v2 = { - event_type = "google.cloud.pubsub.topic.v1.messagePublished" - pubsub_topic = module.pubsub.topic.id - # TODO: service_account_email + event_type = "google.cloud.pubsub.topic.v1.messagePublished" + pubsub_topic = module.pubsub.topic.id + service_account_create = true } } : { v1 = { diff --git a/modules/cloud-function/README.md b/modules/cloud-function/README.md index eb64cf551d..40619d4038 100644 --- a/modules/cloud-function/README.md +++ b/modules/cloud-function/README.md @@ -234,7 +234,7 @@ module "cf-http" { | [build_worker_pool](variables.tf#L31) | Build worker pool, in projects//locations//workerPools/ format | string | | null | | [description](variables.tf#L46) | Optional description. | string | | "Terraform managed." | | [environment_variables](variables.tf#L52) | Cloud function environment variables. | map(string) | | {} | -| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | object({…}) | | {…} | +| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | object({…}) | | {…} | | [iam](variables.tf#L76) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [ingress_settings](variables.tf#L82) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | | [labels](variables.tf#L88) | Resource labels. | map(string) | | {} | @@ -243,10 +243,10 @@ module "cf-http" { | [secrets](variables.tf#L120) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | | [service_account](variables.tf#L132) | Service account email. Unused if service account is auto-created. | string | | null | | [service_account_create](variables.tf#L138) | Auto-create service account. | bool | | false | -| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | -| [v2](variables.tf#L191) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | -| [vpc_connector](variables.tf#L172) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | -| [vpc_connector_config](variables.tf#L182) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | +| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | +| [v2](variables.tf#L192) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | +| [vpc_connector](variables.tf#L173) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | +| [vpc_connector_config](variables.tf#L183) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | ## Outputs @@ -259,7 +259,10 @@ module "cf-http" { | [service_account](outputs.tf#L42) | Service account resource. | | | [service_account_email](outputs.tf#L47) | Service account email. | | | [service_account_iam_email](outputs.tf#L52) | Service account email. | | +| [trigger_service_account](outputs.tf#L60) | Service account resource. | | +| [trigger_service_account_email](outputs.tf#L65) | Service account email. | | +| [trigger_service_account_iam_email](outputs.tf#L70) | Service account email. | | | [uri](outputs.tf#L38) | Cloud function service uri. | | -| [vpc_connector](outputs.tf#L60) | VPC connector resource if created. | | +| [vpc_connector](outputs.tf#L78) | VPC connector resource if created. | | diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index 816ed2592f..f81f698494 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -39,6 +39,16 @@ locals { ) : var.service_account ) + trigger_service_account_email = ( + try(var.trigger_config.v2.service_account_create, null) == null + ? false + : var.trigger_config.v2.service_account_create ? ( + length(google_service_account.trigger_service_account) > 0 + ? google_service_account.trigger_service_account[0].email + : null + ) + : try(var.trigger_config.v2.service_account_email, null) + ) vpc_connector = ( var.vpc_connector == null ? null @@ -212,7 +222,7 @@ resource "google_cloudfunctions2_function" "function" { } resource "google_cloudfunctions_function_iam_binding" "default" { - for_each = var.iam + for_each = var.v2 == false ? var.iam : {} project = var.project_id region = var.region cloud_function = local.function.name @@ -220,6 +230,15 @@ resource "google_cloudfunctions_function_iam_binding" "default" { members = each.value } +resource "google_cloudfunctions2_function_iam_binding" "default" { + for_each = var.v2 == true ? var.iam : {} + project = var.project_id + location = google_cloudfunctions2_function.function[0].location + cloud_function = local.function.name + role = each.key + members = each.value +} + resource "google_storage_bucket" "bucket" { count = var.bucket_config == null ? 0 : 1 project = var.project_id @@ -271,3 +290,21 @@ resource "google_service_account" "service_account" { account_id = "tf-cf-${var.name}" display_name = "Terraform Cloud Function ${var.name}." } + +resource "google_service_account" "trigger_service_account" { + count = try(var.trigger_config.v2.service_account_create, null) == null ? 0 : ( + var.trigger_config.v2.service_account_create ? 1 : 0 + ) + project = var.project_id + account_id = "tf-cf-trigger-${var.name}" + display_name = "Terraform trigger for Cloud Function ${var.name}." +} + +resource "google_project_iam_member" "trigger_iam" { + count = try(var.trigger_config.v2.service_account_create, null) == null ? 0 : ( + var.trigger_config.v2.service_account_create ? 1 : 0 + ) + project = var.project_id + member = "serviceAccount:${google_service_account.trigger_service_account[0].email}" + role = "roles/run.invoker" +} diff --git a/modules/cloud-function/outputs.tf b/modules/cloud-function/outputs.tf index a4bbcebb4e..5f6e12bef9 100644 --- a/modules/cloud-function/outputs.tf +++ b/modules/cloud-function/outputs.tf @@ -57,6 +57,24 @@ output "service_account_iam_email" { ]) } +output "trigger_service_account" { + description = "Service account resource." + value = try(google_service_account.trigger_service_account[0], null) +} + +output "trigger_service_account_email" { + description = "Service account email." + value = local.trigger_service_account_email +} + +output "trigger_service_account_iam_email" { + description = "Service account email." + value = join("", [ + "serviceAccount:", + local.trigger_service_account_email == null ? "" : local.trigger_service_account_email + ]) +} + output "vpc_connector" { description = "VPC connector resource if created." value = try(google_vpc_access_connector.connector.0.id, null) diff --git a/modules/cloud-function/variables.tf b/modules/cloud-function/variables.tf index 93d3634a0f..c701dbe330 100644 --- a/modules/cloud-function/variables.tf +++ b/modules/cloud-function/variables.tf @@ -68,7 +68,7 @@ variable "function_config" { entry_point = "main" instances = 1 memory = 256 - runtime = "python37" + runtime = "python310" timeout = 180 } } @@ -158,8 +158,9 @@ variable "trigger_config" { value = string operator = string }))) - service_account_email = optional(string) - retry_policy = optional(string) + service_account_email = optional(string) + service_account_create = optional(bool) + retry_policy = optional(string) })) }) default = null From 4e6e67293b0e0aaf9a62b9095b457aab21a5a375 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Tue, 15 Nov 2022 14:01:18 +0100 Subject: [PATCH 04/10] Move comparision outside of try --- modules/cloud-function/main.tf | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index f81f698494..41af998485 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -85,9 +85,10 @@ resource "google_cloudfunctions_function" "function" { source_archive_bucket = local.bucket source_archive_object = google_storage_bucket_object.bundle.name labels = var.labels - trigger_http = try(var.trigger_config.v1 == null, true) ? true : null - ingress_settings = var.ingress_settings - build_worker_pool = var.build_worker_pool + trigger_http = try(var.trigger_config.v1, null) == null ? true : null + + ingress_settings = var.ingress_settings + build_worker_pool = var.build_worker_pool vpc_connector = local.vpc_connector vpc_connector_egress_settings = try( @@ -95,7 +96,7 @@ resource "google_cloudfunctions_function" "function" { ) dynamic "event_trigger" { - for_each = try(var.trigger_config.v1 == null, true) ? [] : [""] + for_each = try(var.trigger_config.v1, null) != null ? [""] : [] content { event_type = var.trigger_config.v1.event resource = var.trigger_config.v1.resource @@ -158,7 +159,7 @@ resource "google_cloudfunctions2_function" "function" { } } dynamic "event_trigger" { - for_each = try(var.trigger_config.v2 == null, true) ? [] : [""] + for_each = try(var.trigger_config.v2, null) != null ? [""] : [] content { trigger_region = var.trigger_config.v2.region event_type = var.trigger_config.v2.event_type From 5b0b1af2f62051251cf2e71e8fc696b617f4f756 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Tue, 15 Nov 2022 15:27:53 +0100 Subject: [PATCH 05/10] Fix tests refering to wrong IAM resource --- tests/modules/cloud_function_v2/test_plan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/modules/cloud_function_v2/test_plan.py b/tests/modules/cloud_function_v2/test_plan.py index de5a06a9d5..44b7c27fd2 100644 --- a/tests/modules/cloud_function_v2/test_plan.py +++ b/tests/modules/cloud_function_v2/test_plan.py @@ -29,6 +29,6 @@ def test_resource_count(resources): def test_iam(resources): "Test IAM binding resources." bindings = [r['values'] for r in resources if r['type'] - == 'google_cloudfunctions_function_iam_binding'] + == 'google_cloudfunctions2_function_iam_binding'] assert len(bindings) == 1 assert bindings[0]['role'] == 'roles/cloudfunctions.invoker' From de2bea16a44c2255b3f9913db3e0cbadae68213c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Tue, 15 Nov 2022 17:03:56 +0100 Subject: [PATCH 06/10] Make trigger_config non-nullable and simplify expressions --- modules/cloud-function/README.md | 2 +- modules/cloud-function/main.tf | 18 +++++++----------- modules/cloud-function/variables.tf | 4 ++-- 3 files changed, 10 insertions(+), 14 deletions(-) diff --git a/modules/cloud-function/README.md b/modules/cloud-function/README.md index 40619d4038..c49e5dc863 100644 --- a/modules/cloud-function/README.md +++ b/modules/cloud-function/README.md @@ -243,7 +243,7 @@ module "cf-http" { | [secrets](variables.tf#L120) | Secret Manager secrets. Key is the variable name or mountpoint, volume versions are in version:path format. | map(object({…})) | | {} | | [service_account](variables.tf#L132) | Service account email. Unused if service account is auto-created. | string | | null | | [service_account_create](variables.tf#L138) | Auto-create service account. | bool | | false | -| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | null | +| [trigger_config](variables.tf#L144) | Function trigger configuration. Leave null for HTTP trigger. | object({…}) | | { v1 = null, v2 = null } | | [v2](variables.tf#L192) | Whether to use Cloud Function version 2nd Gen or 1st Gen. | bool | | false | | [vpc_connector](variables.tf#L173) | VPC connector configuration. Set create to 'true' if a new connector needs to be created. | object({…}) | | null | | [vpc_connector_config](variables.tf#L183) | VPC connector network configuration. Must be provided if new VPC connector is being created. | object({…}) | | null | diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index 41af998485..5e5110c2a0 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -85,7 +85,7 @@ resource "google_cloudfunctions_function" "function" { source_archive_bucket = local.bucket source_archive_object = google_storage_bucket_object.bundle.name labels = var.labels - trigger_http = try(var.trigger_config.v1, null) == null ? true : null + trigger_http = var.trigger_config.v1 == null ? true : null ingress_settings = var.ingress_settings build_worker_pool = var.build_worker_pool @@ -96,7 +96,7 @@ resource "google_cloudfunctions_function" "function" { ) dynamic "event_trigger" { - for_each = try(var.trigger_config.v1, null) != null ? [""] : [] + for_each = var.trigger_config.v1 == null ? [] : [""] content { event_type = var.trigger_config.v1.event resource = var.trigger_config.v1.resource @@ -159,7 +159,7 @@ resource "google_cloudfunctions2_function" "function" { } } dynamic "event_trigger" { - for_each = try(var.trigger_config.v2, null) != null ? [""] : [] + for_each = var.trigger_config.v2 == null ? [] : [""] content { trigger_region = var.trigger_config.v2.region event_type = var.trigger_config.v2.event_type @@ -223,7 +223,7 @@ resource "google_cloudfunctions2_function" "function" { } resource "google_cloudfunctions_function_iam_binding" "default" { - for_each = var.v2 == false ? var.iam : {} + for_each = !var.v2 ? var.iam : {} project = var.project_id region = var.region cloud_function = local.function.name @@ -232,7 +232,7 @@ resource "google_cloudfunctions_function_iam_binding" "default" { } resource "google_cloudfunctions2_function_iam_binding" "default" { - for_each = var.v2 == true ? var.iam : {} + for_each = var.v2 ? var.iam : {} project = var.project_id location = google_cloudfunctions2_function.function[0].location cloud_function = local.function.name @@ -293,18 +293,14 @@ resource "google_service_account" "service_account" { } resource "google_service_account" "trigger_service_account" { - count = try(var.trigger_config.v2.service_account_create, null) == null ? 0 : ( - var.trigger_config.v2.service_account_create ? 1 : 0 - ) + count = try(var.trigger_config.v2.service_account_create, false) == true ? 1 : 0 project = var.project_id account_id = "tf-cf-trigger-${var.name}" display_name = "Terraform trigger for Cloud Function ${var.name}." } resource "google_project_iam_member" "trigger_iam" { - count = try(var.trigger_config.v2.service_account_create, null) == null ? 0 : ( - var.trigger_config.v2.service_account_create ? 1 : 0 - ) + count = try(var.trigger_config.v2.service_account_create, false) == true ? 1 : 0 project = var.project_id member = "serviceAccount:${google_service_account.trigger_service_account[0].email}" role = "roles/run.invoker" diff --git a/modules/cloud-function/variables.tf b/modules/cloud-function/variables.tf index c701dbe330..7cd573bd5f 100644 --- a/modules/cloud-function/variables.tf +++ b/modules/cloud-function/variables.tf @@ -163,9 +163,9 @@ variable "trigger_config" { retry_policy = optional(string) })) }) - default = null + default = { v1 = null, v2 = null } validation { - condition = try(((var.trigger_config.v1 == null) != (var.trigger_config.v2 == null)), var.trigger_config == null) + condition = !(var.trigger_config.v1 != null && var.trigger_config.v2 != null) error_message = "Provide configuration for only one generation - either v1 or v2" } } From 97c6a25b90b22e5386d7627df93357b982cd1107 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Wed, 16 Nov 2022 09:31:43 +0100 Subject: [PATCH 07/10] Use hungarian notation. As per: https://cloud.google.com/apis/design/naming_convention#quantities --- .../network-dashboard/main.tf | 2 +- .../main.tf | 4 ++-- .../unmanaged-instances-healthcheck/main.tf | 8 +++---- blueprints/serverless/api-gateway/main.tf | 4 ++-- modules/cloud-function/README.md | 2 +- modules/cloud-function/main.tf | 18 +++++++------- modules/cloud-function/variables.tf | 24 +++++++++---------- 7 files changed, 31 insertions(+), 31 deletions(-) diff --git a/blueprints/cloud-operations/network-dashboard/main.tf b/blueprints/cloud-operations/network-dashboard/main.tf index 1c5fd58f6d..e74cabd6e2 100644 --- a/blueprints/cloud-operations/network-dashboard/main.tf +++ b/blueprints/cloud-operations/network-dashboard/main.tf @@ -151,7 +151,7 @@ module "cloud-function" { entry_point = "main" runtime = "python39" instances = 1 - memory = 256 # Memory in MB + memory_mb = 256 } diff --git a/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf b/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf index 4366540572..1be2d1a983 100644 --- a/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf +++ b/blueprints/cloud-operations/scheduled-asset-inventory-export-bq/main.tf @@ -114,8 +114,8 @@ module "cffile" { name = var.name_cffile bucket_name = "${var.name_cffile}-${random_pet.random.id}" bucket_config = { - location = var.region - lifecycle_delete_age = null + location = var.region + lifecycle_delete_age_days = null } bundle_config = { source_dir = "cffile" diff --git a/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf b/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf index 088f8aafaa..d69dddf2b5 100644 --- a/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf +++ b/blueprints/cloud-operations/unmanaged-instances-healthcheck/main.tf @@ -125,8 +125,8 @@ module "cf-restarter" { function_config = { entry_point = "RestartInstance" ingress_settings = null - instances = 1 - memory = 256 + instance_count = 1 + memory_mb = 256 runtime = "go116" timeout = 300 } @@ -156,8 +156,8 @@ module "cf-healthchecker" { function_config = { entry_point = "HealthCheck" ingress_settings = null - instances = 1 - memory = 256 + instance_count = 1 + memory_mb = 256 runtime = "go116" timeout = 300 } diff --git a/blueprints/serverless/api-gateway/main.tf b/blueprints/serverless/api-gateway/main.tf index 664ee990f4..4fe132eda0 100644 --- a/blueprints/serverless/api-gateway/main.tf +++ b/blueprints/serverless/api-gateway/main.tf @@ -70,8 +70,8 @@ module "functions" { region = each.value ingress_settings = "ALLOW_ALL" bucket_config = { - location = null - lifecycle_delete_age = 1 + location = null + lifecycle_delete_age_days = 1 } bundle_config = { source_dir = "${path.module}/function" diff --git a/modules/cloud-function/README.md b/modules/cloud-function/README.md index c49e5dc863..debd658b33 100644 --- a/modules/cloud-function/README.md +++ b/modules/cloud-function/README.md @@ -137,7 +137,7 @@ module "cf-http" { name = "test-cf-http" bucket_name = "test-cf-bundles" bucket_config = { - lifecycle_delete_age = 1 + lifecycle_delete_age_days = 1 } bundle_config = { source_dir = "fabric/assets/" diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index 5e5110c2a0..46400aee85 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -76,9 +76,9 @@ resource "google_cloudfunctions_function" "function" { name = "${local.prefix}${var.name}" description = var.description runtime = var.function_config.runtime - available_memory_mb = var.function_config.memory - max_instances = var.function_config.instances - timeout = var.function_config.timeout + available_memory_mb = var.function_config.memory_mb + max_instances = var.function_config.instance_count + timeout = var.function_config.timeout_seconds entry_point = var.function_config.entry_point environment_variables = var.environment_variables service_account_email = local.service_account_email @@ -178,10 +178,10 @@ resource "google_cloudfunctions2_function" "function" { } } service_config { - max_instance_count = var.function_config.instances + max_instance_count = var.function_config.instance_count min_instance_count = 0 - available_memory = "${var.function_config.memory}M" - timeout_seconds = var.function_config.timeout + available_memory = "${var.function_config.memory_mb}M" + timeout_seconds = var.function_config.timeout_seconds environment_variables = var.environment_variables ingress_settings = var.ingress_settings all_traffic_on_latest_revision = true @@ -253,18 +253,18 @@ resource "google_storage_bucket" "bucket" { labels = var.labels dynamic "lifecycle_rule" { - for_each = var.bucket_config.lifecycle_delete_age == null ? [] : [""] + for_each = var.bucket_config.lifecycle_delete_age_days == null ? [] : [""] content { action { type = "Delete" } condition { - age = var.bucket_config.lifecycle_delete_age + age = var.bucket_config.lifecycle_delete_age_days with_state = "ARCHIVED" } } } dynamic "versioning" { - for_each = var.bucket_config.lifecycle_delete_age == null ? [] : [""] + for_each = var.bucket_config.lifecycle_delete_age_days == null ? [] : [""] content { enabled = true } diff --git a/modules/cloud-function/variables.tf b/modules/cloud-function/variables.tf index 7cd573bd5f..08e166d937 100644 --- a/modules/cloud-function/variables.tf +++ b/modules/cloud-function/variables.tf @@ -17,8 +17,8 @@ variable "bucket_config" { description = "Enable and configure auto-created bucket. Set fields to null to use defaults." type = object({ - location = optional(string) - lifecycle_delete_age = optional(number) + location = optional(string) + lifecycle_delete_age_days = optional(number) }) default = null } @@ -58,18 +58,18 @@ variable "environment_variables" { variable "function_config" { description = "Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout" type = object({ - entry_point = optional(string, "main") - instances = optional(number, 1) - memory = optional(number, 256) # Memory in MB - runtime = optional(string, "python310") - timeout = optional(number, 180) + entry_point = optional(string, "main") + instance_count = optional(number, 1) + memory_mb = optional(number, 256) # Memory in MB + runtime = optional(string, "python310") + timeout_seconds = optional(number, 180) }) default = { - entry_point = "main" - instances = 1 - memory = 256 - runtime = "python310" - timeout = 180 + entry_point = "main" + instance_count = 1 + memory_mb = 256 + runtime = "python310" + timeout_seconds = 180 } } From bce8e2b0828797482e15433cd25f4fe1a843838e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Wed, 16 Nov 2022 09:55:45 +0100 Subject: [PATCH 08/10] Re-enable tests --- modules/cloud-function/README.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/modules/cloud-function/README.md b/modules/cloud-function/README.md index debd658b33..9d8994c04f 100644 --- a/modules/cloud-function/README.md +++ b/modules/cloud-function/README.md @@ -213,12 +213,11 @@ module "cf-http" { bucket_name = "test-cf-bundles" build_worker_pool = "projects/my-project/locations/europe-west1/workerPools/my_build_worker_pool" bundle_config = { - source_dir = "my-cf-source-folder" + source_dir = "fabric/assets" output_path = "bundle.zip" - excludes = null } } -# tftest skip +# tftest modules=1 resources=2 ``` @@ -230,11 +229,11 @@ module "cf-http" { | [bundle_config](variables.tf#L37) | Cloud function source folder and generated zip bundle paths. Output path defaults to '/tmp/bundle.zip' if null. | object({…}) | ✓ | | | [name](variables.tf#L94) | Name used for cloud function and associated resources. | string | ✓ | | | [project_id](variables.tf#L109) | Project id used for all resources. | string | ✓ | | -| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | +| [bucket_config](variables.tf#L17) | Enable and configure auto-created bucket. Set fields to null to use defaults. | object({…}) | | null | | [build_worker_pool](variables.tf#L31) | Build worker pool, in projects//locations//workerPools/ format | string | | null | | [description](variables.tf#L46) | Optional description. | string | | "Terraform managed." | | [environment_variables](variables.tf#L52) | Cloud function environment variables. | map(string) | | {} | -| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | object({…}) | | {…} | +| [function_config](variables.tf#L58) | Cloud function configuration. Defaults to using main as entrypoint, 1 instance with 256MiB of memory, and 180 second timeout | object({…}) | | {…} | | [iam](variables.tf#L76) | IAM bindings for topic in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} | | [ingress_settings](variables.tf#L82) | Control traffic that reaches the cloud function. Allowed values are ALLOW_ALL, ALLOW_INTERNAL_AND_GCLB and ALLOW_INTERNAL_ONLY . | string | | null | | [labels](variables.tf#L88) | Resource labels. | map(string) | | {} | From 4947ac50289884397228563aeb57a6639c45597f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Wed, 16 Nov 2022 14:23:48 +0100 Subject: [PATCH 09/10] Simplify trigger_service_account_email variable expression --- modules/cloud-function/main.tf | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index 46400aee85..95ed4734e6 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -40,14 +40,9 @@ locals { : var.service_account ) trigger_service_account_email = ( - try(var.trigger_config.v2.service_account_create, null) == null - ? false - : var.trigger_config.v2.service_account_create ? ( - length(google_service_account.trigger_service_account) > 0 - ? google_service_account.trigger_service_account[0].email - : null - ) - : try(var.trigger_config.v2.service_account_email, null) + coalesce(try(var.trigger_config.v2.service_account_create, false), false) + ? google_service_account.trigger_service_account[0].email + : null ) vpc_connector = ( var.vpc_connector == null @@ -293,14 +288,14 @@ resource "google_service_account" "service_account" { } resource "google_service_account" "trigger_service_account" { - count = try(var.trigger_config.v2.service_account_create, false) == true ? 1 : 0 + count = coalesce(try(var.trigger_config.v2.service_account_create, false), false) ? 1 : 0 project = var.project_id account_id = "tf-cf-trigger-${var.name}" display_name = "Terraform trigger for Cloud Function ${var.name}." } resource "google_project_iam_member" "trigger_iam" { - count = try(var.trigger_config.v2.service_account_create, false) == true ? 1 : 0 + count = coalesce(try(var.trigger_config.v2.service_account_create, false), false) ? 1 : 0 project = var.project_id member = "serviceAccount:${google_service_account.trigger_service_account[0].email}" role = "roles/run.invoker" From 01218060e80d05fe2a6f7d74bd3a48b4a26c153d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Wiktor=20Niesiob=C4=99dzki?= Date: Wed, 16 Nov 2022 15:24:42 +0100 Subject: [PATCH 10/10] Simplify service_account_email expression --- modules/cloud-function/main.tf | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/modules/cloud-function/main.tf b/modules/cloud-function/main.tf index 95ed4734e6..35dba72942 100644 --- a/modules/cloud-function/main.tf +++ b/modules/cloud-function/main.tf @@ -29,16 +29,8 @@ locals { ? google_cloudfunctions2_function.function[0] : google_cloudfunctions_function.function[0] ) - prefix = var.prefix == null ? "" : "${var.prefix}-" - service_account_email = ( - var.service_account_create - ? ( - length(google_service_account.service_account) > 0 - ? google_service_account.service_account[0].email - : null - ) - : var.service_account - ) + prefix = var.prefix == null ? "" : "${var.prefix}-" + service_account_email = var.service_account_create ? google_service_account.service_account[0].email : var.service_account trigger_service_account_email = ( coalesce(try(var.trigger_config.v2.service_account_create, false), false) ? google_service_account.trigger_service_account[0].email