string | ✓ | |
+| [custom_domain](variables.tf#L17) | Custom domain for the Load Balancer. | string | | null |
+| [iap](variables.tf#L23) | Identity-Aware Proxy for Cloud Run in the LB. | object({…}) | | {} |
+| [image](variables.tf#L34) | Container image to deploy. | string | | "us-docker.pkg.dev/cloudrun/container/hello" |
+| [ingress_settings](variables.tf#L40) | Ingress traffic sources allowed to call the service. | string | | "all" |
+| [project_create](variables.tf#L46) | Parameters for the creation of a new project. | object({…}) | | null |
+| [region](variables.tf#L60) | Cloud region where resource will be deployed. | string | | "europe-west1" |
+| [run_svc_name](variables.tf#L66) | Cloud Run service name. | string | | "hello" |
+| [security_policy](variables.tf#L72) | Security policy (Cloud Armor) to enforce in the LB. | object({…}) | | {} |
+
+## Outputs
+
+| name | description | sensitive |
+|---|---|:---:|
+| [custom_domain](outputs.tf#L19) | Custom domain for the Load Balancer. | |
+| [default_URL](outputs.tf#L24) | Cloud Run service default URL. | |
+| [load_balancer_ip](outputs.tf#L29) | LB IP that forwards to Cloud Run service. | |
+
+
+
+## Tests
+
+```hcl
+module "test" {
+ source = "./fabric/blueprints/serverless/cloud-run-explore"
+ project_create = {
+ billing_account_id = "ABCDE-12345-ABCDE"
+ parent = "organizations/0123456789"
+ }
+ project_id = "myproject"
+ custom_domain = "cloud-run-explore.example.org"
+ ingress_settings = "internal-and-cloud-load-balancing"
+ security_policy = {
+ enabled = true
+ ip_blacklist = ["79.149.0.0/16"]
+ }
+ iap = {
+ enabled = true
+ email = "user@example.org"
+ }
+}
+
+# tftest modules=4 resources=17
+```
\ No newline at end of file
diff --git a/blueprints/serverless/cloud-run-explore/images/architecture.png b/blueprints/serverless/cloud-run-explore/images/architecture.png
new file mode 100644
index 0000000000..46e3a41df0
Binary files /dev/null and b/blueprints/serverless/cloud-run-explore/images/architecture.png differ
diff --git a/blueprints/serverless/cloud-run-explore/images/forbidden.png b/blueprints/serverless/cloud-run-explore/images/forbidden.png
new file mode 100644
index 0000000000..67d313b856
Binary files /dev/null and b/blueprints/serverless/cloud-run-explore/images/forbidden.png differ
diff --git a/blueprints/serverless/cloud-run-explore/images/service-running.png b/blueprints/serverless/cloud-run-explore/images/service-running.png
new file mode 100644
index 0000000000..2c517a0ac6
Binary files /dev/null and b/blueprints/serverless/cloud-run-explore/images/service-running.png differ
diff --git a/blueprints/serverless/cloud-run-explore/images/use-case-1.png b/blueprints/serverless/cloud-run-explore/images/use-case-1.png
new file mode 100644
index 0000000000..8028c65da5
Binary files /dev/null and b/blueprints/serverless/cloud-run-explore/images/use-case-1.png differ
diff --git a/blueprints/serverless/cloud-run-explore/images/use-case-2.png b/blueprints/serverless/cloud-run-explore/images/use-case-2.png
new file mode 100644
index 0000000000..a0fafb9946
Binary files /dev/null and b/blueprints/serverless/cloud-run-explore/images/use-case-2.png differ
diff --git a/blueprints/serverless/cloud-run-explore/images/use-case-3.png b/blueprints/serverless/cloud-run-explore/images/use-case-3.png
new file mode 100644
index 0000000000..af834a3d1a
Binary files /dev/null and b/blueprints/serverless/cloud-run-explore/images/use-case-3.png differ
diff --git a/blueprints/serverless/cloud-run-explore/images/use-case-4.png b/blueprints/serverless/cloud-run-explore/images/use-case-4.png
new file mode 100644
index 0000000000..113e9206ea
Binary files /dev/null and b/blueprints/serverless/cloud-run-explore/images/use-case-4.png differ
diff --git a/blueprints/serverless/cloud-run-explore/images/use-case-5.png b/blueprints/serverless/cloud-run-explore/images/use-case-5.png
new file mode 100644
index 0000000000..d4f918782d
Binary files /dev/null and b/blueprints/serverless/cloud-run-explore/images/use-case-5.png differ
diff --git a/blueprints/serverless/cloud-run-explore/main.tf b/blueprints/serverless/cloud-run-explore/main.tf
new file mode 100644
index 0000000000..04bb3cc8b8
--- /dev/null
+++ b/blueprints/serverless/cloud-run-explore/main.tf
@@ -0,0 +1,187 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+ gclb_create = var.custom_domain == null ? false : true
+}
+
+module "project" {
+ source = "../../../modules/project"
+ billing_account = (var.project_create != null
+ ? var.project_create.billing_account_id
+ : null
+ )
+ parent = (var.project_create != null
+ ? var.project_create.parent
+ : null
+ )
+ name = var.project_id
+ services = [
+ "run.googleapis.com",
+ "compute.googleapis.com",
+ "iap.googleapis.com"
+ ]
+ project_create = var.project_create != null
+}
+
+# Cloud Run service
+module "cloud_run" {
+ source = "../../../modules/cloud-run"
+ project_id = module.project.project_id
+ name = var.run_svc_name
+ region = var.region
+ containers = [{
+ image = var.image
+ options = null
+ ports = null
+ resources = null
+ volume_mounts = null
+ }]
+ iam = {
+ "roles/run.invoker" = ["allUsers"]
+ }
+ ingress_settings = var.ingress_settings
+}
+
+# Reserved static IP for the Load Balancer
+resource "google_compute_global_address" "default" {
+ count = local.gclb_create ? 1 : 0
+ project = module.project.project_id
+ name = "glb-ip"
+}
+
+# Global L7 HTTPS Load Balancer in front of Cloud Run
+module "glb" {
+ source = "../../../modules/net-glb"
+ count = local.gclb_create ? 1 : 0
+ project_id = module.project.project_id
+ name = "glb"
+ address = google_compute_global_address.default[0].address
+ backend_service_configs = {
+ default = {
+ backends = [
+ { backend = "neg-0" }
+ ]
+ health_checks = []
+ port_name = "http"
+ security_policy = try(google_compute_security_policy.policy[0].name,
+ null)
+ iap_config = try({
+ oauth2_client_id = google_iap_client.iap_client[0].client_id,
+ oauth2_client_secret = google_iap_client.iap_client[0].secret
+ }, null)
+ }
+ }
+ health_check_configs = {}
+ neg_configs = {
+ neg-0 = {
+ cloudrun = {
+ region = var.region
+ target_service = {
+ name = var.run_svc_name
+ }
+ }
+ }
+ }
+ protocol = "HTTPS"
+ ssl_certificates = {
+ managed_configs = {
+ default = {
+ domains = [var.custom_domain]
+ }
+ }
+ }
+}
+
+# Cloud Armor configuration
+resource "google_compute_security_policy" "policy" {
+ count = local.gclb_create && var.security_policy.enabled ? 1 : 0
+ name = "cloud-run-policy"
+ project = module.project.project_id
+ rule {
+ action = "deny(403)"
+ priority = 1000
+ match {
+ versioned_expr = "SRC_IPS_V1"
+ config {
+ src_ip_ranges = var.security_policy.ip_blacklist
+ }
+ }
+ description = "Deny access to list of IPs"
+ }
+ rule {
+ action = "deny(403)"
+ priority = 900
+ match {
+ expr {
+ expression = "request.path.matches(\"${var.security_policy.path_blocked}\")"
+ }
+ }
+ description = "Deny access to specific URL paths"
+ }
+ rule {
+ action = "allow"
+ priority = "2147483647"
+ match {
+ versioned_expr = "SRC_IPS_V1"
+ config {
+ src_ip_ranges = ["*"]
+ }
+ }
+ description = "Default rule"
+ }
+}
+
+# Identity-Aware Proxy (IAP) or OAuth brand (see OAuth consent screen)
+# Note:
+# Only "Organization Internal" brands can be created programmatically
+# via API. To convert it into an external brand please use the GCP
+# Console.
+# Brands can only be created once for a Google Cloud project and the
+# underlying Google API doesn't support DELETE or PATCH methods.
+# Destroying a Terraform-managed Brand will remove it from state but
+# will not delete it from Google Cloud.
+resource "google_iap_brand" "iap_brand" {
+ count = local.gclb_create && var.iap.enabled ? 1 : 0
+ project = module.project.project_id
+ # Support email displayed on the OAuth consent screen. The caller must be
+ # the user with the associated email address, or if a group email is
+ # specified, the caller can be either a user or a service account which
+ # is an owner of the specified group in Cloud Identity.
+ support_email = var.iap.email
+ application_title = var.iap.app_title
+}
+
+# IAP owned OAuth2 client
+# Note:
+# Only internal org clients can be created via declarative tools.
+# External clients must be manually created via the GCP console.
+# Warning:
+# All arguments including secret will be stored in the raw state as plain-text.
+resource "google_iap_client" "iap_client" {
+ count = local.gclb_create && var.iap.enabled ? 1 : 0
+ display_name = var.iap.oauth2_client_name
+ brand = google_iap_brand.iap_brand[0].name
+}
+
+# IAM policy for IAP
+# For simplicity we use the same email as support_email and authorized member
+resource "google_iap_web_iam_member" "iap_iam" {
+ count = local.gclb_create && var.iap.enabled ? 1 : 0
+ project = module.project.project_id
+ role = "roles/iap.httpsResourceAccessor"
+ member = "user:${var.iap.email}"
+}
diff --git a/blueprints/serverless/cloud-run-explore/outputs.tf b/blueprints/serverless/cloud-run-explore/outputs.tf
new file mode 100644
index 0000000000..2005b13d88
--- /dev/null
+++ b/blueprints/serverless/cloud-run-explore/outputs.tf
@@ -0,0 +1,32 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+# Custom domain for the Load Balancer. I'd prefer getting the value from the
+# SSL certificate but it is not exported as output
+output "custom_domain" {
+ description = "Custom domain for the Load Balancer."
+ value = local.gclb_create ? var.custom_domain : "none"
+}
+
+output "default_URL" {
+ description = "Cloud Run service default URL."
+ value = module.cloud_run.service.status[0].url
+}
+
+output "load_balancer_ip" {
+ description = "LB IP that forwards to Cloud Run service."
+ value = local.gclb_create ? module.glb[0].address : "none"
+}
diff --git a/blueprints/serverless/cloud-run-explore/variables.tf b/blueprints/serverless/cloud-run-explore/variables.tf
new file mode 100644
index 0000000000..1c3b04a1a9
--- /dev/null
+++ b/blueprints/serverless/cloud-run-explore/variables.tf
@@ -0,0 +1,80 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "custom_domain" {
+ description = "Custom domain for the Load Balancer."
+ type = string
+ default = null
+}
+
+variable "iap" {
+ description = "Identity-Aware Proxy for Cloud Run in the LB."
+ type = object({
+ enabled = optional(bool, false)
+ app_title = optional(string, "Cloud Run Explore Application")
+ oauth2_client_name = optional(string, "Test Client")
+ email = optional(string)
+ })
+ default = {}
+}
+
+variable "image" {
+ description = "Container image to deploy."
+ type = string
+ default = "us-docker.pkg.dev/cloudrun/container/hello"
+}
+
+variable "ingress_settings" {
+ description = "Ingress traffic sources allowed to call the service."
+ type = string
+ default = "all"
+}
+
+variable "project_create" {
+ description = "Parameters for the creation of a new project."
+ type = object({
+ billing_account_id = string
+ parent = string
+ })
+ default = null
+}
+
+variable "project_id" {
+ description = "Project ID."
+ type = string
+}
+
+variable "region" {
+ description = "Cloud region where resource will be deployed."
+ type = string
+ default = "europe-west1"
+}
+
+variable "run_svc_name" {
+ description = "Cloud Run service name."
+ type = string
+ default = "hello"
+}
+
+variable "security_policy" {
+ description = "Security policy (Cloud Armor) to enforce in the LB."
+ type = object({
+ enabled = optional(bool, false)
+ ip_blacklist = optional(list(string), ["*"])
+ path_blocked = optional(string, "/login.html")
+ })
+ default = {}
+}