Skip to content

Commit 1060256

Browse files
Deepraj1996Deepraj1996
committed
updated iap_config object to have enabled boolean field and iap_members variable
1 parent 739224a commit 1060256

File tree

11 files changed

+35
-31
lines changed

11 files changed

+35
-31
lines changed

‎build/int.cloudbuild.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -163,22 +163,22 @@ steps:
163163
waitFor:
164164
- teardown internal-lb-http gce-mig
165165
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
166-
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/backend-with-IAP --stage init --verbose']
166+
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/backend-with-iap --stage init --verbose']
167167
- id: apply backend-with-iap
168168
waitFor:
169169
- init backend-with-iap
170170
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
171-
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/backend-with-IAP --stage apply --verbose']
171+
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/backend-with-iap --stage apply --verbose']
172172
- id: verify backend-with-iap
173173
waitFor:
174174
- apply backend-with-iap
175175
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
176-
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/backend-with-IAP --stage verify --verbose']
176+
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/backend-with-iap --stage verify --verbose']
177177
- id: teardown backend-with-iap
178178
waitFor:
179179
- verify backend-with-iap
180180
name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
181-
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/backend-with-IAP --stage teardown --verbose']
181+
args: ['/bin/bash', '-c', 'cft test run TestAll/examples/backend-with-iap --stage teardown --verbose']
182182
tags:
183183
- 'ci'
184184
- 'integration'

‎examples/backend-with-iap/main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ module "lb-backend-iap" {
2121
project_id = var.project_id
2222
name = "backend-with-iap"
2323
iap_config = {
24+
enable = true
2425
iap_members = ["user:[email protected]"]
2526
}
2627
}

‎examples/lb-http-separate-frontend-and-backend/main.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,8 @@ module "cloud-nat-group2" {
6868
}
6969

7070
module "lb-http-backend" {
71-
source = "terraform-google-modules/lb-http/google//modules/backend"
72-
version = "~> 12.0"
71+
source = "terraform-google-modules/lb-http/google//modules/backend"
72+
version = "~> 12.0"
7373

7474
project_id = var.project_id
7575
name = "backend-lb"
@@ -105,7 +105,7 @@ module "lb-http-backend" {
105105
]
106106

107107
iap_config = {
108-
iap_members = []
108+
enable = false
109109
}
110110
}
111111

‎metadata.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ spec:
4040
- name: serverless_negs
4141
location: modules/serverless_negs
4242
examples:
43-
- name: backend-with-IAP
44-
location: examples/backend-with-IAP
43+
- name: backend-with-iap
44+
location: examples/backend-with-iap
4545
- name: cdn-policy
4646
location: examples/cdn-policy
4747
- name: certificate-map
@@ -338,13 +338,13 @@ spec:
338338
roles:
339339
- level: Project
340340
roles:
341+
- roles/run.admin
342+
- roles/iam.serviceAccountUser
341343
- roles/certificatemanager.owner
342344
- roles/vpcaccess.admin
343345
- roles/iam.serviceAccountAdmin
344346
- roles/storage.admin
345347
- roles/compute.admin
346-
- roles/run.admin
347-
- roles/iam.serviceAccountUser
348348
services:
349349
- certificatemanager.googleapis.com
350350
- cloudresourcemanager.googleapis.com

‎modules/backend/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ This module creates `google_compute_backend_service` resource and its dependenci
2222
| groups | The list of backend instance group which serves the traffic. | <pre>list(object({<br> group = string<br> description = optional(string)<br><br> balancing_mode = optional(string)<br> capacity_scaler = optional(number)<br> max_connections = optional(number)<br> max_connections_per_instance = optional(number)<br> max_connections_per_endpoint = optional(number)<br> max_rate = optional(number)<br> max_rate_per_instance = optional(number)<br> max_rate_per_endpoint = optional(number)<br> max_utilization = optional(number)<br> }))</pre> | `[]` | no |
2323
| health\_check | Input for creating HttpHealthCheck or HttpsHealthCheck resource for health checking this BackendService. A health check must be specified unless the backend service uses an internet or serverless NEG as a backend. | <pre>object({<br> host = optional(string, null)<br> request_path = optional(string, null)<br> request = optional(string, null)<br> response = optional(string, null)<br> port = optional(number, null)<br> port_name = optional(string, null)<br> proxy_header = optional(string, null)<br> port_specification = optional(string, null)<br> protocol = optional(string, null)<br> check_interval_sec = optional(number, 5)<br> timeout_sec = optional(number, 5)<br> healthy_threshold = optional(number, 2)<br> unhealthy_threshold = optional(number, 2)<br> logging = optional(bool, false)<br> })</pre> | `null` | no |
2424
| host\_path\_mappings | The list of host/path for which traffic could be sent to the backend service | <pre>list(object({<br> host = string<br> path = string<br> }))</pre> | <pre>[<br> {<br> "host": "*",<br> "path": "/*"<br> }<br>]</pre> | no |
25-
| iap\_config | Settings for enabling Cloud Identity Aware Proxy and Users/SAs to be given IAP HttpResourceAccessor access to the service. | <pre>object({<br> iap_members = list(string)<br> oauth2_client_id = optional(string)<br> oauth2_client_secret = optional(string)<br> })</pre> | <pre>{<br> "iap_members": []<br>}</pre> | no |
25+
| iap\_config | Settings for enabling Cloud Identity Aware Proxy and Users/SAs to be given IAP HttpResourceAccessor access to the service. | <pre>object({<br> enable = bool<br> oauth2_client_id = optional(string)<br> oauth2_client_secret = optional(string)<br> iap_members = list(string)<br> })</pre> | <pre>{<br> "enable": false,<br> "iap_members": []<br>}</pre> | no |
2626
| load\_balancing\_scheme | Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL\_MANAGED for Envoy-based load balancer, INTERNAL\_MANAGED for internal load balancer and INTERNAL\_SELF\_MANAGED for traffic director) | `string` | `"EXTERNAL_MANAGED"` | no |
2727
| locality\_lb\_policy | The load balancing algorithm used within the scope of the locality. | `string` | `null` | no |
2828
| log\_config | This field denotes the logging options for the load balancer traffic served by this backend service. If logging is enabled, logs will be exported to Stackdriver. | <pre>object({<br> enable = bool<br> sample_rate = number<br> })</pre> | <pre>{<br> "enable": true,<br> "sample_rate": 1<br>}</pre> | no |

‎modules/backend/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,10 @@ resource "google_compute_backend_service" "default" {
8080
}
8181

8282
dynamic "iap" {
83-
for_each = length(var.iap_config.iap_members) > 0 ? [1] : []
83+
for_each = var.iap_config.enable ? [1] : []
8484
content {
8585
oauth2_client_id = lookup(var.iap_config, "oauth2_client_id", "")
86-
enabled = length(var.iap_config.iap_members) > 0
86+
enabled = var.iap_config.enable
8787
oauth2_client_secret = lookup(var.iap_config, "oauth2_client_secret", "")
8888
}
8989
}

‎modules/backend/metadata.yaml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ spec:
3232
description: {}
3333
content:
3434
examples:
35-
- name: backend-with-IAP
36-
location: examples/backend-with-IAP
35+
- name: backend-with-iap
36+
location: examples/backend-with-iap
3737
- name: cdn-policy
3838
location: examples/cdn-policy
3939
- name: certificate-map
@@ -194,11 +194,13 @@ spec:
194194
description: Settings for enabling Cloud Identity Aware Proxy and Users/SAs to be given IAP HttpResourceAccessor access to the service.
195195
varType: |-
196196
object({
197-
iap_members = list(string)
197+
enable = bool
198198
oauth2_client_id = optional(string)
199199
oauth2_client_secret = optional(string)
200+
iap_members = list(string)
200201
})
201202
defaultValue:
203+
enable: false
202204
iap_members: []
203205
- name: cdn_policy
204206
description: Cloud CDN configuration for this BackendService.
@@ -333,13 +335,13 @@ spec:
333335
roles:
334336
- level: Project
335337
roles:
338+
- roles/compute.networkAdmin
339+
- roles/iap.admin
336340
- roles/iam.serviceAccountUser
337341
- roles/iam.serviceAccountAdmin
338342
- roles/compute.admin
339343
- roles/storage.admin
340344
- roles/run.admin
341-
- roles/compute.networkAdmin
342-
- roles/iap.admin
343345
services:
344346
- cloudresourcemanager.googleapis.com
345347
- compute.googleapis.com

‎modules/backend/variables.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,11 +156,12 @@ variable "backend_bucket_name" {
156156
variable "iap_config" {
157157
description = "Settings for enabling Cloud Identity Aware Proxy and Users/SAs to be given IAP HttpResourceAccessor access to the service."
158158
type = object({
159-
iap_members = list(string)
159+
enable = bool
160160
oauth2_client_id = optional(string)
161161
oauth2_client_secret = optional(string)
162+
iap_members = list(string)
162163
})
163-
default = { iap_members = [] }
164+
default = { enable = false, iap_members = [] }
164165
}
165166

166167
variable "cdn_policy" {

‎modules/dynamic_backends/metadata.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ spec:
3232
description: {}
3333
content:
3434
examples:
35-
- name: backend-with-IAP
36-
location: examples/backend-with-IAP
35+
- name: backend-with-iap
36+
location: examples/backend-with-iap
3737
- name: cdn-policy
3838
location: examples/cdn-policy
3939
- name: certificate-map
@@ -330,13 +330,13 @@ spec:
330330
roles:
331331
- level: Project
332332
roles:
333-
- roles/iam.serviceAccountUser
334-
- roles/certificatemanager.owner
335333
- roles/vpcaccess.admin
336334
- roles/iam.serviceAccountAdmin
337335
- roles/storage.admin
338336
- roles/compute.admin
339337
- roles/run.admin
338+
- roles/iam.serviceAccountUser
339+
- roles/certificatemanager.owner
340340
services:
341341
- certificatemanager.googleapis.com
342342
- cloudresourcemanager.googleapis.com

‎modules/frontend/metadata.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ spec:
3232
description: {}
3333
content:
3434
examples:
35-
- name: backend-with-IAP
36-
location: examples/backend-with-IAP
35+
- name: backend-with-iap
36+
location: examples/backend-with-iap
3737
- name: cdn-policy
3838
location: examples/cdn-policy
3939
- name: certificate-map
@@ -246,11 +246,11 @@ spec:
246246
roles:
247247
- level: Project
248248
roles:
249+
- roles/iam.serviceAccountUser
249250
- roles/compute.admin
250251
- roles/storage.admin
251252
- roles/iap.admin
252253
- roles/certificatemanager.owner
253-
- roles/iam.serviceAccountUser
254254
services:
255255
- certificatemanager.googleapis.com
256256
- compute.googleapis.com

0 commit comments

Comments
 (0)