|
| 1 | +/** |
| 2 | + * Copyright 2017 Google LLC |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + * you may not use this file except in compliance with the License. |
| 6 | + * You may obtain a copy of the License at |
| 7 | + * |
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | + * |
| 10 | + * Unless required by applicable law or agreed to in writing, software |
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + * See the License for the specific language governing permissions and |
| 14 | + * limitations under the License. |
| 15 | + */ |
| 16 | + |
| 17 | + |
| 18 | +locals { |
| 19 | + address = var.create_address ? join("", google_compute_global_address.default.*.address) : var.address |
| 20 | + url_map = var.create_url_map ? join("", google_compute_url_map.default.*.self_link) : var.url_map |
| 21 | +} |
| 22 | + |
| 23 | +resource "google_compute_global_forwarding_rule" "http" { |
| 24 | + project = var.project |
| 25 | + count = var.http_forward ? 1 : 0 |
| 26 | + name = var.name |
| 27 | + target = google_compute_target_http_proxy.default[0].self_link |
| 28 | + ip_address = local.address |
| 29 | + port_range = "80" |
| 30 | +} |
| 31 | + |
| 32 | +resource "google_compute_global_forwarding_rule" "https" { |
| 33 | + project = var.project |
| 34 | + count = var.ssl ? 1 : 0 |
| 35 | + name = "${var.name}-https" |
| 36 | + target = google_compute_target_https_proxy.default[0].self_link |
| 37 | + ip_address = local.address |
| 38 | + port_range = "443" |
| 39 | +} |
| 40 | + |
| 41 | +resource "google_compute_global_address" "default" { |
| 42 | + count = var.create_address ? 1 : 0 |
| 43 | + project = var.project |
| 44 | + name = "${var.name}-address" |
| 45 | + ip_version = var.ip_version |
| 46 | +} |
| 47 | + |
| 48 | +# HTTP proxy when http forwarding is true |
| 49 | +resource "google_compute_target_http_proxy" "default" { |
| 50 | + project = var.project |
| 51 | + count = var.http_forward ? 1 : 0 |
| 52 | + name = "${var.name}-http-proxy" |
| 53 | + url_map = local.url_map |
| 54 | +} |
| 55 | + |
| 56 | +# HTTPS proxy when ssl is true |
| 57 | +resource "google_compute_target_https_proxy" "default" { |
| 58 | + project = var.project |
| 59 | + count = var.ssl ? 1 : 0 |
| 60 | + name = "${var.name}-https-proxy" |
| 61 | + url_map = local.url_map |
| 62 | + |
| 63 | + ssl_certificates = compact(concat(var.ssl_certificates, google_compute_ssl_certificate.default.*.self_link, ), ) |
| 64 | + ssl_policy = var.ssl_policy |
| 65 | + quic_override = var.quic ? "ENABLE" : null |
| 66 | +} |
| 67 | + |
| 68 | +resource "google_compute_ssl_certificate" "default" { |
| 69 | + project = var.project |
| 70 | + count = var.ssl && ! var.use_ssl_certificates ? 1 : 0 |
| 71 | + name_prefix = "${var.name}-certificate-" |
| 72 | + private_key = var.private_key |
| 73 | + certificate = var.certificate |
| 74 | + |
| 75 | + lifecycle { |
| 76 | + create_before_destroy = true |
| 77 | + } |
| 78 | +} |
| 79 | + |
| 80 | +resource "google_compute_url_map" "default" { |
| 81 | + project = var.project |
| 82 | + count = var.create_url_map ? 1 : 0 |
| 83 | + name = "${var.name}-url-map" |
| 84 | + default_service = google_compute_backend_service.default[keys(var.backends)[0]].self_link |
| 85 | + |
| 86 | +} |
| 87 | + |
| 88 | +resource "google_compute_backend_service" "default" { |
| 89 | + for_each = var.backends |
| 90 | + |
| 91 | + project = var.project |
| 92 | + name = "${var.name}-backend-${each.key}" |
| 93 | + |
| 94 | + port_name = each.value.port_name |
| 95 | + protocol = each.value.protocol |
| 96 | + timeout_sec = lookup(each.value, "timeout_sec", null) |
| 97 | + description = lookup(each.value, "description", null) |
| 98 | + connection_draining_timeout_sec = lookup(each.value, "connection_draining_timeout_sec", null) |
| 99 | + enable_cdn = lookup(each.value, "enable_cdn", false) |
| 100 | + security_policy = var.security_policy |
| 101 | + health_checks = [google_compute_health_check.default[each.key].self_link] |
| 102 | + |
| 103 | + dynamic "backend" { |
| 104 | + for_each = toset(each.value["groups"]) |
| 105 | + content { |
| 106 | + balancing_mode = lookup(backend.value, "balancing_mode") |
| 107 | + capacity_scaler = lookup(backend.value, "capacity_scaler") |
| 108 | + description = lookup(backend.value, "description") |
| 109 | + group = lookup(backend.value, "group") |
| 110 | + max_connections = lookup(backend.value, "max_connections") |
| 111 | + max_connections_per_instance = lookup(backend.value, "max_connections_per_instance") |
| 112 | + max_connections_per_endpoint = lookup(backend.value, "max_connections_per_endpoint") |
| 113 | + max_rate = lookup(backend.value, "max_rate") |
| 114 | + max_rate_per_instance = lookup(backend.value, "max_rate_per_instance") |
| 115 | + max_rate_per_endpoint = lookup(backend.value, "max_rate_per_endpoint") |
| 116 | + max_utilization = lookup(backend.value, "max_utilization") |
| 117 | + } |
| 118 | + } |
| 119 | + |
| 120 | + depends_on = [google_compute_health_check.default] |
| 121 | + |
| 122 | + {% if dynamic_backends %} |
| 123 | + lifecycle { |
| 124 | + ignore_changes = [backend] |
| 125 | + } |
| 126 | + {% endif %} |
| 127 | +} |
| 128 | + |
| 129 | +resource "google_compute_health_check" "default" { |
| 130 | + for_each = var.backends |
| 131 | + project = var.project |
| 132 | + name = "${var.name}-hc-${each.key}" |
| 133 | + |
| 134 | + check_interval_sec = lookup(each.value["health_check"], "check_interval_sec", 5) |
| 135 | + timeout_sec = lookup(each.value["health_check"], "timeout_sec", 5) |
| 136 | + healthy_threshold = lookup(each.value["health_check"], "healthy_threshold", 2) |
| 137 | + unhealthy_threshold = lookup(each.value["health_check"], "unhealthy_threshold", 2) |
| 138 | + |
| 139 | + dynamic "http_health_check" { |
| 140 | + for_each = each.value["protocol"] == "HTTP" ? [ |
| 141 | + { |
| 142 | + host = lookup(each.value["health_check"], "host", null) |
| 143 | + request_path = lookup(each.value["health_check"], "request_path", null) |
| 144 | + port = lookup(each.value["health_check"], "port", null) |
| 145 | + } |
| 146 | + ] : [] |
| 147 | + |
| 148 | + content { |
| 149 | + host = lookup(http_health_check.value, "host", null) |
| 150 | + request_path = lookup(http_health_check.value, "request_path", null) |
| 151 | + port = lookup(http_health_check.value, "port", null) |
| 152 | + } |
| 153 | + } |
| 154 | + |
| 155 | + dynamic "https_health_check" { |
| 156 | + for_each = each.value["protocol"] == "HTTPS" ? [ |
| 157 | + { |
| 158 | + host = lookup(each.value["health_check"], "host", null) |
| 159 | + request_path = lookup(each.value["health_check"], "request_path", null) |
| 160 | + port = lookup(each.value["health_check"], "port", null) |
| 161 | + } |
| 162 | + ] : [] |
| 163 | + |
| 164 | + content { |
| 165 | + host = lookup(https_health_check.value, "host", null) |
| 166 | + request_path = lookup(https_health_check.value, "request_path", null) |
| 167 | + port = lookup(https_health_check.value, "port", null) |
| 168 | + } |
| 169 | + } |
| 170 | + |
| 171 | + dynamic "http2_health_check" { |
| 172 | + for_each = each.value["protocol"] == "HTTP2" ? [ |
| 173 | + { |
| 174 | + host = lookup(each.value["health_check"], "host", null) |
| 175 | + request_path = lookup(each.value["health_check"], "request_path", null) |
| 176 | + port = lookup(each.value["health_check"], "port", null) |
| 177 | + } |
| 178 | + ] : [] |
| 179 | + |
| 180 | + content { |
| 181 | + host = lookup(http2_health_check.value, "host", null) |
| 182 | + request_path = lookup(http2_health_check.value, "request_path", null) |
| 183 | + port = lookup(http2_health_check.value, "port", null) |
| 184 | + } |
| 185 | + } |
| 186 | + |
| 187 | +} |
| 188 | + |
| 189 | +resource "google_compute_firewall" "default-hc" { |
| 190 | + count = length(var.firewall_networks) |
| 191 | + project = length(var.firewall_networks) == 1 && var.firewall_projects[0] == "default" ? var.project : var.firewall_projects[count.index] |
| 192 | + name = "${var.name}-hc-${count.index}" |
| 193 | + network = var.firewall_networks[count.index] |
| 194 | + source_ranges = [ |
| 195 | + "130.211.0.0/22", |
| 196 | + "35.191.0.0/16" |
| 197 | + ] |
| 198 | + target_tags = var.target_tags |
| 199 | + |
| 200 | + dynamic "allow" { |
| 201 | + for_each = var.backends |
| 202 | + content { |
| 203 | + protocol = "tcp" |
| 204 | + ports = [allow.value.port] |
| 205 | + } |
| 206 | + } |
| 207 | +} |
0 commit comments