-
Notifications
You must be signed in to change notification settings - Fork 369
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Loading status checks…
feat: Add creating serverless negs inside module/serverless-negs itse…
…lf (#438)
Showing
15 changed files
with
491 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,107 @@ | ||
# HTTPS load balancer with Cloud Run | ||
|
||
[![button](http://gstatic.com/cloudssh/images/open-btn.png)](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/terraform-google-lb-http&working_dir=examples/cloudrun-implicit-serverless-neg&page=shell&tutorial=README.md) | ||
|
||
This example deploys a Cloud Run application and exposes it behind a Cloud HTTPS load balancer with | ||
HTTP-to-HTTPS redirection (which creates a Serverless Network | ||
Endpoint Group (NEG) implicitly). In the examples/cloudrun, the serverless neg is created explicitly. | ||
|
||
You can tweak this example to enable other functionalities such as: | ||
|
||
- serving static assets from Cloud CDN | ||
- enabling a security profile via Cloud Armor | ||
- run global endpoints by deploying Cloud Run service to multiple regions. | ||
|
||
## Change to the example directory | ||
|
||
``` | ||
[[ `basename $PWD` != cloudrun-implicit-serverless-neg ]] && cd examples/cloudrun-implicit-serverless-neg | ||
``` | ||
|
||
## Install Terraform | ||
|
||
1. Install Terraform if it is not already installed (visit | ||
[terraform.io](https://terraform.io) for other distributions): | ||
|
||
## Set up the environment | ||
|
||
1. Set the project, replace `YOUR_PROJECT` with your project ID:- | ||
|
||
``` | ||
PROJECT=YOUR_PROJECT | ||
``` | ||
|
||
``` | ||
gcloud config set project ${PROJECT} | ||
``` | ||
|
||
2. Configure the environment for Terraform: | ||
|
||
``` | ||
[[ $CLOUD_SHELL ]] || gcloud auth application-default login | ||
export GOOGLE_PROJECT=$(gcloud config get-value project) | ||
``` | ||
|
||
## Option 1: Run on HTTP load balancer (unencrypted, not recommended) | ||
|
||
This option provisions an HTTP forwarding rule (insecure) and is not recommended | ||
for production use. It is provided since it provisions faster than the Option 2. | ||
|
||
1. Initialize: | ||
|
||
``` | ||
terraform init | ||
``` | ||
1. Deploy the load balancer, replace `example.com` with your domain name. | ||
``` | ||
terraform apply -var=project_id=$PROJECT \ | ||
-var=ssl=false -var=domain=null | ||
``` | ||
1. It may take some time for the load balancer to provision. Visit the output | ||
IP address of the load balancer. | ||
## Option 2: Run on HTTPS load balancer (with HTTP-to-HTTPS redirect) | ||
This options creates a Google-managed SSL certificate for your domain name, | ||
sets it up on HTTPS forwarding rule and creates a HTTP forwarding rule to | ||
redirect HTTP traffic to HTTPS. | ||
1. Make sure you have a **domain name**. This is required since we provision a | ||
Google-managed SSL certificate specifically for this domain name. | ||
1. Initialize: | ||
``` | ||
terraform init | ||
``` | ||
1. Deploy the load balancer, replace `example.com` with your domain name. | ||
``` | ||
terraform apply -var=project_id=$PROJECT \ | ||
-var=domain=example.com | ||
``` | ||
1. After the deployment completes it outputs the IP address of the load balancer. | ||
Update DNS records for your domain to point to this IP address. | ||
1. It may take around half an hour for the SSL certificate to be provisioned | ||
and the application to start serving traffic. | ||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --> | ||
## Inputs | ||
| Name | Description | Type | Default | Required | | ||
|------|-------------|------|---------|:--------:| | ||
| project\_id | n/a | `string` | n/a | yes | | ||
## Outputs | ||
| Name | Description | | ||
|------|-------------| | ||
| load-balancer-ip | n/a | | ||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,72 @@ | ||
/** | ||
* Copyright 2020 Google LLC | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
module "lb-http" { | ||
source = "terraform-google-modules/lb-http/google//modules/serverless_negs" | ||
version = "~> 10.0" | ||
|
||
name = "tf-cr-lb-1" | ||
project = var.project_id | ||
|
||
ssl = false | ||
https_redirect = false | ||
labels = { "example-label" = "cloud-run-example" } | ||
|
||
backends = { | ||
default = { | ||
description = null | ||
groups = [] | ||
serverless_neg_backends = [{ region : "us-central1", type : "cloud-run", service : { name : google_cloud_run_service.default.name } }] | ||
enable_cdn = false | ||
|
||
iap_config = { | ||
enable = false | ||
} | ||
log_config = { | ||
enable = false | ||
} | ||
} | ||
} | ||
} | ||
|
||
resource "google_cloud_run_service" "default" { | ||
name = "example-1" | ||
location = "us-central1" | ||
project = var.project_id | ||
|
||
template { | ||
spec { | ||
containers { | ||
image = "gcr.io/cloudrun/hello" | ||
} | ||
} | ||
} | ||
metadata { | ||
annotations = { | ||
# For valid annotation values and descriptions, see | ||
# https://cloud.google.com/sdk/gcloud/reference/run/deploy#--ingress | ||
"run.googleapis.com/ingress" = "all" | ||
} | ||
} | ||
} | ||
|
||
resource "google_cloud_run_service_iam_member" "public-access" { | ||
location = google_cloud_run_service.default.location | ||
project = google_cloud_run_service.default.project | ||
service = google_cloud_run_service.default.name | ||
role = "roles/run.invoker" | ||
member = "allUsers" | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
/** | ||
* Copyright 2020 Google LLC | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
output "load-balancer-ip" { | ||
value = module.lb-http.external_ip | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
/** | ||
* Copyright 2020 Google LLC | ||
* | ||
* Licensed under the Apache License, Version 2.0 (the "License"); | ||
* you may not use this file except in compliance with the License. | ||
* You may obtain a copy of the License at | ||
* | ||
* http://www.apache.org/licenses/LICENSE-2.0 | ||
* | ||
* Unless required by applicable law or agreed to in writing, software | ||
* distributed under the License is distributed on an "AS IS" BASIS, | ||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
* See the License for the specific language governing permissions and | ||
* limitations under the License. | ||
*/ | ||
|
||
variable "project_id" { | ||
type = string | ||
} | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.