metadata.yaml

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: blueprints.cloud.google.com/v1alpha1
kind: BlueprintMetadata
metadata:
  name: terraform-google-lb-http
  annotations:
    config.kubernetes.io/local-config: "true"
spec:
  title: Global HTTP Load Balancer Terraform Module
  source:
    repo: https://github.com/terraform-google-modules/terraform-google-lb-http
    sourceType: git
  version: 6.3.0
  actuationTool:
    type: Terraform
    version: '>= 0.13'
  examples:
  - name: cloudrun
    location: examples/cloudrun
  - name: dynamic-backend
    location: examples/dynamic-backend
  - name: gke-node-port
    location: examples/https-gke/gke-node-port
  - name: https-gke
    location: examples/https-gke
  - name: https-redirect
    location: examples/https-redirect
  - name: mig-nat-http-lb
    location: examples/mig-nat-http-lb
  - name: multi-backend-multi-mig-bucket-https-lb
    location: examples/multi-backend-multi-mig-bucket-https-lb
  - name: multi-mig-http-lb
    location: examples/multi-mig-http-lb
  - name: multiple-certs
    location: examples/multiple-certs
  - name: shared-vpc
    location: examples/shared-vpc
  variables:
  - name: address
    description: Existing IPv4 address to use (the actual IP address value)
    type: string
    required: false
  - name: backends
    description: Map backend indices to list of backend maps.
    type: |-
      map(object({
          port                    = number
          protocol                = string
          port_name               = string
          description             = string
          enable_cdn              = bool
          compression_mode        = string
          security_policy         = string
          custom_request_headers  = list(string)
          custom_response_headers = list(string)

          timeout_sec                     = number
          connection_draining_timeout_sec = number
          session_affinity                = string
          affinity_cookie_ttl_sec         = number

          health_check = object({
            check_interval_sec  = number
            timeout_sec         = number
            healthy_threshold   = number
            unhealthy_threshold = number
            request_path        = string
            port                = number
            host                = string
            logging             = bool
          })

          log_config = object({
            enable      = bool
            sample_rate = number
          })

          groups = list(object({
            group = string

            balancing_mode               = string
            capacity_scaler              = number
            description                  = string
            max_connections              = number
            max_connections_per_instance = number
            max_connections_per_endpoint = number
            max_rate                     = number
            max_rate_per_instance        = number
            max_rate_per_endpoint        = number
            max_utilization              = number
          }))
          iap_config = object({
            enable               = bool
            oauth2_client_id     = string
            oauth2_client_secret = string
          })
        }))
    required: true
  - name: certificate
    description: Content of the SSL certificate. Required if `ssl` is `true` and `ssl_certificates` is empty.
    type: string
    required: false
  - name: certificate_map
    description: Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy
    type: string
    required: false
  - name: create_address
    description: Create a new global IPv4 address
    type: bool
    default: true
    required: false
  - name: create_ipv6_address
    description: Allocate a new IPv6 address. Conflicts with "ipv6_address" - if both specified, "create_ipv6_address" takes precedence.
    type: bool
    default: false
    required: false
  - name: create_url_map
    description: Set to `false` if url_map variable is provided.
    type: bool
    default: true
    required: false
  - name: enable_ipv6
    description: Enable IPv6 address on the CDN load-balancer
    type: bool
    default: false
    required: false
  - name: firewall_networks
    description: Names of the networks to create firewall rules in
    type: list(string)
    default:
    - default
    required: false
  - name: firewall_projects
    description: Names of the projects to create firewall rules in
    type: list(string)
    default:
    - default
    required: false
  - name: http_forward
    description: Set to `false` to disable HTTP port 80 forward
    type: bool
    default: true
    required: false
  - name: https_redirect
    description: Set to `true` to enable https redirect on the lb.
    type: bool
    default: false
    required: false
  - name: ipv6_address
    description: An existing IPv6 address to use (the actual IP address value)
    type: string
    required: false
  - name: labels
    description: The labels to attach to resources created by this module
    type: map(string)
    default: {}
    required: false
  - name: load_balancing_scheme
    description: Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL_MANAGED for Envoy-based load balancer, INTERNAL for classic internal load balancer, and INTERNAL_SELF_MANAGED for internal load balancer)
    type: string
    default: EXTERNAL
    required: false
  - name: managed_ssl_certificate_domains
    description: Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` and `use_ssl_certificates` set to `false`.
    type: list(string)
    default: []
    required: false
  - name: name
    description: Name for the forwarding rule and prefix for supporting resources
    type: string
    required: true
  - name: private_key
    description: Content of the private SSL key. Required if `ssl` is `true` and `ssl_certificates` is empty.
    type: string
    required: false
  - name: project
    description: The project to deploy to, if not set the default provider project is used.
    type: string
    required: true
  - name: quic
    description: Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only.
    type: bool
    required: false
  - name: random_certificate_suffix
    description: Bool to enable/disable random certificate name generation. Set and keep this to true if you need to change the SSL cert.
    type: bool
    default: false
    required: false
  - name: security_policy
    description: The resource URL for the security policy to associate with the backend service
    type: string
    required: false
  - name: ssl
    description: Set to `true` to enable SSL support, requires variable `ssl_certificates` - a list of self_link certs
    type: bool
    default: false
    required: false
  - name: ssl_certificates
    description: SSL cert self_link list. Required if `ssl` is `true` and no `private_key` and `certificate` is provided.
    type: list(string)
    default: []
    required: false
  - name: ssl_policy
    description: Selfink to SSL Policy
    type: string
    required: false
  - name: target_service_accounts
    description: List of target service accounts for health check firewall rule. Exactly one of target_tags or target_service_accounts should be specified.
    type: list(string)
    default: []
    required: false
  - name: target_tags
    description: List of target tags for health check firewall rule. Exactly one of target_tags or target_service_accounts should be specified.
    type: list(string)
    default: []
    required: false
  - name: url_map
    description: The url_map resource to use. Default is to send all traffic to first backend.
    type: string
    required: false
  - name: use_ssl_certificates
    description: If true, use the certificates provided by `ssl_certificates`, otherwise, create cert from `private_key` and `certificate`
    type: bool
    default: false
    required: false
  outputs:
  - name: backend_services
    description: The backend service resources.
  - name: external_ip
    description: The external IPv4 assigned to the global fowarding rule.
  - name: external_ipv6_address
    description: The external IPv6 assigned to the global fowarding rule.
  - name: http_proxy
    description: The HTTP proxy used by this module.
  - name: https_proxy
    description: The HTTPS proxy used by this module.
  - name: ipv6_enabled
    description: Whether IPv6 configuration is enabled on this load-balancer
  - name: url_map
    description: The default URL map used by this module.
  roles:
  - level: Project
    roles:
    - roles/owner
    - roles/storage.admin
  services:
  - cloudresourcemanager.googleapis.com
  - storage-api.googleapis.com
  - serviceusage.googleapis.com
  - compute.googleapis.com
  - run.googleapis.com
  - iam.googleapis.com