Skip to content

Latest commit

 

History

History

service-directory

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 
 
 
 
 
 
 

Google Cloud Service Directory Module

This module allows managing a single Service Directory namespace, including multiple services, endpoints and IAM bindings at the namespace and service levels.

It can be used in conjunction with the DNS module to create [service-directory based DNS zones](https://cloud.google.com/service-directory/docs/configuring-service-directory-zone, offloading IAM control of A and SRV records at the namespace or service level to Service Directory. The last examples shows how to wire the two modules together.

Examples

Namespace with IAM

module "service-directory" {
  source     = "./fabric/modules/service-directory"
  project_id = "my-project"
  location   = "europe-west1"
  name       = "sd-1"
  iam = {
    "roles/servicedirectory.editor" = [
      "serviceAccount:[email protected]"
    ]
  }
}
# tftest modules=1 resources=2 inventory=simple.yaml

Services with IAM and endpoints

module "service-directory" {
  source     = "./fabric/modules/service-directory"
  project_id = "my-project"
  location   = "europe-west1"
  name       = "sd-1"
  services = {
    one = {
      endpoints = ["first", "second"]
      metadata  = null
    }
  }
  service_iam = {
    one = {
      "roles/servicedirectory.editor" = [
        "serviceAccount:service-editor.example.com"
      ]
    }
  }
  endpoint_config = {
    "one/first"  = { address = "127.0.0.1", port = 80, metadata = {} }
    "one/second" = { address = "127.0.0.2", port = 80, metadata = {} }
  }
}
# tftest modules=1 resources=5 inventory=services.yaml

DNS based zone

Wiring a service directory namespace to a private DNS zone allows querying the namespace, and delegating control of DNS records at the namespace or service level. This effectively allows fine grained ACL control of Cloud DNS zones.

module "service-directory" {
  source     = "./fabric/modules/service-directory"
  project_id = "my-project"
  location   = "europe-west1"
  name       = "apps"
  iam = {
    "roles/servicedirectory.editor" = [
      "serviceAccount:[email protected]"
    ]
  }
  services = {
    app1 = { endpoints = ["one"], metadata = null }
  }
  endpoint_config = {
    "app1/one" = { address = "127.0.0.1", port = 80, metadata = {} }
  }
}

module "dns-sd" {
  source     = "./fabric/modules/dns"
  project_id = "my-project"
  name       = "apps"
  zone_config = {
    domain = "apps.example.org."
    private = {
      client_networks             = [var.vpc.self_link]
      service_directory_namespace = module.service-directory.id
    }
  }
}
# tftest modules=2 resources=5 inventory=dns.yaml

Services with endpoints using Private Network Access

Private Network Access enables supported Google Cloud products to send HTTP requests to resources inside a VPC.

locals {
  project_number = "123456789012"
}

module "service-directory" {
  source     = "./fabric/modules/service-directory"
  project_id = "my-project"
  location   = "europe-west1"
  name       = "sd-1"
  services = {
    one = {
      endpoints = ["first", "second"]
      metadata  = null
    }
  }
  endpoint_config = {
    "one/first" = {
      address  = "10.0.0.11",
      port     = 443,
      network  = "projects/${local.project_number}/locations/global/networks/${var.vpc.name}"
      metadata = {}
    }
    "one/second" = {
      address  = "10.0.0.12",
      port     = 443,
      network  = "projects/${local.project_number}/locations/global/networks/${var.vpc.name}"
      metadata = {}
    }
  }
}
# tftest modules=1 resources=4 inventory=pna.yaml

Note that the network argument is unusual in that it requires the project number, instead of the more common project ID.

Variables

name description type required default
location Namespace location. string
name Namespace name. string
project_id Project used for resources. string
endpoint_config Map of endpoint attributes, keys are in service/endpoint format. map(object({…})) {}
iam IAM bindings for namespace, in {ROLE => [MEMBERS]} format. map(list(string)) {}
labels Labels. map(string) {}
service_iam IAM bindings for services, in {SERVICE => {ROLE => [MEMBERS]}} format. map(map(list(string))) {}
services Service configuration, using service names as keys. map(object({…})) {}

Outputs

name description sensitive
endpoints Endpoint resources.
id Fully qualified namespace id.
name Namespace name.
namespace Namespace resource.
service_id Service ids (short names).
service_names Service ids (long names).
services Service resources.