From 4ed762bc76f40cc7d9fe7d660cdd2d75009a48e2 Mon Sep 17 00:00:00 2001 From: Taher Jegham Date: Mon, 15 Jan 2024 11:44:07 +0100 Subject: [PATCH] feat: enable mtls on external application application load balancer --- .gitignore | 1 + modules/net-lb-app-ext/README.md | 17 +++++++++-------- modules/net-lb-app-ext/main.tf | 19 ++++++++++--------- modules/net-lb-app-ext/variables.tf | 6 ++++++ 4 files changed, 26 insertions(+), 17 deletions(-) diff --git a/.gitignore b/.gitignore index 0af2c504bb..543bc87027 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ venv/* */venv/* +**/.python-version **/.terraform **/terraform.tfstate* **/terraform.tfvars diff --git a/modules/net-lb-app-ext/README.md b/modules/net-lb-app-ext/README.md index 5939043cb3..b9e919c44c 100644 --- a/modules/net-lb-app-ext/README.md +++ b/modules/net-lb-app-ext/README.md @@ -876,8 +876,8 @@ module "glb-0" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [name](variables.tf#L91) | Load balancer name. | string | ✓ | | -| [project_id](variables.tf#L193) | Project id. | string | ✓ | | +| [name](variables.tf#L97) | Load balancer name. | string | ✓ | | +| [project_id](variables.tf#L199) | Project id. | string | ✓ | | | [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null | | [backend_buckets_config](variables.tf#L23) | Backend buckets configuration. | map(object({…})) | | {} | | [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} | @@ -885,13 +885,14 @@ module "glb-0" { | [group_configs](variables.tf#L62) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | | [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) | | {…} | | [https_proxy_config](variables.tf#L74) | HTTPS proxy connfiguration. | object({…}) | | {} | -| [labels](variables.tf#L85) | Labels set on resources. | map(string) | | {} | -| [neg_configs](variables.tf#L96) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | -| [ports](variables.tf#L187) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | -| [protocol](variables.tf#L198) | Protocol supported by this load balancer. | string | | "HTTP" | -| [ssl_certificates](variables.tf#L211) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | +| [labels](variables.tf#L91) | Labels set on resources. | map(string) | | {} | +| [mtls_policy](variables.tf#L85) | id of the mTLS policy to use for the target proxy. | string | | "" | +| [neg_configs](variables.tf#L102) | Optional network endpoint groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} | +| [ports](variables.tf#L193) | Optional ports for HTTP load balancer, valid ports are 80 and 8080. | list(string) | | null | +| [protocol](variables.tf#L204) | Protocol supported by this load balancer. | string | | "HTTP" | +| [ssl_certificates](variables.tf#L217) | SSL target proxy certificates (only if protocol is HTTPS) for existing, custom, and managed certificates. | object({…}) | | {} | | [urlmap_config](variables-urlmap.tf#L19) | The URL map configuration. | object({…}) | | {…} | -| [use_classic_version](variables.tf#L228) | Use classic Global Load Balancer. | bool | | true | +| [use_classic_version](variables.tf#L234) | Use classic Global Load Balancer. | bool | | true | ## Outputs diff --git a/modules/net-lb-app-ext/main.tf b/modules/net-lb-app-ext/main.tf index 94a79d9996..0e2a23206c 100644 --- a/modules/net-lb-app-ext/main.tf +++ b/modules/net-lb-app-ext/main.tf @@ -82,13 +82,14 @@ resource "google_compute_target_http_proxy" "default" { } resource "google_compute_target_https_proxy" "default" { - count = var.protocol == "HTTPS" ? 1 : 0 - project = var.project_id - name = var.name - description = var.description - certificate_map = var.https_proxy_config.certificate_map - quic_override = var.https_proxy_config.quic_override - ssl_certificates = local.proxy_ssl_certificates - ssl_policy = var.https_proxy_config.ssl_policy - url_map = google_compute_url_map.default.id + count = var.protocol == "HTTPS" ? 1 : 0 + project = var.project_id + name = var.name + description = var.description + certificate_map = var.https_proxy_config.certificate_map + quic_override = var.https_proxy_config.quic_override + ssl_certificates = local.proxy_ssl_certificates + ssl_policy = var.https_proxy_config.ssl_policy + url_map = google_compute_url_map.default.id + server_tls_policy = var.mtls_policy } diff --git a/modules/net-lb-app-ext/variables.tf b/modules/net-lb-app-ext/variables.tf index bc254091b5..8345b01616 100644 --- a/modules/net-lb-app-ext/variables.tf +++ b/modules/net-lb-app-ext/variables.tf @@ -82,6 +82,12 @@ variable "https_proxy_config" { nullable = false } +variable "mtls_policy" { + description = "id of the mTLS policy to use for the target proxy." + type = string + default = "" +} + variable "labels" { description = "Labels set on resources." type = map(string)