92 lines
2.4 KiB
HCL
92 lines
2.4 KiB
HCL
terraform {
|
|
required_version = ">= 1.6.0"
|
|
required_providers {
|
|
google = {
|
|
source = "hashicorp/google"
|
|
version = "~> 6.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "google" {
|
|
project = var.project_id
|
|
region = var.region
|
|
}
|
|
|
|
locals {
|
|
enabled = var.provision
|
|
}
|
|
|
|
resource "google_project_service" "run" {
|
|
count = local.enabled ? 1 : 0
|
|
project = var.project_id
|
|
service = "run.googleapis.com"
|
|
}
|
|
|
|
resource "google_project_service" "secretmanager" {
|
|
count = local.enabled ? 1 : 0
|
|
project = var.project_id
|
|
service = "secretmanager.googleapis.com"
|
|
}
|
|
|
|
resource "google_service_account" "workload" {
|
|
count = local.enabled ? 1 : 0
|
|
account_id = "gateway-workload"
|
|
display_name = "Least-privilege gateway workload"
|
|
}
|
|
|
|
resource "google_secret_manager_secret_iam_member" "runtime_reader" {
|
|
count = local.enabled ? 1 : 0
|
|
project = var.project_id
|
|
secret_id = var.secret_id
|
|
role = "roles/secretmanager.secretAccessor"
|
|
member = "serviceAccount:${google_service_account.workload[0].email}"
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service" "gateway" {
|
|
count = local.enabled ? 1 : 0
|
|
name = "platform-gateway"
|
|
location = var.region
|
|
ingress = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"
|
|
|
|
template {
|
|
service_account = google_service_account.workload[0].email
|
|
containers {
|
|
image = var.service_image
|
|
env {
|
|
name = "UPSTREAM_MODE"
|
|
value = "platform-proxy"
|
|
}
|
|
env {
|
|
name = "RUNTIME_SECRET"
|
|
value_source {
|
|
secret_key_ref {
|
|
secret = var.secret_id
|
|
version = "latest"
|
|
}
|
|
}
|
|
}
|
|
resources {
|
|
limits = { cpu = "1", memory = "512Mi" }
|
|
}
|
|
}
|
|
scaling { max_instance_count = 10 }
|
|
}
|
|
depends_on = [google_project_service.run, google_project_service.secretmanager,
|
|
google_secret_manager_secret_iam_member.runtime_reader]
|
|
}
|
|
|
|
resource "google_cloud_run_v2_service_iam_member" "gateway_invoker" {
|
|
count = local.enabled ? 1 : 0
|
|
name = google_cloud_run_v2_service.gateway[0].name
|
|
location = var.region
|
|
role = "roles/run.invoker"
|
|
member = "allUsers"
|
|
}
|
|
|
|
# The application must use this gateway/proxy for peer calls; direct peer ingress is not exposed.
|
|
output "gateway_uri" {
|
|
value = try(google_cloud_run_v2_service.gateway[0].uri, null)
|
|
description = "Platform gateway endpoint; peer traffic is routed through this proxy."
|
|
}
|