Skip to content

Commit e39c5a8

Browse files
modular-magicianmodular-magician
authored
Add support for Regional L7 XLB. (#5531) (#10738)
Signed-off-by: Modular Magician <[email protected]>
1 parent 9029378 commit e39c5a8

6 files changed

+238
-28
lines changed

‎.changelog/5531.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
compute: added support for regional external HTTP(S) load balancer
3+
```

‎google/resource_compute_region_backend_service.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -566,10 +566,10 @@ or serverless NEG as a backend.`,
566566
Type: schema.TypeString,
567567
Optional: true,
568568
ForceNew: true,
569-
ValidateFunc: validation.StringInSlice([]string{"EXTERNAL", "INTERNAL", "INTERNAL_MANAGED", ""}, false),
569+
ValidateFunc: validation.StringInSlice([]string{"EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL", "INTERNAL_MANAGED", ""}, false),
570570
Description: `Indicates what kind of load balancing this regional backend service
571571
will be used for. A backend service created for one type of load
572-
balancing cannot be used with the other(s). Default value: "INTERNAL" Possible values: ["EXTERNAL", "INTERNAL", "INTERNAL_MANAGED"]`,
572+
balancing cannot be used with the other(s). Default value: "INTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL", "INTERNAL_MANAGED"]`,
573573
Default: "INTERNAL",
574574
},
575575
"locality_lb_policy": {
@@ -796,7 +796,7 @@ runtime value should be 1900. Defaults to 1900.`,
796796
Optional: true,
797797
Description: `A named port on a backend instance group representing the port for
798798
communication to the backend VMs in that group. Required when the
799-
loadBalancingScheme is EXTERNAL, INTERNAL_MANAGED, or INTERNAL_SELF_MANAGED
799+
loadBalancingScheme is EXTERNAL, EXTERNAL_MANAGED, INTERNAL_MANAGED, or INTERNAL_SELF_MANAGED
800800
and the backends are instance groups. The named port must be defined on each
801801
backend instance group. This parameter has no meaning if the backends are NEGs. API sets a
802802
default of "http" if not given.
@@ -3581,7 +3581,7 @@ func resourceComputeRegionBackendServiceEncoder(d *schema.ResourceData, meta int
35813581
obj["iap"] = iap
35823582
}
35833583

3584-
if d.Get("load_balancing_scheme").(string) == "INTERNAL_MANAGED" {
3584+
if d.Get("load_balancing_scheme").(string) == "EXTERNAL_MANAGED" || d.Get("load_balancing_scheme").(string) == "INTERNAL_MANAGED" {
35853585
return obj, nil
35863586
}
35873587

‎google/resource_compute_subnetwork.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -1157,8 +1157,8 @@ func expandComputeSubnetworkLogConfig(v interface{}, d TerraformResourceData, co
11571157
if len(l) == 0 || l[0] == nil {
11581158
purpose, ok := d.GetOkExists("purpose")
11591159

1160-
if ok && purpose.(string) == "INTERNAL_HTTPS_LOAD_BALANCER" {
1161-
// Subnetworks for L7ILB do not accept any values for logConfig
1160+
if ok && (purpose.(string) == "REGIONAL_MANAGED_PROXY" || purpose.(string) == "INTERNAL_HTTPS_LOAD_BALANCER") {
1161+
// Subnetworks for regional L7 ILB/XLB do not accept any values for logConfig
11621162
return nil, nil
11631163
}
11641164
// send enable = false to ensure logging is disabled if there is no config

‎website/docs/r/compute_forwarding_rule.html.markdown

+209-2
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,212 @@ resource "google_compute_subnetwork" "proxy" {
802802
role = "ACTIVE"
803803
}
804804
```
805+
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
806+
<a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.jpy.wang%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=forwarding_rule_regional_http_xlb&cloudshell_image=gcr.io%2Fgraphite-cloud-shell-images%2Fterraform%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
807+
<img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
808+
</a>
809+
</div>
810+
## Example Usage - Forwarding Rule Regional Http Xlb
811+
812+
813+
```hcl
814+
// Forwarding rule for Regional External Load Balancing
815+
resource "google_compute_forwarding_rule" "default" {
816+
provider = google-beta
817+
depends_on = [google_compute_subnetwork.proxy]
818+
name = "website-forwarding-rule"
819+
region = "us-central1"
820+
821+
ip_protocol = "TCP"
822+
load_balancing_scheme = "EXTERNAL_MANAGED"
823+
port_range = "80"
824+
target = google_compute_region_target_http_proxy.default.id
825+
network = google_compute_network.default.id
826+
ip_address = google_compute_address.default.id
827+
network_tier = "STANDARD"
828+
}
829+
830+
resource "google_compute_region_target_http_proxy" "default" {
831+
provider = google-beta
832+
833+
region = "us-central1"
834+
name = "website-proxy"
835+
url_map = google_compute_region_url_map.default.id
836+
}
837+
838+
resource "google_compute_region_url_map" "default" {
839+
provider = google-beta
840+
841+
region = "us-central1"
842+
name = "website-map"
843+
default_service = google_compute_region_backend_service.default.id
844+
}
845+
846+
resource "google_compute_region_backend_service" "default" {
847+
provider = google-beta
848+
849+
load_balancing_scheme = "EXTERNAL_MANAGED"
850+
851+
backend {
852+
group = google_compute_region_instance_group_manager.rigm.instance_group
853+
balancing_mode = "UTILIZATION"
854+
capacity_scaler = 1.0
855+
}
856+
857+
region = "us-central1"
858+
name = "website-backend"
859+
protocol = "HTTP"
860+
timeout_sec = 10
861+
862+
health_checks = [google_compute_region_health_check.default.id]
863+
}
864+
865+
data "google_compute_image" "debian_image" {
866+
provider = google-beta
867+
family = "debian-9"
868+
project = "debian-cloud"
869+
}
870+
871+
resource "google_compute_region_instance_group_manager" "rigm" {
872+
provider = google-beta
873+
region = "us-central1"
874+
name = "website-rigm"
875+
version {
876+
instance_template = google_compute_instance_template.instance_template.id
877+
name = "primary"
878+
}
879+
base_instance_name = "internal-glb"
880+
target_size = 1
881+
}
882+
883+
resource "google_compute_instance_template" "instance_template" {
884+
provider = google-beta
885+
name = "template-website-backend"
886+
machine_type = "e2-medium"
887+
888+
network_interface {
889+
network = google_compute_network.default.id
890+
subnetwork = google_compute_subnetwork.default.id
891+
}
892+
893+
disk {
894+
source_image = data.google_compute_image.debian_image.self_link
895+
auto_delete = true
896+
boot = true
897+
}
898+
899+
tags = ["allow-ssh", "load-balanced-backend"]
900+
}
901+
902+
resource "google_compute_region_health_check" "default" {
903+
depends_on = [google_compute_firewall.fw4]
904+
provider = google-beta
905+
906+
region = "us-central1"
907+
name = "website-hc"
908+
http_health_check {
909+
port_specification = "USE_SERVING_PORT"
910+
}
911+
}
912+
913+
resource "google_compute_address" "default" {
914+
name = "website-ip-1"
915+
provider = google-beta
916+
region = "us-central1"
917+
network_tier = "STANDARD"
918+
}
919+
920+
resource "google_compute_firewall" "fw1" {
921+
provider = google-beta
922+
name = "website-fw-1"
923+
network = google_compute_network.default.id
924+
source_ranges = ["10.1.2.0/24"]
925+
allow {
926+
protocol = "tcp"
927+
}
928+
allow {
929+
protocol = "udp"
930+
}
931+
allow {
932+
protocol = "icmp"
933+
}
934+
direction = "INGRESS"
935+
}
936+
937+
resource "google_compute_firewall" "fw2" {
938+
depends_on = [google_compute_firewall.fw1]
939+
provider = google-beta
940+
name = "website-fw-2"
941+
network = google_compute_network.default.id
942+
source_ranges = ["0.0.0.0/0"]
943+
allow {
944+
protocol = "tcp"
945+
ports = ["22"]
946+
}
947+
target_tags = ["allow-ssh"]
948+
direction = "INGRESS"
949+
}
950+
951+
resource "google_compute_firewall" "fw3" {
952+
depends_on = [google_compute_firewall.fw2]
953+
provider = google-beta
954+
name = "website-fw-3"
955+
network = google_compute_network.default.id
956+
source_ranges = ["130.211.0.0/22", "35.191.0.0/16"]
957+
allow {
958+
protocol = "tcp"
959+
}
960+
target_tags = ["load-balanced-backend"]
961+
direction = "INGRESS"
962+
}
963+
964+
resource "google_compute_firewall" "fw4" {
965+
depends_on = [google_compute_firewall.fw3]
966+
provider = google-beta
967+
name = "website-fw-4"
968+
network = google_compute_network.default.id
969+
source_ranges = ["10.129.0.0/26"]
970+
target_tags = ["load-balanced-backend"]
971+
allow {
972+
protocol = "tcp"
973+
ports = ["80"]
974+
}
975+
allow {
976+
protocol = "tcp"
977+
ports = ["443"]
978+
}
979+
allow {
980+
protocol = "tcp"
981+
ports = ["8000"]
982+
}
983+
direction = "INGRESS"
984+
}
985+
986+
resource "google_compute_network" "default" {
987+
provider = google-beta
988+
name = "website-net"
989+
auto_create_subnetworks = false
990+
routing_mode = "REGIONAL"
991+
}
992+
993+
resource "google_compute_subnetwork" "default" {
994+
provider = google-beta
995+
name = "website-net-default"
996+
ip_cidr_range = "10.1.2.0/24"
997+
region = "us-central1"
998+
network = google_compute_network.default.id
999+
}
1000+
1001+
resource "google_compute_subnetwork" "proxy" {
1002+
provider = google-beta
1003+
name = "website-net-proxy"
1004+
ip_cidr_range = "10.129.0.0/26"
1005+
region = "us-central1"
1006+
network = google_compute_network.default.id
1007+
purpose = "REGIONAL_MANAGED_PROXY"
1008+
role = "ACTIVE"
1009+
}
1010+
```
8051011

8061012
## Argument Reference
8071013

@@ -867,14 +1073,15 @@ The following arguments are supported:
8671073
* `load_balancing_scheme` -
8681074
(Optional)
8691075
This signifies what the ForwardingRule will be used for and can be
870-
EXTERNAL, INTERNAL, or INTERNAL_MANAGED. EXTERNAL is used for Classic
1076+
EXTERNAL, EXTERNAL_MANAGED, INTERNAL, or INTERNAL_MANAGED. EXTERNAL is used for Classic
8711077
Cloud VPN gateways, protocol forwarding to VMs from an external IP address,
8721078
and HTTP(S), SSL Proxy, TCP Proxy, and Network TCP/UDP load balancers.
8731079
INTERNAL is used for protocol forwarding to VMs from an internal IP address,
8741080
and internal TCP/UDP load balancers.
1081+
EXTERNAL_MANAGED is used for regional external HTTP(S) load balancers.
8751082
INTERNAL_MANAGED is used for internal HTTP(S) load balancers.
8761083
Default value is `EXTERNAL`.
877-
Possible values are `EXTERNAL`, `INTERNAL`, and `INTERNAL_MANAGED`.
1084+
Possible values are `EXTERNAL`, `EXTERNAL_MANAGED`, `INTERNAL`, and `INTERNAL_MANAGED`.
8781085

8791086
* `network` -
8801087
(Optional)

‎website/docs/r/compute_region_backend_service.html.markdown

+2-2
Original file line numberDiff line numberDiff line change
@@ -410,7 +410,7 @@ The following arguments are supported:
410410
will be used for. A backend service created for one type of load
411411
balancing cannot be used with the other(s).
412412
Default value is `INTERNAL`.
413-
Possible values are `EXTERNAL`, `INTERNAL`, and `INTERNAL_MANAGED`.
413+
Possible values are `EXTERNAL`, `EXTERNAL_MANAGED`, `INTERNAL`, and `INTERNAL_MANAGED`.
414414

415415
* `locality_lb_policy` -
416416
(Optional)
@@ -449,7 +449,7 @@ The following arguments are supported:
449449
(Optional)
450450
A named port on a backend instance group representing the port for
451451
communication to the backend VMs in that group. Required when the
452-
loadBalancingScheme is EXTERNAL, INTERNAL_MANAGED, or INTERNAL_SELF_MANAGED
452+
loadBalancingScheme is EXTERNAL, EXTERNAL_MANAGED, INTERNAL_MANAGED, or INTERNAL_SELF_MANAGED
453453
and the backends are instance groups. The named port must be defined on each
454454
backend instance group. This parameter has no meaning if the backends are NEGs. API sets a
455455
default of "http" if not given.

‎website/docs/r/os_config_os_policy_assignment.html.markdown

+18-18
Original file line numberDiff line numberDiff line change
@@ -703,24 +703,6 @@ The `disruption_budget` block supports:
703703
(Optional)
704704
Specifies the relative value defined as a percentage, which will be multiplied by a reference value.
705705

706-
The `source` block supports:
707-
708-
* `allow_insecure` -
709-
(Optional)
710-
Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.
711-
712-
* `gcs` -
713-
(Optional)
714-
A Cloud Storage object.
715-
716-
* `local_path` -
717-
(Optional)
718-
A local path within the VM to use.
719-
720-
* `remote` -
721-
(Optional)
722-
A generic remote file.
723-
724706
- - -
725707

726708
* `description` -
@@ -970,6 +952,24 @@ The `zypper` block supports:
970952
(Required)
971953
Required. A one word, unique name for this repository. This is the `repo id` in the zypper config file and also the `display_name` if `display_name` is omitted. This id is also used as the unique identifier when checking for GuestPolicy conflicts.
972954

955+
The `file` block supports:
956+
957+
* `allow_insecure` -
958+
(Optional)
959+
Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.
960+
961+
* `gcs` -
962+
(Optional)
963+
A Cloud Storage object.
964+
965+
* `local_path` -
966+
(Optional)
967+
A local path within the VM to use.
968+
969+
* `remote` -
970+
(Optional)
971+
A generic remote file.
972+
973973
The `gcs` block supports:
974974

975975
* `bucket` -

0 commit comments

Comments
 (0)