metadata.yaml

# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: blueprints.cloud.google.com/v1alpha1
kind: BlueprintMetadata
metadata:
  name: terraform-google-lb-http-dynamic-backends
  annotations:
    config.kubernetes.io/local-config: "true"
spec:
  info:
    title: Global HTTP Load Balancer Terraform Module
    source:
      repo: https://github.com/terraform-google-modules/terraform-google-lb-http.git
      sourceType: git
      dir: /modules/dynamic_backends
    version: 12.1.4
    actuationTool:
      flavor: Terraform
      version: ">= 1.3"
    description: {}
  content:
    examples:
      - name: cdn-policy
        location: examples/cdn-policy
      - name: certificate-map
        location: examples/certificate-map
      - name: cloudrun
        location: examples/cloudrun
      - name: cloudrun-implicit-serverless-neg
        location: examples/cloudrun-implicit-serverless-neg
      - name: cross-project-mig-backend
        location: examples/cross-project-mig-backend
      - name: dynamic-backend
        location: examples/dynamic-backend
      - name: gke-node-port
        location: examples/https-gke/gke-node-port
      - name: https-gke
        location: examples/https-gke
      - name: https-redirect
        location: examples/https-redirect
      - name: internal-lb-cloud-run
        location: examples/internal-lb-cloud-run
      - name: internal-lb-gce-mig
        location: examples/internal-lb-gce-mig
      - name: lb-http-separate-frontend-and-backend
        location: examples/lb-http-separate-frontend-and-backend
      - name: mig-nat-http-lb
        location: examples/mig-nat-http-lb
      - name: multi-backend-multi-mig-bucket-https-lb
        location: examples/multi-backend-multi-mig-bucket-https-lb
      - name: multi-mig-http-lb
        location: examples/multi-mig-http-lb
      - name: multiple-certs
        location: examples/multiple-certs
      - name: shared-vpc
        location: examples/shared-vpc
      - name: traffic-director
        location: examples/traffic-director
      - name: user-managed-google-managed-ssl
        location: examples/user-managed-google-managed-ssl
  interfaces:
    variables:
      - name: project
        description: The project to deploy to, if not set the default provider project is used.
        varType: string
        required: true
      - name: name
        description: Name for the forwarding rule and prefix for supporting resources
        varType: string
        required: true
      - name: create_address
        description: Create a new global IPv4 address
        varType: bool
        defaultValue: true
      - name: address
        description: Existing IPv4 address to use (the actual IP address value)
        varType: string
      - name: enable_ipv6
        description: Enable IPv6 address on the CDN load-balancer
        varType: bool
        defaultValue: false
      - name: create_ipv6_address
        description: Allocate a new IPv6 address. Conflicts with "ipv6_address" - if both specified, "create_ipv6_address" takes precedence.
        varType: bool
        defaultValue: false
      - name: ipv6_address
        description: An existing IPv6 address to use (the actual IP address value)
        varType: string
      - name: firewall_networks
        description: Names of the networks to create firewall rules in
        varType: list(string)
        defaultValue:
          - default
      - name: firewall_projects
        description: Names of the projects to create firewall rules in
        varType: list(string)
        defaultValue:
          - default
      - name: target_tags
        description: List of target tags for health check firewall rule. Exactly one of target_tags or target_service_accounts should be specified.
        varType: list(string)
        defaultValue: []
      - name: target_service_accounts
        description: List of target service accounts for health check firewall rule. Exactly one of target_tags or target_service_accounts should be specified.
        varType: list(string)
        defaultValue: []
      - name: backends
        description: Map backend indices to list of backend maps.
        varType: |-
          map(object({
              port                    = optional(number)
              project                 = optional(string)
              protocol                = optional(string)
              port_name               = optional(string)
              description             = optional(string)
              enable_cdn              = optional(bool)
              compression_mode        = optional(string)
              security_policy         = optional(string, null)
              edge_security_policy    = optional(string, null)
              custom_request_headers  = optional(list(string))
              custom_response_headers = optional(list(string))

              timeout_sec                     = optional(number)
              connection_draining_timeout_sec = optional(number)
              session_affinity                = optional(string)
              affinity_cookie_ttl_sec         = optional(number)
              locality_lb_policy              = optional(string)

              health_check = optional(object({
                host                = optional(string)
                request_path        = optional(string)
                request             = optional(string)
                response            = optional(string)
                port                = optional(number)
                port_name           = optional(string)
                proxy_header        = optional(string)
                port_specification  = optional(string)
                protocol            = optional(string)
                check_interval_sec  = optional(number)
                timeout_sec         = optional(number)
                healthy_threshold   = optional(number)
                unhealthy_threshold = optional(number)
                logging             = optional(bool)
              }))

              log_config = object({
                enable      = optional(bool)
                sample_rate = optional(number)
              })

              groups = list(object({
                group       = string
                description = optional(string)

                balancing_mode               = optional(string)
                capacity_scaler              = optional(number)
                max_connections              = optional(number)
                max_connections_per_instance = optional(number)
                max_connections_per_endpoint = optional(number)
                max_rate                     = optional(number)
                max_rate_per_instance        = optional(number)
                max_rate_per_endpoint        = optional(number)
                max_utilization              = optional(number)
              }))
              iap_config = optional(object({
                enable               = bool
                oauth2_client_id     = optional(string)
                oauth2_client_secret = optional(string)
              }))
              cdn_policy = optional(object({
                cache_mode                   = optional(string)
                signed_url_cache_max_age_sec = optional(string)
                default_ttl                  = optional(number)
                max_ttl                      = optional(number)
                client_ttl                   = optional(number)
                negative_caching             = optional(bool)
                negative_caching_policy = optional(object({
                  code = optional(number)
                  ttl  = optional(number)
                }))
                serve_while_stale = optional(number)
                cache_key_policy = optional(object({
                  include_host           = optional(bool)
                  include_protocol       = optional(bool)
                  include_query_string   = optional(bool)
                  query_string_blacklist = optional(list(string))
                  query_string_whitelist = optional(list(string))
                  include_http_headers   = optional(list(string))
                  include_named_cookies  = optional(list(string))
                }))
                bypass_cache_on_request_headers = optional(list(string))
              }))
              outlier_detection = optional(object({
                base_ejection_time = optional(object({
                  seconds = number
                  nanos   = optional(number)
                }))
                consecutive_errors                    = optional(number)
                consecutive_gateway_failure           = optional(number)
                enforcing_consecutive_errors          = optional(number)
                enforcing_consecutive_gateway_failure = optional(number)
                enforcing_success_rate                = optional(number)
                interval = optional(object({
                  seconds = number
                  nanos   = optional(number)
                }))
                max_ejection_percent        = optional(number)
                success_rate_minimum_hosts  = optional(number)
                success_rate_request_volume = optional(number)
                success_rate_stdev_factor   = optional(number)
              }))
            }))
        required: true
      - name: create_url_map
        description: Set to `false` if url_map variable is provided.
        varType: bool
        defaultValue: true
      - name: url_map
        description: The url_map resource to use. Default is to send all traffic to first backend.
        varType: string
      - name: http_forward
        description: Set to `false` to disable HTTP port 80 forward
        varType: bool
        defaultValue: true
      - name: ssl
        description: "Set to `true` to enable SSL support. If `true` then at least one of these are required: 1) `ssl_certificates` OR 2) `create_ssl_certificate` set to `true` and `private_key/certificate` OR  3) `managed_ssl_certificate_domains`, OR 4) `certificate_map`"
        varType: bool
        defaultValue: false
      - name: create_ssl_certificate
        description: If `true`, Create certificate using `private_key/certificate`
        varType: bool
        defaultValue: false
      - name: ssl_certificates
        description: SSL cert self_link list. Requires `ssl` to be set to `true`
        varType: list(string)
        defaultValue: []
      - name: private_key
        description: Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`
        varType: string
      - name: certificate
        description: Content of the SSL certificate. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true`
        varType: string
      - name: managed_ssl_certificate_domains
        description: Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true`
        varType: list(string)
        defaultValue: []
      - name: certificate_map
        description: Certificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy.  Requires `ssl` to be set to `true`
        varType: string
      - name: ssl_policy
        description: Selfink to SSL Policy
        varType: string
      - name: quic
        description: Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only.
        varType: bool
      - name: edge_security_policy
        description: The resource URL for the edge security policy to associate with the backend service
        varType: string
      - name: security_policy
        description: The resource URL for the security policy to associate with the backend service
        varType: string
      - name: https_redirect
        description: Set to `true` to enable https redirect on the lb.
        varType: bool
        defaultValue: false
      - name: random_certificate_suffix
        description: Bool to enable/disable random certificate name generation. Set and keep this to true if you need to change the SSL cert.
        varType: bool
        defaultValue: false
      - name: labels
        description: The labels to attach to resources created by this module
        varType: map(string)
        defaultValue: {}
      - name: load_balancing_scheme
        description: Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL_MANAGED for Envoy-based load balancer, and INTERNAL_SELF_MANAGED for traffic director)
        varType: string
        defaultValue: EXTERNAL
      - name: network
        description: Network for INTERNAL_SELF_MANAGED load balancing scheme
        varType: string
        defaultValue: default
      - name: server_tls_policy
        description: The resource URL for the server TLS policy to associate with the https proxy service
        varType: string
      - name: http_port
        description: The port for the HTTP load balancer
        varType: number
        defaultValue: 80
      - name: https_port
        description: The port for the HTTPS load balancer
        varType: number
        defaultValue: 443
      - name: http_keep_alive_timeout_sec
        description: Specifies how long to keep a connection open, after completing a response, while there is no matching traffic (in seconds).
        varType: number
    outputs:
      - name: backend_services
        description: The backend service resources.
      - name: external_ip
        description: The external IPv4 assigned to the global fowarding rule.
      - name: external_ipv6_address
        description: The external IPv6 assigned to the global fowarding rule.
      - name: http_proxy
        description: The HTTP proxy used by this module.
      - name: https_proxy
        description: The HTTPS proxy used by this module.
      - name: ipv6_enabled
        description: Whether IPv6 configuration is enabled on this load-balancer
      - name: ssl_certificate_created
        description: The SSL certificate create from key/pem
      - name: url_map
        description: The default URL map used by this module.
  requirements:
    roles:
      - level: Project
        roles:
          - roles/compute.xpnAdmin
      - level: Project
        roles:
          - roles/storage.admin
          - roles/compute.admin
          - roles/run.admin
          - roles/iam.serviceAccountUser
          - roles/certificatemanager.owner
          - roles/vpcaccess.admin
          - roles/iam.serviceAccountAdmin
    services:
      - cloudresourcemanager.googleapis.com
      - storage-api.googleapis.com
      - serviceusage.googleapis.com
      - compute.googleapis.com
      - run.googleapis.com
      - iam.googleapis.com
      - certificatemanager.googleapis.com
      - vpcaccess.googleapis.com
    providerVersions:
      - source: hashicorp/google
        version: ">= 6.0, < 7"
      - source: hashicorp/google-beta
        version: ">= 6.0, < 7"
      - source: hashicorp/random
        version: ">= 2.1"