Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Creates a global HTTP load balancer for Compute Engine by using forwarding rules

License

NotificationsYou must be signed in to change notification settings

terraform-google-modules/terraform-google-lb-http

Modular Global HTTP Load Balancer for GCE using forwarding rules.

  • If you would like to allow for backend groups to be managed outside Terraform,such as via GKE services, see thedynamicbackends submodule.
  • If you would like to use load balancing with serverless backends (Cloud Run,Cloud Functions or App Engine), see theserverless_negs submodule andcloudrun example.

Load Balancer Types

Compatibility

This module is meant for use with Terraform 1.3+ and tested using Terraform 1.3. If you find incompatibilities using Terraform >=1.3, please open an issue. If you haven'tupgraded and need a Terraform0.12.x-compatible version of this module, the last released versionintended for Terraform 0.12.x isv4.5.0.

Version

Current version is 12.0. Upgrade guides:

Usage

module"gce-lb-http" {source="GoogleCloudPlatform/lb-http/google"version="~> 9.0"project="my-project-id"name="group-http-lb"target_tags=[module.mig1.target_tags,module.mig2.target_tags]backends={    default= {      port= var.service_port      protocol="HTTP"      port_name= var.service_port_name      timeout_sec=10      enable_cdn=false      health_check= {        request_path="/"        port= var.service_port      }      log_config= {        enable=true        sample_rate=1.0      }      groups= [        {# Each node pool instance group should be added to the backend.          group= var.backend        },      ]      iap_config= {        enable=false      }    }  }}

Resources created

Figure 1.diagram of terraform resources

architecture diagram

Inputs

NameDescriptionTypeDefaultRequired
addressExisting IPv4 address to use (the actual IP address value)stringnullno
backendsMap backend indices to list of backend maps.
map(object({
port = optional(number)
project = optional(string)
protocol = optional(string)
port_name = optional(string)
description = optional(string)
enable_cdn = optional(bool)
compression_mode = optional(string)
security_policy = optional(string, null)
edge_security_policy = optional(string, null)
custom_request_headers = optional(list(string))
custom_response_headers = optional(list(string))

timeout_sec = optional(number)
connection_draining_timeout_sec = optional(number)
session_affinity = optional(string)
affinity_cookie_ttl_sec = optional(number)
locality_lb_policy = optional(string)

health_check = optional(object({
host = optional(string)
request_path = optional(string)
request = optional(string)
response = optional(string)
port = optional(number)
port_name = optional(string)
proxy_header = optional(string)
port_specification = optional(string)
protocol = optional(string)
check_interval_sec = optional(number)
timeout_sec = optional(number)
healthy_threshold = optional(number)
unhealthy_threshold = optional(number)
logging = optional(bool)
}))

log_config = object({
enable = optional(bool)
sample_rate = optional(number)
})

groups = list(object({
group = string
description = optional(string)

balancing_mode = optional(string)
capacity_scaler = optional(number)
max_connections = optional(number)
max_connections_per_instance = optional(number)
max_connections_per_endpoint = optional(number)
max_rate = optional(number)
max_rate_per_instance = optional(number)
max_rate_per_endpoint = optional(number)
max_utilization = optional(number)
}))
iap_config = optional(object({
enable = bool
oauth2_client_id = optional(string)
oauth2_client_secret = optional(string)
}))
cdn_policy = optional(object({
cache_mode = optional(string)
signed_url_cache_max_age_sec = optional(string)
default_ttl = optional(number)
max_ttl = optional(number)
client_ttl = optional(number)
negative_caching = optional(bool)
negative_caching_policy = optional(object({
code = optional(number)
ttl = optional(number)
}))
serve_while_stale = optional(number)
cache_key_policy = optional(object({
include_host = optional(bool)
include_protocol = optional(bool)
include_query_string = optional(bool)
query_string_blacklist = optional(list(string))
query_string_whitelist = optional(list(string))
include_http_headers = optional(list(string))
include_named_cookies = optional(list(string))
}))
bypass_cache_on_request_headers = optional(list(string))
}))
outlier_detection = optional(object({
base_ejection_time = optional(object({
seconds = number
nanos = optional(number)
}))
consecutive_errors = optional(number)
consecutive_gateway_failure = optional(number)
enforcing_consecutive_errors = optional(number)
enforcing_consecutive_gateway_failure = optional(number)
enforcing_success_rate = optional(number)
interval = optional(object({
seconds = number
nanos = optional(number)
}))
max_ejection_percent = optional(number)
success_rate_minimum_hosts = optional(number)
success_rate_request_volume = optional(number)
success_rate_stdev_factor = optional(number)
}))
}))
n/ayes
certificateContent of the SSL certificate. Requiresssl to be set totrue andcreate_ssl_certificate set totruestringnullno
certificate_mapCertificate Map ID in format projects/{project}/locations/global/certificateMaps/{name}. Identifies a certificate map associated with the given target proxy. Requiresssl to be set totruestringnullno
create_addressCreate a new global IPv4 addressbooltrueno
create_ipv6_addressAllocate a new IPv6 address. Conflicts with "ipv6_address" - if both specified, "create_ipv6_address" takes precedence.boolfalseno
create_ssl_certificateIftrue, Create certificate usingprivate_key/certificateboolfalseno
create_url_mapSet tofalse if url_map variable is provided.booltrueno
edge_security_policyThe resource URL for the edge security policy to associate with the backend servicestringnullno
enable_ipv6Enable IPv6 address on the CDN load-balancerboolfalseno
firewall_networksNames of the networks to create firewall rules inlist(string)
[
"default"
]
no
firewall_projectsNames of the projects to create firewall rules inlist(string)
[
"default"
]
no
http_forwardSet tofalse to disable HTTP port 80 forwardbooltrueno
http_keep_alive_timeout_secSpecifies how long to keep a connection open, after completing a response, while there is no matching traffic (in seconds).numbernullno
http_portThe port for the HTTP load balancernumber80no
https_portThe port for the HTTPS load balancernumber443no
https_redirectSet totrue to enable https redirect on the lb.boolfalseno
ipv6_addressAn existing IPv6 address to use (the actual IP address value)stringnullno
labelsThe labels to attach to resources created by this modulemap(string){}no
load_balancing_schemeLoad balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL_MANAGED for Envoy-based load balancer, and INTERNAL_SELF_MANAGED for traffic director)string"EXTERNAL"no
managed_ssl_certificate_domainsCreate Google-managed SSL certificates for specified domains. Requiresssl to be set totruelist(string)[]no
nameName for the forwarding rule and prefix for supporting resourcesstringn/ayes
networkNetwork for INTERNAL_SELF_MANAGED load balancing schemestring"default"no
private_keyContent of the private SSL key. Requiresssl to be set totrue andcreate_ssl_certificate set totruestringnullno
projectThe project to deploy to, if not set the default provider project is used.stringn/ayes
quicSpecifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only.boolnullno
random_certificate_suffixBool to enable/disable random certificate name generation. Set and keep this to true if you need to change the SSL cert.boolfalseno
security_policyThe resource URL for the security policy to associate with the backend servicestringnullno
server_tls_policyThe resource URL for the server TLS policy to associate with the https proxy servicestringnullno
sslSet totrue to enable SSL support. Iftrue then at least one of these are required: 1)ssl_certificates OR 2)create_ssl_certificate set totrue andprivate_key/certificate OR 3)managed_ssl_certificate_domains, OR 4)certificate_mapboolfalseno
ssl_certificatesSSL cert self_link list. Requiresssl to be set totruelist(string)[]no
ssl_policySelfink to SSL Policystringnullno
target_service_accountsList of target service accounts for health check firewall rule. Exactly one of target_tags or target_service_accounts should be specified.list(string)[]no
target_tagsList of target tags for health check firewall rule. Exactly one of target_tags or target_service_accounts should be specified.list(string)[]no
url_mapThe url_map resource to use. Default is to send all traffic to first backend.stringnullno

Outputs

NameDescription
backend_servicesThe backend service resources.
external_ipThe external IPv4 assigned to the global fowarding rule.
external_ipv6_addressThe external IPv6 assigned to the global fowarding rule.
http_proxyThe HTTP proxy used by this module.
https_proxyThe HTTPS proxy used by this module.
ipv6_enabledWhether IPv6 configuration is enabled on this load-balancer
ssl_certificate_createdThe SSL certificate create from key/pem
url_mapThe default URL map used by this module.

About

Creates a global HTTP load balancer for Compute Engine by using forwarding rules

Topics

Resources

License

Contributing

Security policy

Stars

Watchers

Forks

Packages

No packages published

[8]ページ先頭

©2009-2025 Movatter.jp