feat: Add frontend and backend modules (#461)

build/int.cloudbuild.yaml

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-timeout: 6120s
+timeout: 6840s
 steps:
 - id: swap-module-refs
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
@@ -24,29 +24,15 @@ steps:
   - 'TF_VAR_org_id=$_ORG_ID'
   - 'TF_VAR_folder_id=$_FOLDER_ID'
   - 'TF_VAR_billing_account=$_BILLING_ACCOUNT'
-# cloudrun implicit serverless negs
 - id: init-all
   waitFor:
     - prepare
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'cft test run all --stage init --verbose']
-- id: apply cloudrun-implicit
+- id: create
   waitFor:
     - init-all
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'cft test run TestCloudrunImplicit --stage apply --verbose']
-- id: verify cloudrun-implicit
-  waitFor:
-    - apply cloudrun-implicit
-  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'sleep 720 && cft test run TestCloudrunImplicit --stage verify --verbose']
-- id: teardown cloudrun-implicit
-  waitFor:
-    - verify cloudrun-implicit
-  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'cft test run TestCloudrunImplicit --stage teardown --verbose']
-- id: create
-  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'source /usr/local/bin/task_helper_functions.sh && kitchen_do create']
 - id: converge
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
@@ -109,6 +95,38 @@ steps:
 - id: user-managed-google-managed-ssl-example-teardown
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'cft test run TestAll/examples/user-managed-google-managed-ssl --stage teardown --verbose']
+# cloudrun implicit serverless negs
+- id: apply cloudrun-implicit
+  waitFor:
+    - create
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestCloudrunImplicit --stage apply --verbose']
+- id: verify cloudrun-implicit
+  waitFor:
+    - apply cloudrun-implicit
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'sleep 720 && cft test run TestCloudrunImplicit --stage verify --verbose']
+- id: teardown cloudrun-implicit
+  waitFor:
+    - verify cloudrun-implicit
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestCloudrunImplicit --stage teardown --verbose']
+# separate frontend and backend module for http load balancer
+- id: apply lb-http-separate-frontend-and-backend
+  waitFor:
+    - create
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestSeparateFrontendAndBackend --stage apply --verbose']
+- id: verify lb-http-separate-frontend-and-backend
+  waitFor:
+    - apply lb-http-separate-frontend-and-backend
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'sleep 720 && cft test run TestSeparateFrontendAndBackend --stage verify --verbose']
+- id: teardown lb-http-separate-frontend-and-backend
+  waitFor:
+    - verify lb-http-separate-frontend-and-backend
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestSeparateFrontendAndBackend --stage teardown --verbose']
 tags:
 - 'ci'
 - 'integration'

examples/lb-http-separate-frontend-and-backend/README.md

@@ -0,0 +1,95 @@
+# HTTP Load Balancer Example - Separate modules for creating HTTP load balancer frontend and backend resources
+
+[![button](http://gstatic.com/cloudssh/images/open-btn.png)](https://console.cloud.google.com/cloudshell/open?git_repo=https://github.com/GoogleCloudPlatform/terraform-google-lb-http&working_dir=examples/lb-http-separate-frontend-and-backend&page=shell&tutorial=README.md)
+
+This example creates a global HTTP forwarding rule to forward traffic to instance groups in the us-west1 and us-east1 regions. The `google_compute_backend_service` and its dependencies are created as part of `backend` module.
+The forwarding rules and its dependecies are created as part of `frontend` modules.
+
+## Change to the example directory
+
+```
+[[ `basename $PWD` != lb-http-separate-frontend-and-backend ]] && cd examples/lb-http-separate-frontend-and-backend
+```
+
+## Install Terraform
+
+1. Install Terraform if it is not already installed (visit [terraform.io](https://terraform.io) for other distributions):
+
+## Set up the environment
+
+1. Set the project, replace `YOUR_PROJECT` with your project ID:
+
+```
+PROJECT=YOUR_PROJECT
+```
+
+```
+gcloud config set project ${PROJECT}
+```
+
+2. Configure the environment for Terraform:
+
+```
+[[ $CLOUD_SHELL ]] || gcloud auth application-default login
+export GOOGLE_PROJECT=$(gcloud config get-value project)
+```
+
+## Run Terraform
+
+```
+terraform init
+terraform apply
+```
+
+## Test load balancing
+
+1. Open the URL of the load balancer in your browser:
+
+```
+echo http://$(terraform output load-balancer-ip)
+```
+
+You should see the instance details from the region closest to you.
+
+## Test forwarding to the other region
+
+1. Change the size of the instance group that’s currently serving requests to zero, so that traffic is forwarded to the group in the other region.
+
+   For example, if requests are being served from group1 (us-west1), resize group1 to zero. You can do this using the [`gcloud` CLI](https://cloud.google.com/sdk/gcloud/reference/compute/instance-groups/managed/resize) or the [web console](https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances#resize_managed_group).
+
+   ```
+   gcloud compute instance-groups managed resize lb-http-separate-frontend-and-backend-group1-mig --size=0 --region=us-west1
+   ```
+   It may take a few minutes for the instance group to be resized.
+
+   **Note**: This change will cause your infrastructure to _drift_ from the Terraform state. You can run `terraform apply` at any time to update the infrastructure to match the Terraform state.
+
+2. Open the external load-balancer IP address again, and verify that you see responses from the instance group in the other region.
+
+  ```
+  echo http://$(terraform output load-balancer-ip)| sed 's/"//g'
+  ```
+
+## Cleanup
+
+1. Remove all resources created by terraform:
+
+```
+terraform destroy
+```
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| project\_id | n/a | `string` | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| load-balancer-ip | n/a |
+| load-balancer-ipv6 | The IPv6 address of the load-balancer, if enabled; else "undefined" |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

examples/lb-http-separate-frontend-and-backend/gceme.sh.tpl

@@ -0,0 +1 @@
+../mig-nat-http-lb/gceme.sh.tpl

examples/lb-http-separate-frontend-and-backend/main.tf

@@ -0,0 +1,117 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+resource "google_compute_network" "default" {
+  name                    = "lb-http-separate-frontend-and-backend"
+  auto_create_subnetworks = "false"
+}
+
+resource "google_compute_subnetwork" "group1" {
+  name                     = "lb-http-separate-frontend-and-backend-group1"
+  ip_cidr_range            = "10.126.0.0/20"
+  network                  = google_compute_network.default.self_link
+  region                   = "us-west1"
+  private_ip_google_access = true
+}
+
+# Router and Cloud NAT are required for installing packages from repos (apache, php etc)
+resource "google_compute_router" "group1" {
+  name    = "lb-http-separate-frontend-and-backend-gw-group1"
+  network = google_compute_network.default.self_link
+  region  = "us-west1"
+}
+
+module "cloud-nat-group1" {
+  source     = "terraform-google-modules/cloud-nat/google"
+  version    = "~> 5.0"
+  router     = google_compute_router.group1.name
+  project_id = var.project_id
+  region     = "us-west1"
+  name       = "lb-http-separate-frontend-and-backend-cloud-nat-group1"
+}
+
+resource "google_compute_subnetwork" "group2" {
+  name                     = "lb-http-separate-frontend-and-backend-group2"
+  ip_cidr_range            = "10.127.0.0/20"
+  network                  = google_compute_network.default.self_link
+  region                   = "us-east1"
+  private_ip_google_access = true
+}
+
+# Router and Cloud NAT are required for installing packages from repos (apache, php etc)
+resource "google_compute_router" "group2" {
+  name    = "lb-http-separate-frontend-and-backend-gw-group2"
+  network = google_compute_network.default.self_link
+  region  = "us-east1"
+}
+
+module "cloud-nat-group2" {
+  source     = "terraform-google-modules/cloud-nat/google"
+  version    = "~> 5.0"
+  router     = google_compute_router.group2.name
+  project_id = var.project_id
+  region     = "us-east1"
+  name       = "lb-http-separate-frontend-and-backend-cloud-nat-group2"
+}
+
+module "lb-http-backend" {
+  source     = "terraform-google-modules/lb-http/google//modules/backend"
+  version    = "~> 12.0"
+  project_id = var.project_id
+  name       = "backend-lb"
+  target_tags = [
+    "lb-http-separate-frontend-and-backend-group1",
+    module.cloud-nat-group1.router_name,
+    "lb-http-separate-frontend-and-backend-group2",
+    module.cloud-nat-group2.router_name
+  ]
+  firewall_networks = [google_compute_network.default.name]
+  protocol          = "HTTP"
+  port_name         = "http"
+  timeout_sec       = 10
+  enable_cdn        = false
+
+  health_check = {
+    request_path = "/"
+    port         = 80
+  }
+
+  log_config = {
+    enable      = true
+    sample_rate = 1.0
+  }
+
+  groups = [
+    {
+      group = module.mig1.instance_group
+    },
+    {
+      group = module.mig2.instance_group
+    },
+  ]
+
+  iap_config = {
+    enable = false
+  }
+}
+
+module "lb-http-frontend" {
+  source        = "terraform-google-modules/lb-http/google//modules/frontend"
+  version       = "~> 12.0"
+  project_id    = var.project_id
+  name          = "frontend-lb"
+  url_map_input = module.lb-http-backend.backend_service_info
+}

examples/lb-http-separate-frontend-and-backend/mig.tf

@@ -0,0 +1,93 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+provider "google" {
+  project = var.project_id
+}
+
+provider "google-beta" {
+  project = var.project_id
+}
+
+data "template_file" "group-startup-script" {
+  template = file(format("%s/gceme.sh.tpl", path.module))
+
+  vars = {
+    PROXY_PATH = ""
+  }
+}
+
+module "mig1_template" {
+  source     = "terraform-google-modules/vm/google//modules/instance_template"
+  version    = "~> 12.0"
+  network    = google_compute_network.default.self_link
+  subnetwork = google_compute_subnetwork.group1.self_link
+  service_account = {
+    email  = ""
+    scopes = ["cloud-platform"]
+  }
+  name_prefix          = "lb-http-separate-frontend-and-backend-group1"
+  startup_script       = data.template_file.group-startup-script.rendered
+  source_image_family  = "ubuntu-2004-lts"
+  source_image_project = "ubuntu-os-cloud"
+  tags = [
+    "lb-http-separate-frontend-and-backend-group1",
+    module.cloud-nat-group1.router_name
+  ]
+}
+
+module "mig1" {
+  source            = "terraform-google-modules/vm/google//modules/mig"
+  version           = "~> 12.0"
+  instance_template = module.mig1_template.self_link
+  region            = "us-west1"
+  hostname          = "lb-http-separate-frontend-and-backend-group1"
+  target_size       = 2
+  named_ports = [{
+    name = "http",
+    port = 80
+  }]
+}
+
+module "mig2_template" {
+  source     = "terraform-google-modules/vm/google//modules/instance_template"
+  version    = "~> 12.0"
+  network    = google_compute_network.default.self_link
+  subnetwork = google_compute_subnetwork.group2.self_link
+  service_account = {
+    email  = ""
+    scopes = ["cloud-platform"]
+  }
+  name_prefix    = "lb-http-separate-frontend-and-backend-group2"
+  startup_script = data.template_file.group-startup-script.rendered
+  tags = [
+    "lb-http-separate-frontend-and-backend-group2",
+    module.cloud-nat-group2.router_name
+  ]
+}
+
+module "mig2" {
+  source            = "terraform-google-modules/vm/google//modules/mig"
+  version           = "~> 12.0"
+  instance_template = module.mig2_template.self_link
+  region            = "us-east1"
+  hostname          = "lb-http-separate-frontend-and-backend-group2"
+  target_size       = 2
+  named_ports = [{
+    name = "http",
+    port = 80
+  }]
+}