| <a name="input_cloud_function"></a> [cloud\_function](#input\_cloud\_function) | Parameters for Cloud Function. The Cloud Function is used to inject licenses to FGTs,<br>upload user-specified configurations and manage the FGT autoscale group.<br><br>Options:<br><br> - cloud\_func\_interface : (Optional \| string \| default:"port1")<br> To communicate with FGTs, the Cloud Function must be connected to the VPC where FGTs also exist.<br> By default, this project assumes the Cloud Function connects to the first VPC you specified in "network\_interfaces", and configure your FGTs through port1.<br> You can also set it to "port2", "port3", ..., "port8" to force the Cloud Function to connect to other VPC and communicate with your FortiGates through that port,<br> but you need to specify the corresponding route of FGTs in "config\_script" or "config\_file" so FGTs can reply to the Cloud Function requests from "cloud\_function.function\_ip\_range".<br> - function\_ip\_range : (Required \| string) Cloud function needs to have its only CIDR ip range ending with "/28", which cannot be used by other resources. Example "10.1.0.0/28".<br> This IP range subnet cannot be used by other resources, such as VMs, Private Service Connect, or load balancers.<br> A static route will be created in the FGT that routes data destined for "cloud\_function.function\_ip\_range" to port "cloud\_function.cloud\_func\_interface".<br> - license\_source : (Optional \| string \| default:"none") The source of license if your image\_type is "byol".<br> "none" : Don't inject licenses to FGTs.<br> "file" : Injecting licenses based on license files. All license files should be in license\_file\_folder.<br> "fortiflex" : Injecting licenses based on FortiFlex. Need to specify the parameter fortiflex if license\_source is "fortiflex".<br> "file\_fortiflex" : Injecting licenses based on license files first. If all license files are in use, try FortiFlex next.<br> - license\_file\_folder : (Optional \| string \| default:"./licenses") The folder where all ".lic" license files are located. Default is "./licenses" folder.<br> - autoscale\_psksecret : (Optional \| string \| default:"psksecret") The secret key used to synchronize information between FortiGates. If not set, the module will randomly generate a 16-character secret key.<br> - logging\_level : (Optional \| string \| default:"INFO") Verbosity of logs. Possible values include "NONE", "ERROR", "WARN", "INFO", "DEBUG", and "TRACE". You can find logs in Google Cloud Logs Explorer.<br> - fortiflex: (Optional \| object) You need to specify this parameter if your license\_source is "fortiflex" or "file\_fortiflex".<br> - retrieve\_mode : (Optional \| string \| default:"use\_stopped") How to retrieve an existing fortiflex license (entitlement):<br> "use\_stopped" Retrieves "STOPPED", "EXPIRED" or "PENDING" licenses, and changes them to "ACTIVE". If the license is released, change the license to "STOPPED".<br> "use\_active" Retrieves "ACTIVE" or "PENDING" licenses. If the license is released, the license keeps "ACTIVE".<br> - username : (Reuqired if license\_source is "fortiflex" or "file\_fortiflex" \| string \| default:"") The username of your FortiFlex account.<br> - password : (Reuqired if license\_source is "fortiflex" or "file\_fortiflex" \| string \| default:"") The password of your FortiFlex account.<br> - config : (Reuqired if license\_source is "fortiflex" or "file\_fortiflex" \| string \| default:"") The configuration ID of your FortiFlex configuration (product type should be FortiGate-VM).<br> - service\_config : (Optional \| object) This parameter controls the instance that runs the cloud function. For simplicity, it is recommended to use the default value.<br> - max\_instance\_count : (Optional \| number \| default:1) The limit on the maximum number of function instances that may coexist at a given time.<br> - max\_instance\_request\_concurrency : (Optional \| number \| default:10) Sets the maximum number of concurrent requests that one cloud function can handle at the same time. Recommended to set it to no less than the maximum number of FGT instances (variable "autoscaler.max\_instances").<br> - available\_cpu : (Optional \| string \| default:"1") The number of CPUs used in a single container instance.<br> - available\_memory : (Optional \| string \| default:"1G") The amount of memory available for a function. Supported units are k, M, G, Mi, Gi. If no unit is supplied the value is interpreted as bytes.<br> - timeout\_seconds : (Optional \| number \| default:240) The function execution timeout. Execution is considered failed and can be terminated if the function is not completed at the end of the timeout period.<br> - ingress\_settings: (Optional \| string \| default:"ALLOW\_ALL") The cloud function accepts what type of ingress traffic. Possible values are: ALLOW\_ALL, ALLOW\_INTERNAL\_ONLY, ALLOW\_INTERNAL\_AND\_GCLB.<br> - egress\_settings: (Optional \| string \| default:"PRIVATE\_RANGES\_ONLY") What type of egress traffic will be sent to the VPC connector. Possible values are: VPC\_CONNECTOR\_EGRESS\_SETTINGS\_UNSPECIFIED, PRIVATE\_RANGES\_ONLY, ALL\_TRAFFIC.<br> - build\_service\_account\_email: (Optional \| string \| default:"") The email address of the service account used to build the cloud function. This account needs to have role "roles/cloudbuild.builds.builder".<br> The <PROJECT\_NUMBER>@cloudbuild.gserviceaccount.com will be used if it is not specified.<br> - trigger\_service\_account\_email: (Optional \| string \| default:"") The email address of the service account used to trigger the cloud function. This account needs to have role "roles/run.invoker".<br> The default service account will be used if it is not specified.<br> - additional\_variables : (Optional \| map \| default: {}) Additional variables used in cloud function. It is used to specify example-specific variables.<br><br>Example:<pre>cloud_function = {<br> function_ip_range = "10.1.0.0/28" # Cloud function needs to have its own CIDR ip range ending with "/28". This IP range cannot be used by other resources.<br> license_source = "file" # "none", "fortiflex", "file", "file_fortiflex"<br> license_file_folder = "./licenses"<br> autoscale_psksecret = "psksecret"<br> logging_level = "INFO" # "NONE", "ERROR", "WARN", "INFO", "DEBUG", "TRACE"<br> # Specify fortiflex parameters if license_source is "fortiflex" or "file_fortiflex"<br> # fortiflex = {<br> # retrieve_mode = "use_active"<br> # username = "Your fortiflex username"<br> # password = "Your fortiflex password"<br> # config = "Your fortiflex configuration ID"<br> # }<br> # Parameters of google cloud function.<br> service_config = {<br> max_instance_request_concurrency = 10<br> timeout_seconds = 360<br> }<br>}</pre> | <pre>object({<br> cloud_func_interface = optional(string, "port1")<br> function_ip_range = string<br> license_source = optional(string, "none")<br> license_file_folder = optional(string, "./licenses")<br> autoscale_psksecret = optional(string, "psksecret")<br> logging_level = optional(string, "NONE")<br> fortiflex = optional(object({<br> retrieve_mode = optional(string, "use_stopped")<br> username = optional(string, "")<br> password = optional(string, "")<br> config = optional(string, "")<br> }), {})<br> service_config = optional(object({<br> max_instance_count = optional(number, 1)<br> max_instance_request_concurrency = optional(number, 10)<br> available_cpu = optional(string, "1")<br> available_memory = optional(string, "1G")<br> timeout_seconds = optional(number, 240)<br> ingress_settings = optional(string, "ALLOW_ALL")<br> egress_settings = optional(string, "PRIVATE_RANGES_ONLY")<br> }), {})<br> build_service_account_email = optional(string, "")<br> trigger_service_account_email = optional(string, "")<br> additional_variables = optional(map(string), {})<br> })</pre> | n/a | yes |
0 commit comments