Add an LB in front of cloud run services

terraform/lb.tf

@@ -0,0 +1,57 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# TODO(icco): This is currently all setup manually.
+#resource "google_compute_backend_service" "apiserver" {
+#  provider   = google-beta
+#  name       = "apiserver"
+#  project    = var.project
+#  enable_cdn = true
+#
+#  backend {
+#    group = google_compute_region_network_endpoint_group.apiserver.id
+#  }
+#}
+
+resource "google_compute_global_address" "verification-server" {
+  name    = "verification-server-address"
+  project = var.project
+}
+
+#resource "google_compute_url_map" "urlmap" {
+#  name            = "verification-server"
+#  project         = var.project
+#  default_service = google_compute_backend_service.apiserver.id
+#
+# TODO(icco): Add host base routing for all four services.
+#}
+#
+#resource "google_compute_target_http_proxy" "default" {
+#  name    = "verification-server"
+#  project = var.project
+#  url_map = google_compute_url_map.urlmap.id
+#}
+#
+#resource "google_compute_forwarding_rule" "verification-server" {
+#  provider = google-beta
+#  name     = "verification-server"
+#  project  = var.project
+#
+#  ip_protocol           = "TCP"
+#  ip_address            = google_compute_global_address.verification-server.address
+#  load_balancing_scheme = "EXTERNAL"
+#  port_range            = "80"
+#  target                = google_compute_target_http_proxy.default.id
+#  network_tier          = "PREMIUM"
+#}

terraform/service_admin_apiserver.tf

@@ -139,6 +139,17 @@ resource "google_cloud_run_service" "adminapi" {
   }
 }
 
+resource "google_compute_region_network_endpoint_group" "adminapi" {
+  name     = "adminapi"
+  provider = google-beta
+  project  = var.project
+  region   = var.region
+
+  cloud_run {
+    service = google_cloud_run_service.adminapi.name
+  }
+}
+
 resource "google_cloud_run_domain_mapping" "adminapi" {
   count    = var.adminapi_custom_domain != "" ? 1 : 0
   location = var.cloudrun_location

terraform/service_apiserver.tf

@@ -147,6 +147,17 @@ resource "google_cloud_run_service" "apiserver" {
   }
 }
 
+resource "google_compute_region_network_endpoint_group" "apiserver" {
+  name     = "apiserver"
+  provider = google-beta
+  project  = var.project
+  region   = var.region
+
+  cloud_run {
+    service = google_cloud_run_service.apiserver.name
+  }
+}
+
 resource "google_cloud_run_domain_mapping" "apiserver" {
   count    = var.apiserver_custom_domain != "" ? 1 : 0
   location = var.cloudrun_location

terraform/service_server.tf

@@ -168,6 +168,17 @@ resource "google_cloud_run_service" "server" {
   }
 }
 
+resource "google_compute_region_network_endpoint_group" "server" {
+  name     = "server"
+  provider = google-beta
+  project  = var.project
+  region   = var.region
+
+  cloud_run {
+    service = google_cloud_run_service.server.name
+  }
+}
+
 resource "google_cloud_run_domain_mapping" "server" {
   count    = var.server_custom_domain != "" ? 1 : 0
   location = var.cloudrun_location

terraform/variables.tf

@@ -139,7 +139,7 @@ variable "server_custom_domain" {
 terraform {
   required_providers {
     google      = "~> 3.32"
-    google-beta = "~> 3.32"
+    google-beta = "~> 3.35"
     null        = "~> 2.1"
     random      = "~> 2.3"
   }