Terraform:如何从对象列表创建 API 网关终端节点和方法?

我想创建一个 terraform (v0.12+( 模块，该模块输出具有 Lambda 集成的 AWS API 网关。我不太明白如何(或者是否可能(迭代映射列表以动态输出资源。

用户应该能够像这样实例化模块：

module "api_gateway" {
source = "./apig"
endpoints = [
{
path = "example1"
method = "GET"
lambda = "some.lambda.reference"
},
{
path = "example1"
method = "POST"
lambda = "some.lambda.reference"
},
{
path = "example2"
method = "GET"
lambda = "another.lambda.reference"
}
]
}

从endpoints接口，我想输出三个资源：

path_part = endpoint[i].pathaws_api_gateway_resource
http_method = endpoint[i].method的aws_api_gateway_method
aws_api_gateway_integrationendpoint[i].lambda等

Terraform的for_each属性似乎不够强大，无法处理这个问题。我知道 Terraform 也支持for循环和for / in循环，但我找不到任何使用此类表达式进行资源声明的示例。

让我们从写出该endpoints变量的声明开始，因为答案的其余部分取决于它以这种方式定义：

variable "endpoints" {
type = set(object({
path   = string
method = string
lambda = string
})
}

上面说endpoints是一组对象，这意味着项目的顺序并不重要。排序是微不足道的，因为我们无论如何都要在 API 中为每个对象创建单独的对象。

下一步是弄清楚如何从给定的数据结构移动到一个映射结构，其中每个键都是唯一的，并且每个元素映射到要生成的资源的一个实例。为此，我们必须定义我们想要的映射，我认为这里是：

每个不同的path一个aws_api_gateway_resource。
每个不同的path和method对都有一个aws_api_gateway_method。
每个不同的path和method对都有一个aws_api_gateway_integration。
每个不同的path/method/status_code三重对应一个aws_api_gateway_integration_response。
每个不同的path/method/status_code三重一个aws_api_gateway_method_response。

因此，我们似乎在这里需要三个集合：第一个是所有路径的集合，第二个是从path+method对到描述该方法的对象，第三个是我们想要建模的终结点和状态代码的每个组合。

locals {
response_codes = toset({
status_code         = 200
response_templates  = {} # TODO: Fill this in
response_models     = {} # TODO: Fill this in
response_parameters = {} # TODO: Fill this in
})
# endpoints is a set of all of the distinct paths in var.endpoints
endpoints = toset(var.endpoints.*.path)
# methods is a map from method+path identifier strings to endpoint definitions
methods = {
for e in var.endpoints : "${e.method} ${e.path}" => e
}
# responses is a map from method+path+status_code identifier strings
# to endpoint definitions
responses = {
for pair in setproduct(var.endpoints, local.response_codes) :
"${pair[0].method} ${pair[0].path} ${pair[1].status_code}" => {
method              = pair[0].method
path                = pair[0].path
method_key          = "${pair[0].method} ${pair[0].path}" # key for local.methods
status_code         = pair[1].status_code
response_templates  = pair[1].response_templates
response_models     = pair[1].response_models
response_parameters = pair[1].response_parameters
}
}
}

定义这两个派生集合后，我们现在可以写出资源配置：

resource "aws_api_gateway_rest_api" "example" {
name = "example"
}
resource "aws_api_gateway_resource" "example" {
for_each = local.endpoints
rest_api_id = aws_api_gateway_rest_api.example.id
parent_id   = aws_api_gateway_rest_api.example.root_resource_id
path_part   = each.value
}
resource "aws_api_gateway_method" "example" {
for_each = local.methods
rest_api_id = aws_api_gateway_resource.example[each.value.path].rest_api_id
resource_id = aws_api_gateway_resource.example[each.value.path].resource_id
http_method = each.value.method
}
resource "aws_api_gateway_integration" "example" {
for_each = local.methods
rest_api_id = aws_api_gateway_method.example[each.key].rest_api_id
resource_id = aws_api_gateway_method.example[each.key].resource_id
http_method = aws_api_gateway_method.example[each.key].http_method
type                    = "AWS_PROXY"
integration_http_method = "POST"
uri                     = each.value.lambda
}
resource "aws_api_gateway_integration_response" "example" {
for_each = var.responses
rest_api_id = aws_api_gateway_integration.example[each.value.method_key].rest_api_id
resource_id = aws_api_gateway_integration.example[each.value.method_key].resource_id
http_method = each.value.method
status_code = each.value.status_code
response_parameters = each.value.response_parameters
response_templates  = each.value.response_templates
# NOTE: There are some other arguments for
# aws_api_gateway_integration_response that I've left out
# here. If you need them you'll need to adjust the above
# local value expressions to include them too.
}
resource "aws_api_gateway_response" "example" {
for_each = var.responses
rest_api_id = aws_api_gateway_integration_response.example[each.key].rest_api_id
resource_id = aws_api_gateway_integration_response.example[each.key].resource_id
http_method = each.value.method
status_code = each.value.status_code
response_models     = each.value.response_models
}

您可能还需要一个aws_api_gateway_deployment。为此，请务必确保它依赖于我们上面定义的所有API 网关资源，以便 Terraform 将等到 API 完全配置后再尝试部署它：

resource "aws_api_gateway_deployment" "example" {
rest_api_id = aws_api_gateway_rest_api.example.id
# (whatever other settings are appropriate)
depends_on = [
aws_api_gateway_resource.example,
aws_api_gateway_method.example,
aws_api_gateway_integration.example,
aws_api_gateway_integration_response.example,
aws_api_gateway_method_response.example,
]
}
output "execution_arn" {
value = aws_api_gateway_rest_api.example.execution_arn
# Execution can't happen until the gateway is deployed, so
# this extra hint will ensure that the aws_lambda_permission
# granting access to this API will be created only once
# the API is fully deployed.
depends_on = [
aws_api_gateway_deployment.example,
]
}

撇开

API 网关的详细信息不谈，此类情况的一般过程是：

定义您的输入。
弄清楚如何从输入获取到集合，每个资源所需的每个实例都有一个元素。
编写local表达式来描述从输入到重复集合的投影。
写入resource块，其中for_each引用适当的本地值作为其重复值。

for表达式以及flatten和setproduct函数是我们的主要工具，用于从结构投影数据，该结构便于调用方在输入变量中提供for_each表达式所需的结构。

API Gateway有一个特别复杂的数据模型，因此在Terraform语言中表达其所有可能性可能需要比其他服务更多的投影和其他转换。由于 OpenAPI 已经定义了用于定义 REST API 的灵活声明性语言，并且 API Gateway 已经原生支持它，因此让您的endpoints变量采用标准的 OpenAPI 定义并将其直接传递给 API Gateway，从而获得 OpenAPI 模式格式的所有表现力，而无需自己在 Terraform 中实现所有细节：

variable "endpoints" {
# arbitrary OpenAPI schema object to be validated by API Gateway
type = any
}
resource "aws_api_gateway_rest_api" "example" {
name = "example"
body = jsonencode(var.endpoints)
}

即使您仍然希望endpoints变量是更高级别的模型，您也可以考虑使用 Terraform 语言来构建OpenAPI 模式，方法是从var.endpoints派生数据结构并最终将其传递给jsonencode。

有一个配置文件(json(

#configuration.json
{
"lambda1": {
"name": "my-name",
"path": "my-path",
"method": "GET"
},
"lambda2": {
"name": "my-name2",
"path": "my-path2",
"method": "GET"
},
}

和以下地形


locals {
conf = jsondecode(file("${path.module}/configuration.json"))
name="name"
}
data "aws_caller_identity" "current" {}

resource "aws_lambda_permission" "apigw_lambda" {
for_each      = local.conf
statement_id  = "AllowExecutionFromAPIGateway"
action        = "lambda:InvokeFunction"
function_name = each.value.name
principal     = "apigateway.amazonaws.com"
# More: http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html
source_arn = "arn:aws:execute-api:${var.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.api.id}/*/${aws_api_gateway_method.methods[each.key].http_method}${aws_api_gateway_resource.worker-path[each.key].path}"
}
resource "aws_api_gateway_rest_api" "api" {
name        = local.name
description = "an endpoints...."
endpoint_configuration {
types = ["REGIONAL"]
}
lifecycle {
create_before_destroy = true
}
}
resource "aws_api_gateway_resource" "country-endpoint" {
rest_api_id = aws_api_gateway_rest_api.api.id
parent_id   = aws_api_gateway_rest_api.api.root_resource_id
path_part   = local.country-code # https.exmaple.com/stage/uk
lifecycle {
create_before_destroy = true
}
}
resource "aws_api_gateway_resource" "worker-path" {
for_each    = local.conf
rest_api_id = aws_api_gateway_rest_api.api.id
parent_id   = aws_api_gateway_resource.country-endpoint.id
path_part   = each.value.path # https.exmaple.com/stage/uk/path_from_json
lifecycle {
create_before_destroy = true
}
}
resource "aws_api_gateway_method" "methods" {
for_each      = local.conf
http_method   = each.value.method
resource_id   = aws_api_gateway_resource.worker-path[each.key].id
rest_api_id   = aws_api_gateway_rest_api.api.id
authorization = "NONE"
}

resource "aws_api_gateway_integration" "lambda-api-integration-get-config" {
for_each      = local.conf
# The ID of the REST API and the endpoint at which to integrate a Lambda function
resource_id   = aws_api_gateway_resource.worker-path[each.key].id
rest_api_id   = aws_api_gateway_rest_api.api.id
# The HTTP method to integrate with the Lambda function
http_method = aws_api_gateway_method.methods[each.key].http_method
# AWS is used for Lambda proxy integration when you want to use a Velocity template
type = "AWS_PROXY"
# The URI at which the API is invoked
uri = data.terraform_remote_state.workers.outputs.lambda_invoke[each.key]
integration_http_method = "POST"
}

相关内容

最新更新

热门标签：