feat(lambda): optional public ALB in requirements module - #30
Merged
Conversation
Add an opt-in public ALB (install_alb, default false) to the Lambda requirements module: ALB + HTTPS(443)/HTTP(80->redirect) listeners + SG, so stacks can expose Lambda over HTTP without hand-copying the ALB per cluster (previously done inline in galicia). The Lambda scope workflow attaches per-scope target groups + listener rules to the HTTPS listener at runtime. - cert: created as a DNS-validated wildcard from domain_name + public_zone_id, or reused via certificate_arn (avoids duplicating the static-files wildcard) - subnets: discovered by nullplatform/subnet-type=public tag, or public_subnet_ids - outputs: lambda_alb_arn / lambda_alb_listener_arn / lambda_alb_dns_name - default OFF keeps IAM-only consumers unaffected
…role The ALB networking override does data.aws_lb_listener / data.aws_lb lookups (and the provider reads tags on refresh), needing read actions missing from the enumerated list (DescribeTags, DescribeLoadBalancers, DescribeLoadBalancerAttributes). Replace the enumerated Describe* reads with elasticloadbalancing:Describe* to cover them all; mutating actions stay enumerated.
Reach parity with the galicia agent lambda policy set: the ALB networking override reads the lambda permission (lambda:GetPolicy), waits on the Route53 change (route53:GetChange), and the agent scripts discover resources by tag (tag:GetResources). These were the only actions galicia granted that the requirements role was still missing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an opt-in public ALB (
install_alb, defaultfalse) to the Lambda requirements module — ALB + HTTPS(443)/HTTP(80→redirect) listeners + SG — so stacks can expose Lambda over HTTP without hand-copying the ALB per cluster (previously done inline in galicia's infra layer). The Lambda scope workflow attaches per-scope target groups + listener rules to the HTTPS listener at runtime.domain_name+public_zone_id, or reuse viacertificate_arn(avoids a second*.<domain>next to static-files)nullplatform/subnet-type=publictag onvpc_id, orpublic_subnet_idslambda_alb_arn/lambda_alb_listener_arn/lambda_alb_dns_nameNew file
lambda/specs/requirements/alb.tf+ vars/outputs. fmt + validate + trivy clean.