gcp_compute_target_ssl_proxy – Creates a GCP TargetSslProxy — Ansible Documentation

- AnsibleFest
- Products
- Community
- Webinars & Training
- Blog

Documentation

# gcp_compute_target_ssl_proxy – Creates a GCP TargetSslProxy

New in version 2.6.

- Synopsis
- Requirements
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- Represents a TargetSslProxy resource, which is used by one or more global forwarding rule to route incoming SSL requests to a backend service.

## Requirements

The below requirements are needed on the host that executes this module.

- python >= 2.6
- requests >= 2.18.4
- google-auth >= 1.3.0

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
auth_kind string / required | Choices: application machineaccount serviceaccount | The type of credential used.
description - |  | An optional description of this resource.
name - / required |  | Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
project string |  | The Google Cloud Platform project to use.
proxy_header - | Choices: NONE PROXY_V1 | Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
scopes list |  | Array of scopes to be used.
service - / required |  | A reference to the BackendService resource. This field represents a link to a BackendService resource in GCP. It can be specified in two ways. First, you can place a dictionary with key 'selfLink' and value of your resource's selfLink Alternatively, you can add `register: name-of-resource` to a gcp_compute_backend_service task and then set this service field to "{{ name-of-resource }}"
service_account_contents string |  | A string representing the contents of a Service Account JSON file. This should not be passed in as a dictionary, but a string that has the exact contents of a service account json file (valid JSON)
service_account_email string |  | An optional service account email address if machineaccount is selected and the user does not wish to use the default email.
service_account_file path |  | The path of a Service Account JSON file if serviceaccount is selected as type.
ssl_certificates - / required |  | A list of SslCertificate resources that are used to authenticate connections between users and the load balancer. Currently, exactly one SSL certificate must be specified.
ssl_policy - added in 2.8 |  | A reference to the SslPolicy resource that will be associated with the TargetSslProxy resource. If not set, the TargetSslProxy resource will not have any SSL policy configured. This field represents a link to a SslPolicy resource in GCP. It can be specified in two ways. First, you can place a dictionary with key 'selfLink' and value of your resource's selfLink Alternatively, you can add `register: name-of-resource` to a gcp_compute_ssl_policy task and then set this ssl_policy field to "{{ name-of-resource }}"
state - | Choices: present ← absent | Whether the given object should exist in GCP

## Notes

Note

- API Reference: https://cloud.google.com/compute/docs/reference/v1/targetSslProxies
- Setting Up SSL proxy for Google Cloud Load Balancing: https://cloud.google.com/compute/docs/load-balancing/tcp-ssl/
- For authentication, you can set service_account_file using the `GCP_SERVICE_ACCOUNT_FILE` env variable.
- For authentication, you can set service_account_email using the `GCP_SERVICE_ACCOUNT_EMAIL` env variable.
- For authentication, you can set service_account_contents using the `GCP_SERVICE_ACCOUNT_CONTENTS` env variable.
- For authentication, you can set auth_kind using the `GCP_AUTH_KIND` env variable.
- For authentication, you can set scopes using the `GCP_SCOPES` env variable.
- Environment variables values will only be used if the playbook values are not set.
- The service_account_email and service_account_file options are mutually exclusive.

## Examples

    - name: create a instance group
      gcp_compute_instance_group:
        name: instancegroup-targetsslproxy
        zone: us-central1-a
        project: "{{ gcp_project }}"
        auth_kind: "{{ gcp_cred_kind }}"
        service_account_file: "{{ gcp_cred_file }}"
        state: present
      register: instancegroup

    - name: create a health check
      gcp_compute_health_check:
        name: healthcheck-targetsslproxy
        type: TCP
        tcp_health_check:
          port_name: service-health
          request: ping
          response: pong
        healthy_threshold: 10
        timeout_sec: 2
        unhealthy_threshold: 5
        project: "{{ gcp_project }}"
        auth_kind: "{{ gcp_cred_kind }}"
        service_account_file: "{{ gcp_cred_file }}"
        state: present
      register: healthcheck

    - name: create a backend service
      gcp_compute_backend_service:
        name: backendservice-targetsslproxy
        backends:
        - group: "{{ instancegroup }}"
        health_checks:
        - "{{ healthcheck.selfLink }}"
        protocol: SSL
        project: "{{ gcp_project }}"
        auth_kind: "{{ gcp_cred_kind }}"
        service_account_file: "{{ gcp_cred_file }}"
        state: present
      register: backendservice

    - name: create a ssl certificate
      gcp_compute_ssl_certificate:
        name: sslcert-targetsslproxy
        description: A certificate for testing. Do not use this certificate in production
        certificate: "-----BEGIN CERTIFICATE----- MIICqjCCAk+gAwIBAgIJAIuJ+0352Kq4MAoGCCqGSM49BAMCMIGwMQswCQYDVQQG
          EwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjERMA8GA1UEBwwIS2lya2xhbmQxFTAT BgNVBAoMDEdvb2dsZSwgSW5jLjEeMBwGA1UECwwVR29vZ2xlIENsb3VkIFBsYXRm
          b3JtMR8wHQYDVQQDDBZ3d3cubXktc2VjdXJlLXNpdGUuY29tMSEwHwYJKoZIhvcN AQkBFhJuZWxzb25hQGdvb2dsZS5jb20wHhcNMTcwNjI4MDQ1NjI2WhcNMjcwNjI2
          MDQ1NjI2WjCBsDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24xETAP BgNVBAcMCEtpcmtsYW5kMRUwEwYDVQQKDAxHb29nbGUsIEluYy4xHjAcBgNVBAsM
          FUdvb2dsZSBDbG91ZCBQbGF0Zm9ybTEfMB0GA1UEAwwWd3d3Lm15LXNlY3VyZS1z aXRlLmNvbTEhMB8GCSqGSIb3DQEJARYSbmVsc29uYUBnb29nbGUuY29tMFkwEwYH
          KoZIzj0CAQYIKoZIzj0DAQcDQgAEHGzpcRJ4XzfBJCCPMQeXQpTXwlblimODQCuQ 4mzkzTv0dXyB750fOGN02HtkpBOZzzvUARTR10JQoSe2/5PIwaNQME4wHQYDVR0O
          BBYEFKIQC3A2SDpxcdfn0YLKineDNq/BMB8GA1UdIwQYMBaAFKIQC3A2SDpxcdfn 0YLKineDNq/BMAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDSQAwRgIhALs4vy+O
          M3jcqgA4fSW/oKw6UJxp+M6a+nGMX+UJR3YgAiEAvvl39QRVAiv84hdoCuyON0lJ zqGNhIPGq2ULqXKK8BY=
          -----END CERTIFICATE-----"
        private_key: "-----BEGIN EC PRIVATE KEY----- MHcCAQEEIObtRo8tkUqoMjeHhsOh2ouPpXCgBcP+EDxZCB/tws15oAoGCCqGSM49
          AwEHoUQDQgAEHGzpcRJ4XzfBJCCPMQeXQpTXwlblimODQCuQ4mzkzTv0dXyB750f OGN02HtkpBOZzzvUARTR10JQoSe2/5PIwQ==
          -----END EC PRIVATE KEY-----"
        project: "{{ gcp_project }}"
        auth_kind: "{{ gcp_cred_kind }}"
        service_account_file: "{{ gcp_cred_file }}"
        state: present
      register: sslcert

    - name: create a target ssl proxy
      gcp_compute_target_ssl_proxy:
        name: test_object
        ssl_certificates:
        - "{{ sslcert }}"
        service: "{{ backendservice }}"
        project: test_project
        auth_kind: serviceaccount
        service_account_file: "/tmp/auth.pem"
        state: present

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
creationTimestamp string | success | Creation timestamp in RFC3339 text format.
description string | success | An optional description of this resource.
id integer | success | The unique identifier for the resource.
name string | success | Name of the resource. Provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `[a-z]([-a-z0-9]*[a-z0-9])?` which means the first character must be a lowercase letter, and all following characters must be a dash, lowercase letter, or digit, except the last character, which cannot be a dash.
proxyHeader string | success | Specifies the type of proxy header to append before sending data to the backend, either NONE or PROXY_V1. The default is NONE.
service dictionary | success | A reference to the BackendService resource.
sslCertificates list | success | A list of SslCertificate resources that are used to authenticate connections between users and the load balancer. Currently, exactly one SSL certificate must be specified.
sslPolicy dictionary | success | A reference to the SslPolicy resource that will be associated with the TargetSslProxy resource. If not set, the TargetSslProxy resource will not have any SSL policy configured.

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Google Inc. (@googlecloudplatform)

Hint

If you notice any issues in this documentation you can edit this document to improve it.