Sql user features (#1856)
* added user type feature * fix readme * fix comment * fix blueprint cloudsql users value + minor fix * readme fix * variables fix * local var fix * fix for in local var * fix on readme * fix intentations var in readme * fix blueprint user quote --------- Co-authored-by: Francesco Spinelli <francesco.spinelli@nttdata.com>
This commit is contained in:
Francesco Spinelli
GitHub
parent
911d125f0a
commit
1c2f1c7b0d
|
|
@ -34,7 +34,9 @@ module "db" {
|
|||
}
|
||||
databases = [var.postgres_database]
|
||||
users = {
|
||||
postgres = var.postgres_user_password
|
||||
postgres = {
|
||||
password = var.postgres_user_password
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -27,6 +27,8 @@ module "cloudsql" {
|
|||
region = var.region
|
||||
tier = local.cloudsql_conf.tier
|
||||
users = {
|
||||
"${local.cloudsql_conf.user}" = var.cloudsql_password
|
||||
"${local.cloudsql_conf.user}" = {
|
||||
password = var.cloudsql_password
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -61,7 +61,9 @@ module "cloudsql" {
|
|||
tier = local.cloudsql_conf.tier
|
||||
databases = [local.cloudsql_conf.db]
|
||||
users = {
|
||||
"${local.cloudsql_conf.user}" = var.cloudsql_password
|
||||
"${local.cloudsql_conf.user}" = {
|
||||
password = var.cloudsql_password
|
||||
}
|
||||
}
|
||||
deletion_protection = false
|
||||
}
|
||||
|
|
|
|||
|
|
@ -86,9 +86,13 @@ module "db" {
|
|||
|
||||
users = {
|
||||
# generatea password for user1
|
||||
user1 = null
|
||||
user1 = {
|
||||
password = null
|
||||
}
|
||||
# assign a password to user2
|
||||
user2 = "mypassword"
|
||||
user2 = {
|
||||
password = "mypassword"
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=6 inventory=custom.yaml
|
||||
|
|
@ -212,7 +216,7 @@ module "db" {
|
|||
| [replicas](variables.tf#L179) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map(object({ region = string encryption_key_name = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [require_ssl](variables.tf#L188) | Enable SSL connections only. | <code>bool</code> | | <code>null</code> |
|
||||
| [root_password](variables.tf#L194) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> | | <code>null</code> |
|
||||
| [users](variables.tf#L205) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map(string)</code> | | <code>null</code> |
|
||||
| [users](variables.tf#L205) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code title="map(object({ password = optional(string) type = optional(string) }))">map(object({…}))</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/**
|
||||
/** TO MOD
|
||||
* Copyright 2022 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
|
|
@ -17,6 +17,7 @@
|
|||
locals {
|
||||
prefix = var.prefix == null ? "" : "${var.prefix}-"
|
||||
is_mysql = can(regex("^MYSQL", var.database_version))
|
||||
is_postgres = can(regex("^POSTGRES", var.database_version))
|
||||
has_replicas = try(length(var.replicas) > 0, false)
|
||||
is_regional = var.availability_type == "REGIONAL" ? true : false
|
||||
|
||||
|
|
@ -25,20 +26,20 @@ locals {
|
|||
enable_backup = var.backup_configuration.enabled || (local.is_mysql && local.has_replicas) || (local.is_mysql && local.is_regional)
|
||||
|
||||
users = {
|
||||
for user, password in coalesce(var.users, {}) :
|
||||
(user) => (
|
||||
local.is_mysql
|
||||
? {
|
||||
name = split("@", user)[0]
|
||||
host = try(split("@", user)[1], null)
|
||||
password = try(random_password.passwords[user].result, password)
|
||||
}
|
||||
: {
|
||||
name = user
|
||||
host = null
|
||||
password = try(random_password.passwords[user].result, password)
|
||||
}
|
||||
)
|
||||
for k, v in coalesce(var.users, {}) :
|
||||
k =>
|
||||
local.is_mysql ?
|
||||
{
|
||||
name = try(v.type, "BUILT_IN") == "BUILT_IN" ? split("@", k)[0] : k
|
||||
host = try(v.type, "BUILT_IN") == "BUILT_IN" ? try(split("@", k)[1], null) : null
|
||||
password = try(v.type, "BUILT_IN") == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
|
||||
type = try(v.type, "BUILT_IN")
|
||||
} : {
|
||||
name = local.is_postgres ? try(trimsuffix(k, ".gserviceaccount.com"), k) : k
|
||||
host = null
|
||||
password = try(v.type, "BUILT_IN") == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
|
||||
type = try(v.type, "BUILT_IN")
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -178,14 +179,15 @@ resource "google_sql_database" "databases" {
|
|||
|
||||
resource "random_password" "passwords" {
|
||||
for_each = toset([
|
||||
for user, password in coalesce(var.users, {}) :
|
||||
user
|
||||
if password == null
|
||||
for k, v in coalesce(var.users, {}) :
|
||||
k
|
||||
if v.password == null
|
||||
])
|
||||
length = 16
|
||||
special = true
|
||||
}
|
||||
|
||||
|
||||
resource "google_sql_user" "users" {
|
||||
for_each = local.users
|
||||
project = var.project_id
|
||||
|
|
@ -193,6 +195,7 @@ resource "google_sql_user" "users" {
|
|||
name = each.value.name
|
||||
host = each.value.host
|
||||
password = each.value.password
|
||||
type = each.value.type
|
||||
}
|
||||
|
||||
resource "google_sql_ssl_cert" "postgres_client_certificates" {
|
||||
|
|
|
|||
|
|
@ -203,8 +203,11 @@ variable "tier" {
|
|||
}
|
||||
|
||||
variable "users" {
|
||||
description = "Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password."
|
||||
type = map(string)
|
||||
default = null
|
||||
description = "Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'."
|
||||
type = map(object({
|
||||
password = optional(string)
|
||||
type = optional(string)
|
||||
}))
|
||||
default = null
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue