diff --git a/examples/data-solutions/README.md b/examples/data-solutions/README.md index e91e4873..6217f2cb 100644 --- a/examples/data-solutions/README.md +++ b/examples/data-solutions/README.md @@ -30,7 +30,7 @@ This [example](./data-platform-foundations/) implements SQL Server Always On Ava ### Cloud SQL instance with multi-region read replicas - + This [example](./cloudsql-multiregion/) creates a [Cloud SQL instance](https://cloud.google.com/sql) with multi-region read replicas as described in the [Cloud SQL for PostgreSQL disaster recovery](https://cloud.google.com/architecture/cloud-sql-postgres-disaster-recovery-complete-failover-fallback) article.
diff --git a/examples/data-solutions/cloudsql-multiregion/README.md b/examples/data-solutions/cloudsql-multiregion/README.md index 29fe63c9..29da83ec 100644 --- a/examples/data-solutions/cloudsql-multiregion/README.md +++ b/examples/data-solutions/cloudsql-multiregion/README.md @@ -80,6 +80,27 @@ This implementation is intentionally minimal and easy to read. A real world use - Using a Shared VPC - Using VPC-SC to mitigate data exfiltration +### Shared VPC +The example supports the configuration of a Shared VPC as an input variable. +To deploy the solution on a Shared VPC, you have to configure the `network_config` variable: + +``` +network_config = { + host_project = "PROJECT_ID" + network_self_link = "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/VPC_NAME" + subnet_self_link = "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/$REGION/subnetworks/SUBNET_NAME" + cloudsql_psa_range = "10.60.0.0/24" + } +``` + +To run this example, the Shared VPC project needs to have: + - A Private Service Connect with a range of `/24` (example: `10.60.0.0/24`) to deploy the Cloud SQL instance. + - Internet access configured (for example Cloud NAT) to let the Test VM download packages. + +In order to run the example and deploy Cloud SQL on a shared VPC the identity running Terraform must have the following IAM role on the Shared VPC Host project. + - Compute Network Admin (roles/compute.networkAdmin) + - Compute Shared VPC Admin (roles/compute.xpnAdmin) + ## Test your environment We assume all those steps are run using a user listed on `data_eng_principals`. You can authenticate as the user using the following command: @@ -118,15 +139,16 @@ The above command will delete the associated resources so there will be no billa | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [postgres_user_password](variables.tf#L29) | `postgres` user password. | string | ✓ | | -| [prefix](variables.tf#L40) | Unique prefix used for resource names. Not used for project if 'project_create' is null. | string | ✓ | | -| [project_id](variables.tf#L54) | Project id, references existing project if `project_create` is null. | string | ✓ | | -| [cmek_encryption](variables.tf#L17) | Flag to enable CMEK on GCP resources created. | bool | | false | +| [postgres_user_password](variables.tf#L40) | `postgres` user password. | string | ✓ | | +| [prefix](variables.tf#L51) | Unique prefix used for resource names. Not used for project if 'project_create' is null. | string | ✓ | | +| [project_id](variables.tf#L65) | Project id, references existing project if `project_create` is null. | string | ✓ | | | [data_eng_principals](variables.tf#L23) | Groups with Service Account Token creator role on service accounts in IAM format, only user supported on CloudSQL, eg 'user@domain.com'. | list(string) | | [] | -| [postgres_database](variables.tf#L34) | `postgres` database. | string | | "guestbook" | -| [project_create](variables.tf#L45) | Provide values if project creation is needed, uses existing project if null. Parent is in 'folders/nnn' or 'organizations/nnn' format. | object({…}) | | null | -| [regions](variables.tf#L59) | Map of instance_name => location where instances will be deployed. | map(string) | | {…} | -| [sql_configuration](variables.tf#L73) | Cloud SQL configuration | object({…}) | | {…} | +| [network_config](variables.tf#L29) | Shared VPC network configurations to use. If null networks will be created in projects with preconfigured values. | object({…}) | | null | +| [postgres_database](variables.tf#L45) | `postgres` database. | string | | "guestbook" | +| [project_create](variables.tf#L56) | Provide values if project creation is needed, uses existing project if null. Parent is in 'folders/nnn' or 'organizations/nnn' format. | object({…}) | | null | +| [regions](variables.tf#L70) | Map of instance_name => location where instances will be deployed. | map(string) | | {…} | +| [service_encryption_keys](variables.tf#L17) | Cloud KMS keys to use to encrypt resources. Provide a key for each reagion configured. | map(string) | | null | +| [sql_configuration](variables.tf#L84) | Cloud SQL configuration | object({…}) | | {…} | ## Outputs diff --git a/examples/data-solutions/cloudsql-multiregion/cloudsql.tf b/examples/data-solutions/cloudsql-multiregion/cloudsql.tf index 01c30565..b33dc980 100644 --- a/examples/data-solutions/cloudsql-multiregion/cloudsql.tf +++ b/examples/data-solutions/cloudsql-multiregion/cloudsql.tf @@ -16,8 +16,8 @@ module "db" { source = "../../../modules/cloudsql-instance" project_id = module.project.project_id availability_type = var.sql_configuration.availability_type - encryption_key_name = var.cmek_encryption ? module.kms[var.regions.primary].keys.key.id : null - network = module.vpc.self_link + encryption_key_name = var.service_encryption_keys != null ? try(var.service_encryption_keys[var.regions.primary], null) : null + network = local.vpc_self_link name = "${var.prefix}-db" region = var.regions.primary database_version = var.sql_configuration.database_version @@ -29,7 +29,7 @@ module "db" { for k, v in var.regions : k => { region = v, - encryption_key_name = var.cmek_encryption ? module.kms[v].keys.key.id : null + encryption_key_name = var.service_encryption_keys != null ? try(var.service_encryption_keys[v], null) : null } if k != "primary" } databases = [var.postgres_database] diff --git a/examples/data-solutions/cloudsql-multiregion/datastorage.tf b/examples/data-solutions/cloudsql-multiregion/datastorage.tf index 1b75deb0..1b45a97b 100644 --- a/examples/data-solutions/cloudsql-multiregion/datastorage.tf +++ b/examples/data-solutions/cloudsql-multiregion/datastorage.tf @@ -19,7 +19,7 @@ module "gcs" { name = "data" location = var.regions.primary storage_class = "REGIONAL" - encryption_key = var.cmek_encryption ? module.kms[var.regions.primary].keys["key"].id : null + encryption_key = var.service_encryption_keys != null ? try(var.service_encryption_keys[var.regions.primary], null) : null force_destroy = true } diff --git a/examples/data-solutions/cloudsql-multiregion/gce.tf b/examples/data-solutions/cloudsql-multiregion/gce.tf index 435d0495..17048aa8 100644 --- a/examples/data-solutions/cloudsql-multiregion/gce.tf +++ b/examples/data-solutions/cloudsql-multiregion/gce.tf @@ -29,8 +29,8 @@ module "test-vm" { zone = "${var.regions.primary}-b" name = "sql-test" network_interfaces = [{ - network = module.vpc.self_link - subnetwork = module.vpc.subnets["${var.regions.primary}/subnet"].self_link + network = local.vpc_self_link + subnetwork = local.subnet nat = false addresses = null }] @@ -50,10 +50,10 @@ module "test-vm" { type = "pd-ssd" size = 10 } - encryption = var.cmek_encryption ? { + encryption = var.service_encryption_keys != null ? { encrypt_boot = true disk_encryption_key_raw = null - kms_key_self_link = var.cmek_encryption ? module.kms[var.regions.primary].keys["key"].id : null + kms_key_self_link = var.service_encryption_keys != null ? try(var.service_encryption_keys[var.regions.primary], null) : null } : null metadata = { startup-script = local.startup-script } tags = ["ssh"] diff --git a/examples/data-solutions/cloudsql-multiregion/images/diagram.png b/examples/data-solutions/cloudsql-multiregion/images/diagram.png index 35c8ff8e..6679e013 100644 Binary files a/examples/data-solutions/cloudsql-multiregion/images/diagram.png and b/examples/data-solutions/cloudsql-multiregion/images/diagram.png differ diff --git a/examples/data-solutions/cloudsql-multiregion/kms.tf b/examples/data-solutions/cloudsql-multiregion/kms.tf deleted file mode 100644 index d35ca71f..00000000 --- a/examples/data-solutions/cloudsql-multiregion/kms.tf +++ /dev/null @@ -1,37 +0,0 @@ -# Copyright 2022 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -module "kms" { - for_each = toset(distinct(values(var.regions))) - source = "../../../modules/kms" - project_id = module.project.project_id - - keyring = { - name = "${var.prefix}-keyring-${each.value}" - location = each.value - } - - keys = { - key = null - } - key_iam = { - key = { - "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [ - "serviceAccount:${module.project.service_accounts.robots.compute}", - "serviceAccount:${module.project.service_accounts.robots.sql}", - "serviceAccount:${module.project.service_accounts.robots.storage}" - ] - } - } -} diff --git a/examples/data-solutions/cloudsql-multiregion/main.tf b/examples/data-solutions/cloudsql-multiregion/main.tf index 634b6f79..c3264877 100644 --- a/examples/data-solutions/cloudsql-multiregion/main.tf +++ b/examples/data-solutions/cloudsql-multiregion/main.tf @@ -54,6 +54,20 @@ locals { "serviceAccount:${module.project.service_accounts.robots.sql}" ] } + + shared_vpc_project = try(var.network_config.host_project, null) + use_shared_vpc = var.network_config != null + + subnet = ( + local.use_shared_vpc + ? var.network_config.subnet_self_link + : values(module.vpc.0.subnet_self_links)[0] + ) + vpc_self_link = ( + local.use_shared_vpc + ? var.network_config.network_self_link + : module.vpc.0.self_link + ) } module "project" { @@ -67,6 +81,7 @@ module "project" { iam_additive = var.project_create == null ? local.iam : {} services = [ "cloudkms.googleapis.com", + "compute.googleapis.com", "iap.googleapis.com", "logging.googleapis.com", "monitoring.googleapis.com", @@ -77,10 +92,26 @@ module "project" { "storage.googleapis.com", "storage-component.googleapis.com", ] + + shared_vpc_service_config = local.shared_vpc_project == null ? null : { + attach = true + host_project = local.shared_vpc_project + service_identity_iam = {} + } + + service_encryption_key_ids = { + compute = try(values(var.service_encryption_keys), []) + sql = try(values(var.service_encryption_keys), []) + storage = try(values(var.service_encryption_keys), []) + } + service_config = { + disable_on_destroy = false, disable_dependent_services = false + } } module "vpc" { source = "../../../modules/net-vpc" + count = local.use_shared_vpc ? 0 : 1 project_id = module.project.project_id name = "vpc" subnets = [ @@ -100,15 +131,17 @@ module "vpc" { module "firewall" { source = "../../../modules/net-vpc-firewall" + count = local.use_shared_vpc ? 0 : 1 project_id = module.project.project_id - network = module.vpc.name + network = module.vpc.0.name admin_ranges = ["10.0.0.0/20"] } module "nat" { source = "../../../modules/net-cloudnat" + count = local.use_shared_vpc ? 0 : 1 project_id = module.project.project_id region = var.regions.primary name = "${var.prefix}-default" - router_network = module.vpc.name + router_network = module.vpc.0.name } diff --git a/examples/data-solutions/cloudsql-multiregion/variables.tf b/examples/data-solutions/cloudsql-multiregion/variables.tf index 3764f4e1..66083b5f 100644 --- a/examples/data-solutions/cloudsql-multiregion/variables.tf +++ b/examples/data-solutions/cloudsql-multiregion/variables.tf @@ -14,10 +14,10 @@ * limitations under the License. */ -variable "cmek_encryption" { - description = "Flag to enable CMEK on GCP resources created." - type = bool - default = false +variable "service_encryption_keys" { + description = "Cloud KMS keys to use to encrypt resources. Provide a key for each reagion configured." + type = map(string) + default = null } variable "data_eng_principals" { @@ -26,6 +26,17 @@ variable "data_eng_principals" { default = [] } +variable "network_config" { + description = "Shared VPC network configurations to use. If null networks will be created in projects with preconfigured values." + type = object({ + host_project = string + network_self_link = string + subnet_self_link = string + cloudsql_psa_range = string + }) + default = null +} + variable "postgres_user_password" { description = "`postgres` user password." type = string diff --git a/tests/examples/data_solutions/cloudsql-multiregion/test_plan.py b/tests/examples/data_solutions/cloudsql-multiregion/test_plan.py index e97e22d3..90371cf7 100644 --- a/tests/examples/data_solutions/cloudsql-multiregion/test_plan.py +++ b/tests/examples/data_solutions/cloudsql-multiregion/test_plan.py @@ -15,5 +15,5 @@ def test_resources(e2e_plan_runner): "Test that plan works and the numbers of resources is as expected." modules, resources = e2e_plan_runner() - assert len(modules) == 11 - assert len(resources) == 53 + assert len(modules) == 9 + assert len(resources) == 48