Merge pull request #623 from GoogleCloudPlatform/lcaggio/sql-kms
Add KMS on CloudSQL module
This commit is contained in:
commit
565e3d99fc
|
@ -56,8 +56,8 @@ module "db" {
|
||||||
tier = "db-g1-small"
|
tier = "db-g1-small"
|
||||||
|
|
||||||
replicas = {
|
replicas = {
|
||||||
replica1 = "europe-west3"
|
replica1 = { region = "europe-west3", encryption_key_name = null }
|
||||||
replica2 = "us-central1"
|
replica2 = { region = "us-central1", encryption_key_name = null }
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=3
|
# tftest modules=1 resources=3
|
||||||
|
@ -93,6 +93,53 @@ module "db" {
|
||||||
}
|
}
|
||||||
# tftest modules=1 resources=6
|
# tftest modules=1 resources=6
|
||||||
```
|
```
|
||||||
|
|
||||||
|
### CMEK encryption
|
||||||
|
```hcl
|
||||||
|
|
||||||
|
module "project" {
|
||||||
|
source = "./modules/project"
|
||||||
|
billing_account = var.billing_account_id
|
||||||
|
parent = var.organization_id
|
||||||
|
name = "my-db-project"
|
||||||
|
services = [
|
||||||
|
"servicenetworking.googleapis.com",
|
||||||
|
"sqladmin.googleapis.com",
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
|
module "kms" {
|
||||||
|
source = "./modules/kms"
|
||||||
|
project_id = module.project.project_id
|
||||||
|
keyring = {
|
||||||
|
name = "keyring"
|
||||||
|
location = var.region
|
||||||
|
}
|
||||||
|
keys = {
|
||||||
|
key-sql = null
|
||||||
|
}
|
||||||
|
key_iam = {
|
||||||
|
key-sql = {
|
||||||
|
"roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
|
||||||
|
"serviceAccount:${module.project.service_accounts.robots.sqladmin}"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
module "db" {
|
||||||
|
source = "./modules/cloudsql-instance"
|
||||||
|
project_id = module.project.project_id
|
||||||
|
encryption_key_name = module.kms.keys["key-sql"].id
|
||||||
|
network = var.vpc.self_link
|
||||||
|
name = "db"
|
||||||
|
region = var.region
|
||||||
|
database_version = "POSTGRES_13"
|
||||||
|
tier = "db-g1-small"
|
||||||
|
}
|
||||||
|
|
||||||
|
# tftest modules=3 resources=10
|
||||||
|
```
|
||||||
<!-- BEGIN TFDOC -->
|
<!-- BEGIN TFDOC -->
|
||||||
|
|
||||||
## Variables
|
## Variables
|
||||||
|
@ -100,11 +147,11 @@ module "db" {
|
||||||
| name | description | type | required | default |
|
| name | description | type | required | default |
|
||||||
|---|---|:---:|:---:|:---:|
|
|---|---|:---:|:---:|:---:|
|
||||||
| [database_version](variables.tf#L50) | Database type and version to create. | <code>string</code> | ✓ | |
|
| [database_version](variables.tf#L50) | Database type and version to create. | <code>string</code> | ✓ | |
|
||||||
| [name](variables.tf#L91) | Name of primary replica. | <code>string</code> | ✓ | |
|
| [name](variables.tf#L97) | Name of primary instance. | <code>string</code> | ✓ | |
|
||||||
| [network](variables.tf#L96) | VPC self link where the instances will be deployed. Private Service Networking must be enabled and configured in this VPC. | <code>string</code> | ✓ | |
|
| [network](variables.tf#L102) | VPC self link where the instances will be deployed. Private Service Networking must be enabled and configured in this VPC. | <code>string</code> | ✓ | |
|
||||||
| [project_id](variables.tf#L107) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
|
| [project_id](variables.tf#L113) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
|
||||||
| [region](variables.tf#L112) | Region of the primary replica. | <code>string</code> | ✓ | |
|
| [region](variables.tf#L118) | Region of the primary instance. | <code>string</code> | ✓ | |
|
||||||
| [tier](variables.tf#L123) | The machine type to use for the instances. | <code>string</code> | ✓ | |
|
| [tier](variables.tf#L132) | The machine type to use for the instances. | <code>string</code> | ✓ | |
|
||||||
| [authorized_networks](variables.tf#L17) | Map of NAME=>CIDR_RANGE to allow to connect to the database(s). | <code>map(string)</code> | | <code>null</code> |
|
| [authorized_networks](variables.tf#L17) | Map of NAME=>CIDR_RANGE to allow to connect to the database(s). | <code>map(string)</code> | | <code>null</code> |
|
||||||
| [availability_type](variables.tf#L23) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>"ZONAL"</code> |
|
| [availability_type](variables.tf#L23) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>"ZONAL"</code> |
|
||||||
| [backup_configuration](variables.tf#L29) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object({ enabled = bool binary_log_enabled = bool start_time = string location = string log_retention_days = number retention_count = number })">object({…})</code> | | <code title="{ enabled = false binary_log_enabled = false start_time = "23:00" location = null log_retention_days = 7 retention_count = 7 }">{…}</code> |
|
| [backup_configuration](variables.tf#L29) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object({ enabled = bool binary_log_enabled = bool start_time = string location = string log_retention_days = number retention_count = number })">object({…})</code> | | <code title="{ enabled = false binary_log_enabled = false start_time = "23:00" location = null log_retention_days = 7 retention_count = 7 }">{…}</code> |
|
||||||
|
@ -112,11 +159,12 @@ module "db" {
|
||||||
| [deletion_protection](variables.tf#L61) | Allow terraform to delete instances. | <code>bool</code> | | <code>false</code> |
|
| [deletion_protection](variables.tf#L61) | Allow terraform to delete instances. | <code>bool</code> | | <code>false</code> |
|
||||||
| [disk_size](variables.tf#L67) | Disk size in GB. Set to null to enable autoresize. | <code>number</code> | | <code>null</code> |
|
| [disk_size](variables.tf#L67) | Disk size in GB. Set to null to enable autoresize. | <code>number</code> | | <code>null</code> |
|
||||||
| [disk_type](variables.tf#L73) | The type of data disk: `PD_SSD` or `PD_HDD`. | <code>string</code> | | <code>"PD_SSD"</code> |
|
| [disk_type](variables.tf#L73) | The type of data disk: `PD_SSD` or `PD_HDD`. | <code>string</code> | | <code>"PD_SSD"</code> |
|
||||||
| [flags](variables.tf#L79) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map(string)</code> | | <code>null</code> |
|
| [encryption_key_name](variables.tf#L79) | The full path to the encryption key used for the CMEK disk encryption of the primary instance. | <code>string</code> | | <code>null</code> |
|
||||||
| [labels](variables.tf#L85) | Labels to be attached to all instances. | <code>map(string)</code> | | <code>null</code> |
|
| [flags](variables.tf#L85) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map(string)</code> | | <code>null</code> |
|
||||||
| [prefix](variables.tf#L101) | Prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
|
| [labels](variables.tf#L91) | Labels to be attached to all instances. | <code>map(string)</code> | | <code>null</code> |
|
||||||
| [replicas](variables.tf#L117) | Map of NAME=>REGION for additional read replicas. Set to null to disable replica creation. | <code>map(any)</code> | | <code>null</code> |
|
| [prefix](variables.tf#L107) | Prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
|
||||||
| [users](variables.tf#L128) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map(string)</code> | | <code>null</code> |
|
| [replicas](variables.tf#L123) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map(object({ region = string encryption_key_name = string }))">map(object({…}))</code> | | <code>{}</code> |
|
||||||
|
| [users](variables.tf#L137) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map(string)</code> | | <code>null</code> |
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
|
|
||||||
|
@ -129,8 +177,10 @@ module "db" {
|
||||||
| [instances](outputs.tf#L50) | Cloud SQL instance resources. | ✓ |
|
| [instances](outputs.tf#L50) | Cloud SQL instance resources. | ✓ |
|
||||||
| [ip](outputs.tf#L56) | IP address of the primary instance. | |
|
| [ip](outputs.tf#L56) | IP address of the primary instance. | |
|
||||||
| [ips](outputs.tf#L61) | IP addresses of all instances. | |
|
| [ips](outputs.tf#L61) | IP addresses of all instances. | |
|
||||||
| [self_link](outputs.tf#L69) | Self link of the primary instance. | |
|
| [name](outputs.tf#L69) | Name of the primary instance. | |
|
||||||
| [self_links](outputs.tf#L74) | Self links of all instances. | |
|
| [names](outputs.tf#L74) | Names of all instances. | |
|
||||||
| [user_passwords](outputs.tf#L82) | Map of containing the password of all users created through terraform. | ✓ |
|
| [self_link](outputs.tf#L82) | Self link of the primary instance. | |
|
||||||
|
| [self_links](outputs.tf#L87) | Self links of all instances. | |
|
||||||
|
| [user_passwords](outputs.tf#L95) | Map of containing the password of all users created through terraform. | ✓ |
|
||||||
|
|
||||||
<!-- END TFDOC -->
|
<!-- END TFDOC -->
|
||||||
|
|
|
@ -39,10 +39,12 @@ locals {
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "google_sql_database_instance" "primary" {
|
resource "google_sql_database_instance" "primary" {
|
||||||
|
provider = google-beta
|
||||||
project = var.project_id
|
project = var.project_id
|
||||||
name = "${local.prefix}${var.name}"
|
name = "${local.prefix}${var.name}"
|
||||||
region = var.region
|
region = var.region
|
||||||
database_version = var.database_version
|
database_version = var.database_version
|
||||||
|
encryption_key_name = var.encryption_key_name
|
||||||
|
|
||||||
settings {
|
settings {
|
||||||
tier = var.tier
|
tier = var.tier
|
||||||
|
@ -99,11 +101,13 @@ resource "google_sql_database_instance" "primary" {
|
||||||
}
|
}
|
||||||
|
|
||||||
resource "google_sql_database_instance" "replicas" {
|
resource "google_sql_database_instance" "replicas" {
|
||||||
|
provider = google-beta
|
||||||
for_each = local.has_replicas ? var.replicas : {}
|
for_each = local.has_replicas ? var.replicas : {}
|
||||||
project = var.project_id
|
project = var.project_id
|
||||||
name = "${local.prefix}${each.key}"
|
name = "${local.prefix}${each.key}"
|
||||||
region = each.value
|
region = each.value.region
|
||||||
database_version = var.database_version
|
database_version = var.database_version
|
||||||
|
encryption_key_name = each.value.encryption_key_name
|
||||||
master_instance_name = google_sql_database_instance.primary.name
|
master_instance_name = google_sql_database_instance.primary.name
|
||||||
|
|
||||||
settings {
|
settings {
|
||||||
|
|
|
@ -66,6 +66,19 @@ output "ips" {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
output "name" {
|
||||||
|
description = "Name of the primary instance."
|
||||||
|
value = google_sql_database_instance.primary.name
|
||||||
|
}
|
||||||
|
|
||||||
|
output "names" {
|
||||||
|
description = "Names of all instances."
|
||||||
|
value = {
|
||||||
|
for id, instance in local._all_intances :
|
||||||
|
id => instance.name
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
output "self_link" {
|
output "self_link" {
|
||||||
description = "Self link of the primary instance."
|
description = "Self link of the primary instance."
|
||||||
value = google_sql_database_instance.primary.self_link
|
value = google_sql_database_instance.primary.self_link
|
||||||
|
|
|
@ -76,6 +76,12 @@ variable "disk_type" {
|
||||||
default = "PD_SSD"
|
default = "PD_SSD"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
variable "encryption_key_name" {
|
||||||
|
description = "The full path to the encryption key used for the CMEK disk encryption of the primary instance."
|
||||||
|
type = string
|
||||||
|
default = null
|
||||||
|
}
|
||||||
|
|
||||||
variable "flags" {
|
variable "flags" {
|
||||||
description = "Map FLAG_NAME=>VALUE for database-specific tuning."
|
description = "Map FLAG_NAME=>VALUE for database-specific tuning."
|
||||||
type = map(string)
|
type = map(string)
|
||||||
|
@ -89,7 +95,7 @@ variable "labels" {
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "name" {
|
variable "name" {
|
||||||
description = "Name of primary replica."
|
description = "Name of primary instance."
|
||||||
type = string
|
type = string
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -110,14 +116,17 @@ variable "project_id" {
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "region" {
|
variable "region" {
|
||||||
description = "Region of the primary replica."
|
description = "Region of the primary instance."
|
||||||
type = string
|
type = string
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "replicas" {
|
variable "replicas" {
|
||||||
description = "Map of NAME=>REGION for additional read replicas. Set to null to disable replica creation."
|
description = "Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation."
|
||||||
type = map(any)
|
type = map(object({
|
||||||
default = null
|
region = string
|
||||||
|
encryption_key_name = string
|
||||||
|
}))
|
||||||
|
default = {}
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "tier" {
|
variable "tier" {
|
||||||
|
|
|
@ -42,7 +42,9 @@ locals {
|
||||||
gcf = "service-%s@gcf-admin-robot"
|
gcf = "service-%s@gcf-admin-robot"
|
||||||
pubsub = "service-%s@gcp-sa-pubsub"
|
pubsub = "service-%s@gcp-sa-pubsub"
|
||||||
secretmanager = "service-%s@gcp-sa-secretmanager"
|
secretmanager = "service-%s@gcp-sa-secretmanager"
|
||||||
|
sql = "service-%s@gcp-sa-cloud-sql"
|
||||||
storage = "service-%s@gs-project-accounts"
|
storage = "service-%s@gs-project-accounts"
|
||||||
|
sqladmin = "service-%s@gcp-sa-cloud-sql"
|
||||||
}
|
}
|
||||||
service_accounts_default = {
|
service_accounts_default = {
|
||||||
compute = "${local.project.number}-compute@developer.gserviceaccount.com"
|
compute = "${local.project.number}-compute@developer.gserviceaccount.com"
|
||||||
|
@ -56,9 +58,10 @@ locals {
|
||||||
k => "${format(v, local.project.number)}.iam.gserviceaccount.com"
|
k => "${format(v, local.project.number)}.iam.gserviceaccount.com"
|
||||||
}
|
}
|
||||||
service_accounts_jit_services = [
|
service_accounts_jit_services = [
|
||||||
"secretmanager.googleapis.com",
|
"cloudasset.googleapis.com",
|
||||||
"pubsub.googleapis.com",
|
"pubsub.googleapis.com",
|
||||||
"cloudasset.googleapis.com"
|
"secretmanager.googleapis.com",
|
||||||
|
"sqladmin.googleapis.com"
|
||||||
]
|
]
|
||||||
service_accounts_cmek_service_keys = distinct(flatten([
|
service_accounts_cmek_service_keys = distinct(flatten([
|
||||||
for s in keys(var.service_encryption_key_ids) : [
|
for s in keys(var.service_encryption_key_ids) : [
|
||||||
|
|
|
@ -94,7 +94,7 @@ variable "region" {
|
||||||
}
|
}
|
||||||
|
|
||||||
variable "replicas" {
|
variable "replicas" {
|
||||||
type = map(any)
|
type = any
|
||||||
default = null
|
default = null
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -35,8 +35,8 @@ def test_prefix(plan_runner):
|
||||||
assert r['values']['name'] == 'prefix-db'
|
assert r['values']['name'] == 'prefix-db'
|
||||||
|
|
||||||
replicas = """{
|
replicas = """{
|
||||||
replica1 = "europe-west3"
|
replica1 = { region = "europe-west3", encryption_key_name = null }
|
||||||
replica2 = "us-central1"
|
replica2 = { region = "us-central1", encryption_key_name = null }
|
||||||
}"""
|
}"""
|
||||||
|
|
||||||
_, resources = plan_runner(prefix="prefix")
|
_, resources = plan_runner(prefix="prefix")
|
||||||
|
@ -49,8 +49,8 @@ def test_replicas(plan_runner):
|
||||||
"Test replicated instance."
|
"Test replicated instance."
|
||||||
|
|
||||||
replicas = """{
|
replicas = """{
|
||||||
replica1 = "europe-west3"
|
replica1 = { region = "europe-west3", encryption_key_name = null }
|
||||||
replica2 = "us-central1"
|
replica2 = { region = "us-central1", encryption_key_name = null }
|
||||||
}"""
|
}"""
|
||||||
|
|
||||||
_, resources = plan_runner(replicas=replicas, prefix="prefix")
|
_, resources = plan_runner(replicas=replicas, prefix="prefix")
|
||||||
|
@ -80,10 +80,9 @@ def test_mysql_replicas_enables_backup(plan_runner):
|
||||||
"Test MySQL backup setup with replicas."
|
"Test MySQL backup setup with replicas."
|
||||||
|
|
||||||
replicas = """{
|
replicas = """{
|
||||||
replica1 = "europe-west3"
|
replica1 = { region = "europe-west3", encryption_key_name = null }
|
||||||
}"""
|
}"""
|
||||||
_, resources = plan_runner(replicas=replicas,
|
_, resources = plan_runner(replicas=replicas, database_version="MYSQL_8_0")
|
||||||
database_version="MYSQL_8_0")
|
|
||||||
assert len(resources) == 2
|
assert len(resources) == 2
|
||||||
primary = [r for r in resources if r['name'] == 'primary'][0]
|
primary = [r for r in resources if r['name'] == 'primary'][0]
|
||||||
backup_config = primary['values']['settings'][0]['backup_configuration'][0]
|
backup_config = primary['values']['settings'][0]['backup_configuration'][0]
|
||||||
|
|
Loading…
Reference in New Issue