192 lines
9.7 KiB
Markdown
192 lines
9.7 KiB
Markdown
# Cloud SQL instance with read replicas
|
|
|
|
This module manages the creation of Cloud SQL instances with potential read replicas in other regions. It can also create an initial set of users and databases via the `users` and `databases` parameters.
|
|
|
|
Note that this module assumes that some options are the same for both the primary instance and all the replicas (e.g. tier, disks, labels, flags, etc).
|
|
|
|
*Warning:* if you use the `users` field, you terraform state will contain each user's password in plain text.
|
|
|
|
## Simple example
|
|
|
|
This example shows how to setup a project, VPC and a standalone Cloud SQL instance.
|
|
|
|
```hcl
|
|
module "project" {
|
|
source = "./fabric/modules/project"
|
|
billing_account = var.billing_account_id
|
|
parent = var.organization_id
|
|
name = "my-db-project"
|
|
services = [
|
|
"servicenetworking.googleapis.com"
|
|
]
|
|
}
|
|
|
|
module "vpc" {
|
|
source = "./fabric/modules/net-vpc"
|
|
project_id = module.project.project_id
|
|
name = "my-network"
|
|
psa_config = {
|
|
ranges = { cloud-sql = "10.60.0.0/16" }
|
|
routes = null
|
|
}
|
|
}
|
|
|
|
module "db" {
|
|
source = "./fabric/modules/cloudsql-instance"
|
|
project_id = module.project.project_id
|
|
network = module.vpc.self_link
|
|
name = "db"
|
|
region = "europe-west1"
|
|
database_version = "POSTGRES_13"
|
|
tier = "db-g1-small"
|
|
}
|
|
# tftest modules=3 resources=9
|
|
```
|
|
|
|
## Cross-regional read replica
|
|
|
|
```hcl
|
|
module "db" {
|
|
source = "./fabric/modules/cloudsql-instance"
|
|
project_id = var.project_id
|
|
network = var.vpc.self_link
|
|
name = "db"
|
|
region = "europe-west1"
|
|
database_version = "POSTGRES_13"
|
|
tier = "db-g1-small"
|
|
|
|
replicas = {
|
|
replica1 = { region = "europe-west3", encryption_key_name = null }
|
|
replica2 = { region = "us-central1", encryption_key_name = null }
|
|
}
|
|
}
|
|
# tftest modules=1 resources=3
|
|
```
|
|
|
|
## Custom flags, databases and users
|
|
|
|
```hcl
|
|
module "db" {
|
|
source = "./fabric/modules/cloudsql-instance"
|
|
project_id = var.project_id
|
|
network = var.vpc.self_link
|
|
name = "db"
|
|
region = "europe-west1"
|
|
database_version = "MYSQL_8_0"
|
|
tier = "db-g1-small"
|
|
|
|
flags = {
|
|
disconnect_on_expired_password = "on"
|
|
}
|
|
|
|
databases = [
|
|
"people",
|
|
"departments"
|
|
]
|
|
|
|
users = {
|
|
# generatea password for user1
|
|
user1 = null
|
|
# assign a password to user2
|
|
user2 = "mypassword"
|
|
}
|
|
}
|
|
# tftest modules=1 resources=6
|
|
```
|
|
|
|
### CMEK encryption
|
|
```hcl
|
|
|
|
module "project" {
|
|
source = "./fabric/modules/project"
|
|
billing_account = var.billing_account_id
|
|
parent = var.organization_id
|
|
name = "my-db-project"
|
|
services = [
|
|
"servicenetworking.googleapis.com",
|
|
"sqladmin.googleapis.com",
|
|
]
|
|
}
|
|
|
|
module "kms" {
|
|
source = "./fabric/modules/kms"
|
|
project_id = module.project.project_id
|
|
keyring = {
|
|
name = "keyring"
|
|
location = var.region
|
|
}
|
|
keys = {
|
|
key-sql = null
|
|
}
|
|
key_iam = {
|
|
key-sql = {
|
|
"roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
|
|
"serviceAccount:${module.project.service_accounts.robots.sqladmin}"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
module "db" {
|
|
source = "./fabric/modules/cloudsql-instance"
|
|
project_id = module.project.project_id
|
|
encryption_key_name = module.kms.keys["key-sql"].id
|
|
network = var.vpc.self_link
|
|
name = "db"
|
|
region = var.region
|
|
database_version = "POSTGRES_13"
|
|
tier = "db-g1-small"
|
|
}
|
|
|
|
# tftest modules=3 resources=10
|
|
```
|
|
<!-- BEGIN TFDOC -->
|
|
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [database_version](variables.tf#L61) | Database type and version to create. | <code>string</code> | ✓ | |
|
|
| [name](variables.tf#L114) | Name of primary instance. | <code>string</code> | ✓ | |
|
|
| [network](variables.tf#L119) | VPC self link where the instances will be deployed. Private Service Networking must be enabled and configured in this VPC. | <code>string</code> | ✓ | |
|
|
| [project_id](variables.tf#L140) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
|
|
| [region](variables.tf#L145) | Region of the primary instance. | <code>string</code> | ✓ | |
|
|
| [tier](variables.tf#L165) | The machine type to use for the instances. | <code>string</code> | ✓ | |
|
|
| [allocated_ip_ranges](variables.tf#L17) | (Optional)The name of the allocated ip range for the private ip CloudSQL instance. For example: \"google-managed-services-default\". If set, the instance ip will be created in the allocated range. The range name must comply with RFC 1035. Specifically, the name must be 1-63 characters long and match the regular expression a-z?. | <code title="object({ primary = optional(string) replica = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
| [authorized_networks](variables.tf#L26) | Map of NAME=>CIDR_RANGE to allow to connect to the database(s). | <code>map(string)</code> | | <code>null</code> |
|
|
| [availability_type](variables.tf#L32) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>"ZONAL"</code> |
|
|
| [backup_configuration](variables.tf#L38) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object({ enabled = optional(bool, false) binary_log_enabled = optional(bool, false) start_time = optional(string, "23:00") location = optional(string) log_retention_days = optional(number, 7) point_in_time_recovery_enabled = optional(bool) retention_count = optional(number, 7) })">object({…})</code> | | <code title="{ enabled = false binary_log_enabled = false start_time = "23:00" location = null log_retention_days = 7 point_in_time_recovery_enabled = null retention_count = 7 }">{…}</code> |
|
|
| [databases](variables.tf#L66) | Databases to create once the primary instance is created. | <code>list(string)</code> | | <code>null</code> |
|
|
| [deletion_protection](variables.tf#L72) | Allow terraform to delete instances. | <code>bool</code> | | <code>false</code> |
|
|
| [disk_size](variables.tf#L78) | Disk size in GB. Set to null to enable autoresize. | <code>number</code> | | <code>null</code> |
|
|
| [disk_type](variables.tf#L84) | The type of data disk: `PD_SSD` or `PD_HDD`. | <code>string</code> | | <code>"PD_SSD"</code> |
|
|
| [encryption_key_name](variables.tf#L90) | The full path to the encryption key used for the CMEK disk encryption of the primary instance. | <code>string</code> | | <code>null</code> |
|
|
| [flags](variables.tf#L96) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map(string)</code> | | <code>null</code> |
|
|
| [ipv4_enabled](variables.tf#L102) | Add a public IP address to database instance. | <code>bool</code> | | <code>false</code> |
|
|
| [labels](variables.tf#L108) | Labels to be attached to all instances. | <code>map(string)</code> | | <code>null</code> |
|
|
| [postgres_client_certificates](variables.tf#L124) | Map of cert keys connect to the application(s) using public IP. | <code>list(string)</code> | | <code>null</code> |
|
|
| [prefix](variables.tf#L130) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
|
|
| [replicas](variables.tf#L150) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map(object({ region = string encryption_key_name = string }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [root_password](variables.tf#L159) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> | | <code>null</code> |
|
|
| [users](variables.tf#L170) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map(string)</code> | | <code>null</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [connection_name](outputs.tf#L24) | Connection name of the primary instance. | |
|
|
| [connection_names](outputs.tf#L29) | Connection names of all instances. | |
|
|
| [id](outputs.tf#L37) | ID of the primary instance. | |
|
|
| [ids](outputs.tf#L42) | IDs of all instances. | |
|
|
| [instances](outputs.tf#L50) | Cloud SQL instance resources. | ✓ |
|
|
| [ip](outputs.tf#L56) | IP address of the primary instance. | |
|
|
| [ips](outputs.tf#L61) | IP addresses of all instances. | |
|
|
| [name](outputs.tf#L69) | Name of the primary instance. | |
|
|
| [names](outputs.tf#L74) | Names of all instances. | |
|
|
| [postgres_client_certificates](outputs.tf#L82) | The CA Certificate used to connect to the SQL Instance via SSL. | ✓ |
|
|
| [self_link](outputs.tf#L88) | Self link of the primary instance. | |
|
|
| [self_links](outputs.tf#L93) | Self links of all instances. | |
|
|
| [user_passwords](outputs.tf#L101) | Map of containing the password of all users created through terraform. | ✓ |
|
|
|
|
<!-- END TFDOC -->
|