fix(cloudsql): always render backup_configuration block to allow disabling backups (#3780)
* fix(cloudsql): always render backup_configuration block to allow disabling backups * refactor(cloudsql): use nullable backup_configuration variable for explicit don't-manage semantics * fix(cloudsql): force point_in_time_recovery_enabled=false when backups disabled * fix(cloudsql): guard binary_log_enabled and point_in_time_recovery_enabled when backups disabled * formatting --------- Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>
This commit is contained in:
Daniel Chan
@@ -408,38 +408,38 @@ module "db" {
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [database_version](variables.tf#L82) | Database type and version to create. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L198) | Name of primary instance. | <code>string</code> | ✓ | |
|
||||
| [network_config](variables.tf#L203) | Network configuration for the instance. Only one between private_network and psc_config can be used. | <code title="object({ authorized_networks = optional(map(string)) connectivity = object({ public_ipv4 = optional(bool, false) psa_config = optional(object({ private_network = string allocated_ip_ranges = optional(object({ primary = optional(string) replica = optional(string) })) })) psc_allowed_consumer_projects = optional(list(string)) enable_private_path_for_services = optional(bool, false) }) })">object({…})</code> | ✓ | |
|
||||
| [project_id](variables.tf#L246) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L251) | Region of the primary instance. | <code>string</code> | ✓ | |
|
||||
| [tier](variables.tf#L303) | The machine type to use for the instances. | <code>string</code> | ✓ | |
|
||||
| [database_version](variables.tf#L72) | Database type and version to create. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L188) | Name of primary instance. | <code>string</code> | ✓ | |
|
||||
| [network_config](variables.tf#L193) | Network configuration for the instance. Only one between private_network and psc_config can be used. | <code title="object({ authorized_networks = optional(map(string)) connectivity = object({ public_ipv4 = optional(bool, false) psa_config = optional(object({ private_network = string allocated_ip_ranges = optional(object({ primary = optional(string) replica = optional(string) })) })) psc_allowed_consumer_projects = optional(list(string)) enable_private_path_for_services = optional(bool, false) }) })">object({…})</code> | ✓ | |
|
||||
| [project_id](variables.tf#L236) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L241) | Region of the primary instance. | <code>string</code> | ✓ | |
|
||||
| [tier](variables.tf#L293) | The machine type to use for the instances. | <code>string</code> | ✓ | |
|
||||
| [activation_policy](variables.tf#L16) | This variable specifies when the instance should be active. Can be either ALWAYS, NEVER or ON_DEMAND. Default is ALWAYS. | <code>string</code> | | <code>"ALWAYS"</code> |
|
||||
| [availability_type](variables.tf#L27) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>"ZONAL"</code> |
|
||||
| [backup_configuration](variables.tf#L33) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object({ enabled = optional(bool, false) binary_log_enabled = optional(bool, false) start_time = optional(string, "23:00") location = optional(string) log_retention_days = optional(number, 7) point_in_time_recovery_enabled = optional(bool) retention_count = optional(number, 7) retain_backups_on_delete = optional(bool) final_backup = optional(object({ enabled = optional(bool, false) retention_days = optional(number, 7) })) })">object({…})</code> | | <code title="{ enabled = false binary_log_enabled = false start_time = "23:00" location = null log_retention_days = 7 point_in_time_recovery_enabled = null retention_count = 7 retain_backups_on_delete = null final_backup = null }">{…}</code> |
|
||||
| [collation](variables.tf#L63) | The name of server instance collation. | <code>string</code> | | <code>null</code> |
|
||||
| [connector_enforcement](variables.tf#L69) | Specifies if connections must use Cloud SQL connectors. | <code>string</code> | | <code>null</code> |
|
||||
| [data_cache](variables.tf#L75) | Enable data cache. Only used for Enterprise MYSQL and PostgreSQL. | <code>bool</code> | | <code>false</code> |
|
||||
| [databases](variables.tf#L87) | Databases to create once the primary instance is created. | <code>list(string)</code> | | <code>null</code> |
|
||||
| [disk_autoresize_limit](variables.tf#L93) | The maximum size to which storage capacity can be automatically increased. The default value is 0, which specifies that there is no limit. | <code>number</code> | | <code>0</code> |
|
||||
| [disk_size](variables.tf#L99) | Disk size in GB. Set to null to enable autoresize. | <code>number</code> | | <code>null</code> |
|
||||
| [disk_type](variables.tf#L105) | The type of data disk: `PD_SSD` or `PD_HDD`. | <code>string</code> | | <code>"PD_SSD"</code> |
|
||||
| [edition](variables.tf#L111) | The edition of the instance, can be ENTERPRISE or ENTERPRISE_PLUS. | <code>string</code> | | <code>"ENTERPRISE"</code> |
|
||||
| [encryption_key_name](variables.tf#L117) | The full path to the encryption key used for the CMEK disk encryption of the primary instance. | <code>string</code> | | <code>null</code> |
|
||||
| [flags](variables.tf#L123) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map(string)</code> | | <code>null</code> |
|
||||
| [gcp_deletion_protection](variables.tf#L129) | Set Google's deletion protection attribute which applies across all surfaces (UI, API, & Terraform). | <code>bool</code> | | <code>true</code> |
|
||||
| [insights_config](variables.tf#L136) | Query Insights configuration. Defaults to null which disables Query Insights. | <code title="object({ query_string_length = optional(number, 1024) record_application_tags = optional(bool, false) record_client_address = optional(bool, false) query_plans_per_minute = optional(number, 5) })">object({…})</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L147) | Labels to be attached to all instances. | <code>map(string)</code> | | <code>null</code> |
|
||||
| [maintenance_config](variables.tf#L153) | Set maintenance window configuration and maintenance deny period (up to 90 days). Date format: 'yyyy-mm-dd'. | <code title="object({ maintenance_window = optional(object({ day = optional(number) hour = number update_track = optional(string, null) }), null) deny_maintenance_period = optional(object({ start_date = string end_date = string start_time = optional(string, "00:00:00") }), null) })">object({…})</code> | | <code>{}</code> |
|
||||
| [managed_connection_pooling_config](variables.tf#L188) | Configuration for Managed Connection Pooling. NOTE: This feature is only available for PostgreSQL on Enterprise Plus edition instances. | <code title="object({ enabled = optional(bool, false) flags = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [password_validation_policy](variables.tf#L222) | Password validation policy configuration for instances. | <code title="object({ enabled = optional(bool, true) change_interval = optional(number) default_complexity = optional(bool) disallow_username_substring = optional(bool) min_length = optional(number) reuse_interval = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [prefix](variables.tf#L236) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
|
||||
| [replicas](variables.tf#L256) | Map of NAME=> {REGION, KMS_KEY, AVAILABILITY_TYPE} for additional read replicas. Set to null to disable replica creation. | <code title="map(object({ region = string encryption_key_name = optional(string) availability_type = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [root_password](variables.tf#L267) | Root password of the Cloud SQL instance, or flag to create a random password. Required for MS SQL Server. | <code title="object({ password = optional(string) random_password = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
| [ssl](variables.tf#L281) | Setting to enable SSL, set config and certificates. | <code title="object({ client_certificates = optional(list(string)) mode = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [terraform_deletion_protection](variables.tf#L296) | Prevent terraform from deleting instances. | <code>bool</code> | | <code>true</code> |
|
||||
| [time_zone](variables.tf#L308) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | <code>string</code> | | <code>null</code> |
|
||||
| [users](variables.tf#L314) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code title="map(object({ password = optional(string) password_version = optional(number) type = optional(string, "BUILT_IN") }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [backup_configuration](variables.tf#L33) | Backup settings for primary instance. Set to null to leave existing GCP backup settings unmanaged. When set, all fields are managed by Terraform including disabling backups when enabled=false. | <code title="object({ enabled = optional(bool, false) binary_log_enabled = optional(bool, false) start_time = optional(string, "23:00") location = optional(string) log_retention_days = optional(number, 7) point_in_time_recovery_enabled = optional(bool) retention_count = optional(number, 7) retain_backups_on_delete = optional(bool) final_backup = optional(object({ enabled = optional(bool, false) retention_days = optional(number, 7) })) })">object({…})</code> | | <code>null</code> |
|
||||
| [collation](variables.tf#L53) | The name of server instance collation. | <code>string</code> | | <code>null</code> |
|
||||
| [connector_enforcement](variables.tf#L59) | Specifies if connections must use Cloud SQL connectors. | <code>string</code> | | <code>null</code> |
|
||||
| [data_cache](variables.tf#L65) | Enable data cache. Only used for Enterprise MYSQL and PostgreSQL. | <code>bool</code> | | <code>false</code> |
|
||||
| [databases](variables.tf#L77) | Databases to create once the primary instance is created. | <code>list(string)</code> | | <code>null</code> |
|
||||
| [disk_autoresize_limit](variables.tf#L83) | The maximum size to which storage capacity can be automatically increased. The default value is 0, which specifies that there is no limit. | <code>number</code> | | <code>0</code> |
|
||||
| [disk_size](variables.tf#L89) | Disk size in GB. Set to null to enable autoresize. | <code>number</code> | | <code>null</code> |
|
||||
| [disk_type](variables.tf#L95) | The type of data disk: `PD_SSD` or `PD_HDD`. | <code>string</code> | | <code>"PD_SSD"</code> |
|
||||
| [edition](variables.tf#L101) | The edition of the instance, can be ENTERPRISE or ENTERPRISE_PLUS. | <code>string</code> | | <code>"ENTERPRISE"</code> |
|
||||
| [encryption_key_name](variables.tf#L107) | The full path to the encryption key used for the CMEK disk encryption of the primary instance. | <code>string</code> | | <code>null</code> |
|
||||
| [flags](variables.tf#L113) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map(string)</code> | | <code>null</code> |
|
||||
| [gcp_deletion_protection](variables.tf#L119) | Set Google's deletion protection attribute which applies across all surfaces (UI, API, & Terraform). | <code>bool</code> | | <code>true</code> |
|
||||
| [insights_config](variables.tf#L126) | Query Insights configuration. Defaults to null which disables Query Insights. | <code title="object({ query_string_length = optional(number, 1024) record_application_tags = optional(bool, false) record_client_address = optional(bool, false) query_plans_per_minute = optional(number, 5) })">object({…})</code> | | <code>null</code> |
|
||||
| [labels](variables.tf#L137) | Labels to be attached to all instances. | <code>map(string)</code> | | <code>null</code> |
|
||||
| [maintenance_config](variables.tf#L143) | Set maintenance window configuration and maintenance deny period (up to 90 days). Date format: 'yyyy-mm-dd'. | <code title="object({ maintenance_window = optional(object({ day = optional(number) hour = number update_track = optional(string, null) }), null) deny_maintenance_period = optional(object({ start_date = string end_date = string start_time = optional(string, "00:00:00") }), null) })">object({…})</code> | | <code>{}</code> |
|
||||
| [managed_connection_pooling_config](variables.tf#L178) | Configuration for Managed Connection Pooling. NOTE: This feature is only available for PostgreSQL on Enterprise Plus edition instances. | <code title="object({ enabled = optional(bool, false) flags = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [password_validation_policy](variables.tf#L212) | Password validation policy configuration for instances. | <code title="object({ enabled = optional(bool, true) change_interval = optional(number) default_complexity = optional(bool) disallow_username_substring = optional(bool) min_length = optional(number) reuse_interval = optional(number) })">object({…})</code> | | <code>null</code> |
|
||||
| [prefix](variables.tf#L226) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
|
||||
| [replicas](variables.tf#L246) | Map of NAME=> {REGION, KMS_KEY, AVAILABILITY_TYPE} for additional read replicas. Set to null to disable replica creation. | <code title="map(object({ region = string encryption_key_name = optional(string) availability_type = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [root_password](variables.tf#L257) | Root password of the Cloud SQL instance, or flag to create a random password. Required for MS SQL Server. | <code title="object({ password = optional(string) random_password = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
| [ssl](variables.tf#L271) | Setting to enable SSL, set config and certificates. | <code title="object({ client_certificates = optional(list(string)) mode = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [terraform_deletion_protection](variables.tf#L286) | Prevent terraform from deleting instances. | <code>bool</code> | | <code>true</code> |
|
||||
| [time_zone](variables.tf#L298) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | <code>string</code> | | <code>null</code> |
|
||||
| [users](variables.tf#L304) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code title="map(object({ password = optional(string) password_version = optional(number) type = optional(string, "BUILT_IN") }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -20,6 +20,7 @@ locals {
|
||||
is_postgres = can(regex("^POSTGRES", var.database_version))
|
||||
has_replicas = length(var.replicas) > 0
|
||||
is_regional = var.availability_type == "REGIONAL" ? true : false
|
||||
|
||||
users = {
|
||||
for k, v in var.users : k =>
|
||||
local.is_mysql
|
||||
@@ -61,7 +62,7 @@ resource "google_sql_database_instance" "primary" {
|
||||
collation = var.collation
|
||||
connector_enforcement = var.connector_enforcement
|
||||
time_zone = var.time_zone
|
||||
retain_backups_on_delete = var.backup_configuration.retain_backups_on_delete
|
||||
retain_backups_on_delete = try(var.backup_configuration.retain_backups_on_delete, null)
|
||||
|
||||
ip_configuration {
|
||||
ipv4_enabled = var.network_config.connectivity.public_ipv4
|
||||
@@ -102,34 +103,44 @@ resource "google_sql_database_instance" "primary" {
|
||||
}
|
||||
}
|
||||
|
||||
# backup_configuration is Optional+Computed in the provider schema, meaning an absent block
|
||||
# is treated as "don't manage" rather than "set to disabled". Setting var.backup_configuration
|
||||
# to null preserves existing GCP settings; passing an object (even with enabled=false) causes
|
||||
# Terraform to actively manage and apply the desired state.
|
||||
# See: https://github.com/hashicorp/terraform-provider-google/blob/main/google/services/sql/resource_sql_database_instance.go#L424
|
||||
# See: https://developer.hashicorp.com/terraform/language/attr-as-blocks
|
||||
dynamic "backup_configuration" {
|
||||
for_each = var.backup_configuration.enabled ? { 1 = 1 } : {}
|
||||
for_each = var.backup_configuration != null ? [1] : []
|
||||
content {
|
||||
enabled = true
|
||||
// enable binary log if the user asks for it or we have replicas (default in regional),
|
||||
// but only for MySQL
|
||||
enabled = var.backup_configuration.enabled
|
||||
// auto-enable binary log for MySQL when replicas or regional HA are in use;
|
||||
// must be null (not true) when backups are disabled
|
||||
binary_log_enabled = (
|
||||
local.is_mysql
|
||||
local.is_mysql && var.backup_configuration.enabled
|
||||
? var.backup_configuration.binary_log_enabled || local.has_replicas || local.is_regional
|
||||
: null
|
||||
)
|
||||
start_time = var.backup_configuration.start_time
|
||||
location = var.backup_configuration.location
|
||||
// must be explicitly false (not null) when backups are disabled
|
||||
point_in_time_recovery_enabled = (
|
||||
var.backup_configuration.point_in_time_recovery_enabled
|
||||
var.backup_configuration.enabled
|
||||
? var.backup_configuration.point_in_time_recovery_enabled
|
||||
: false
|
||||
)
|
||||
transaction_log_retention_days = (
|
||||
var.backup_configuration.log_retention_days
|
||||
)
|
||||
backup_retention_settings {
|
||||
retained_backups = var.backup_configuration.retention_count
|
||||
retention_unit = "COUNT"
|
||||
transaction_log_retention_days = var.backup_configuration.log_retention_days
|
||||
dynamic "backup_retention_settings" {
|
||||
for_each = var.backup_configuration.enabled ? { 1 = 1 } : {}
|
||||
content {
|
||||
retained_backups = var.backup_configuration.retention_count
|
||||
retention_unit = "COUNT"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "final_backup_config" {
|
||||
for_each = var.backup_configuration.final_backup != null ? [var.backup_configuration.final_backup] : []
|
||||
for_each = try(var.backup_configuration.final_backup != null ? [var.backup_configuration.final_backup] : [], [])
|
||||
content {
|
||||
enabled = final_backup_config.value.enabled
|
||||
retention_days = final_backup_config.value.retention_days
|
||||
|
||||
@@ -31,8 +31,8 @@ variable "availability_type" {
|
||||
}
|
||||
|
||||
variable "backup_configuration" {
|
||||
description = "Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas."
|
||||
nullable = false
|
||||
description = "Backup settings for primary instance. Set to null to leave existing GCP backup settings unmanaged. When set, all fields are managed by Terraform including disabling backups when enabled=false."
|
||||
nullable = true
|
||||
type = object({
|
||||
enabled = optional(bool, false)
|
||||
binary_log_enabled = optional(bool, false)
|
||||
@@ -47,17 +47,7 @@ variable "backup_configuration" {
|
||||
retention_days = optional(number, 7)
|
||||
}))
|
||||
})
|
||||
default = {
|
||||
enabled = false
|
||||
binary_log_enabled = false
|
||||
start_time = "23:00"
|
||||
location = null
|
||||
log_retention_days = 7
|
||||
point_in_time_recovery_enabled = null
|
||||
retention_count = 7
|
||||
retain_backups_on_delete = null
|
||||
final_backup = null
|
||||
}
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "collation" {
|
||||
|
||||
Reference in New Issue
Block a user