Enable remaining PSC config options in modules/cloudsql-instance (#3982)

* Enable remaining PSC config options * Windows slashes * Updates from review; slim down locals; obsolete psc_allowed_consumer_projects * Windows slashes * tfvars; examples * Copy-paste bug * Proper list check * Updates from Automated PR Review * Slahes * null psc fix; regenerate custom test inventory * fmt * Correct fixtures; remove deletion_policy from instance resources * Fix test * Remove deletio policy --------- Co-authored-by: Julio Castillo <jccb@google.com>
2026-05-30 11:38:55 -06:00
parent f0325fc0c4
commit 3ee1cc7ab3
7 changed files with 287 additions and 34 deletions
--- a/modules/cloudsql-instance/README.md
+++ b/modules/cloudsql-instance/README.md
@@ -13,6 +13,7 @@ Note that this module assumes that some options are the same for both the primar
  - [Custom flags, databases and users](#custom-flags-databases-and-users)
  - [CMEK encryption](#cmek-encryption)
  - [Instance with PSC enabled](#instance-with-psc-enabled)
+  - [Instance with PSC auto connections](#instance-with-psc-auto-connections)
  - [Enable public IP](#enable-public-ip)
  - [Query Insights](#query-insights)
  - [Maintenance Config](#maintenance-config)
@@ -246,7 +247,9 @@ module "db" {
  project_id = var.project_id
  network_config = {
    connectivity = {
-      psc_allowed_consumer_projects = [var.project_id]
+      psc_config = {
+        allowed_consumer_projects = [var.project_id]
+      }
    }
  }
  prefix            = "myprefix"
@@ -262,6 +265,39 @@ module "db" {
 # tftest modules=1 resources=1 inventory=psc.yaml e2e
 ```

+### Instance with PSC auto connections
+
+```hcl
+module "db" {
+  source     = "./fabric/modules/cloudsql-instance"
+  project_id = var.project_id
+  context = {
+    networks = { myvpc = "https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa" }
+  }
+  network_config = {
+    connectivity = {
+      psc_config = {
+        allowed_consumer_projects = [var.project_id]
+        psc_auto_connections = [{
+          consumer_network            = "$networks:myvpc"
+          consumer_service_project_id = var.project_id
+        }]
+      }
+    }
+  }
+  prefix            = "myprefix"
+  name              = "db"
+  region            = var.region
+  availability_type = "REGIONAL"
+  database_version  = "POSTGRES_13"
+  tier              = "db-g1-small"
+
+  gcp_deletion_protection       = false
+  terraform_deletion_protection = false
+}
+# tftest modules=1 resources=1 inventory=psc-auto.yaml e2e
+```
+
 ### Enable public IP

 Use `public_ipv4` to create instances with a public IP.
@@ -417,9 +453,9 @@ module "db" {
 | [database_version](variables.tf#L96) | Database type and version to create. | <code>string</code> | ✓ |  |
 | [name](variables.tf#L213) | Name of primary instance. | <code>string</code> | ✓ |  |
 | [network_config](variables.tf#L218) | Network configuration for the instance. Only one between private_network and psc_config can be used. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ |  |
-| [project_id](variables.tf#L261) | The ID of the project where this instances will be created. | <code>string</code> | ✓ |  |
-| [region](variables.tf#L266) | Region of the primary instance. | <code>string</code> | ✓ |  |
-| [tier](variables.tf#L318) | The machine type to use for the instances. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L278) | The ID of the project where this instances will be created. | <code>string</code> | ✓ |  |
+| [region](variables.tf#L283) | Region of the primary instance. | <code>string</code> | ✓ |  |
+| [tier](variables.tf#L335) | The machine type to use for the instances. | <code>string</code> | ✓ |  |
 | [activation_policy](variables.tf#L17) | This variable specifies when the instance should be active. Can be either ALWAYS, NEVER or ON_DEMAND. Default is ALWAYS. | <code>string</code> |  | <code>&#34;ALWAYS&#34;</code> |
 | [availability_type](variables.tf#L28) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> |  | <code>&#34;ZONAL&#34;</code> |
 | [backup_configuration](variables.tf#L34) | Backup settings for primary instance. Set to null to leave existing GCP backup settings unmanaged. When set, all fields are managed by Terraform including disabling backups when enabled=false. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
@@ -440,14 +476,14 @@ module "db" {
 | [labels](variables.tf#L162) | Labels to be attached to all instances. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 | [maintenance_config](variables.tf#L168) | Set maintenance window configuration and maintenance deny period (up to 90 days). Date format: 'yyyy-mm-dd'. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [managed_connection_pooling_config](variables.tf#L203) | Configuration for Managed Connection Pooling. NOTE: This feature is only available for PostgreSQL on Enterprise Plus edition instances. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [password_validation_policy](variables.tf#L237) | Password validation policy configuration for instances. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
-| [prefix](variables.tf#L251) | Optional prefix used to generate instance names. | <code>string</code> |  | <code>null</code> |
-| [replicas](variables.tf#L271) | Map of NAME=> {REGION, KMS_KEY, AVAILABILITY_TYPE} for additional read replicas. Set to null to disable replica creation. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [root_password](variables.tf#L282) | Root password of the Cloud SQL instance, or flag to create a random password. Required for MS SQL Server. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [ssl](variables.tf#L296) | Setting to enable SSL, set config and certificates. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [terraform_deletion_protection](variables.tf#L311) | Prevent terraform from deleting instances. | <code>bool</code> |  | <code>true</code> |
-| [time_zone](variables.tf#L323) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | <code>string</code> |  | <code>null</code> |
-| [users](variables.tf#L329) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [password_validation_policy](variables.tf#L254) | Password validation policy configuration for instances. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [prefix](variables.tf#L268) | Optional prefix used to generate instance names. | <code>string</code> |  | <code>null</code> |
+| [replicas](variables.tf#L288) | Map of NAME=> {REGION, KMS_KEY, AVAILABILITY_TYPE} for additional read replicas. Set to null to disable replica creation. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [root_password](variables.tf#L299) | Root password of the Cloud SQL instance, or flag to create a random password. Required for MS SQL Server. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [ssl](variables.tf#L313) | Setting to enable SSL, set config and certificates. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [terraform_deletion_protection](variables.tf#L328) | Prevent terraform from deleting instances. | <code>bool</code> |  | <code>true</code> |
+| [time_zone](variables.tf#L340) | The time_zone to be used by the database engine (supported only for SQL Server), in SQL Server timezone format. | <code>string</code> |  | <code>null</code> |
+| [users](variables.tf#L346) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |

 ## Outputs

--- a/modules/cloudsql-instance/main.tf
+++ b/modules/cloudsql-instance/main.tf
@@ -43,6 +43,29 @@ locals {
  project_id = lookup(local.ctx.project_ids, var.project_id, var.project_id)
  region     = lookup(local.ctx.locations, var.region, var.region)

+  ### PSC locals
+  psc_allowed_consumer_projects = (
+    try(var.network_config.connectivity.psc_config.allowed_consumer_projects, null) == null
+    ? null
+    : [
+      for p in try(var.network_config.connectivity.psc_config.allowed_consumer_projects, []) :
+      lookup(local.ctx.project_ids, p, p)
+    ]
+  )
+  psc_auto_connections = [
+    for c in coalesce(
+      try(var.network_config.connectivity.psc_config.psc_auto_connections, []),
+      []
+      ) : {
+      consumer_network = lookup(local.ctx.networks, c.consumer_network, c.consumer_network)
+      consumer_service_project_id = (
+        c.consumer_service_project_id == null
+        ? null
+        : lookup(local.ctx.project_ids, c.consumer_service_project_id, c.consumer_service_project_id)
+      )
+    }
+  ]
+
  users = {
    for k, v in var.users : k =>
    local.is_mysql
@@ -113,16 +136,22 @@ resource "google_sql_database_instance" "primary" {
      }
      dynamic "psc_config" {
        for_each = (
-          var.network_config.connectivity.psc_allowed_consumer_projects != null
+          try(var.network_config.connectivity.psc_config, null) != null
          ? [""]
          : []
        )
        content {
-          psc_enabled = true
-          allowed_consumer_projects = [
-            for p in var.network_config.connectivity.psc_allowed_consumer_projects :
-            lookup(local.ctx.project_ids, p, p)
-          ]
+          psc_enabled               = true
+          allowed_consumer_projects = local.psc_allowed_consumer_projects
+          network_attachment_uri    = try(var.network_config.connectivity.psc_config.network_attachment_uri, null)
+
+          dynamic "psc_auto_connections" {
+            for_each = local.psc_auto_connections
+            content {
+              consumer_network            = psc_auto_connections.value.consumer_network
+              consumer_service_project_id = psc_auto_connections.value.consumer_service_project_id
+            }
+          }
        }
      }
    }
@@ -314,16 +343,26 @@ resource "google_sql_database_instance" "replicas" {
      }
      dynamic "psc_config" {
        for_each = (
-          var.network_config.connectivity.psc_allowed_consumer_projects != null
+          try(var.network_config.connectivity.psc_config, null) != null
          ? [""]
          : []
        )
        content {
-          psc_enabled = true
-          allowed_consumer_projects = [
-            for p in var.network_config.connectivity.psc_allowed_consumer_projects :
-            lookup(local.ctx.project_ids, p, p)
-          ]
+          psc_enabled               = true
+          allowed_consumer_projects = local.psc_allowed_consumer_projects
+          network_attachment_uri    = try(var.network_config.connectivity.psc_config.network_attachment_uri, null)
+
+          dynamic "psc_auto_connections" {
+            for_each = (
+              try(var.network_config.connectivity.psc_config.psc_auto_connections, null) != null
+              ? [""]
+              : []
+            )
+            content {
+              consumer_network            = local.psc_consumer_network
+              consumer_service_project_id = local.psc_consumer_service_project_id
+            }
+          }
        }
      }
    }
--- a/modules/cloudsql-instance/variables.tf
+++ b/modules/cloudsql-instance/variables.tf
@@ -228,10 +228,27 @@ variable "network_config" {
          replica = optional(string)
        }))
      }))
-      psc_allowed_consumer_projects    = optional(list(string))
+      psc_allowed_consumer_projects = optional(list(string)) # OBSOLETE. See validation below.
+      psc_config = optional(object({
+        allowed_consumer_projects = optional(list(string))
+        network_attachment_uri    = optional(string)
+        psc_auto_connections = optional(list(object({
+          consumer_network            = string
+          consumer_service_project_id = optional(string)
+        })))
+      }))
      enable_private_path_for_services = optional(bool, false)
    })
  })
+  validation {
+    condition = (
+      try(var.network_config.connectivity, null) == null ? true : (
+        var.network_config.connectivity.psc_allowed_consumer_projects == null ||
+        length(var.network_config.connectivity.psc_allowed_consumer_projects) == 0
+      )
+    )
+    error_message = "network_config.connectivity.psc_allowed_consumer_projects is obsolete. Use network_config.connectivity.psc_config.allowed_consumer_projects instead."
+  }
 }

 variable "password_validation_policy" {