fix cloud sql PSA after module upgrade (#2226)
* fix cloud sql PSA after module upgrade add proxy subnet for ILB * fix cloud run service accessible from public url in case the service is privately deployed * add deletion_policy variable in psa_configs for net-vpc module fix destroy issue with phpIPAM blueprint
This commit is contained in:
simonebruzzechesse
committed by
GitHub
GitHub
parent
024d3255e6
commit
b6771ae7ad
@@ -193,8 +193,8 @@ billable charges made afterwards.
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [prefix](variables.tf#L116) | Prefix used for resource names. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L135) | Project id, references existing project if `project_create` is null. | <code>string</code> | ✓ | |
|
||||
| [prefix](variables.tf#L118) | Prefix used for resource names. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L137) | Project id, references existing project if `project_create` is null. | <code>string</code> | ✓ | |
|
||||
| [admin_principals](variables.tf#L19) | Users, groups and/or service accounts that are assigned roles, in IAM format (`group:foo@example.com`). | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [cloud_run_invoker](variables.tf#L25) | IAM member authorized to access the end-point (for example, 'user:YOUR_IAM_USER' for only you or 'allUsers' for everyone). | <code>string</code> | | <code>"allUsers"</code> |
|
||||
| [cloudsql_password](variables.tf#L31) | CloudSQL password (will be randomly generated by default). | <code>string</code> | | <code>null</code> |
|
||||
@@ -203,14 +203,14 @@ billable charges made afterwards.
|
||||
| [custom_domain](variables.tf#L49) | Cloud Run service custom domain for GLB. | <code>string</code> | | <code>null</code> |
|
||||
| [deletion_protection](variables.tf#L55) | Prevent Terraform from destroying data storage resources (storage buckets, GKE clusters, CloudSQL instances) in this blueprint. When this field is set in Terraform state, a terraform destroy or terraform apply that would delete data storage resources will fail. | <code>bool</code> | | <code>false</code> |
|
||||
| [iap](variables.tf#L62) | Identity-Aware Proxy for Cloud Run in the LB. | <code title="object({ enabled = optional(bool, false) app_title = optional(string, "Cloud Run Explore Application") oauth2_client_name = optional(string, "Test Client") email = optional(string) })">object({…})</code> | | <code>{}</code> |
|
||||
| [ip_ranges](variables.tf#L74) | CIDR blocks: VPC serverless connector, Private Service Access(PSA) for CloudSQL, CloudSQL VPC. | <code title="object({ connector = string psa = string ilb = string })">object({…})</code> | | <code title="{ connector = "10.8.0.0/28" psa = "10.60.0.0/24" ilb = "10.128.0.0/28" }">{…}</code> |
|
||||
| [phpipam_config](variables.tf#L88) | PHPIpam configuration. | <code title="object({ image = optional(string, "phpipam/phpipam-www:latest") port = optional(number, 80) })">object({…})</code> | | <code title="{ image = "phpipam/phpipam-www:latest" port = 80 }">{…}</code> |
|
||||
| [phpipam_exposure](variables.tf#L100) | Whether to expose the application publicly via GLB or internally via ILB, default GLB. | <code>string</code> | | <code>"EXTERNAL"</code> |
|
||||
| [phpipam_password](variables.tf#L110) | Password for the phpipam user (will be randomly generated by default). | <code>string</code> | | <code>null</code> |
|
||||
| [project_create](variables.tf#L126) | Provide values if project creation is needed, uses existing project if null. Parent is in 'folders/nnn' or 'organizations/nnn' format. | <code title="object({ billing_account_id = string parent = string })">object({…})</code> | | <code>null</code> |
|
||||
| [region](variables.tf#L140) | Region for the created resources. | <code>string</code> | | <code>"europe-west4"</code> |
|
||||
| [security_policy](variables.tf#L146) | Security policy (Cloud Armor) to enforce in the LB. | <code title="object({ enabled = optional(bool, false) ip_blacklist = optional(list(string), ["*"]) path_blocked = optional(string, "/login.html") })">object({…})</code> | | <code>{}</code> |
|
||||
| [vpc_config](variables.tf#L156) | VPC Network and subnetwork self links for internal LB setup. | <code title="object({ network = string subnetwork = string })">object({…})</code> | | <code>null</code> |
|
||||
| [ip_ranges](variables.tf#L74) | CIDR blocks: VPC serverless connector, Private Service Access(PSA) for CloudSQL, CloudSQL VPC. | <code title="object({ connector = string proxy = string psa = string ilb = string })">object({…})</code> | | <code title="{ connector = "10.8.0.0/28" proxy = "10.10.0.0/26" psa = "10.60.0.0/24" ilb = "10.128.0.0/28" }">{…}</code> |
|
||||
| [phpipam_config](variables.tf#L90) | PHPIpam configuration. | <code title="object({ image = optional(string, "phpipam/phpipam-www:latest") port = optional(number, 80) })">object({…})</code> | | <code title="{ image = "phpipam/phpipam-www:latest" port = 80 }">{…}</code> |
|
||||
| [phpipam_exposure](variables.tf#L102) | Whether to expose the application publicly via GLB or internally via ILB, default GLB. | <code>string</code> | | <code>"EXTERNAL"</code> |
|
||||
| [phpipam_password](variables.tf#L112) | Password for the phpipam user (will be randomly generated by default). | <code>string</code> | | <code>null</code> |
|
||||
| [project_create](variables.tf#L128) | Provide values if project creation is needed, uses existing project if null. Parent is in 'folders/nnn' or 'organizations/nnn' format. | <code title="object({ billing_account_id = string parent = string })">object({…})</code> | | <code>null</code> |
|
||||
| [region](variables.tf#L142) | Region for the created resources. | <code>string</code> | | <code>"europe-west4"</code> |
|
||||
| [security_policy](variables.tf#L148) | Security policy (Cloud Armor) to enforce in the LB. | <code title="object({ enabled = optional(bool, false) ip_blacklist = optional(list(string), ["*"]) path_blocked = optional(string, "/login.html") })">object({…})</code> | | <code>{}</code> |
|
||||
| [vpc_config](variables.tf#L158) | VPC Network and subnetwork self links for internal LB setup. | <code title="object({ network = string subnetwork = string })">object({…})</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
@@ -236,5 +236,5 @@ module "test" {
|
||||
}
|
||||
project_id = "test-prj"
|
||||
}
|
||||
# tftest modules=8 resources=46
|
||||
# tftest modules=8 resources=47
|
||||
```
|
||||
|
||||
@@ -25,9 +25,9 @@ module "cloudsql" {
|
||||
databases = [local.cloudsql_conf.db]
|
||||
network_config = {
|
||||
connectivity = {
|
||||
psa_configs = [{
|
||||
psa_config = {
|
||||
private_network = local.network
|
||||
}]
|
||||
}
|
||||
}
|
||||
}
|
||||
prefix = var.prefix
|
||||
|
||||
@@ -76,6 +76,7 @@ module "vpc" {
|
||||
project_id = module.project.project_id
|
||||
name = "${var.prefix}-sql-vpc"
|
||||
psa_configs = [{
|
||||
deletion_policy = "ABANDON"
|
||||
ranges = {
|
||||
cloud-sql = var.ip_ranges.psa
|
||||
}
|
||||
@@ -87,6 +88,14 @@ module "vpc" {
|
||||
region = var.region
|
||||
}
|
||||
]
|
||||
subnets_proxy_only = [
|
||||
{
|
||||
ip_cidr_range = var.ip_ranges.proxy
|
||||
name = "regional-proxy"
|
||||
region = var.region
|
||||
active = true
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
resource "random_password" "phpipam_password" {
|
||||
@@ -99,7 +108,7 @@ module "cloud_run" {
|
||||
project_id = module.project.project_id
|
||||
name = "${var.prefix}-cr-phpipam"
|
||||
prefix = var.prefix
|
||||
ingress_settings = "all"
|
||||
ingress_settings = "internal-and-cloud-load-balancing"
|
||||
region = var.region
|
||||
|
||||
containers = {
|
||||
|
||||
@@ -75,11 +75,13 @@ variable "ip_ranges" {
|
||||
description = "CIDR blocks: VPC serverless connector, Private Service Access(PSA) for CloudSQL, CloudSQL VPC."
|
||||
type = object({
|
||||
connector = string
|
||||
proxy = string
|
||||
psa = string
|
||||
ilb = string
|
||||
})
|
||||
default = {
|
||||
connector = "10.8.0.0/28"
|
||||
proxy = "10.10.0.0/26"
|
||||
psa = "10.60.0.0/24"
|
||||
ilb = "10.128.0.0/28"
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user