kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for password validation policy to cloudsql module (#2740)

Browse Source 
* add support for password validation policy to cloudsql module

* fix defaults
This commit is contained in:
Ludovico Magnocavallo
2024-12-09 10:44:15 +01:00
committed by GitHub
parent 2defaed545
commit f3b14f5e69
3 changed files with 122 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

132
modules/cloudsql-instance/main.tf
View File

@@ -20,28 +20,29 @@ locals {
is_postgres = can(regex("^POSTGRES", var.database_version))
has_replicas = length(var.replicas) > 0
is_regional = var.availability_type == "REGIONAL" ? true : false
// Enable backup if the user asks for it or if the user is deploying
// MySQL in HA configuration (regional or with specified replicas)
enable_backup = var.backup_configuration.enabled || (local.is_mysql && local.has_replicas) || (local.is_mysql && local.is_regional)
# enable backup if the user asks for it or if the user is deploying
# MySQL in HA configuration (regional or with specified replicas)
enable_backup = (
var.backup_configuration.enabled ||
(local.is_mysql && local.has_replicas) ||
(local.is_mysql && local.is_regional)
)
users = {
for k, v in coalesce(var.users, {}) :
k =>
local.is_mysql ?
{
for k, v in coalesce(var.users, {}) : k =>
local.is_mysql
? {
name = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? split("@", k)[0] : k
host = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(split("@", k)[1], null) : null
password = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = coalesce(v.type, "BUILT_IN")
} : {
}
: {
name = local.is_postgres ? try(trimsuffix(k, ".gserviceaccount.com"), k) : k
host = null
password = coalesce(v.type, "BUILT_IN") == "BUILT_IN" ? try(random_password.passwords[k].result, v.password) : null
type = coalesce(v.type, "BUILT_IN")
}
}
}
resource "google_sql_database_instance" "primary" {
@@ -69,13 +70,23 @@ resource "google_sql_database_instance" "primary" {
time_zone = var.time_zone
ip_configuration {
ipv4_enabled = var.network_config.connectivity.public_ipv4
private_network = try(var.network_config.connectivity.psa_config.private_network, null)
allocated_ip_range = try(var.network_config.connectivity.psa_config.allocated_ip_ranges.primary, null)
ssl_mode = var.ssl.ssl_mode
enable_private_path_for_google_cloud_services = var.network_config.connectivity.enable_private_path_for_services
ipv4_enabled = var.network_config.connectivity.public_ipv4
private_network = try(
var.network_config.connectivity.psa_config.private_network, null
)
allocated_ip_range = try(
var.network_config.connectivity.psa_config.allocated_ip_ranges.primary, null
)
ssl_mode = var.ssl.ssl_mode
enable_private_path_for_google_cloud_services = (
var.network_config.connectivity.enable_private_path_for_services
)
dynamic "authorized_networks" {
for_each = var.network_config.authorized_networks != null ? var.network_config.authorized_networks : {}
for_each = (
var.network_config.authorized_networks != null
? var.network_config.authorized_networks
: {}
)
iterator = network
content {
name = network.key
@@ -83,10 +94,16 @@ resource "google_sql_database_instance" "primary" {
}
}
dynamic "psc_config" {
for_each = var.network_config.connectivity.psc_allowed_consumer_projects != null ? [""] : []
for_each = (
var.network_config.connectivity.psc_allowed_consumer_projects != null
? [""]
: []
)
content {
psc_enabled = true
allowed_consumer_projects = var.network_config.connectivity.psc_allowed_consumer_projects
psc_enabled = true
allowed_consumer_projects = (
var.network_config.connectivity.psc_allowed_consumer_projects
)
}
}
}
@@ -95,7 +112,6 @@ resource "google_sql_database_instance" "primary" {
for_each = local.enable_backup ? { 1 = 1 } : {}
content {
enabled = true
// enable binary log if the user asks for it or we have replicas (default in regional),
// but only for MySQL
binary_log_enabled = (
@@ -103,10 +119,14 @@ resource "google_sql_database_instance" "primary" {
? var.backup_configuration.binary_log_enabled || local.has_replicas || local.is_regional
: null
)
start_time = var.backup_configuration.start_time
location = var.backup_configuration.location
point_in_time_recovery_enabled = var.backup_configuration.point_in_time_recovery_enabled
transaction_log_retention_days = var.backup_configuration.log_retention_days
start_time = var.backup_configuration.start_time
location = var.backup_configuration.location
point_in_time_recovery_enabled = (
var.backup_configuration.point_in_time_recovery_enabled
)
transaction_log_retention_days = (
var.backup_configuration.log_retention_days
)
backup_retention_settings {
retained_backups = var.backup_configuration.retention_count
retention_unit = "COUNT"
@@ -158,6 +178,28 @@ resource "google_sql_database_instance" "primary" {
update_track = var.maintenance_config.maintenance_window.update_track
}
}
dynamic "password_validation_policy" {
for_each = var.password_validation_policy != null ? [""] : []
content {
complexity = (
var.password_validation_policy.default_complexity == true
? "COMPLEXITY_DEFAULT"
: null # "COMPLEXITY_UNSPECIFIED" generates a permadiff
)
disallow_username_substring = (
var.password_validation_policy.disallow_username_substring
)
enable_password_policy = var.password_validation_policy.enabled
min_length = var.password_validation_policy.min_length
password_change_interval = (
var.password_validation_policy.change_interval == null
? null
: "${var.password_validation_policy.change_interval}s"
)
reuse_interval = var.password_validation_policy.reuse_interval
}
}
}
deletion_protection = var.terraform_deletion_protection
}
@@ -183,12 +225,24 @@ resource "google_sql_database_instance" "replicas" {
activation_policy = var.activation_policy
ip_configuration {
ipv4_enabled = var.network_config.connectivity.public_ipv4
private_network = try(var.network_config.connectivity.psa_config.private_network, null)
allocated_ip_range = try(var.network_config.connectivity.psa_config.allocated_ip_ranges.replica, null)
enable_private_path_for_google_cloud_services = var.network_config.connectivity.enable_private_path_for_services
ipv4_enabled = (
var.network_config.connectivity.public_ipv4
)
private_network = (
try(var.network_config.connectivity.psa_config.private_network, null)
)
allocated_ip_range = try(
var.network_config.connectivity.psa_config.allocated_ip_ranges.replica, null
)
enable_private_path_for_google_cloud_services = (
var.network_config.connectivity.enable_private_path_for_services
)
dynamic "authorized_networks" {
for_each = var.network_config.authorized_networks != null ? var.network_config.authorized_networks : {}
for_each = (
var.network_config.authorized_networks != null
? var.network_config.authorized_networks
: {}
)
iterator = network
content {
name = network.key
@@ -196,10 +250,16 @@ resource "google_sql_database_instance" "replicas" {
}
}
dynamic "psc_config" {
for_each = var.network_config.connectivity.psc_allowed_consumer_projects != null ? [""] : []
for_each = (
var.network_config.connectivity.psc_allowed_consumer_projects != null
? [""]
: []
)
content {
psc_enabled = true
allowed_consumer_projects = var.network_config.connectivity.psc_allowed_consumer_projects
psc_enabled = true
allowed_consumer_projects = (
var.network_config.connectivity.psc_allowed_consumer_projects
)
}
}
}
@@ -249,7 +309,11 @@ moved {
}
resource "google_sql_ssl_cert" "client_certificates" {
for_each = var.ssl.client_certificates != null ? toset(var.ssl.client_certificates) : toset([])
for_each = (
var.ssl.client_certificates != null
? toset(var.ssl.client_certificates)
: toset([])
)
provider = google-beta
project = var.project_id
instance = google_sql_database_instance.primary.name