Enable remaining PSC config options in modules/alloydb (#4000)

* Add PSC config variables * Remove locals * fmt * Updates from Automated PR Review
2026-05-29 11:56:15 -06:00
parent 58301c9eda
commit f3bec257b2
4 changed files with 190 additions and 16 deletions
--- a/modules/alloydb/README.md
+++ b/modules/alloydb/README.md
@@ -16,6 +16,7 @@ Note that this module assumes that some options are the same for both the primar
  - [Cross region replication](#cross-region-replication)
  - [Cross region replication with primary and secondary cluster read pool](#cross-region-replication-with-primary-and-secondary-cluster-read-pool)
  - [PSC instance](#psc-instance)
+  - [PSC instance with auto connections](#psc-instance-with-auto-connections)
  - [Custom flags and users definition](#custom-flags-and-users-definition)
  - [CMEK encryption](#cmek-encryption)
 - [Tag bindings](#tag-bindings)
@@ -270,6 +271,31 @@ module "alloydb" {
 # tftest modules=1 resources=2 inventory=psc.yaml e2e
 ```

+### PSC instance with auto connections
+
+```hcl
+module "alloydb" {
+  source         = "./fabric/modules/alloydb"
+  project_id     = var.project_id
+  project_number = var.project_number
+  cluster_name   = "db"
+  location       = var.region
+  instance_name  = "db"
+  network_config = {
+    psc_config = {
+      allowed_consumer_projects = [var.project_number]
+      psc_auto_connections = [{
+        consumer_project = var.project_id
+        consumer_network = var.vpc.id
+      }]
+    }
+  }
+
+  deletion_protection = false
+}
+# tftest modules=1 resources=2 inventory=psc_auto.yaml e2e
+```
+
 ### Custom flags and users definition

 ```hcl
@@ -428,7 +454,7 @@ module "alloydb" {
 | [instance_name](variables.tf#L211) | Name of primary instance. | <code>string</code> | ✓ |  |
 | [location](variables.tf#L223) | Region or zone of the cluster and instance. | <code>string</code> | ✓ |  |
 | [network_config](variables.tf#L268) | Network configuration for cluster and instance. Only one between psa_config and psc_config can be used. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ |  |
-| [project_id](variables.tf#L319) | The ID of the project where this instances will be created. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L324) | The ID of the project where this instances will be created. | <code>string</code> | ✓ |  |
 | [annotations](variables.tf#L17) | Map FLAG_NAME=>VALUE for annotations which allow client tools to store small amount of arbitrary data. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 | [automated_backup_configuration](variables.tf#L23) | Automated backup settings for cluster. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [availability_type](variables.tf#L61) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> |  | <code>&#34;REGIONAL&#34;</code> |
@@ -447,15 +473,15 @@ module "alloydb" {
 | [labels](variables.tf#L217) | Labels to be attached to all instances. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 | [machine_config](variables.tf#L229) | AlloyDB machine config. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [maintenance_config](variables.tf#L243) | Set maintenance window configuration. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [observability_config](variables.tf#L293) | Advanced query insights config for AlloyDB. Mutually exclusive with query_insights_config. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
-| [prefix](variables.tf#L309) | Optional prefix used to generate instance names. | <code>string</code> |  | <code>null</code> |
-| [project_number](variables.tf#L324) | The project number of the project where this instances will be created. Only used for testing purposes. | <code>string</code> |  | <code>null</code> |
-| [query_insights_config](variables.tf#L330) | Query insights config. Mutually exclusive with observability_config. It will be ignored if observability_config is enabled. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [read_pool](variables.tf#L341) | Map of read pool instances to create in the primary cluster. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [skip_await_major_version_upgrade](variables.tf#L397) | Set to true to skip awaiting on the major version upgrade of the cluster. | <code>bool</code> |  | <code>true</code> |
-| [subscription_type](variables.tf#L403) | The subscription type of cluster. Possible values are: 'STANDARD' or 'TRIAL'. | <code>string</code> |  | <code>&#34;STANDARD&#34;</code> |
-| [tag_bindings](variables.tf#L409) | Tag bindings for this service, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
-| [users](variables.tf#L416) | Map of users to create in the primary instance (and replicated to other replicas). Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'ALLOYDB_BUILT_IN' or 'ALLOYDB_IAM_USER'. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [observability_config](variables.tf#L298) | Advanced query insights config for AlloyDB. Mutually exclusive with query_insights_config. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [prefix](variables.tf#L314) | Optional prefix used to generate instance names. | <code>string</code> |  | <code>null</code> |
+| [project_number](variables.tf#L329) | The project number of the project where this instances will be created. Only used for testing purposes. | <code>string</code> |  | <code>null</code> |
+| [query_insights_config](variables.tf#L335) | Query insights config. Mutually exclusive with observability_config. It will be ignored if observability_config is enabled. | <code>object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [read_pool](variables.tf#L346) | Map of read pool instances to create in the primary cluster. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [skip_await_major_version_upgrade](variables.tf#L402) | Set to true to skip awaiting on the major version upgrade of the cluster. | <code>bool</code> |  | <code>true</code> |
+| [subscription_type](variables.tf#L408) | The subscription type of cluster. Possible values are: 'STANDARD' or 'TRIAL'. | <code>string</code> |  | <code>&#34;STANDARD&#34;</code> |
+| [tag_bindings](variables.tf#L414) | Tag bindings for this service, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
+| [users](variables.tf#L421) | Map of users to create in the primary instance (and replicated to other replicas). Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'ALLOYDB_BUILT_IN' or 'ALLOYDB_IAM_USER'. | <code>map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |

 ## Outputs

--- a/modules/alloydb/main.tf
+++ b/modules/alloydb/main.tf
@@ -172,7 +172,7 @@ resource "google_alloydb_cluster" "primary" {

  # psc_config block should exist only when PSC is enabled to prevent Terraform state drift
  dynamic "psc_config" {
-    for_each = length(local.allowed_consumer_projects) > 0 ? [""] : []
+    for_each = (try(var.network_config.psc_config, null) != null ? [""] : [])
    content {
      psc_enabled = true
    }
@@ -240,9 +240,24 @@ resource "google_alloydb_instance" "primary" {

  # psc_instance_config block should exist only when there are PSC allowed consumer projects to prevent Terraform state drift
  dynamic "psc_instance_config" {
-    for_each = length(local.allowed_consumer_projects) > 0 ? [""] : []
+    for_each = (try(var.network_config.psc_config, null) != null ? [""] : [])
    content {
      allowed_consumer_projects = local.allowed_consumer_projects
+
+      dynamic "psc_interface_configs" {
+        for_each = (try(var.network_config.psc_config.psc_interface_configs, null) != null ? [""] : [])
+        content {
+          network_attachment_resource = try(var.network_config.psc_config.psc_interface_configs.network_attachment_resource, null)
+        }
+      }
+
+      dynamic "psc_auto_connections" {
+        for_each = try(var.network_config.psc_config.psc_auto_connections, null) == null ? [] : var.network_config.psc_config.psc_auto_connections
+        content {
+          consumer_network = psc_auto_connections.value.consumer_network
+          consumer_project = psc_auto_connections.value.consumer_project
+        }
+      }
    }
  }

@@ -375,7 +390,7 @@ resource "google_alloydb_cluster" "secondary" {

  # psc_config block should exist only when PSC is enabled to prevent Terraform state drift
  dynamic "psc_config" {
-    for_each = length(local.allowed_consumer_projects) > 0 ? [""] : []
+    for_each = (try(var.network_config.psc_config, null) != null ? [""] : [])
    content {
      psc_enabled = true
    }
@@ -446,9 +461,24 @@ resource "google_alloydb_instance" "secondary" {

  # psc_instance_config block should exist only when there are PSC allowed consumer projects to prevent Terraform state drift
  dynamic "psc_instance_config" {
-    for_each = length(local.allowed_consumer_projects) > 0 ? [""] : []
+    for_each = (try(var.network_config.psc_config, null) != null ? [""] : [])
    content {
      allowed_consumer_projects = local.allowed_consumer_projects
+
+      dynamic "psc_interface_configs" {
+        for_each = (try(var.network_config.psc_config.psc_interface_configs, null) != null ? [""] : [])
+        content {
+          network_attachment_resource = try(var.network_config.psc_config.psc_interface_configs.network_attachment_resource, null)
+        }
+      }
+
+      dynamic "psc_auto_connections" {
+        for_each = try(var.network_config.psc_config.psc_auto_connections, null) == null ? [] : var.network_config.psc_config.psc_auto_connections
+        content {
+          consumer_network = psc_auto_connections.value.consumer_network
+          consumer_project = psc_auto_connections.value.consumer_project
+        }
+      }
    }
  }

@@ -517,9 +547,24 @@ resource "google_alloydb_instance" "read_pool_primary" {

  # psc_instance_config block should exist only when there are PSC allowed consumer projects to prevent Terraform state drift
  dynamic "psc_instance_config" {
-    for_each = length(local.allowed_consumer_projects) > 0 ? [""] : []
+    for_each = (try(var.network_config.psc_config, null) != null ? [""] : [])
    content {
      allowed_consumer_projects = local.allowed_consumer_projects
+
+      dynamic "psc_interface_configs" {
+        for_each = (try(var.network_config.psc_config.psc_interface_configs, null) != null ? [""] : [])
+        content {
+          network_attachment_resource = try(var.network_config.psc_config.psc_interface_configs.network_attachment_resource, null)
+        }
+      }
+
+      dynamic "psc_auto_connections" {
+        for_each = try(var.network_config.psc_config.psc_auto_connections, null) == null ? [] : var.network_config.psc_config.psc_auto_connections
+        content {
+          consumer_network = psc_auto_connections.value.consumer_network
+          consumer_project = psc_auto_connections.value.consumer_project
+        }
+      }
    }
  }

@@ -599,9 +644,24 @@ resource "google_alloydb_instance" "read_pool_secondary" {

  # psc_instance_config block should exist only when there are PSC allowed consumer projects to prevent Terraform state drift
  dynamic "psc_instance_config" {
-    for_each = length(local.allowed_consumer_projects) > 0 ? [""] : []
+    for_each = (try(var.network_config.psc_config, null) != null ? [""] : [])
    content {
      allowed_consumer_projects = local.allowed_consumer_projects
+
+      dynamic "psc_interface_configs" {
+        for_each = (try(var.network_config.psc_config.psc_interface_configs, null) != null ? [""] : [])
+        content {
+          network_attachment_resource = try(var.network_config.psc_config.psc_interface_configs.network_attachment_resource, null)
+        }
+      }
+
+      dynamic "psc_auto_connections" {
+        for_each = try(var.network_config.psc_config.psc_auto_connections, null) == null ? [] : var.network_config.psc_config.psc_auto_connections
+        content {
+          consumer_network = psc_auto_connections.value.consumer_network
+          consumer_project = psc_auto_connections.value.consumer_project
+        }
+      }
    }
  }

--- a/modules/alloydb/variables.tf
+++ b/modules/alloydb/variables.tf
@@ -277,6 +277,11 @@ variable "network_config" {
    }))
    psc_config = optional(object({
      allowed_consumer_projects = list(string)
+      network_attachment_uri    = optional(string)
+      psc_auto_connections = optional(list(object({
+        consumer_project = optional(string)
+        consumer_network = optional(string)
+      })))
    }))
  })
  nullable = false
--- a/tests/modules/alloydb/examples/psc_auto.yaml
+++ b/tests/modules/alloydb/examples/psc_auto.yaml
@@ -0,0 +1,83 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  module.alloydb.google_alloydb_cluster.primary:
+    annotations: null
+    cluster_id: db
+    cluster_type: PRIMARY
+    continuous_backup_config:
+    - enabled: true
+      encryption_config: []
+      recovery_window_days: 14
+    database_version: POSTGRES_15
+    display_name: db
+    effective_labels:
+      goog-terraform-provisioned: 'true'
+    encryption_config: []
+    etag: null
+    initial_user: []
+    labels: null
+    location: europe-west8
+    maintenance_update_policy: []
+    project: project-id
+    psc_config:
+    - psc_enabled: true
+    restore_backup_source: []
+    restore_backupdr_backup_source: []
+    restore_backupdr_pitr_source: []
+    restore_continuous_backup_source: []
+    secondary_config: []
+    skip_await_major_version_upgrade: true
+    subscription_type: STANDARD
+    terraform_labels:
+      goog-terraform-provisioned: 'true'
+    timeouts: null
+  module.alloydb.google_alloydb_instance.primary:
+    annotations: null
+    availability_type: REGIONAL
+    connection_pool_config: []
+    display_name: db
+    effective_labels:
+      goog-terraform-provisioned: 'true'
+    gce_zone: null
+    instance_id: db
+    instance_type: PRIMARY
+    labels: null
+    machine_config:
+    - cpu_count: 2
+    psc_instance_config:
+    - allowed_consumer_projects:
+      - '123'
+      psc_auto_connections:
+      - consumer_network: projects/xxx/global/networks/aaa
+        consumer_project: project-id
+      psc_interface_configs: []
+    query_insights_config:
+    - query_plans_per_minute: 5
+      query_string_length: 1024
+      record_application_tags: true
+      record_client_address: true
+    read_pool_config: []
+    terraform_labels:
+      goog-terraform-provisioned: 'true'
+    timeouts: null
+
+counts:
+  google_alloydb_cluster: 1
+  google_alloydb_instance: 1
+  modules: 1
+  resources: 2
+
+outputs: {}