diff --git a/modules/alloydb/README.md b/modules/alloydb/README.md index caeb1d15e..69e34ce73 100644 --- a/modules/alloydb/README.md +++ b/modules/alloydb/README.md @@ -16,6 +16,7 @@ Note that this module assumes that some options are the same for both the primar - [Cross region replication](#cross-region-replication) - [Cross region replication with primary and secondary cluster read pool](#cross-region-replication-with-primary-and-secondary-cluster-read-pool) - [PSC instance](#psc-instance) + - [PSC instance with auto connections](#psc-instance-with-auto-connections) - [Custom flags and users definition](#custom-flags-and-users-definition) - [CMEK encryption](#cmek-encryption) - [Tag bindings](#tag-bindings) @@ -270,6 +271,31 @@ module "alloydb" { # tftest modules=1 resources=2 inventory=psc.yaml e2e ``` +### PSC instance with auto connections + +```hcl +module "alloydb" { + source = "./fabric/modules/alloydb" + project_id = var.project_id + project_number = var.project_number + cluster_name = "db" + location = var.region + instance_name = "db" + network_config = { + psc_config = { + allowed_consumer_projects = [var.project_number] + psc_auto_connections = [{ + consumer_project = var.project_id + consumer_network = var.vpc.id + }] + } + } + + deletion_protection = false +} +# tftest modules=1 resources=2 inventory=psc_auto.yaml e2e +``` + ### Custom flags and users definition ```hcl @@ -428,7 +454,7 @@ module "alloydb" { | [instance_name](variables.tf#L211) | Name of primary instance. | string | ✓ | | | [location](variables.tf#L223) | Region or zone of the cluster and instance. | string | ✓ | | | [network_config](variables.tf#L268) | Network configuration for cluster and instance. Only one between psa_config and psc_config can be used. | object({…}) | ✓ | | -| [project_id](variables.tf#L319) | The ID of the project where this instances will be created. | string | ✓ | | +| [project_id](variables.tf#L324) | The ID of the project where this instances will be created. | string | ✓ | | | [annotations](variables.tf#L17) | Map FLAG_NAME=>VALUE for annotations which allow client tools to store small amount of arbitrary data. | map(string) | | null | | [automated_backup_configuration](variables.tf#L23) | Automated backup settings for cluster. | object({…}) | | {} | | [availability_type](variables.tf#L61) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | string | | "REGIONAL" | @@ -447,15 +473,15 @@ module "alloydb" { | [labels](variables.tf#L217) | Labels to be attached to all instances. | map(string) | | null | | [machine_config](variables.tf#L229) | AlloyDB machine config. | object({…}) | | {} | | [maintenance_config](variables.tf#L243) | Set maintenance window configuration. | object({…}) | | {} | -| [observability_config](variables.tf#L293) | Advanced query insights config for AlloyDB. Mutually exclusive with query_insights_config. | object({…}) | | null | -| [prefix](variables.tf#L309) | Optional prefix used to generate instance names. | string | | null | -| [project_number](variables.tf#L324) | The project number of the project where this instances will be created. Only used for testing purposes. | string | | null | -| [query_insights_config](variables.tf#L330) | Query insights config. Mutually exclusive with observability_config. It will be ignored if observability_config is enabled. | object({…}) | | {} | -| [read_pool](variables.tf#L341) | Map of read pool instances to create in the primary cluster. | map(object({…})) | | {} | -| [skip_await_major_version_upgrade](variables.tf#L397) | Set to true to skip awaiting on the major version upgrade of the cluster. | bool | | true | -| [subscription_type](variables.tf#L403) | The subscription type of cluster. Possible values are: 'STANDARD' or 'TRIAL'. | string | | "STANDARD" | -| [tag_bindings](variables.tf#L409) | Tag bindings for this service, in key => tag value id format. | map(string) | | {} | -| [users](variables.tf#L416) | Map of users to create in the primary instance (and replicated to other replicas). Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'ALLOYDB_BUILT_IN' or 'ALLOYDB_IAM_USER'. | map(object({…})) | | {} | +| [observability_config](variables.tf#L298) | Advanced query insights config for AlloyDB. Mutually exclusive with query_insights_config. | object({…}) | | null | +| [prefix](variables.tf#L314) | Optional prefix used to generate instance names. | string | | null | +| [project_number](variables.tf#L329) | The project number of the project where this instances will be created. Only used for testing purposes. | string | | null | +| [query_insights_config](variables.tf#L335) | Query insights config. Mutually exclusive with observability_config. It will be ignored if observability_config is enabled. | object({…}) | | {} | +| [read_pool](variables.tf#L346) | Map of read pool instances to create in the primary cluster. | map(object({…})) | | {} | +| [skip_await_major_version_upgrade](variables.tf#L402) | Set to true to skip awaiting on the major version upgrade of the cluster. | bool | | true | +| [subscription_type](variables.tf#L408) | The subscription type of cluster. Possible values are: 'STANDARD' or 'TRIAL'. | string | | "STANDARD" | +| [tag_bindings](variables.tf#L414) | Tag bindings for this service, in key => tag value id format. | map(string) | | {} | +| [users](variables.tf#L421) | Map of users to create in the primary instance (and replicated to other replicas). Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'ALLOYDB_BUILT_IN' or 'ALLOYDB_IAM_USER'. | map(object({…})) | | {} | ## Outputs diff --git a/modules/alloydb/main.tf b/modules/alloydb/main.tf index 90e7cf89e..7110897b3 100644 --- a/modules/alloydb/main.tf +++ b/modules/alloydb/main.tf @@ -172,7 +172,7 @@ resource "google_alloydb_cluster" "primary" { # psc_config block should exist only when PSC is enabled to prevent Terraform state drift dynamic "psc_config" { - for_each = length(local.allowed_consumer_projects) > 0 ? [""] : [] + for_each = (try(var.network_config.psc_config, null) != null ? [""] : []) content { psc_enabled = true } @@ -240,9 +240,24 @@ resource "google_alloydb_instance" "primary" { # psc_instance_config block should exist only when there are PSC allowed consumer projects to prevent Terraform state drift dynamic "psc_instance_config" { - for_each = length(local.allowed_consumer_projects) > 0 ? [""] : [] + for_each = (try(var.network_config.psc_config, null) != null ? [""] : []) content { allowed_consumer_projects = local.allowed_consumer_projects + + dynamic "psc_interface_configs" { + for_each = (try(var.network_config.psc_config.psc_interface_configs, null) != null ? [""] : []) + content { + network_attachment_resource = try(var.network_config.psc_config.psc_interface_configs.network_attachment_resource, null) + } + } + + dynamic "psc_auto_connections" { + for_each = try(var.network_config.psc_config.psc_auto_connections, null) == null ? [] : var.network_config.psc_config.psc_auto_connections + content { + consumer_network = psc_auto_connections.value.consumer_network + consumer_project = psc_auto_connections.value.consumer_project + } + } } } @@ -375,7 +390,7 @@ resource "google_alloydb_cluster" "secondary" { # psc_config block should exist only when PSC is enabled to prevent Terraform state drift dynamic "psc_config" { - for_each = length(local.allowed_consumer_projects) > 0 ? [""] : [] + for_each = (try(var.network_config.psc_config, null) != null ? [""] : []) content { psc_enabled = true } @@ -446,9 +461,24 @@ resource "google_alloydb_instance" "secondary" { # psc_instance_config block should exist only when there are PSC allowed consumer projects to prevent Terraform state drift dynamic "psc_instance_config" { - for_each = length(local.allowed_consumer_projects) > 0 ? [""] : [] + for_each = (try(var.network_config.psc_config, null) != null ? [""] : []) content { allowed_consumer_projects = local.allowed_consumer_projects + + dynamic "psc_interface_configs" { + for_each = (try(var.network_config.psc_config.psc_interface_configs, null) != null ? [""] : []) + content { + network_attachment_resource = try(var.network_config.psc_config.psc_interface_configs.network_attachment_resource, null) + } + } + + dynamic "psc_auto_connections" { + for_each = try(var.network_config.psc_config.psc_auto_connections, null) == null ? [] : var.network_config.psc_config.psc_auto_connections + content { + consumer_network = psc_auto_connections.value.consumer_network + consumer_project = psc_auto_connections.value.consumer_project + } + } } } @@ -517,9 +547,24 @@ resource "google_alloydb_instance" "read_pool_primary" { # psc_instance_config block should exist only when there are PSC allowed consumer projects to prevent Terraform state drift dynamic "psc_instance_config" { - for_each = length(local.allowed_consumer_projects) > 0 ? [""] : [] + for_each = (try(var.network_config.psc_config, null) != null ? [""] : []) content { allowed_consumer_projects = local.allowed_consumer_projects + + dynamic "psc_interface_configs" { + for_each = (try(var.network_config.psc_config.psc_interface_configs, null) != null ? [""] : []) + content { + network_attachment_resource = try(var.network_config.psc_config.psc_interface_configs.network_attachment_resource, null) + } + } + + dynamic "psc_auto_connections" { + for_each = try(var.network_config.psc_config.psc_auto_connections, null) == null ? [] : var.network_config.psc_config.psc_auto_connections + content { + consumer_network = psc_auto_connections.value.consumer_network + consumer_project = psc_auto_connections.value.consumer_project + } + } } } @@ -599,9 +644,24 @@ resource "google_alloydb_instance" "read_pool_secondary" { # psc_instance_config block should exist only when there are PSC allowed consumer projects to prevent Terraform state drift dynamic "psc_instance_config" { - for_each = length(local.allowed_consumer_projects) > 0 ? [""] : [] + for_each = (try(var.network_config.psc_config, null) != null ? [""] : []) content { allowed_consumer_projects = local.allowed_consumer_projects + + dynamic "psc_interface_configs" { + for_each = (try(var.network_config.psc_config.psc_interface_configs, null) != null ? [""] : []) + content { + network_attachment_resource = try(var.network_config.psc_config.psc_interface_configs.network_attachment_resource, null) + } + } + + dynamic "psc_auto_connections" { + for_each = try(var.network_config.psc_config.psc_auto_connections, null) == null ? [] : var.network_config.psc_config.psc_auto_connections + content { + consumer_network = psc_auto_connections.value.consumer_network + consumer_project = psc_auto_connections.value.consumer_project + } + } } } diff --git a/modules/alloydb/variables.tf b/modules/alloydb/variables.tf index 0e89a33b3..20bee0837 100644 --- a/modules/alloydb/variables.tf +++ b/modules/alloydb/variables.tf @@ -277,6 +277,11 @@ variable "network_config" { })) psc_config = optional(object({ allowed_consumer_projects = list(string) + network_attachment_uri = optional(string) + psc_auto_connections = optional(list(object({ + consumer_project = optional(string) + consumer_network = optional(string) + }))) })) }) nullable = false diff --git a/tests/modules/alloydb/examples/psc_auto.yaml b/tests/modules/alloydb/examples/psc_auto.yaml new file mode 100644 index 000000000..ccf6d2741 --- /dev/null +++ b/tests/modules/alloydb/examples/psc_auto.yaml @@ -0,0 +1,83 @@ +# Copyright 2026 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +values: + module.alloydb.google_alloydb_cluster.primary: + annotations: null + cluster_id: db + cluster_type: PRIMARY + continuous_backup_config: + - enabled: true + encryption_config: [] + recovery_window_days: 14 + database_version: POSTGRES_15 + display_name: db + effective_labels: + goog-terraform-provisioned: 'true' + encryption_config: [] + etag: null + initial_user: [] + labels: null + location: europe-west8 + maintenance_update_policy: [] + project: project-id + psc_config: + - psc_enabled: true + restore_backup_source: [] + restore_backupdr_backup_source: [] + restore_backupdr_pitr_source: [] + restore_continuous_backup_source: [] + secondary_config: [] + skip_await_major_version_upgrade: true + subscription_type: STANDARD + terraform_labels: + goog-terraform-provisioned: 'true' + timeouts: null + module.alloydb.google_alloydb_instance.primary: + annotations: null + availability_type: REGIONAL + connection_pool_config: [] + display_name: db + effective_labels: + goog-terraform-provisioned: 'true' + gce_zone: null + instance_id: db + instance_type: PRIMARY + labels: null + machine_config: + - cpu_count: 2 + psc_instance_config: + - allowed_consumer_projects: + - '123' + psc_auto_connections: + - consumer_network: projects/xxx/global/networks/aaa + consumer_project: project-id + psc_interface_configs: [] + query_insights_config: + - query_plans_per_minute: 5 + query_string_length: 1024 + record_application_tags: true + record_client_address: true + read_pool_config: [] + terraform_labels: + goog-terraform-provisioned: 'true' + timeouts: null + +counts: + google_alloydb_cluster: 1 + google_alloydb_instance: 1 + modules: 1 + resources: 2 + +outputs: {}