844ef0b44f
* Add optinal secondary read pool support to the alloydb module * Fix formatting --------- Co-authored-by: Julio Castillo <jccb@google.com>
432 lines
22 KiB
Markdown
432 lines
22 KiB
Markdown
# AlloyDB module
|
|
|
|
This module manages the creation of an AlloyDB cluster. It also supports cross-region replication scenario by setting up a secondary cluster.
|
|
It can also create an initial set of users via the `users` variable.
|
|
|
|
Note that this module assumes that some options are the same for both the primary instance and the secondary one in case of cross regional replication configuration.
|
|
|
|
> [!WARNING]
|
|
> If you use the `users` field, you terraform state will contain each user's password in plain text.
|
|
|
|
<!-- TOC -->
|
|
* [AlloyDB module](#alloydb-module)
|
|
* [Examples](#examples)
|
|
* [Simple example](#simple-example)
|
|
* [Read pool](#read-pool)
|
|
* [Cross region replication](#cross-region-replication)
|
|
* [PSC instance](#psc-instance)
|
|
* [Custom flags and users definition](#custom-flags-and-users-definition)
|
|
* [CMEK encryption](#cmek-encryption)
|
|
* [Variables](#variables)
|
|
* [Outputs](#outputs)
|
|
* [Fixtures](#fixtures)
|
|
<!-- TOC -->
|
|
|
|
## Examples
|
|
|
|
### Simple example
|
|
|
|
This example shows how to setup a project, VPC and AlloyDB cluster and instance.
|
|
|
|
```hcl
|
|
module "project" {
|
|
source = "./fabric/modules/project"
|
|
billing_account = var.billing_account_id
|
|
parent = var.folder_id
|
|
name = "alloydb"
|
|
prefix = var.prefix
|
|
services = [
|
|
"servicenetworking.googleapis.com",
|
|
"alloydb.googleapis.com",
|
|
]
|
|
}
|
|
|
|
module "vpc" {
|
|
source = "./fabric/modules/net-vpc"
|
|
project_id = module.project.project_id
|
|
name = "my-network"
|
|
# need only one - psa_config or subnets_psc
|
|
psa_configs = [{
|
|
ranges = { alloydb = "10.60.0.0/16" }
|
|
}]
|
|
subnets_psc = [{
|
|
ip_cidr_range = "10.0.3.0/24"
|
|
name = "psc"
|
|
region = var.region
|
|
}]
|
|
}
|
|
|
|
module "alloydb" {
|
|
source = "./fabric/modules/alloydb"
|
|
project_id = module.project.project_id
|
|
project_number = var.project_number
|
|
cluster_name = "db"
|
|
instance_name = "db"
|
|
location = var.region
|
|
initial_user = {
|
|
password = "changeit"
|
|
}
|
|
network_config = {
|
|
psa_config = {
|
|
network = module.vpc.id
|
|
}
|
|
}
|
|
deletion_protection = false
|
|
}
|
|
# tftest modules=3 resources=17 inventory=simple.yaml e2e
|
|
```
|
|
|
|
### Read pool
|
|
|
|
One node read pool instance is always zonal, two or more nodes make the instance always regional. By default a read pool instance has one node.
|
|
|
|
```hcl
|
|
module "alloydb" {
|
|
source = "./fabric/modules/alloydb"
|
|
project_id = var.project_id
|
|
project_number = var.project_number
|
|
cluster_name = "db"
|
|
location = var.region
|
|
instance_name = "db"
|
|
initial_user = {
|
|
password = "changeit"
|
|
}
|
|
network_config = {
|
|
psa_config = {
|
|
network = var.vpc.id
|
|
}
|
|
}
|
|
read_pool = {
|
|
"zonal-read-pool" = {}
|
|
"regional-read-pool" = {
|
|
node_count = 2
|
|
}
|
|
}
|
|
|
|
deletion_protection = false
|
|
}
|
|
# tftest modules=1 resources=4 inventory=read_pool.yaml e2e
|
|
```
|
|
|
|
### Cross region replication
|
|
|
|
```hcl
|
|
module "alloydb" {
|
|
source = "./fabric/modules/alloydb"
|
|
project_id = var.project_id
|
|
project_number = var.project_number
|
|
cluster_name = "db"
|
|
location = var.region
|
|
instance_name = "db"
|
|
initial_user = {
|
|
password = "changeit"
|
|
}
|
|
network_config = {
|
|
psa_config = {
|
|
network = var.vpc.id
|
|
}
|
|
}
|
|
cross_region_replication = {
|
|
enabled = true
|
|
region = "europe-west12"
|
|
}
|
|
|
|
deletion_protection = false
|
|
}
|
|
# tftest modules=1 resources=4 inventory=cross_region_replication.yaml e2e
|
|
```
|
|
|
|
In a cross-region replication scenario (like in the previous example) this module also supports
|
|
|
|
* [promoting the secondary instance](https://cloud.google.com/alloydb/docs/cross-region-replication/work-with-cross-region-replication#promote-secondary-cluster) to become a primary instance via the `var.cross_region_replication.promote_secondary` flag.
|
|
|
|
* aligning an existing cluster after switchover via the `var.cross_region_replication.switchover_mode` flag.
|
|
|
|
### Cross region replication with primary and secondary cluster read pool
|
|
|
|
```hcl
|
|
module "alloydb" {
|
|
source = "./fabric/modules/alloydb"
|
|
project_id = var.project_id
|
|
project_number = var.project_number
|
|
cluster_name = "db"
|
|
location = var.region
|
|
instance_name = "db"
|
|
initial_user = {
|
|
password = "changeit"
|
|
}
|
|
network_config = {
|
|
psa_config = {
|
|
network = var.vpc.id
|
|
}
|
|
}
|
|
read_pool = {
|
|
"primary-read-pool" = {
|
|
node_count = 1
|
|
}
|
|
}
|
|
cross_region_replication = {
|
|
enabled = true
|
|
region = "europe-west12"
|
|
read_pool = {
|
|
"secondary-read-pool" = {
|
|
node_count = 1
|
|
}
|
|
}
|
|
}
|
|
|
|
deletion_protection = false
|
|
}
|
|
# tftest inventory=cross_region_read_pools.yaml e2e
|
|
```
|
|
|
|
|
|
### PSC instance
|
|
|
|
```hcl
|
|
module "alloydb" {
|
|
source = "./fabric/modules/alloydb"
|
|
project_id = var.project_id
|
|
project_number = var.project_number
|
|
cluster_name = "db"
|
|
location = var.region
|
|
instance_name = "db"
|
|
initial_user = {
|
|
password = "changeit"
|
|
}
|
|
network_config = {
|
|
psc_config = { allowed_consumer_projects = [var.project_number] }
|
|
}
|
|
|
|
deletion_protection = false
|
|
}
|
|
# tftest modules=1 resources=2 inventory=psc.yaml e2e
|
|
```
|
|
|
|
### Custom flags and users definition
|
|
|
|
```hcl
|
|
module "alloydb" {
|
|
source = "./fabric/modules/alloydb"
|
|
project_id = var.project_id
|
|
project_number = var.project_number
|
|
cluster_name = "primary"
|
|
location = var.region
|
|
instance_name = "primary"
|
|
flags = {
|
|
"alloydb.enable_pgaudit" = "on"
|
|
"alloydb.iam_authentication" = "on"
|
|
idle_in_transaction_session_timeout = "900000"
|
|
timezone = "'UTC'"
|
|
}
|
|
initial_user = {
|
|
password = "changeit"
|
|
}
|
|
network_config = {
|
|
psa_config = {
|
|
network = var.vpc.id
|
|
}
|
|
}
|
|
users = {
|
|
# generate a password for user1
|
|
user1 = {
|
|
password = null
|
|
}
|
|
# assign a password to user2
|
|
user2 = {
|
|
password = "mypassword"
|
|
}
|
|
}
|
|
|
|
deletion_protection = false
|
|
}
|
|
# tftest modules=1 resources=5 inventory=custom.yaml e2e
|
|
```
|
|
|
|
### CMEK encryption
|
|
|
|
```hcl
|
|
module "project" {
|
|
source = "./fabric/modules/project"
|
|
name = "alloycmek"
|
|
billing_account = var.billing_account_id
|
|
prefix = var.prefix
|
|
parent = var.folder_id
|
|
services = [
|
|
"alloydb.googleapis.com",
|
|
"cloudkms.googleapis.com",
|
|
"servicenetworking.googleapis.com"
|
|
]
|
|
}
|
|
|
|
module "kms" {
|
|
source = "./fabric/modules/kms"
|
|
project_id = module.project.project_id
|
|
keyring = {
|
|
location = var.region
|
|
name = "${var.prefix}-keyring"
|
|
}
|
|
keys = {
|
|
"key-regional" = {
|
|
}
|
|
}
|
|
iam = {
|
|
"roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
|
|
module.project.service_agents.alloydb.iam_email
|
|
]
|
|
}
|
|
}
|
|
|
|
module "vpc" {
|
|
source = "./fabric/modules/net-vpc"
|
|
project_id = module.project.project_id
|
|
name = "my-network"
|
|
subnets = [
|
|
{
|
|
ip_cidr_range = "10.0.0.0/24"
|
|
name = "production"
|
|
region = var.region
|
|
},
|
|
]
|
|
psa_configs = [{
|
|
ranges = { myrange = "10.0.1.0/24" }
|
|
}]
|
|
}
|
|
|
|
|
|
module "alloydb" {
|
|
source = "./fabric/modules/alloydb"
|
|
project_id = module.project.project_id
|
|
project_number = var.project_number
|
|
cluster_name = "primary"
|
|
location = var.region
|
|
instance_name = "primary"
|
|
initial_user = {
|
|
password = "changeit"
|
|
}
|
|
network_config = {
|
|
psa_config = {
|
|
network = module.vpc.id
|
|
}
|
|
}
|
|
encryption_config = {
|
|
primary_kms_key_name = module.kms.keys.key-regional.id
|
|
}
|
|
|
|
deletion_protection = false
|
|
}
|
|
|
|
# tftest inventory=cmek.yaml e2e
|
|
```
|
|
|
|
## Tag bindings
|
|
|
|
Refer to the [Creating and managing tags](https://cloud.google.com/resource-manager/docs/tags/tags-creating-and-managing) documentation for details on usage.
|
|
|
|
```hcl
|
|
module "org" {
|
|
source = "./fabric/modules/organization"
|
|
organization_id = var.organization_id
|
|
tags = {
|
|
environment = {
|
|
description = "Environment specification."
|
|
values = {
|
|
dev = {}
|
|
prod = {}
|
|
sandbox = {}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
module "alloydb" {
|
|
source = "./fabric/modules/alloydb"
|
|
project_id = var.project_id
|
|
project_number = var.project_number
|
|
cluster_name = "primary"
|
|
location = var.region
|
|
instance_name = "primary"
|
|
initial_user = {
|
|
password = "changeit"
|
|
}
|
|
network_config = {
|
|
psa_config = {
|
|
network = var.vpc.id
|
|
}
|
|
}
|
|
tag_bindings = {
|
|
env-sandbox = module.org.tag_values["environment/sandbox"].id
|
|
}
|
|
deletion_protection = false
|
|
}
|
|
# tftest modules=2 resources=7
|
|
```
|
|
<!-- BEGIN TFDOC -->
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [cluster_name](variables.tf#L81) | Name of the primary cluster. | <code>string</code> | ✓ | |
|
|
| [initial_user](variables.tf#L199) | AlloyDB cluster initial user credentials. | <code title="object({ user = optional(string, "postgres") password = string })">object({…})</code> | ✓ | |
|
|
| [instance_name](variables.tf#L207) | Name of primary instance. | <code>string</code> | ✓ | |
|
|
| [location](variables.tf#L219) | Region or zone of the cluster and instance. | <code>string</code> | ✓ | |
|
|
| [network_config](variables.tf#L264) | Network configuration for cluster and instance. Only one between psa_config and psc_config can be used. | <code title="object({ psa_config = optional(object({ network = string allocated_ip_range = optional(string) authorized_external_networks = optional(list(string), []) enable_public_ip = optional(bool, false) enable_outbound_public_ip = optional(bool, false) })) psc_config = optional(object({ allowed_consumer_projects = list(string) })) })">object({…})</code> | ✓ | |
|
|
| [project_id](variables.tf#L299) | The ID of the project where this instances will be created. | <code>string</code> | ✓ | |
|
|
| [annotations](variables.tf#L17) | Map FLAG_NAME=>VALUE for annotations which allow client tools to store small amount of arbitrary data. | <code>map(string)</code> | | <code>null</code> |
|
|
| [automated_backup_configuration](variables.tf#L23) | Automated backup settings for cluster. | <code title="object({ enabled = optional(bool, false) backup_window = optional(string, "1800s") location = optional(string) weekly_schedule = optional(object({ days_of_week = optional(list(string), [ "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY" ]) start_times = optional(object({ hours = optional(number, 23) }), {}) }), {}) retention_count = optional(number, 7) retention_period = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
| [availability_type](variables.tf#L58) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> | | <code>"REGIONAL"</code> |
|
|
| [client_connection_config](variables.tf#L64) | Client connection config. | <code title="object({ require_connectors = optional(bool, false) ssl_config = optional(object({ ssl_mode = string })) })">object({…})</code> | | <code>null</code> |
|
|
| [cluster_display_name](variables.tf#L75) | Display name of the primary cluster. | <code>string</code> | | <code>null</code> |
|
|
| [continuous_backup_configuration](variables.tf#L87) | Continuous backup settings for cluster. | <code title="object({ enabled = optional(bool, true) recovery_window_days = optional(number, 14) })">object({…})</code> | | <code>{}</code> |
|
|
| [cross_region_replication](variables.tf#L97) | Cross region replication config. | <code title="object({ enabled = optional(bool, false) promote_secondary = optional(bool, false) switchover_mode = optional(bool, false) region = optional(string) secondary_cluster_display_name = optional(string) secondary_cluster_name = optional(string) secondary_instance_display_name = optional(string) secondary_instance_name = optional(string) secondary_machine_config = optional(object({ cpu_count = number machine_type = optional(string) })) read_pool = optional(map(object({ display_name = optional(string) node_count = optional(number, 1) flags = optional(map(string)) client_connection_config = optional(object({ require_connectors = optional(bool, false) ssl_config = optional(object({ ssl_mode = string })) })) machine_config = optional(object({ cpu_count = optional(number, 2) machine_type = optional(string) }), {}) network_config = optional(object({ authorized_external_networks = optional(list(string), []) enable_public_ip = optional(bool, false) }), {}) query_insights_config = optional(object({ query_string_length = optional(number, 1024) record_application_tags = optional(bool, true) record_client_address = optional(bool, true) query_plans_per_minute = optional(number, 5) })) })), {}) })">object({…})</code> | | <code>{}</code> |
|
|
| [database_version](variables.tf#L154) | Database type and version to create. | <code>string</code> | | <code>"POSTGRES_15"</code> |
|
|
| [deletion_policy](variables.tf#L160) | AlloyDB cluster and instance deletion policy. | <code>string</code> | | <code>null</code> |
|
|
| [deletion_protection](variables.tf#L166) | Whether Terraform will be prevented from destroying the cluster. When the field is set to true or unset in Terraform state, a terraform apply or terraform destroy that would delete the cluster will fail. When the field is set to false, deleting the cluster is allowed. | <code>bool</code> | | <code>null</code> |
|
|
| [display_name](variables.tf#L172) | AlloyDB instance display name. | <code>string</code> | | <code>null</code> |
|
|
| [encryption_config](variables.tf#L178) | Set encryption configuration. KMS name format: 'projects/[PROJECT]/locations/[REGION]/keyRings/[RING]/cryptoKeys/[KEY_NAME]'. | <code title="object({ primary_kms_key_name = string secondary_kms_key_name = optional(string) })">object({…})</code> | | <code>null</code> |
|
|
| [flags](variables.tf#L187) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map(string)</code> | | <code>null</code> |
|
|
| [gce_zone](variables.tf#L193) | The GCE zone that the instance should serve from. This can ONLY be specified for ZONAL instances. If present for a REGIONAL instance, an error will be thrown. | <code>string</code> | | <code>null</code> |
|
|
| [labels](variables.tf#L213) | Labels to be attached to all instances. | <code>map(string)</code> | | <code>null</code> |
|
|
| [machine_config](variables.tf#L225) | AlloyDB machine config. | <code title="object({ cpu_count = optional(number, 2) machine_type = optional(string) })">object({…})</code> | | <code>{}</code> |
|
|
| [maintenance_config](variables.tf#L239) | Set maintenance window configuration. | <code title="object({ enabled = optional(bool, false) day = optional(string, "SUNDAY") start_time = optional(object({ hours = optional(number, 23) }), {}) })">object({…})</code> | | <code>{}</code> |
|
|
| [prefix](variables.tf#L289) | Optional prefix used to generate instance names. | <code>string</code> | | <code>null</code> |
|
|
| [project_number](variables.tf#L304) | The project number of the project where this instances will be created. Only used for testing purposes. | <code>string</code> | | <code>null</code> |
|
|
| [query_insights_config](variables.tf#L310) | Query insights config. | <code title="object({ query_string_length = optional(number, 1024) record_application_tags = optional(bool, true) record_client_address = optional(bool, true) query_plans_per_minute = optional(number, 5) })">object({…})</code> | | <code>{}</code> |
|
|
| [read_pool](variables.tf#L321) | Map of read pool instances to create in the primary cluster. | <code title="map(object({ display_name = optional(string) node_count = optional(number, 1) flags = optional(map(string)) client_connection_config = optional(object({ require_connectors = optional(bool, false) ssl_config = optional(object({ ssl_mode = string })) })) machine_config = optional(object({ cpu_count = optional(number, 2) machine_type = optional(string) }), {}) network_config = optional(object({ authorized_external_networks = optional(list(string), []) enable_public_ip = optional(bool, false) }), {}) query_insights_config = optional(object({ query_string_length = optional(number, 1024) record_application_tags = optional(bool, true) record_client_address = optional(bool, true) query_plans_per_minute = optional(number, 5) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
|
| [skip_await_major_version_upgrade](variables.tf#L366) | Set to true to skip awaiting on the major version upgrade of the cluster. | <code>bool</code> | | <code>true</code> |
|
|
| [subscription_type](variables.tf#L372) | The subscription type of cluster. Possible values are: 'STANDARD' or 'TRIAL'. | <code>string</code> | | <code>"STANDARD"</code> |
|
|
| [tag_bindings](variables.tf#L378) | Tag bindings for this service, in key => tag value id format. | <code>map(string)</code> | | <code>{}</code> |
|
|
| [users](variables.tf#L385) | Map of users to create in the primary instance (and replicated to other replicas). Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'ALLOYDB_BUILT_IN' or 'ALLOYDB_IAM_USER'. | <code title="map(object({ password = optional(string) roles = optional(list(string), ["alloydbsuperuser"]) type = optional(string, "ALLOYDB_BUILT_IN") }))">map(object({…}))</code> | | <code>{}</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [cluster_id](outputs.tf#L24) | Fully qualified primary cluster id. | |
|
|
| [cluster_name](outputs.tf#L29) | Name of the primary cluster. | |
|
|
| [id](outputs.tf#L34) | Fully qualified primary instance id. | |
|
|
| [ids](outputs.tf#L39) | Fully qualified ids of all instances. | |
|
|
| [instances](outputs.tf#L47) | AlloyDB instance resources. | ✓ |
|
|
| [ip](outputs.tf#L53) | IP address of the primary instance. | |
|
|
| [ips](outputs.tf#L58) | IP addresses of all instances. | |
|
|
| [name](outputs.tf#L65) | Name of the primary instance. | |
|
|
| [names](outputs.tf#L70) | Names of all instances. | |
|
|
| [outbound_public_ips](outputs.tf#L78) | Public IP addresses of the primary instance. | |
|
|
| [psc_dns_name](outputs.tf#L83) | AlloyDB Primary instance PSC DNS name. | |
|
|
| [psc_dns_names](outputs.tf#L88) | AlloyDB instances PSC DNS names. | |
|
|
| [public_ip](outputs.tf#L95) | Public IP address of the primary instance. | |
|
|
| [read_pool_ids](outputs.tf#L100) | Fully qualified ids of all primary read poll instances. | |
|
|
| [read_pool_ips](outputs.tf#L108) | IP addresses of all primary read poll instances. | |
|
|
| [secondary_cluster_id](outputs.tf#L116) | Fully qualified secondary cluster id. | |
|
|
| [secondary_cluster_name](outputs.tf#L121) | Name of the secondary cluster. | |
|
|
| [secondary_id](outputs.tf#L126) | Fully qualified secondary instance id. | |
|
|
| [secondary_ip](outputs.tf#L131) | IP address of the secondary instance. | |
|
|
| [secondary_outbound_public_ips](outputs.tf#L136) | Public IP addresses of the primary instance. | |
|
|
| [secondary_public_ip](outputs.tf#L141) | Public IP address of the secondary instance. | |
|
|
| [secondary_read_pool_ids](outputs.tf#L146) | Fully qualified ids of all secondary read poll instances. | |
|
|
| [secondary_read_pool_ips](outputs.tf#L154) | IP addresses of all secondary read poll instances. | |
|
|
| [service_attachment](outputs.tf#L162) | AlloyDB Primary instance service attachment. | |
|
|
| [service_attachments](outputs.tf#L167) | AlloyDB instances service attachment. | |
|
|
| [user_passwords](outputs.tf#L174) | Map of containing the password of all users created through terraform. | ✓ |
|
|
<!-- END TFDOC -->
|