Terraform Google Cloud SQL Postgres module with K8s secret deploy

Terraform module for provisioning GCP SQL Postgres database. It should also deploy the username and password to K8s
as a secret. That could be used in setting up cloudsql proxy pod.

Usage

module "postgresql" {
  source  = "AckeeCZ/postgresql/sql"

  project = "${var.project}"
  region = "${var.region}"
  zone = "${var.zone}"
  namespace = "${var.namespace}"
  cluster_ca_certificate = "${module.gke.cluster_ca_certificate}"
  cluster_user = "${module.gke.cluster_username}"
  cluster_pass = "${module.gke.cluster_password}"
  cluster_endpoint = "${module.gke.endpoint}"
  environment = "production"
  instance_tier = "db-n1-standard-1" # optional, default is db-n1-standard-1
  availability_type = "REGIONAL" # REGIONAL for HA setup, ZONAL for single zone
  vault_secret_path = "secret/devops/generated/${TYPE}/${var.project}/${var.environment}" # ${TYPE} should be set to internal for internal projects, external for external projects
  read_replicas = {
    replica-a : {
      instance_tier = "db-custom-1-3840"
      ipv4_enabled  = false
      zone          = "europe-west3-a"
    },
    replica-b : {
      instance_tier = "db-custom-1-3840"
      ipv4_enabled  = false
      zone          = "europe-west3-b"
    },
  }
}

Read replicas

Read replicas are configured from read_replicas parameter map. Key serve as replica name, it is appended to primary's instance_name local variable.

Every read replica have four parameters:

• instance_tier: Instance type for replica, equivalent of primary's instance_tier parameter.
• ipv4_enabled: Availability of public IP address on replica, equivalent of primary's ipv4_enabled parameter.
• zone: Zone where read replicas is deployed. This is bit different from primary's zone parameter. On primary instance, we define "prefered location"
• authorized_networks: List of maps of strings authorized networks allowed to connect to Cloud SQL Read Replica Instance, example: [{name: the_office, cidr: 1.2.3.4/31}] This parameter is optional.

• HA instance will change it's location in case of failover, but read replicas have zone "hard set".

Before you do anything in this module

Install pre-commit hooks by running following commands:

brew install pre-commit terraform-docs
pre-commit install

Dependencies

GKE module: https://gitlab.ack.ee/Infra/terraform-gke-vpc

Example SQL proxy specification

proxy.yaml in infrastuktura-template repo

Requirements

Providers

Modules

No modules.

Resources

Inputs

Outputs