metadata.yaml

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: blueprints.cloud.google.com/v1alpha1
kind: BlueprintMetadata
metadata:
  name: terraform-google-sql-db
  annotations:
    config.kubernetes.io/local-config: "true"
spec:
  title: terraform-google-sql for MySQL
  source:
    repo: https://github.com/terraform-google-modules/terraform-google-sql-db
    sourceType: git
  version: 14.1.0
  actuationTool:
    type: Terraform
    version: '>= 1.3'
  description: {}
  examples:
  - name: mssql-public
    location: examples/mssql-public
  - name: mysql-backup-create-service-account
    location: examples/mysql-backup-create-service-account
  - name: mysql-ha
    location: examples/mysql-ha
  - name: mysql-private
    location: examples/mysql-private
  - name: mysql-public
    location: examples/mysql-public
  - name: postgresql-backup-provided-service-account
    location: examples/postgresql-backup-provided-service-account
  - name: postgresql-ha
    location: examples/postgresql-ha
  - name: postgresql-public
    location: examples/postgresql-public
  - name: postgresql-public-iam
    location: examples/postgresql-public-iam
  variables:
  - name: activation_policy
    description: The activation policy for the master instance. Can be either `ALWAYS`, `NEVER` or `ON_DEMAND`.
    type: string
    default: ALWAYS
  - name: additional_databases
    description: A list of databases to be created in your cluster
    type: |-
      list(object({
          name      = string
          charset   = string
          collation = string
        }))
    default: []
  - name: additional_users
    description: A list of users to be created in your cluster. A random password would be set for the user if the `random_password` variable is set.
    type: |-
      list(object({
          name            = string
          password        = string
          random_password = bool
          type            = string
          host            = string
        }))
    default: []
  - name: availability_type
    description: The availability type for the master instance. Can be either `REGIONAL` or `null`.
    type: string
    default: REGIONAL
  - name: backup_configuration
    description: The backup_configuration settings subblock for the database setings
    type: |-
      object({
          binary_log_enabled             = bool
          enabled                        = bool
          start_time                     = string
          location                       = string
          transaction_log_retention_days = string
          retained_backups               = number
          retention_unit                 = string
        })
    default:
      binary_log_enabled: false
      enabled: false
      location: null
      retained_backups: null
      retention_unit: null
      start_time: null
      transaction_log_retention_days: null
  - name: connector_enforcement
    description: Enforce that clients use the connector library
    type: bool
    default: false
  - name: create_timeout
    description: The optional timout that is applied to limit long database creates.
    type: string
    default: 30m
  - name: database_flags
    description: List of Cloud SQL flags that are applied to the database server. See [more details](https://cloud.google.com/sql/docs/mysql/flags)
    type: |-
      list(object({
          name  = string
          value = string
        }))
    default: []
  - name: database_version
    description: The database version to use
    type: string
    required: true
  - name: db_charset
    description: The charset for the default database
    type: string
    default: ""
  - name: db_collation
    description: 'The collation for the default database. Example: ''utf8_general_ci'''
    type: string
    default: ""
  - name: db_name
    description: The name of the default database to create
    type: string
    default: default
  - name: delete_timeout
    description: The optional timout that is applied to limit long database deletes.
    type: string
    default: 30m
  - name: deletion_protection
    description: Used to block Terraform from deleting a SQL Instance.
    type: bool
    default: true
  - name: deletion_protection_enabled
    description: Enables protection of an instance from accidental deletion across all surfaces (API, gcloud, Cloud Console and Terraform).
    type: bool
    default: false
  - name: deny_maintenance_period
    description: The Deny Maintenance Period fields to prevent automatic maintenance from occurring during a 90-day time period. See [more details](https://cloud.google.com/sql/docs/mysql/maintenance)
    type: |-
      list(object({
          end_date   = string
          start_date = string
          time       = string
        }))
    default: []
  - name: disk_autoresize
    description: Configuration to increase storage size
    type: bool
    default: true
  - name: disk_autoresize_limit
    description: The maximum size to which storage can be auto increased.
    type: number
    default: 0
  - name: disk_size
    description: The disk size for the master instance
    type: number
    default: 10
  - name: disk_type
    description: The disk type for the master instance.
    type: string
    default: PD_SSD
  - name: enable_default_db
    description: Enable or disable the creation of the default database
    type: bool
    default: true
  - name: enable_default_user
    description: Enable or disable the creation of the default user
    type: bool
    default: true
  - name: enable_random_password_special
    description: Enable special characters in generated random passwords.
    type: bool
    default: false
  - name: encryption_key_name
    description: The full path to the encryption key used for the CMEK disk encryption
    type: string
  - name: follow_gae_application
    description: A Google App Engine application whose zone to remain in. Must be in the same region as this instance.
    type: string
  - name: insights_config
    description: The insights_config settings for the database.
    type: |-
      object({
          query_plans_per_minute  = number
          query_string_length     = number
          record_application_tags = bool
          record_client_address   = bool
        })
  - name: iam_users
    description: A list of IAM users to be created in your CloudSQL instance
    type: |-
      list(object({
          id    = string
          email = string
        }))
  - name: ip_configuration
    description: The ip_configuration settings subblock
    type: |-
      object({
          authorized_networks                           = list(map(string))
          ipv4_enabled                                  = bool
          private_network                               = string
          require_ssl                                   = bool
          allocated_ip_range                            = string
          enable_private_path_for_google_cloud_services = optional(bool)
        })
    default:
      allocated_ip_range: null
      authorized_networks: []
      enable_private_path_for_google_cloud_services: false
      ipv4_enabled: true
      private_network: null
      require_ssl: null
  - name: maintenance_window_day
    description: The day of week (1-7) for the master instance maintenance.
    type: number
    default: 1
  - name: maintenance_window_hour
    description: The hour of day (0-23) maintenance window for the master instance maintenance.
    type: number
    default: 23
  - name: maintenance_window_update_track
    description: The update track of maintenance window for the master instance maintenance. Can be either `canary` or `stable`.
    type: string
    default: canary
  - name: module_depends_on
    description: List of modules or resources this module depends on.
    type: list(any)
    default: []
  - name: name
    description: The name of the Cloud SQL resources
    type: string
    required: true
  - name: password_validation_policy_config
    description: The password validation policy settings for the database instance.
    type: |-
      object({
          enable_password_policy      = bool
          min_length                  = number
          complexity                  = string
          disallow_username_substring = bool
        })
  - name: pricing_plan
    description: The pricing plan for the master instance.
    type: string
    default: PER_USE
  - name: project_id
    description: The project ID to manage the Cloud SQL resources
    type: string
    required: true
  - name: random_instance_name
    description: Sets random suffix at the end of the Cloud SQL resource name
    type: bool
    default: false
  - name: read_replica_deletion_protection
    description: Used to block Terraform from deleting replica SQL Instances.
    type: bool
    default: false
  - name: read_replica_deletion_protection_enabled
    description: Enables protection of a read replica from accidental deletion across all surfaces (API, gcloud, Cloud Console and Terraform).
    type: bool
    default: false
  - name: read_replica_name_suffix
    description: The optional suffix to add to the read instance name
    type: string
    default: ""
  - name: read_replicas
    description: List of read replicas to create. Encryption key is required for replica in different region. For replica in same region as master set encryption_key_name = null
    type: |-
      list(object({
          name                  = string
          name_override         = optional(string)
          tier                  = string
          zone                  = string
          availability_type     = string
          disk_type             = string
          disk_autoresize       = bool
          disk_autoresize_limit = number
          disk_size             = string
          user_labels           = map(string)
          database_flags = list(object({
            name  = string
            value = string
          }))
          ip_configuration = object({
            authorized_networks = list(map(string))
            ipv4_enabled        = bool
            private_network     = string
            require_ssl         = bool
            allocated_ip_range  = string
          })
          encryption_key_name = string
        }))
    default: []
  - name: region
    description: The region of the Cloud SQL resources
    type: string
    default: us-central1
  - name: replica_database_version
    description: The read replica database version to use. This var should only be used during a database update. The update sequence 1. read-replica 2. master, setting this to an updated version will cause the replica to update, then you may update the master with the var database_version and remove this field after update is complete
    type: string
    default: ""
  - name: root_password
    description: Mysql password for the root user. If not set, a random one will be generated and available in the root_password output variable.
    type: string
    default: ""
  - name: secondary_zone
    description: 'The preferred zone for the secondary/failover instance, it should be something like: `us-central1-a`, `us-east1-c`.'
    type: string
  - name: tier
    description: The tier for the master instance.
    type: string
    default: db-n1-standard-1
  - name: update_timeout
    description: The optional timout that is applied to limit long database updates.
    type: string
    default: 30m
  - name: user_host
    description: The host for the default user
    type: string
    default: '%'
  - name: user_labels
    description: The key/value labels for the master instances.
    type: map(string)
    default: {}
  - name: user_name
    description: The name of the default user
    type: string
    default: default
  - name: user_password
    description: The password for the default user. If not set, a random one will be generated and available in the generated_user_password output variable.
    type: string
    default: ""
  - name: zone
    description: 'The zone for the master instance, it should be something like: `us-central1-a`, `us-east1-c`.'
    type: string
    required: true
  outputs:
  - name: additional_users
    description: List of maps of additional users and passwords
  - name: generated_user_password
    description: The auto generated default user password if not input password was provided
  - name: iam_users
    description: The list of the IAM users with access to the CloudSQL instance
  - name: instance_connection_name
    description: The connection name of the master instance to be used in connection strings
  - name: instance_first_ip_address
    description: The first IPv4 address of the addresses assigned for the master instance.
  - name: instance_ip_address
    description: The IPv4 address assigned for the master instance
  - name: instance_name
    description: The instance name for the master instance
  - name: instance_self_link
    description: The URI of the master instance
  - name: instance_server_ca_cert
    description: The CA certificate information used to connect to the SQL instance via SSL
  - name: instance_service_account_email_address
    description: The service account email address assigned to the master instance
  - name: instances
    description: A list of all `google_sql_database_instance` resources we've created
  - name: primary
    description: The `google_sql_database_instance` resource representing the primary instance
  - name: private_address
    description: The private IP address assigned for the master instance
  - name: private_ip_address
    description: The first private (PRIVATE) IPv4 address assigned for the master instance
  - name: public_ip_address
    description: The first public (PRIMARY) IPv4 address assigned for the master instance
  - name: read_replica_instance_names
    description: The instance names for the read replica instances
  - name: replicas
    description: A list of `google_sql_database_instance` resources representing the replicas
  - name: replicas_instance_connection_names
    description: The connection names of the replica instances to be used in connection strings
  - name: replicas_instance_first_ip_addresses
    description: The first IPv4 addresses of the addresses assigned for the replica instances
  - name: replicas_instance_self_links
    description: The URIs of the replica instances
  - name: replicas_instance_server_ca_certs
    description: The CA certificates information used to connect to the replica instances via SSL
  - name: replicas_instance_service_account_email_addresses
    description: The service account email addresses assigned to the replica instances
  roles:
  - level: Project
    roles:
    - roles/cloudsql.admin
    - roles/compute.networkAdmin
    - roles/iam.serviceAccountAdmin
    - roles/resourcemanager.projectIamAdmin
    - roles/storage.admin
    - roles/workflows.admin
    - roles/cloudscheduler.admin
    - roles/iam.serviceAccountUser
  services:
  - cloudresourcemanager.googleapis.com
  - compute.googleapis.com
  - servicenetworking.googleapis.com
  - sqladmin.googleapis.com
  - iam.googleapis.com
  - workflows.googleapis.com
  - cloudscheduler.googleapis.com