-
Notifications
You must be signed in to change notification settings - Fork 411
/
metadata.yaml
342 lines (341 loc) · 12.7 KB
/
metadata.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
apiVersion: blueprints.cloud.google.com/v1alpha1
kind: BlueprintMetadata
metadata:
name: terraform-google-sql-db
annotations:
config.kubernetes.io/local-config: "true"
spec:
title: terraform-google-sql for a safer MySQL
source:
repo: https://github.com/terraform-google-modules/terraform-google-sql-db
sourceType: git
version: 14.1.0
actuationTool:
type: Terraform
version: '>= 1.3'
description: {}
examples:
- name: mssql-public
location: examples/mssql-public
- name: mysql-backup-create-service-account
location: examples/mysql-backup-create-service-account
- name: mysql-ha
location: examples/mysql-ha
- name: mysql-private
location: examples/mysql-private
- name: mysql-public
location: examples/mysql-public
- name: postgresql-backup-provided-service-account
location: examples/postgresql-backup-provided-service-account
- name: postgresql-ha
location: examples/postgresql-ha
- name: postgresql-public
location: examples/postgresql-public
- name: postgresql-public-iam
location: examples/postgresql-public-iam
variables:
- name: activation_policy
description: The activation policy for the master instance. Can be either `ALWAYS`, `NEVER` or `ON_DEMAND`.
type: string
default: ALWAYS
- name: additional_databases
description: A list of databases to be created in your cluster
type: |-
list(object({
name = string
charset = string
collation = string
}))
default: []
- name: additional_users
description: A list of users to be created in your cluster. A random password would be set for the user if the `random_password` variable is set.
type: |-
list(object({
name = string
password = string
host = string
type = string
random_password = bool
}))
default: []
- name: allocated_ip_range
description: Existing allocated IP range name for the Private IP CloudSQL instance. The networks needs to be configured with https://cloud.google.com/vpc/docs/configure-private-services-access.
type: string
- name: assign_public_ip
description: Set to true if the master instance should also have a public IP (less secure).
type: string
default: false
- name: availability_type
description: The availability type for the master instance. Can be either `REGIONAL` or `null`.
type: string
default: REGIONAL
- name: backup_configuration
description: The backup_configuration settings subblock for the database setings
type: |-
object({
binary_log_enabled = bool
enabled = bool
start_time = string
location = string
transaction_log_retention_days = string
retained_backups = number
retention_unit = string
})
default:
binary_log_enabled: false
enabled: false
location: null
retained_backups: null
retention_unit: null
start_time: null
transaction_log_retention_days: null
- name: create_timeout
description: The optional timout that is applied to limit long database creates.
type: string
default: 30m
- name: database_flags
description: The database flags for the master instance. See [more details](https://cloud.google.com/sql/docs/mysql/flags)
type: |-
list(object({
name = string
value = string
}))
default: []
- name: database_version
description: The database version to use
type: string
required: true
- name: db_charset
description: The charset for the default database
type: string
default: ""
- name: db_collation
description: 'The collation for the default database. Example: ''utf8_general_ci'''
type: string
default: ""
- name: db_name
description: The name of the default database to create
type: string
default: default
- name: delete_timeout
description: The optional timout that is applied to limit long database deletes.
type: string
default: 30m
- name: deletion_protection
description: Used to block Terraform from deleting a SQL Instance.
type: bool
default: true
- name: deletion_protection_enabled
description: Enables protection of an instance from accidental deletion across all surfaces (API, gcloud, Cloud Console and Terraform).
type: bool
default: false
- name: deny_maintenance_period
description: The Deny Maintenance Period fields to prevent automatic maintenance from occurring during a 90-day time period. See [more details](https://cloud.google.com/sql/docs/mysql/maintenance)
type: |-
list(object({
end_date = string
start_date = string
time = string
}))
default: []
- name: disk_autoresize
description: Configuration to increase storage size
type: bool
default: true
- name: disk_autoresize_limit
description: The maximum size to which storage can be auto increased.
type: number
default: 0
- name: disk_size
description: The disk size for the master instance
type: number
default: 10
- name: disk_type
description: The disk type for the master instance.
type: string
default: PD_SSD
- name: encryption_key_name
description: The full path to the encryption key used for the CMEK disk encryption
type: string
- name: follow_gae_application
description: A Google App Engine application whose zone to remain in. Must be in the same region as this instance.
type: string
- name: insights_config
description: The insights_config settings for the database.
type: |-
object({
query_plans_per_minute = number
query_string_length = number
record_application_tags = bool
record_client_address = bool
})
- name: maintenance_window_day
description: The day of week (1-7) for the master instance maintenance.
type: number
default: 1
- name: maintenance_window_hour
description: The hour of day (0-23) maintenance window for the master instance maintenance.
type: number
default: 23
- name: maintenance_window_update_track
description: The update track of maintenance window for the master instance maintenance. Can be either `canary` or `stable`.
type: string
default: stable
- name: module_depends_on
description: List of modules or resources this module depends on.
type: list(any)
default: []
- name: name
description: The name of the Cloud SQL resources
type: string
required: true
- name: pricing_plan
description: The pricing plan for the master instance.
type: string
default: PER_USE
- name: project_id
description: The project ID to manage the Cloud SQL resources
type: string
required: true
- name: random_instance_name
description: Sets random suffix at the end of the Cloud SQL resource name
type: bool
default: false
- name: read_replica_deletion_protection
description: Used to block Terraform from deleting replica SQL Instances.
type: bool
default: false
- name: read_replica_deletion_protection_enabled
description: Enables protection of a read replica from accidental deletion across all surfaces (API, gcloud, Cloud Console and Terraform).
type: bool
default: false
- name: read_replica_name_suffix
description: The optional suffix to add to the read instance name
type: string
default: ""
- name: read_replicas
description: List of read replicas to create. Encryption key is required for replica in different region. For replica in same region as master set encryption_key_name = null
type: |-
list(object({
name = string
name_override = optional(string)
tier = string
availability_type = string
zone = string
disk_type = string
disk_autoresize = bool
disk_autoresize_limit = number
disk_size = string
user_labels = map(string)
database_flags = list(object({
name = string
value = string
}))
ip_configuration = object({
authorized_networks = list(map(string))
ipv4_enabled = bool
private_network = string
require_ssl = bool
allocated_ip_range = string
})
encryption_key_name = string
}))
default: []
- name: region
description: The region of the Cloud SQL resources
type: string
required: true
- name: secondary_zone
description: 'The preferred zone for the secondary/failover instance, it should be something like: `us-central1-a`, `us-east1-c`.'
type: string
- name: tier
description: The tier for the master instance.
type: string
default: db-n1-standard-1
- name: update_timeout
description: The optional timout that is applied to limit long database updates.
type: string
default: 30m
- name: user_labels
description: The key/value labels for the master instances.
type: map(string)
default: {}
- name: user_name
description: The name of the default user
type: string
default: default
- name: user_password
description: The password for the default user. If not set, a random one will be generated and available in the generated_user_password output variable.
type: string
default: ""
- name: vpc_network
description: Existing VPC network to which instances are connected. The networks needs to be configured with https://cloud.google.com/vpc/docs/configure-private-services-access.
type: string
required: true
- name: zone
description: 'The zone for the master instance, it should be something like: `a`, `c`.'
type: string
required: true
outputs:
- name: generated_user_password
description: The auto generated default user password if not input password was provided
- name: instance_connection_name
description: The connection name of the master instance to be used in connection strings
- name: instance_ip_address
description: The IPv4 address assigned for the master instance
- name: instance_name
description: The instance name for the master instance
- name: instance_self_link
description: The URI of the master instance
- name: instance_service_account_email_address
description: The service account email address assigned to the master instance
- name: instances
description: A list of all `google_sql_database_instance` resources we've created
- name: primary
description: The `google_sql_database_instance` resource representing the primary instance
- name: private_ip_address
description: The first private (PRIVATE) IPv4 address assigned for the master instance
- name: public_ip_address
description: The first public (PRIMARY) IPv4 address assigned for the master instance
- name: read_replica_instance_names
description: The instance names for the read replica instances
- name: replicas
description: A list of `google_sql_database_instance` resources representing the replicas
- name: replicas_instance_connection_names
description: The connection names of the replica instances to be used in connection strings
- name: replicas_instance_self_links
description: The URIs of the replica instances
- name: replicas_instance_service_account_email_addresses
description: The service account email addresses assigned to the replica instances
roles:
- level: Project
roles:
- roles/cloudsql.admin
- roles/compute.networkAdmin
- roles/iam.serviceAccountAdmin
- roles/resourcemanager.projectIamAdmin
- roles/storage.admin
- roles/workflows.admin
- roles/cloudscheduler.admin
- roles/iam.serviceAccountUser
services:
- cloudresourcemanager.googleapis.com
- compute.googleapis.com
- servicenetworking.googleapis.com
- sqladmin.googleapis.com
- iam.googleapis.com
- workflows.googleapis.com
- cloudscheduler.googleapis.com