fix: Improve MySQL root_password documentation

Make also root_password nullable by default as a clearer semantic.

modules/mysql/README.md

@@ -54,7 +54,7 @@ Note: CloudSQL provides [disk autoresize](https://cloud.google.com/sql/docs/mysq
 | read\_replicas | List of read replicas to create. Encryption key is required for replica in different region. For replica in same region as master set encryption\_key\_name = null | <pre>list(object({<br>    name                  = string<br>    name_override         = optional(string)<br>    tier                  = optional(string)<br>    edition               = optional(string)<br>    availability_type     = optional(string)<br>    zone                  = optional(string)<br>    disk_type             = optional(string)<br>    disk_autoresize       = optional(bool)<br>    disk_autoresize_limit = optional(number)<br>    disk_size             = optional(string)<br>    user_labels           = map(string)<br>    database_flags = list(object({<br>      name  = string<br>      value = string<br>    }))<br>    backup_configuration = optional(object({<br>      binary_log_enabled             = bool<br>      transaction_log_retention_days = string<br>    }))<br>    insights_config = optional(object({<br>      query_plans_per_minute  = number<br>      query_string_length     = number<br>      record_application_tags = bool<br>      record_client_address   = bool<br>    }))<br>    ip_configuration = object({<br>      authorized_networks                           = optional(list(map(string)), [])<br>      ipv4_enabled                                  = optional(bool)<br>      private_network                               = optional(string, )<br>      require_ssl                                   = optional(bool)<br>      allocated_ip_range                            = optional(string)<br>      enable_private_path_for_google_cloud_services = optional(bool, false)<br>      psc_enabled                                   = optional(bool, false)<br>      psc_allowed_consumer_projects                 = optional(list(string), [])<br>    })<br>    encryption_key_name = optional(string)<br>  }))</pre> | `[]` | no |
 | region | The region of the Cloud SQL resources | `string` | `"us-central1"` | no |
 | replica\_database\_version | The read replica database version to use. This var should only be used during a database update. The update sequence 1. read-replica 2. master, setting this to an updated version will cause the replica to update, then you may update the master with the var database\_version and remove this field after update is complete | `string` | `""` | no |
-| root\_password | Mysql password for the root user. If not set, a random one will be generated and available in the root\_password output variable. | `string` | `""` | no |
+| root\_password | MySQL password for the root user. | `string` | `null` | no |
 | secondary\_zone | The preferred zone for the secondary/failover instance, it should be something like: `us-central1-a`, `us-east1-c`. | `string` | `null` | no |
 | tier | The tier for the master instance. | `string` | `"db-n1-standard-1"` | no |
 | update\_timeout | The optional timout that is applied to limit long database updates. | `string` | `"30m"` | no |

modules/mysql/main.tf

@@ -59,7 +59,7 @@ resource "google_sql_database_instance" "default" {
   instance_type        = var.instance_type
   encryption_key_name  = var.encryption_key_name
   deletion_protection  = var.deletion_protection
-  root_password        = var.root_password != "" ? var.root_password : null
+  root_password        = var.root_password == "" ? null : var.root_password
 
   settings {
     tier                        = var.tier

modules/mysql/variables.tf

@@ -339,9 +339,9 @@ variable "user_host" {
 }
 
 variable "root_password" {
-  description = "Mysql password for the root user. If not set, a random one will be generated and available in the root_password output variable."
+  description = "MySQL password for the root user."
   type        = string
-  default     = ""
+  default     = null
 }
 
 variable "user_password" {