4

我正在尝试使用 terraform 在 GCP 上创建云 sql 实例。我想使用在前面步骤中创建的现有 VPC 子网，但似乎没有办法引用它。相反，所有示例似乎都需要设置新的 IP 范围。这是我当前创建新 IP 范围的代码：

  provider = google-beta
  project  = "project_name"

  name          = "private_range"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 18
  network       = "projects/project_name/global/networks/vpc_name"
  address       = "192.168.128.0"
}

resource "google_service_networking_connection" "private_vpc_connection" {
  provider = google-beta

  network                 = "projects/project_name/global/networks/vpc_name"
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
}

resource "google_sql_database_instance" "instance" {
  provider = google-beta
  project  = "project_name"

  name   = "db-instance10"
  region = "us-east1"
  database_version = "MYSQL_5_7"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = "projects/project_name/global/networks/vpc_name"
    }
  }
}

provider "google-beta" {
  region = "us-east1"
  zone   = "us-east1-c"
}

当我指定与现有子网完全相同的 IP 范围时。我收到错误：

错误：等待创建 GlobalAddress 时出错：等待创建 GlobalAddress 时出错：请求的范围与其他资源冲突：提供的 IP 范围与现有子网 IP 范围重叠。

似乎没有任何明显的方法可以引用现有子网资源，因为reserved_peering_ranges参数似乎只接受 IP 地址范围资源的名称。

以下是现有子网的资源规范：

    creation_timestamp       = "2020-06-03T07:28:05.762-07:00"
    enable_flow_logs         = true
    fingerprint              = "ied1TiEZjgc="
    gateway_address          = "192.168.128.1"
    id                       = "us-east1/vpc_subnet_name"
    ip_cidr_range            = "192.168.128.0/18"
    name                     = "vpc_subnet_name"
    network                  = "https://www.googleapis.com/compute/v1/projects/project_name/global/networks/vpc_name"
    private_ip_google_access = true
    project                  = "project_name"
    region                   = "us-east1"
    secondary_ip_range       = []
    self_link                = "https://www.googleapis.com/compute/v1/projects/project_name/regions/us-east1/subnetworks/vpc_subnet_name"

    log_config {
        aggregation_interval = "INTERVAL_5_SEC"
        flow_sampling        = 0.5
        metadata             = "INCLUDE_ALL_METADATA"
    }
}
4

2 回答 2

1

通过私有 IP连接到 Cloud sql 实例需要配置私有服务访问，该访问使用不得与任何现有 VPC 子网重叠的已分配 IP 地址范围。

专用连接将您的 VPC 网络与服务的 VPC 网络链接起来。此连接允许 VPC 网络中的 VM 实例使用内部 IP 地址访问服务资源，例如具有内部 IP 地址的 Cloud sql 实例。

创建后，分配的 IP 地址范围和连接可以与其他服务重复使用。

于 2020-06-05T04:07:20.580 回答
0

您可以使用以下模块使用现有的私有 vpc 创建云 sql，但您需要根据您的网络对其进行修改。在这种情况下，我创建了一个单独的专用网络并使用该网络创建云 sql。

https://github.com/gruntwork-io/terraform-google-sql

  1. 获取要从中创建 cloudsql 的云基础设施中的现有网络，以下命令提供 gcloud 网络列表 --uri
  2. 您需要在提到自链接的地方附加网络并散列创建 vpc 的步骤。请参考以下 main.tf 文件

该文件的位置是 --- Cloud_SQL.terraform\modules\sql_example_postgres-private-ip\examples\postgres-private-ip\main.tf

相应地添加变量。

# ------------------------------------------------------------------------------
# LAUNCH A POSTGRES CLOUD SQL PRIVATE IP INSTANCE
# ------------------------------------------------------------------------------

# ------------------------------------------------------------------------------
# CONFIGURE OUR GCP CONNECTION
# ------------------------------------------------------------------------------

provider "google-beta" {
  project = var.project
  region  = var.region
}

terraform {
  # This module is now only being tested with Terraform 0.14.x. However, to make upgrading easier, we are setting
  # 0.12.26 as the minimum version, as that version added support for required_providers with source URLs, making it
  # forwards compatible with 0.14.x code.
  required_version = ">= 0.12.26"

  required_providers {
    google-beta = {
      source  = "hashicorp/google-beta"
      version = "~> 3.57.0"
    }
  }
}

# ------------------------------------------------------------------------------
# CREATE A RANDOM SUFFIX AND PREPARE RESOURCE NAMES
# ------------------------------------------------------------------------------

resource "random_id" "name" {
  byte_length = 2
}

####################################################################

# Reserve global internal address range for the peering
resource "google_compute_global_address" "private_ip_address" {
  provider      = google-beta
# name          = local.private_ip_name
  name           = var.vpc_network
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 16
#  network       = google_compute_network.private_network.self_link
#  network       = google_compute_network.vpc_network.self_link
  network       =  "https://www.googleapis.com/compute/v1/projects/lucky-operand-312611/global/networks/myprivatevpc/"
}

# Establish VPC network peering connection using the reserved address range
resource "google_service_networking_connection" "private_vpc_connection" {
  provider                = google-beta
# network                 = google_compute_network.private_network.self_link
  network                 = "https://www.googleapis.com/compute/v1/projects/lucky-operand-312611/global/networks/myprivatevpc"
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
}

# ------------------------------------------------------------------------------
# CREATE DATABASE INSTANCE WITH PRIVATE IP
# ------------------------------------------------------------------------------

module "postgres" {
  # When using these modules in your own templates, you will need to use a Git URL with a ref attribute that pins you
  # to a specific version of the modules, such as the following example:
  # source = "github.com/gruntwork-io/terraform-google-sql.git//modules/cloud-sql?ref=v0.2.0"
  source = "../../modules/cloud-sql"

  project = var.project
  region  = var.region
  name    = var.instance_name
  db_name = var.db_name

  engine       = var.postgres_version
  machine_type = var.machine_type

  # To make it easier to test this example, we are disabling deletion protection so we can destroy the databases
  # during the tests. By default, we recommend setting deletion_protection to true, to ensure database instances are
  # not inadvertently destroyed.
  deletion_protection = false

  # These together will construct the master_user privileges, i.e.
  # 'master_user_name'@'master_user_host' IDENTIFIED BY 'master_user_password'.
  # These should typically be set as the environment variable TF_VAR_master_user_password, etc.
  # so you don't check these into source control."
  master_user_password = var.master_user_password

  master_user_name = var.master_user_name
  master_user_host = "%"

  # Pass the private network link to the module
 # private_network = google_compute_network.private_network.self_link
   private_network = "https://www.googleapis.com/compute/v1/projects/lucky-operand-312611/global/networks/myprivatevpc" 
  # Wait for the vpc connection to complete
  dependencies = [google_service_networking_connection.private_vpc_connection.network]

  custom_labels = {
    test-id = "postgres-private-ip-example"
  }
}
于 2021-05-07T10:04:19.463 回答