Add ssl certs to cloudsql instance (#1049)

* add ssl certs to cloudsql instance * rename variable * fix typo Co-authored-by: Ludovico Magnocavallo <[email protected]>
GoogleCloudPlatform · Dec 12, 2022 · 031b9f3 · 031b9f3
1 parent 7d61c69
commit 031b9f3
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 10 deletions.
diff --git a/modules/cloudsql-instance/README.md b/modules/cloudsql-instance/README.md
@@ -149,9 +149,9 @@ module "db" {
 | [database_version](variables.tf#L49) | Database type and version to create. | <code>string</code> | ✓ |  |
 | [name](variables.tf#L102) | Name of primary instance. | <code>string</code> | ✓ |  |
 | [network](variables.tf#L107) | VPC self link where the instances will be deployed. Private Service Networking must be enabled and configured in this VPC. | <code>string</code> | ✓ |  |
-| [project_id](variables.tf#L122) | The ID of the project where this instances will be created. | <code>string</code> | ✓ |  |
-| [region](variables.tf#L127) | Region of the primary instance. | <code>string</code> | ✓ |  |
-| [tier](variables.tf#L147) | The machine type to use for the instances. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L128) | The ID of the project where this instances will be created. | <code>string</code> | ✓ |  |
+| [region](variables.tf#L133) | Region of the primary instance. | <code>string</code> | ✓ |  |
+| [tier](variables.tf#L153) | The machine type to use for the instances. | <code>string</code> | ✓ |  |
 | [authorized_networks](variables.tf#L17) | Map of NAME=>CIDR_RANGE to allow to connect to the database(s). | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 | [availability_type](variables.tf#L23) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | <code>string</code> |  | <code>&#34;ZONAL&#34;</code> |
 | [backup_configuration](variables.tf#L29) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | <code title="object&#40;&#123;&#10;  enabled            &#61; bool&#10;  binary_log_enabled &#61; bool&#10;  start_time         &#61; string&#10;  location           &#61; string&#10;  log_retention_days &#61; number&#10;  retention_count    &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  enabled            &#61; false&#10;  binary_log_enabled &#61; false&#10;  start_time         &#61; &#34;23:00&#34;&#10;  location           &#61; null&#10;  log_retention_days &#61; 7&#10;  retention_count    &#61; 7&#10;&#125;">&#123;&#8230;&#125;</code> |
@@ -163,10 +163,11 @@ module "db" {
 | [flags](variables.tf#L84) | Map FLAG_NAME=>VALUE for database-specific tuning. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 | [ipv4_enabled](variables.tf#L90) | Add a public IP address to database instance. | <code>bool</code> |  | <code>false</code> |
 | [labels](variables.tf#L96) | Labels to be attached to all instances. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
-| [prefix](variables.tf#L112) | Optional prefix used to generate instance names. | <code>string</code> |  | <code>null</code> |
-| [replicas](variables.tf#L132) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map&#40;object&#40;&#123;&#10;  region              &#61; string&#10;  encryption_key_name &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [root_password](variables.tf#L141) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> |  | <code>null</code> |
-| [users](variables.tf#L152) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
+| [postgres_client_certificates](variables.tf#L112) | Map of cert keys connect to the application(s) using public IP. | <code>list&#40;string&#41;</code> |  | <code>null</code> |
+| [prefix](variables.tf#L118) | Optional prefix used to generate instance names. | <code>string</code> |  | <code>null</code> |
+| [replicas](variables.tf#L138) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | <code title="map&#40;object&#40;&#123;&#10;  region              &#61; string&#10;  encryption_key_name &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [root_password](variables.tf#L147) | Root password of the Cloud SQL instance. Required for MS SQL Server. | <code>string</code> |  | <code>null</code> |
+| [users](variables.tf#L158) | Map of users to create in the primary instance (and replicated to other replicas) in the format USER=>PASSWORD. For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 
 ## Outputs
 
@@ -181,8 +182,9 @@ module "db" {
 | [ips](outputs.tf#L61) | IP addresses of all instances. |  |
 | [name](outputs.tf#L69) | Name of the primary instance. |  |
 | [names](outputs.tf#L74) | Names of all instances. |  |
-| [self_link](outputs.tf#L82) | Self link of the primary instance. |  |
-| [self_links](outputs.tf#L87) | Self links of all instances. |  |
-| [user_passwords](outputs.tf#L95) | Map of containing the password of all users created through terraform. | ✓ |
+| [postgres_client_certificates](outputs.tf#L82) | The CA Certificate used to connect to the SQL Instance via SSL. | ✓ |
+| [self_link](outputs.tf#L88) | Self link of the primary instance. |  |
+| [self_links](outputs.tf#L93) | Self links of all instances. |  |
+| [user_passwords](outputs.tf#L101) | Map of containing the password of all users created through terraform. | ✓ |
 
 <!-- END TFDOC -->
diff --git a/modules/cloudsql-instance/main.tf b/modules/cloudsql-instance/main.tf
@@ -175,3 +175,10 @@ resource "google_sql_user" "users" {
   host     = each.value.host
   password = each.value.password
 }
+
+resource "google_sql_ssl_cert" "postgres_client_certificates" {
+  for_each    = var.postgres_client_certificates != null ? toset(var.postgres_client_certificates) : toset([])
+  provider    = google-beta
+  instance    = google_sql_database_instance.primary.name
+  common_name = each.key
+}
diff --git a/modules/cloudsql-instance/outputs.tf b/modules/cloudsql-instance/outputs.tf
@@ -79,6 +79,12 @@ output "names" {
   }
 }
 
+output "postgres_client_certificates" {
+  description = "The CA Certificate used to connect to the SQL Instance via SSL."
+  value       = google_sql_ssl_cert.postgres_client_certificates
+  sensitive   = true
+}
+
 output "self_link" {
   description = "Self link of the primary instance."
   value       = google_sql_database_instance.primary.self_link

diff --git a/modules/cloudsql-instance/variables.tf b/modules/cloudsql-instance/variables.tf
@@ -109,6 +109,12 @@ variable "network" {
   type        = string
 }
 
+variable "postgres_client_certificates" {
+  description = "Map of cert keys connect to the application(s) using public IP."
+  type        = list(string)
+  default     = null
+}
+
 variable "prefix" {
   description = "Optional prefix used to generate instance names."
   type        = string