diff --git a/modules/cloudsql-instance/README.md b/modules/cloudsql-instance/README.md
index 130a780f51..d494bad2be 100644
--- a/modules/cloudsql-instance/README.md
+++ b/modules/cloudsql-instance/README.md
@@ -248,11 +248,11 @@ module "db" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [database_version](variables.tf#L68) | Database type and version to create. | string | ✓ | |
-| [name](variables.tf#L146) | Name of primary instance. | string | ✓ | |
-| [network_config](variables.tf#L151) | Network configuration for the instance. Only one between private_network and psc_config can be used. | object({…}) | ✓ | |
-| [project_id](variables.tf#L190) | The ID of the project where this instances will be created. | string | ✓ | |
-| [region](variables.tf#L195) | Region of the primary instance. | string | ✓ | |
-| [tier](variables.tf#L215) | The machine type to use for the instances. | string | ✓ | |
+| [name](variables.tf#L179) | Name of primary instance. | string | ✓ | |
+| [network_config](variables.tf#L184) | Network configuration for the instance. Only one between private_network and psc_config can be used. | object({…}) | ✓ | |
+| [project_id](variables.tf#L223) | The ID of the project where this instances will be created. | string | ✓ | |
+| [region](variables.tf#L228) | Region of the primary instance. | string | ✓ | |
+| [tier](variables.tf#L248) | The machine type to use for the instances. | string | ✓ | |
| [activation_policy](variables.tf#L16) | This variable specifies when the instance should be active. Can be either ALWAYS, NEVER or ON_DEMAND. Default is ALWAYS. | string | | "ALWAYS" |
| [availability_type](variables.tf#L27) | Availability type for the primary replica. Either `ZONAL` or `REGIONAL`. | string | | "ZONAL" |
| [backup_configuration](variables.tf#L33) | Backup settings for primary instance. Will be automatically enabled if using MySQL with one or more replicas. | object({…}) | | {…} |
@@ -269,11 +269,12 @@ module "db" {
| [flags](variables.tf#L123) | Map FLAG_NAME=>VALUE for database-specific tuning. | map(string) | | null |
| [insights_config](variables.tf#L129) | Query Insights configuration. Defaults to null which disables Query Insights. | object({…}) | | null |
| [labels](variables.tf#L140) | Labels to be attached to all instances. | map(string) | | null |
-| [postgres_client_certificates](variables.tf#L174) | Map of cert keys connect to the application(s) using public IP. | list(string) | | null |
-| [prefix](variables.tf#L180) | Optional prefix used to generate instance names. | string | | null |
-| [replicas](variables.tf#L200) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | map(object({…})) | | {} |
-| [root_password](variables.tf#L209) | Root password of the Cloud SQL instance. Required for MS SQL Server. | string | | null |
-| [users](variables.tf#L220) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | map(object({…})) | | null |
+| [maintenance_config](variables.tf#L146) | Set maintenance window configuration and maintenance deny period (up to 90 days). Date format: 'yyyy-mm-dd'. | object({…}) | | {} |
+| [postgres_client_certificates](variables.tf#L207) | Map of cert keys connect to the application(s) using public IP. | list(string) | | null |
+| [prefix](variables.tf#L213) | Optional prefix used to generate instance names. | string | | null |
+| [replicas](variables.tf#L233) | Map of NAME=> {REGION, KMS_KEY} for additional read replicas. Set to null to disable replica creation. | map(object({…})) | | {} |
+| [root_password](variables.tf#L242) | Root password of the Cloud SQL instance. Required for MS SQL Server. | string | | null |
+| [users](variables.tf#L253) | Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'. | map(object({…})) | | null |
## Outputs
diff --git a/modules/cloudsql-instance/main.tf b/modules/cloudsql-instance/main.tf
index a39469e829..66d2c17673 100644
--- a/modules/cloudsql-instance/main.tf
+++ b/modules/cloudsql-instance/main.tf
@@ -121,6 +121,15 @@ resource "google_sql_database_instance" "primary" {
}
}
+ dynamic "deny_maintenance_period" {
+ for_each = var.maintenance_config.deny_maintenance_period != null ? [1] : []
+ content {
+ start_date = var.maintenance_config.deny_maintenance_period.start_date
+ end_date = var.maintenance_config.deny_maintenance_period.end_date
+ time = var.maintenance_config.deny_maintenance_period.start_time
+ }
+ }
+
dynamic "insights_config" {
for_each = var.insights_config != null ? [1] : []
content {
@@ -131,6 +140,15 @@ resource "google_sql_database_instance" "primary" {
query_plans_per_minute = var.insights_config.query_plans_per_minute
}
}
+
+ dynamic "maintenance_window" {
+ for_each = var.maintenance_config.maintenance_window != null ? [""] : []
+ content {
+ day = var.maintenance_config.maintenance_window.day
+ hour = var.maintenance_config.maintenance_window.hour
+ update_track = var.maintenance_config.maintenance_window.update_track
+ }
+ }
}
deletion_protection = var.deletion_protection
}
diff --git a/modules/cloudsql-instance/variables.tf b/modules/cloudsql-instance/variables.tf
index 7ee516bf51..3d9af41492 100644
--- a/modules/cloudsql-instance/variables.tf
+++ b/modules/cloudsql-instance/variables.tf
@@ -143,6 +143,39 @@ variable "labels" {
default = null
}
+variable "maintenance_config" {
+ description = "Set maintenance window configuration and maintenance deny period (up to 90 days). Date format: 'yyyy-mm-dd'."
+ type = object({
+ maintenance_window = optional(object({
+ day = number
+ hour = number
+ update_track = optional(string, null)
+ }), null)
+ deny_maintenance_period = optional(object({
+ start_date = string
+ end_date = string
+ start_time = optional(string, "00:00:00")
+ }), null)
+ })
+ default = {}
+ validation {
+ condition = (
+ var.maintenance_config.maintenance_window == null ? true : (
+ # Maintenance window day validation below
+ var.maintenance_config.maintenance_window.day >= 1 &&
+ var.maintenance_config.maintenance_window.day <= 7 &&
+ # Maintenance window hour validation below
+ var.maintenance_config.maintenance_window.hour >= 0 &&
+ var.maintenance_config.maintenance_window.hour <= 23 &&
+ # Maintenance window update_track validation below
+ var.maintenance_config.maintenance_window.update_track == null ? true :
+ contains(["canary", "stable"], var.maintenance_config.maintenance_window.update_track)
+ )
+ )
+ error_message = "Maintenance window day must be between 1 and 7, maintenance window hour must be between 0 and 23 and maintenance window update_track must be 'stable' or 'canary'."
+ }
+}
+
variable "name" {
description = "Name of primary instance."
type = string
@@ -218,7 +251,7 @@ variable "tier" {
}
variable "users" {
- description = "Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything afterr the first `@` (if persent) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'."
+ description = "Map of users to create in the primary instance (and replicated to other replicas). For MySQL, anything after the first `@` (if present) will be used as the user's host. Set PASSWORD to null if you want to get an autogenerated password. The user types available are: 'BUILT_IN', 'CLOUD_IAM_USER' or 'CLOUD_IAM_SERVICE_ACCOUNT'."
type = map(object({
password = optional(string)
type = optional(string)