GKEからCloudSQLへプライベート接続する

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

variable "project" {}

variable "cluster_name" {}

variable "region" {}

variable "location" {}

variable "primary_node_count" {
  default = "3"
}

variable "machine_type" {
  default = "n1-standard-1"
}

variable "min_master_version" {
  default = "1.14.10-gke.37"
}

variable "node_version" {
  default = "1.14.10-gke.37"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# 自分たちのサービスで使うネットワーク
resource "google_compute_network" "private_network" {
  name = var.cluster_name
}

# アドレス範囲
resource "google_compute_global_address" "private_service" {
  name          = "private-ip-address"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 16
  network       = google_compute_network.private_network.self_link
}

# プライベート接続定義
resource "google_service_networking_connection" "private_vpc_connection" {
  provider = google-beta

  network                 = google_compute_network.private_network.self_link
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.private_service.name]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

# ネットワークを指定している
resource "google_container_cluster" "main" {
  name     = "primary-${var.cluster_name}"
  location = var.location

  remove_default_node_pool = true
  initial_node_count       = 1

  network = google_compute_network.private_network.self_link

  ip_allocation_policy {
    cluster_ipv4_cidr_block  = "${cidrsubnet("192.168.0.0/16", 4, 1)}"
    services_ipv4_cidr_block = "${cidrsubnet("192.168.0.0/16", 4, 2)}"
  }

  min_master_version = var.min_master_version
  node_version       = var.node_version

  master_auth {
    username = ""
    password = ""

    client_certificate_config {
      issue_client_certificate = false
    }
  }
}
# ちゃんとノードプールも定義する

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

resource "google_sql_database" "app_core" {
  name     = "app_core"
  instance = google_sql_database_instance.instance.name
}

resource "google_sql_database_instance" "main" {
  name   = "pg-${var.cluster_name}"
  database_version = "POSTGRES_11"
  region = var.region

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.self_link
    }
  }
}

resource "google_sql_user" "app" {
  name     = "app"
  instance = google_sql_database_instance.instance.name
  password = "ppap"
}

1
2
3
4
5
6
7
8
9

resource "google_service_account" "cloudproxy" {
  account_id   = "proxy-${var.cluster_name}"
  display_name = "Cloud Proxy(${var.cluster_name})"
}

resource "google_project_iam_member" "cloudproxy-iam" {
  role = "roles/cloudsql.client"
  member = "serviceAccount:${google_service_account.cloudproxy.email}"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

      - name: cloudsql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.14
        command: ["/cloud_sql_proxy",
                  "-instances=app_core:us-west1:pg-apple_cluster=tcp:5432",
                  "-credential_file=/secrets/cloudsql/credentials.json"]
        securityContext:
          runAsUser: 2  # non-root user
          allowPrivilegeEscalation: false
        volumeMounts:
          - name: cloudsql-instance-credentials
            mountPath: /secrets/cloudsql
            readOnly: true
      volumes:
        - name: cloudsql-instance-credentials
          secret:
            secretName: cloudsql-instance-credentials