Skip to content

Commit d56fa50

Browse files
Arun Poudelpete-layerhealth
Arun Poudel
authored and
pete-layerhealth
committed
feat: added support for ssl_config support for postgresql_profile
Fixes hashicorp/terraform-provider-google#20929
1 parent 9449992 commit d56fa50

6 files changed

+208
-0
lines changed

‎mmv1/products/datastream/ConnectionProfile.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,18 @@ examples:
9191
test_vars_overrides:
9292
'deletion_protection': 'false'
9393
exclude_test: true
94+
- name: 'datastream_stream_postgresql_sslconfig_server_and_client_verification'
95+
primary_resource_id: 'default'
96+
vars:
97+
connection_profile_id: 'profile-id'
98+
deletion_protection: 'true'
99+
database_instance_name: 'my-instance'
100+
test_vars_overrides:
101+
'deletion_protection': 'false'
102+
oics_vars_overrides:
103+
'deletion_protection': 'false'
104+
external_providers: ["random"]
105+
skip_vcr: true
94106
parameters:
95107
- name: 'connectionProfileId'
96108
type: String
@@ -324,6 +336,69 @@ properties:
324336
description: |
325337
Database for the PostgreSQL connection.
326338
required: true
339+
- name: 'sslConfig'
340+
type: NestedObject
341+
description: |
342+
SSL configuration for the PostgreSQL connection.
343+
required: false
344+
properties:
345+
- name: 'serverVerification'
346+
type: NestedObject
347+
description: |
348+
If this field is set, the communication will be encrypted with TLS encryption
349+
and the server identity will be authenticated.
350+
exactly_one_of:
351+
- 'ssl_config.0.server_verification'
352+
- 'ssl_config.0.server_and_client_verification'
353+
properties:
354+
- name: 'caCertificate'
355+
type: String
356+
description: PEM-encoded server root CA certificate.
357+
required: true
358+
immutable: true
359+
sensitive: true
360+
ignore_read: true
361+
- name: 'serverAndClientVerification'
362+
type: NestedObject
363+
description: |
364+
If this field is set, the communication will be encrypted with TLS encryption
365+
and both the server identity and the client identity will be authenticated.
366+
exactly_one_of:
367+
- 'ssl_config.0.server_verification'
368+
- 'ssl_config.0.server_and_client_verification'
369+
properties:
370+
- name: 'clientCertificate'
371+
type: String
372+
description: |
373+
PEM-encoded certificate used by the source database to authenticate the
374+
client identity (i.e., the Datastream's identity). This certificate is
375+
signed by either a root certificate trusted by the server or one or more
376+
intermediate certificates (which is stored with the leaf certificate) to
377+
link to this certificate to the trusted root certificate.
378+
immutable: true
379+
required: true
380+
sensitive: true
381+
ignore_read: true
382+
- name: 'clientKey'
383+
type: String
384+
description: |
385+
PEM-encoded private key associated with the client certificate.
386+
This value will be used during the SSL/TLS handshake, allowing
387+
the PostgreSQL server to authenticate the client's identity,
388+
i.e. identity of the stream.
389+
immutable: true
390+
required: true
391+
sensitive: true
392+
ignore_read: true
393+
- name: 'caCertificate'
394+
type: String
395+
description: |
396+
PEM-encoded server root CA certificate.
397+
immutable: true
398+
required: true
399+
sensitive: true
400+
ignore_read: true
401+
327402
- name: 'sqlServerProfile'
328403
type: NestedObject
329404
description: |

‎mmv1/templates/terraform/custom_flatten/datastream_connection_profile_postgresql_profile_ssl_config_server_and_client_verification_ca_certificate.go.tmpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{/*
2+
The license inside this block applies to this file
3+
Copyright 2024 Google Inc.
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS,
9+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
See the License for the specific language governing permissions and
11+
limitations under the License.
12+
*/ -}}
13+
{{/* Workaround for https://github.com/hashicorp/terraform-provider-google/issues/12410 */}}
14+
func flatten{{$.GetPrefix}}{{$.TitlelizeProperty}}(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
15+
return d.Get("postgresql_profile.0.ssl_config.0.server_and_client_verification.0.ca_certificate")
16+
}

‎mmv1/templates/terraform/custom_flatten/datastream_connection_profile_postgresql_profile_ssl_config_server_and_client_verification_client_certificate.go.tmpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{/*
2+
The license inside this block applies to this file
3+
Copyright 2024 Google Inc.
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS,
9+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
See the License for the specific language governing permissions and
11+
limitations under the License.
12+
*/ -}}
13+
{{/* Workaround for https://github.com/hashicorp/terraform-provider-google/issues/12410 */}}
14+
func flatten{{$.GetPrefix}}{{$.TitlelizeProperty}}(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
15+
return d.Get("postgresql_profile.0.ssl_config.0.server_and_client_verification.0.client_certificate")
16+
}

‎mmv1/templates/terraform/custom_flatten/datastream_connection_profile_postgresql_profile_ssl_config_server_and_client_verification_client_key.go.tmpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{/*
2+
The license inside this block applies to this file
3+
Copyright 2024 Google Inc.
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS,
9+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
See the License for the specific language governing permissions and
11+
limitations under the License.
12+
*/ -}}
13+
{{/* Workaround for https://github.com/hashicorp/terraform-provider-google/issues/12410 */}}
14+
func flatten{{$.GetPrefix}}{{$.TitlelizeProperty}}(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
15+
return d.Get("postgresql_profile.0.ssl_config.0.server_and_client_verification.0.client_key")
16+
}

‎mmv1/templates/terraform/custom_flatten/datastream_connection_profile_postgresql_profile_ssl_config_server_verification_ca_certificate.go.tmpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{/*
2+
The license inside this block applies to this file
3+
Copyright 2024 Google Inc.
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS,
9+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
See the License for the specific language governing permissions and
11+
limitations under the License.
12+
*/ -}}
13+
{{/* Workaround for https://github.com/hashicorp/terraform-provider-google/issues/12410 */}}
14+
func flatten{{$.GetPrefix}}{{$.TitlelizeProperty}}(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
15+
return d.Get("postgresql_profile.0.ssl_config.0.server_verification.0.ca_certificate")
16+
}

‎mmv1/templates/terraform/examples/datastream_stream_postgresql_sslconfig_server_and_client_verification.tf.tmpl‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
data "google_datastream_static_ips" "datastream_ips" {
2+
location = "us-central1"
3+
}
4+
5+
resource "google_sql_database_instance" "instance" {
6+
name = "{{index $.Vars "database_instance_name"}}"
7+
database_version = "POSTGRES_15"
8+
region = "us-central1"
9+
settings {
10+
tier = "db-f1-micro"
11+
ip_configuration {
12+
ipv4_enabled = true
13+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
14+
dynamic "authorized_networks" {
15+
for_each = data.google_datastream_static_ips.datastream_ips.static_ips
16+
iterator = ip
17+
18+
content {
19+
name = format("datastream-%d", ip.key)
20+
value = ip.value
21+
}
22+
}
23+
}
24+
}
25+
26+
deletion_protection = {{index $.Vars "deletion_protection"}}
27+
}
28+
29+
resource "google_sql_database" "db" {
30+
instance = google_sql_database_instance.instance.name
31+
name = "db"
32+
}
33+
34+
resource "random_password" "pwd" {
35+
length = 16
36+
special = false
37+
}
38+
39+
resource "google_sql_user" "user" {
40+
name = "user"
41+
instance = google_sql_database_instance.instance.name
42+
password = random_password.pwd.result
43+
}
44+
45+
resource "google_sql_ssl_cert" "client_cert" {
46+
common_name = "client-name"
47+
instance = google_sql_database_instance.instance.name
48+
}
49+
50+
resource "google_datastream_connection_profile" "{{$.PrimaryResourceId}}" {
51+
display_name = "Connection Profile"
52+
location = "us-central1"
53+
connection_profile_id = "{{index $.Vars "connection_profile_id"}}"
54+
55+
postgresql_profile {
56+
hostname = google_sql_database_instance.instance.public_ip_address
57+
port = 5432
58+
username = "user"
59+
password = random_password.pwd.result
60+
database = google_sql_database.db.name
61+
ssl_config {
62+
server_and_client_verification {
63+
client_certificate = google_sql_ssl_cert.client_cert.cert
64+
client_key = google_sql_ssl_cert.client_cert.private_key
65+
ca_certificate = google_sql_ssl_cert.client_cert.server_ca_cert
66+
}
67+
}
68+
}
69+
}

0 commit comments

Comments
 (0)