Skip to content

Commit 3f6f788

Browse files
feng-zhefeng-zhe
committed
resolve some review comments
1 parent 50c65d7 commit 3f6f788

File tree

6 files changed

+93
-84
lines changed
  • cloud_sql
    • mysql_instance_customer_managed_cas_ca
    • mysql_instance_google_managed_cas_ca
    • postgres_instance_customer_managed_cas_ca
    • postgres_instance_google_managed_cas_ca
    • sqlserver_instance_customer_managed_cas_ca
    • sqlserver_instance_google_managed_cas_ca

6 files changed

+93
-84
lines changed

‎cloud_sql/mysql_instance_customer_managed_cas_ca/main.tf‎

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2025 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -14,15 +14,23 @@
1414
* limitations under the License.
1515
*/
1616
# [START cloud_sql_instance_service_identity]
17-
resource "google_project_service_identity" "gcp_sa_cloud_sql" {
17+
resource "google_project_service_identity" "default" {
1818
provider = google-beta
1919
service = "sqladmin.googleapis.com"
2020
}
2121
# [END cloud_sql_instance_service_identity]
2222

23+
# [START privateca_ca_pool_suffix]
24+
resource "random_string" "default" {
25+
length = 10
26+
special = false
27+
upper = false
28+
}
29+
# [END privateca_ca_pool_suffix]
30+
2331
# [START cloud_sql_mysql_instance_ca_pool]
24-
resource "google_privateca_ca_pool" "customer_ca_pool" {
25-
name = "tf-test-cap"
32+
resource "google_privateca_ca_pool" "default" {
33+
name = "customer-ca-pool-${random_string.default.result}"
2634
location = "asia-northeast1"
2735
tier = "DEVOPS"
2836
publishing_options {
@@ -33,20 +41,20 @@ resource "google_privateca_ca_pool" "customer_ca_pool" {
3341
# [END cloud_sql_mysql_instance_ca_pool]
3442

3543
# [START cloud_sql_mysql_instance_ca]
36-
resource "google_privateca_certificate_authority" "customer_ca" {
37-
pool = google_privateca_ca_pool.customer_ca_pool.name
38-
certificate_authority_id = "tf-test-ca"
44+
resource "google_privateca_certificate_authority" "default" {
45+
pool = google_privateca_ca_pool.default.name
46+
certificate_authority_id = "my-certificate-authority"
3947
location = "asia-northeast1"
4048
lifetime = "86400s"
4149
type = "SELF_SIGNED"
42-
deletion_protection = false
50+
deletion_protection = false # set to "true" in production
4351
skip_grace_period = true
4452
ignore_active_certificates_on_deletion = true
4553
config {
4654
subject_config {
4755
subject {
48-
organization = "Test LLC"
49-
common_name = "my-ca"
56+
organization = "my organization"
57+
common_name = "my certificate authority name"
5058
}
5159
}
5260
x509_config {
@@ -71,31 +79,28 @@ resource "google_privateca_certificate_authority" "customer_ca" {
7179
# [END cloud_sql_mysql_instance_ca]
7280

7381
# [START cloud_sql_mysql_instance_iam_granting]
74-
resource "google_privateca_ca_pool_iam_member" "granting" {
75-
ca_pool = google_privateca_ca_pool.customer_ca_pool.id
82+
resource "google_privateca_ca_pool_iam_member" "default" {
83+
ca_pool = google_privateca_ca_pool.default.id
7684
role = "roles/privateca.certificateRequester"
7785

78-
member = "serviceAccount:${google_project_service_identity.gcp_sa_cloud_sql.email}"
86+
member = "serviceAccount:${google_project_service_identity.default.email}"
7987
}
8088
# [END cloud_sql_mysql_instance_iam_granting]
8189

8290
# [START cloud_sql_mysql_instance_customer_managed_cas_ca]
83-
resource "google_sql_database_instance" "mysql_instance" {
91+
resource "google_sql_database_instance" "default" {
8492
name = "mysql-instance"
8593
region = "asia-northeast1"
86-
database_version = "MYSQL_8_0"
94+
database_version = "MYSQL_8_4"
8795
settings {
8896
tier = "db-f1-micro"
8997
ip_configuration {
9098
# The following server CA mode lets the instance use customer-managed CAS CA to issue server certificates.
9199
# https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/instances#ipconfiguration
92100
server_ca_mode = "CUSTOMER_MANAGED_CAS_CA"
93-
# This is the name of the customer-owned CAS CA pool.
94-
server_ca_pool = google_privateca_ca_pool.customer_ca_pool.id
101+
server_ca_pool = google_privateca_ca_pool.default.id
95102
}
96103
}
97-
# set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
98-
# use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
99-
deletion_protection = false
104+
deletion_protection = false # set to "true" in production
100105
}
101106
# [END cloud_sql_mysql_instance_customer_managed_cas_ca]

‎cloud_sql/mysql_instance_google_managed_cas_ca/main.tf‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2025 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -15,10 +15,10 @@
1515
*/
1616

1717
# [START cloud_sql_mysql_instance_google_managed_cas_ca]
18-
resource "google_sql_database_instance" "mysql_instance" {
18+
resource "google_sql_database_instance" "default" {
1919
name = "mysql-instance"
2020
region = "asia-northeast1"
21-
database_version = "MYSQL_8_0"
21+
database_version = "MYSQL_8_4"
2222
settings {
2323
tier = "db-f1-micro"
2424
ip_configuration {
@@ -27,8 +27,6 @@ resource "google_sql_database_instance" "mysql_instance" {
2727
server_ca_mode = "GOOGLE_MANAGED_CAS_CA"
2828
}
2929
}
30-
# set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
31-
# use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
32-
deletion_protection = false
30+
deletion_protection = false # set to "true" in production
3331
}
3432
# [END cloud_sql_mysql_instance_google_managed_cas_ca]

‎cloud_sql/postgres_instance_customer_managed_cas_ca/main.tf‎

Lines changed: 28 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2025 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -14,39 +14,47 @@
1414
* limitations under the License.
1515
*/
1616
# [START cloud_sql_instance_service_identity]
17-
resource "google_project_service_identity" "gcp_sa_cloud_sql" {
17+
resource "google_project_service_identity" "default" {
1818
provider = google-beta
1919
service = "sqladmin.googleapis.com"
2020
}
2121
# [END cloud_sql_instance_service_identity]
2222

23-
# [START cloud_sql_postgres_instance_ca_pool]
24-
resource "google_privateca_ca_pool" "customer_ca_pool" {
25-
name = "tf-test-cap"
23+
# [START privateca_ca_pool_suffix]
24+
resource "random_string" "default" {
25+
length = 10
26+
special = false
27+
upper = false
28+
}
29+
# [END privateca_ca_pool_suffix]
30+
31+
# [START cloud_sql_mysql_instance_ca_pool]
32+
resource "google_privateca_ca_pool" "default" {
33+
name = "customer-ca-pool-${random_string.default.result}"
2634
location = "asia-northeast1"
2735
tier = "DEVOPS"
2836
publishing_options {
2937
publish_ca_cert = false
3038
publish_crl = false
3139
}
3240
}
33-
# [END cloud_sql_postgres_instance_ca_pool]
41+
# [END cloud_sql_mysql_instance_ca_pool]
3442

3543
# [START cloud_sql_postgres_instance_ca]
36-
resource "google_privateca_certificate_authority" "customer_ca" {
37-
pool = google_privateca_ca_pool.customer_ca_pool.name
38-
certificate_authority_id = "tf-test-ca"
44+
resource "google_privateca_certificate_authority" "default" {
45+
pool = google_privateca_ca_pool.default.name
46+
certificate_authority_id = "my-certificate-authority"
3947
location = "asia-northeast1"
4048
lifetime = "86400s"
4149
type = "SELF_SIGNED"
42-
deletion_protection = false
50+
deletion_protection = false # set to "true" in production
4351
skip_grace_period = true
4452
ignore_active_certificates_on_deletion = true
4553
config {
4654
subject_config {
4755
subject {
48-
organization = "Test LLC"
49-
common_name = "my-ca"
56+
organization = "my organization"
57+
common_name = "my certificate authority name"
5058
}
5159
}
5260
x509_config {
@@ -71,31 +79,28 @@ resource "google_privateca_certificate_authority" "customer_ca" {
7179
# [END cloud_sql_postgres_instance_ca]
7280

7381
# [START cloud_sql_postgres_instance_iam_granting]
74-
resource "google_privateca_ca_pool_iam_member" "granting" {
75-
ca_pool = google_privateca_ca_pool.customer_ca_pool.id
82+
resource "google_privateca_ca_pool_iam_member" "default" {
83+
ca_pool = google_privateca_ca_pool.default.id
7684
role = "roles/privateca.certificateRequester"
7785

78-
member = "serviceAccount:${google_project_service_identity.gcp_sa_cloud_sql.email}"
86+
member = "serviceAccount:${google_project_service_identity.default.email}"
7987
}
8088
# [END cloud_sql_postgres_instance_iam_granting]
8189

8290
# [START cloud_sql_postgres_instance_google_managed_cas_ca]
83-
resource "google_sql_database_instance" "postgres_instance" {
91+
resource "google_sql_database_instance" "default" {
8492
name = "postgres-instance"
8593
region = "asia-northeast1"
86-
database_version = "POSTGRES_14"
94+
database_version = "POSTGRES_17"
8795
settings {
88-
tier = "db-custom-2-7680"
96+
tier = "db-f1-micro"
8997
ip_configuration {
9098
# The following server CA mode lets the instance use customer-managed CAS CA to issue server certificates.
9199
# https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/instances#ipconfiguration
92100
server_ca_mode = "CUSTOMER_MANAGED_CAS_CA"
93-
# This is the name of the customer-owned CAS CA pool.
94-
server_ca_pool = google_privateca_ca_pool.customer_ca_pool.id
101+
server_ca_pool = google_privateca_ca_pool.default.id
95102
}
96103
}
97-
# set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
98-
# use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
99-
deletion_protection = false
104+
deletion_protection = false # set to "true" in production
100105
}
101106
# [END cloud_sql_postgres_instance_google_managed_cas_ca]

‎cloud_sql/postgres_instance_google_managed_cas_ca/main.tf‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2025 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -15,20 +15,18 @@
1515
*/
1616

1717
# [START cloud_sql_postgres_instance_google_managed_cas_ca]
18-
resource "google_sql_database_instance" "postgres_instance" {
18+
resource "google_sql_database_instance" "default" {
1919
name = "postgres-instance"
2020
region = "asia-northeast1"
21-
database_version = "POSTGRES_14"
21+
database_version = "POSTGRES_17"
2222
settings {
23-
tier = "db-custom-2-7680"
23+
tier = "db-f1-micro"
2424
ip_configuration {
2525
# The following server CA mode lets the instance use Google-managed CAS CA to issue server certificates.
2626
# https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/instances#ipconfiguration
2727
server_ca_mode = "GOOGLE_MANAGED_CAS_CA"
2828
}
2929
}
30-
# set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
31-
# use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
32-
deletion_protection = false
30+
deletion_protection = false # set to "true" in production
3331
}
3432
# [END cloud_sql_postgres_instance_google_managed_cas_ca]

‎cloud_sql/sqlserver_instance_customer_managed_cas_ca/main.tf‎

Lines changed: 27 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* Copyright 2022 Google LLC
2+
* Copyright 2025 Google LLC
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -14,39 +14,47 @@
1414
* limitations under the License.
1515
*/
1616
# [START cloud_sql_instance_service_identity]
17-
resource "google_project_service_identity" "gcp_sa_cloud_sql" {
17+
resource "google_project_service_identity" "default" {
1818
provider = google-beta
1919
service = "sqladmin.googleapis.com"
2020
}
2121
# [END cloud_sql_instance_service_identity]
2222

23-
# [START cloud_sql_sqlserver_instance_ca_pool]
24-
resource "google_privateca_ca_pool" "customer_ca_pool" {
25-
name = "tf-test-cap"
23+
# [START privateca_ca_pool_suffix]
24+
resource "random_string" "default" {
25+
length = 10
26+
special = false
27+
upper = false
28+
}
29+
# [END privateca_ca_pool_suffix]
30+
31+
# [START cloud_sql_mysql_instance_ca_pool]
32+
resource "google_privateca_ca_pool" "default" {
33+
name = "customer-ca-pool-${random_string.default.result}"
2634
location = "asia-northeast1"
2735
tier = "DEVOPS"
2836
publishing_options {
2937
publish_ca_cert = false
3038
publish_crl = false
3139
}
3240
}
33-
# [END cloud_sql_sqlserver_instance_ca_pool]
41+
# [END cloud_sql_mysql_instance_ca_pool]
3442

3543
# [START cloud_sql_sqlserver_instance_ca]
36-
resource "google_privateca_certificate_authority" "customer_ca" {
37-
pool = google_privateca_ca_pool.customer_ca_pool.name
38-
certificate_authority_id = "tf-test-ca"
44+
resource "google_privateca_certificate_authority" "default" {
45+
pool = google_privateca_ca_pool.default.name
46+
certificate_authority_id = "my-certificate-authority"
3947
location = "asia-northeast1"
4048
lifetime = "86400s"
4149
type = "SELF_SIGNED"
42-
deletion_protection = false
50+
deletion_protection = false # set to "true" in production
4351
skip_grace_period = true
4452
ignore_active_certificates_on_deletion = true
4553
config {
4654
subject_config {
4755
subject {
48-
organization = "Test LLC"
49-
common_name = "my-ca"
56+
organization = "my organization"
57+
common_name = "my certificate authority name"
5058
}
5159
}
5260
x509_config {
@@ -71,32 +79,29 @@ resource "google_privateca_certificate_authority" "customer_ca" {
7179
# [END cloud_sql_sqlserver_instance_ca]
7280

7381
# [START cloud_sql_sqlserver_instance_iam_granting]
74-
resource "google_privateca_ca_pool_iam_member" "granting" {
75-
ca_pool = google_privateca_ca_pool.customer_ca_pool.id
82+
resource "google_privateca_ca_pool_iam_member" "default" {
83+
ca_pool = google_privateca_ca_pool.default.id
7684
role = "roles/privateca.certificateRequester"
7785

78-
member = "serviceAccount:${google_project_service_identity.gcp_sa_cloud_sql.email}"
86+
member = "serviceAccount:${google_project_service_identity.default.email}"
7987
}
8088
# [END cloud_sql_sqlserver_instance_iam_granting]
8189

8290
# [START cloud_sql_sqlserver_instance_require_ssl]
83-
resource "google_sql_database_instance" "sqlserver_instance" {
91+
resource "google_sql_database_instance" "default" {
8492
name = "sqlserver-instance"
8593
region = "asia-northeast1"
86-
database_version = "SQLSERVER_2019_STANDARD"
94+
database_version = "SQLSERVER_2022_STANDARD"
8795
root_password = "INSERT-PASSWORD-HERE"
8896
settings {
8997
tier = "db-custom-2-7680"
9098
ip_configuration {
9199
# The following server CA mode lets the instance use customer-managed CAS CA to issue server certificates.
92100
# https://cloud.google.com/sql/docs/sqlserver/admin-api/rest/v1beta4/instances#ipconfiguration
93101
server_ca_mode = "CUSTOMER_MANAGED_CAS_CA"
94-
# This is the name of the customer-owned CAS CA pool.
95-
server_ca_pool = google_privateca_ca_pool.customer_ca_pool.id
102+
server_ca_pool = google_privateca_ca_pool.default.id
96103
}
97104
}
98-
# set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
99-
# use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
100-
deletion_protection = false
105+
deletion_protection = false # set to "true" in production
101106
}
102107
# [END cloud_sql_sqlserver_instance_require_ssl]

0 commit comments

Comments
 (0)