Merge pull request GoogleCloudPlatform#4477 from okrause/gcnv-integration

Allow alternative services for private-service-access

Author: samskillman

community/modules/network/private-service-access/README.md

@@ -2,23 +2,31 @@
 
 This module configures [private service access][psa] for the VPC specified by
 the `network_id` variable. It can be used by the
-[Cloud SQL Federation module][sql].
+[Cloud SQL Federation module][sql] or to connect [Google Cloud NetApp Volumes][gcnv].
 
 It will automatically perform the following steps, as described in the
 [Private Service Access][psa-creation] creation page:
 
 * Create an IP Allocation with the prefix_length specified by the
-  `ip_alloc_prefix_length` variable.
+  `ip_alloc_prefix_length` variable. Let Google pick the base address automatically, or specify it by using the `address` variable.
 * Create a private connection that establishes a [VPC Network Peering][vpcnp]
-  connection between your VPC network and the service producer's network
+  connection between your VPC network and the service producer's network.
+* When connecting to Google Cloud NetApp Volumes, it imports and exports custom routes.
+
+### deletion_policy
+Some services like CloudSQL or NetApp Volumes delete some internal backend resources lazily. This may take up to a few hours. Deleting the PSA peering while the backend resources still exist will fail. Set `deletion_policy = "ABANDON"` to enable error-free deletion for such PSA connections. See [deletion_policy][deletion_policy].
 
 [sql]: https://github.com/GoogleCloudPlatform/hpc-toolkit/tree/main/community/modules/database/slurm-cloudsql-federation
 [psa]: https://cloud.google.com/vpc/docs/configure-private-services-access
 [psa-creation]: https://cloud.google.com/vpc/docs/configure-private-services-access#procedure
 [vpcnp]: https://cloud.google.com/vpc/docs/vpc-peering
+[gcnv]: https://cloud.google.com/netapp/volumes/docs/discover/overview
+[deletion_policy]: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_networking_connection.html#deletion_policy-1
 
 ### Example
 
+Connecting services which use a service networking PSA connection:
+
 ```yaml
   - source: modules/network/vpc
     id: network
@@ -31,6 +39,21 @@ It will automatically perform the following steps, as described in the
     use: [network]
 ```
 
+Connecting [Google Cloud NetApp Volumes](https://cloud.google.com/netapp/volumes/docs/discover/overview) for using it as a shared filesystem:
+
+```yaml
+  - source: modules/network/vpc
+    id: network
+
+  - source: community/modules/network/private-service-access
+    id: ps_connect
+    use: [network]
+    settings:
+      prefix_length: 24
+      service_name: "netapp.servicenetworking.goog"
+      deletion_policy: "ABANDON"
+```
+
 ## License
 
 <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
@@ -53,16 +76,14 @@ limitations under the License.
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.2 |
-| <a name="requirement_google"></a> [google](#requirement\_google) | >= 3.83 |
-| <a name="requirement_google-beta"></a> [google-beta](#requirement\_google-beta) | >= 3.83 |
+| <a name="requirement_google"></a> [google](#requirement\_google) | >= 6.40 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_google"></a> [google](#provider\_google) | >= 3.83 |
-| <a name="provider_google-beta"></a> [google-beta](#provider\_google-beta) | >= 3.83 |
+| <a name="provider_google"></a> [google](#provider\_google) | >= 6.40 |
 | <a name="provider_random"></a> [random](#provider\_random) | ~> 3.0 |
 
 ## Modules
@@ -73,19 +94,22 @@ No modules.
 
 | Name | Type |
 |------|------|
-| [google-beta_google_compute_global_address.private_ip_alloc](https://registry.terraform.io/providers/hashicorp/google-beta/latest/docs/resources/google_compute_global_address) | resource |
+| [google_compute_global_address.private_ip_alloc](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_global_address) | resource |
+| [google_compute_network_peering_routes_config.private_vpc_peering_routes_gcnv](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_network_peering_routes_config) | resource |
 | [google_service_networking_connection.private_vpc_connection](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/service_networking_connection) | resource |
 | [random_id.resource_name_suffix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_address"></a> [address](#input\_address) | The IP address or beginning of the address range allocated for the private service access. | `string` | `null` | no |
+| <a name="input_address"></a> [address](#input\_address) | The IP address or beginning of the address range allocated for the Private Service Access. | `string` | `null` | no |
+| <a name="input_deletion_policy"></a> [deletion\_policy](#input\_deletion\_policy) | The policy to apply when deleting the Private Service Access. Leave empty or use ABANDON. | `string` | `null` | no |
 | <a name="input_labels"></a> [labels](#input\_labels) | Labels to add to supporting resources. Key-value pairs. | `map(string)` | n/a | yes |
-| <a name="input_network_id"></a> [network\_id](#input\_network\_id) | The ID of the GCE VPC network to configure private service Access.:<br/>`projects/<project_id>/global/networks/<network_name>`" | `string` | n/a | yes |
-| <a name="input_prefix_length"></a> [prefix\_length](#input\_prefix\_length) | The prefix length of the IP range allocated for the private service access. | `number` | `16` | no |
+| <a name="input_network_id"></a> [network\_id](#input\_network\_id) | The ID of the GCE VPC network to configure Private Service Access:<br/>`projects/<project_id>/global/networks/<network_name>`" | `string` | n/a | yes |
+| <a name="input_prefix_length"></a> [prefix\_length](#input\_prefix\_length) | The prefix length of the IP range allocated for the Private Service Access. | `number` | `16` | no |
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | ID of project in which Private Service Access will be created. | `string` | n/a | yes |
+| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | The name of the service to connect. Defaults to 'servicenetworking.googleapis.com'. | `string` | `"servicenetworking.googleapis.com"` | no |
 
 ## Outputs
 

community/modules/network/private-service-access/main.tf

@@ -19,12 +19,18 @@ locals {
   labels = merge(var.labels, { ghpc_module = "private-service-access", ghpc_role = "network" })
 }
 
+locals {
+  split_network_id = split("/", var.network_id)
+  network_name     = local.split_network_id[4]
+  network_project  = local.split_network_id[1]
+}
+
 resource "random_id" "resource_name_suffix" {
   byte_length = 4
 }
 
 resource "google_compute_global_address" "private_ip_alloc" {
-  provider      = google-beta
+  provider      = google
   name          = "global-psconnect-ip-${random_id.resource_name_suffix.hex}"
   project       = var.project_id
   purpose       = "VPC_PEERING"
@@ -37,6 +43,18 @@ resource "google_compute_global_address" "private_ip_alloc" {
 
 resource "google_service_networking_connection" "private_vpc_connection" {
   network                 = var.network_id
-  service                 = "servicenetworking.googleapis.com"
+  service                 = var.service_name
   reserved_peering_ranges = [google_compute_global_address.private_ip_alloc.name]
+  deletion_policy         = var.deletion_policy
+}
+
+# Google Cloud NetApp Volumes need enablement of custom_route import and export
+resource "google_compute_network_peering_routes_config" "private_vpc_peering_routes_gcnv" {
+  count   = var.service_name == "netapp.servicenetworking.goog" ? 1 : 0
+  project = local.network_project
+  network = local.network_name
+  peering = google_service_networking_connection.private_vpc_connection.peering
+
+  export_custom_routes = true
+  import_custom_routes = true
 }

community/modules/network/private-service-access/variables.tf

@@ -13,14 +13,14 @@
 # limitations under the License.
 
 variable "address" {
-  description = "The IP address or beginning of the address range allocated for the private service access."
+  description = "The IP address or beginning of the address range allocated for the Private Service Access."
   type        = string
   default     = null
 }
 
 variable "network_id" {
   description = <<-EOT
-    The ID of the GCE VPC network to configure private service Access.:
+    The ID of the GCE VPC network to configure Private Service Access:
     `projects/<project_id>/global/networks/<network_name>`"
     EOT
   type        = string
@@ -36,7 +36,7 @@ variable "labels" {
 }
 
 variable "prefix_length" {
-  description = "The prefix length of the IP range allocated for the private service access."
+  description = "The prefix length of the IP range allocated for the Private Service Access."
   type        = number
   default     = 16
 }
@@ -45,3 +45,15 @@ variable "project_id" {
   description = "ID of project in which Private Service Access will be created."
   type        = string
 }
+
+variable "service_name" {
+  description = "The name of the service to connect. Defaults to 'servicenetworking.googleapis.com'."
+  type        = string
+  default     = "servicenetworking.googleapis.com"
+}
+
+variable "deletion_policy" {
+  description = "The policy to apply when deleting the Private Service Access. Leave empty or use ABANDON."
+  type        = string
+  default     = null
+}

community/modules/network/private-service-access/versions.tf

@@ -18,11 +18,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = ">= 3.83"
-    }
-    google-beta = {
-      source  = "hashicorp/google-beta"
-      version = ">= 3.83"
+      version = ">= 6.40"
     }
     random = {
       source  = "hashicorp/random"