README.md

Introduction

Cloud SQL has a Private Service Connect based offering for connectivity where it exposes producer resources using a service attachment when a user creates a Cloud SQL instance. Cloud SQL with enabled PSC connectivity expects the user to create an endpoint to connect to the corresponding service attachment.

This solution automates the process of creation of Private Service Connect endpoint for the user. You can read more about Private Service Connect for SQL. Here the consumer's project is accessing managed producer services using a private IP address while the producer project is exposing services to consumers' project via service attachments without exposing the SQL instances to the public Internet via a public IP.

Here is a brief overview of the resources being created by the terraform solution :

1. VPC Network and subnets in the consumer project
2. Cloud SQL instance in the producer project with PSC enabled (this Cloud SQL instance creates and comes with a Service attachment for PSC connection)
3. Endpoint in the consumer project to access the Service Attachment
4. VM instance in the consumer project with Cloud NAT
5. Firewall rules to allow only authorised instances to connect to Cloud SQL instance
6. Service account used by the compute instance
7. If required, enable services in consumer & producer projects

After the listed resources have been created, this solution connects a VM instance in the consumer project to the Cloud SQL instance.

Note :

• The TF solution requires an existing consumer project & producer project.

Producer Project : this is a customer owned Google Cloud project in which a customer creates a Cloud SQL instance or any other producer service.

Consumer Project : this is a customer owned Google Cloud project which is accessing the producer resources sitting in a producer project through an endpoint in its network.

• The region for the service attachment of the PSC enabled SQL instance and the service connect endpoint must be the same

Benefits:

• Easily and securely connects your private network (consumer) to access Cloud SQL instance (producer).
• Removes the need to configure an internet gateway or a VPC peering connection. Simplify the management of complicated cloud network architectures.
• Prevents your network traffic from being exposed to the public internet. Data remains secure on Google’s backbone network.
• Reduces costs by avoiding public IP addresses.

Use cases:

• Managing connectivity across private networks with overlapping CIDR ranges
• Developing, testing & running production applications that use Cloud SQL

Architecture

Components :

1. Customer Organisation : Customer's Organisation on Google Cloud. Customer has created & manages this Google Cloud organisation.
2. Customer Organisation - Consumer Project (12345) : Customer's project on Google Cloud. Customer has created & manages this Google Cloud project. This is the project which accesses the producer services from producer projects created in Customer Organisation - Producer Project (56789).
3. Customer Organisation - Cloud SQL (Producer) Project (56789) : Customer's project on Google Cloud. Customer has created & manages this Google Cloud project. This is the project in which customer creates a producer service such as Cloud SQL.
4. Google-owned Organisation : Google Cloud owned organisation to manage the Cloud projects in which resources are created in consumer projects by customers.
5. Google Organisation - Producer Project (45678) : Google Cloud owned project to manage Cloud resources created in consumer projects by customers.
6. Cloud SQL Producer VPC : Google Cloud project's VPC
7. VM : Customer's Compute Instance in customer consumer project which connects to the producer resources in producer project.
8. NAT : NAT in Customer's project to connect customer's Compute Instance to the internet to retrieve packages for DB connection/creation for the VM.
9. PSC Endpoint : Reserved internal IP address in a consumer VPC network with forwarding rule to target Service Attachment for Cloud SQL connection.
10. Service Attachment : are resources can be accessed by using endpoints. A service attachment targets a producer load balancer and lets clients in a consumer VPC network access the load balancer.
11. Dotted Line : The dashed line in between divides a customer's organisation on Google cloud with customer created projects and Google's organisation with Google created projects.
12. Dot-Dashed Line : The dot-dashed line is a connection showing presence of a NAT in the customer's VPC for the Compute instance to leverage in case of pulling relevant resources to access Cloud SQL.
13. Dashed Line : The dashed line is a connection in between Cloud SQL in customer's project as a producer service and the Cloud SQL running over a VM instance in a Google owned cloud project.

Prerequisite

1. User must have terraform and gcloud installed in the machine from which they plan to execute the TF templated scripts which are a part of this solution. Here is the link that describes the Terraform installation steps and gcloud SDK Installation Steps .

2. Users should have the Google Cloud projects which will be used as part of this guide - customer's consumer and customer's producer.

3. Users planning to run this TF solution should have following permissions at least assigned to them in the respective projects as described below. User can either use GCP web console or gcloud cli to assign these permission to the user identity that will execute the solution/script.

   • Customer's Consumer Project

     • roles/compute.networkAdmin
     • roles/compute.securityAdmin
     • roles/iam.serviceAccountAdmin
     • roles/serviceusage.serviceUsageAdmin
     • roles/resourcemanager.projectIamAdmin
     • roles/compute.instanceAdmin

   • Customer's Producer Project

     • roles/cloudsql.admin
     • roles/iam.serviceAccountAdmin
     • roles/serviceusage.serviceUsageAdmin
     • roles/resourcemanager.projectIamAdmin

Execution

1. Authenticate using gcloud command gcloud auth application-default login in the cli/machine that will execute the terraform solution. This link describes more detail about the gcloud auth command mentioned above.
2. Change directory cd in to the example directory cloudsql-easy-networking/examples/3.PSC in order to execute the terraform code.
3. Update the variables in terraform.tfvars as per your configuration like consumer_project_id, producer_project_id etc. User can also go through the Inputs section of this readme that describes the list of input variables that can be updated. Here are two examples of the terraform.tfvars file which can be referred while updating your terraform.tfvars file.
4. Run the command terraform init. This command initializes the working directory containing terraform configuration files. More description about terraform init.
5. Run the command terraform validate to validate the configuration files present in this directory. More description about terraform validate.
6. Run the command terraform plan. This command creates an execution plan, which lets you preview the changes that terraform plans to make in your infrastructure. More details about terraform plan command.Review the content displayed in the plan stage and if all looks good then move to next step.
7. Run the terraform applyand type yes when asked for confirmation/approval. This command executes the actions proposed in a terraform plan. More details about terraform apply.
8. Deleting resources : Enter terraform destroy and type yes when asked for confirmation/approval. This command will delete the resources created using the terraform. More details about terraform destroy.

Examples

This example leverages the existing network and subnetwork. Network information like consumer_network_name, consumer_project_id and consumer_subnetwork_name should be passed in the terraform.tfvars file. If an existing network doesn't exist with the same configuration, terraform shall create a new network/subnetwork with the provided details. The terraform.tfvars should look like :

```
## Producer Project tfvars
cloudsql_instance_name   = "cloudsql-easy-instance"
database_version         = "MYSQL_8_0"
producer_cidr            = "192.168.0.0/16"
producer_project_id      = "<Producer Project>"
deletion_protection      = "false"

## Consumer Project tfvars
consumer_cidr            = "10.0.0.0/16"
consumer_network_name    = "cloudsql-easy"
consumer_project_id      = "<Consumer Project>"
consumer_subnetwork_name = "cloudsql-easy-subnet"

## Common
region                   = "us-central1"
zone                     = "us-central1-a"
```

Requirements

No requirements.

Providers

Name	Version
google	4.84.0
template	2.2.0

Modules

Name	Source	Version
compute_address	terraform-google-modules/address/google	n/a
consumer_nat	../../modules/net-cloudnat	n/a
consumer_project	../../modules/services	n/a
consumer_vpc	../../modules/net-vpc	n/a
firewall_rules	../../modules/firewall-rules	n/a
gce_sa	../../modules/iam-service-account	n/a
google_compute_instance	../../modules/computeinstance	n/a
producer_project	../../modules/services	n/a
sql_db	../../modules/cloudsql	n/a
terraform_service_accounts	../../modules/iam-service-account	n/a

Resources

Name	Type
google_compute_forwarding_rule.cloudsql_forwarding_rule	resource
google_compute_network.consumer_vpc	data source
google_compute_subnetwork.consumer_vpc_subnetwork	data source
template_file.mysql_installer	data source

Inputs

Name	Description	Type	Default	Required
cloudsql_instance_name	Name of the cloud sql instance which will be created.	string	n/a	yes
consumer_cidr	CIDR Range of the Consumer VPC	string	n/a	yes
consumer_network_name	Name of the network to be created in Consumer project	string	n/a	yes
consumer_project_id	Project ID of the Consumer GCP Project.	string	n/a	yes
consumer_subnetwork_name	Name of the subnetwork to be created in Consumer project	string	n/a	yes
create_mysql_db	Bool value to create MySQL DB	bool	true	no
create_nat	Boolean variable to create the Cloud NAT for allowing the VM to connect to external Internet.	bool	true	no
create_network	Variable to determine if a new network should be created or not.	bool	true	no
create_postgresql_db	Bool value to create Postgres DB	bool	false	no
create_subnetwork	Variable to determine if a new sub network should be created or not.	bool	true	no
database_version	Database version of the mysql in Cloud SQL .	string	n/a	yes
deletion_protection	Enable delete protection.	bool	true	no
gce_tags	List of tags to be applied to gce instance.	list(string)	[ "cloudsql" ]	no
load_balancing_scheme	Load Balacing Scheme for the ILB/Forwarding Rule	string	""	no
nat_name	Name of the cloud nat to be created.	string	"sqleasy-nat"	no
producer_project_id	Project ID of the Producer GCP Project.	string	n/a	yes
region	Name of a GCP region.	string	n/a	yes
reserved_ips	IP to reserve for connecting to the SQL instance.	list(string)	[ "10.0.0.5" ]	no
router_name	Name of the router to be used by the NAT.	string	"sqleasynatrouter-1"	no
source_image	Source disk image. If neither source_image nor source_image_family is specified, defaults to the latest public image.	string	""	no
source_image_family	Source image family. If neither source_image nor source_image_family is specified, defaults to the latest public image.	string	"ubuntu-2204-lts"	no
source_image_project	Project where the source image comes from. The default project contains images.	string	"ubuntu-os-cloud"	no
test_dbname	Test DB being created inside the Cloud SQL isntance	string	"test"	no
zone	Name of a GCP zone, should be in the same region as specified in the region variable.	string	n/a	yes

Outputs

Name	Description
cloudsql_instance_name	Name of the SQL instance created in the producer project.
cloudsql_instance_psc_attachment	The psc_service_attachment_link created for the master instance
compute_instance_name	Name of the compute instance created
consumer_network_id	Network ID for the consumer VPC network created in the consumer project.
consumer_network_name	Name of the consumer VPC
consumer_subnetwork_id	Sub Network ID created inside the consumer VPC network created in the consumer project.
reserved_ip	IP Address reserved as service endpoint