First of all I have to apologize and admit that I am new GCP so sorry if I am unclear with anything here.
I have two terraform recipes, one where I am setting up google cloud sql, and some networking around it. And one where I am setting up some other resources and networking supporting them. The end goal is to make it so that resources in the second recipe can access the cloud sql instance established in the first.
I have verified that the network resources established in the first recipe, do allow connections to the cloud sql instance. But when I attempt to test the connection from an instance in the second recipe it doesn't work. Upon reviewing things. I noticed the following:
- The peered network connection between the vpc in the second recipe and servicenetworking.googleapis.com doesn't import any routes, but the peered vpc in the first one does.
- The project ids for the two peering connections are different, even if deployed from the same recipe (as an experiment I moved the peering connection from recipe 1 to recipe 2 and they still come out with different project ids for the peered network they are peering too )
The following is the network for recipe 2:
resource "google_compute_network" "vpc-network" {
name = "vpc-network-${var.environment}"
auto_create_subnetworks = false
routing_mode = "GLOBAL"
delete_default_routes_on_create = true
}
resource "google_compute_subnetwork" "subnet" {
name = "subnet-${var.environment}"
ip_cidr_range = var.subnet_cidr
region = var.gcp_region
network = google_compute_network.vpc-network.name
private_ip_google_access = true
}
resource "google_compute_route" "egress-internet" {
name = "egress-internet-${var.environment}"
dest_range = "0.0.0.0/0"
network = google_compute_network.vpc-network.name
next_hop_gateway = "default-internet-gateway"
}
resource "google_compute_router" "router" {
name = "router-${var.environment}"
region = google_compute_subnetwork.subnet.region
network = google_compute_network.vpc-network.name
}
resource "google_compute_router_nat" "nat-router" {
name = "nat-router-${var.environment}"
router = google_compute_router.router.name
region = google_compute_router.router.region
nat_ip_allocate_option = "AUTO_ONLY"
source_subnetwork_ip_ranges_to_nat = "LIST_OF_SUBNETWORKS"
subnetwork {
name = google_compute_subnetwork.subnet.name
source_ip_ranges_to_nat = ["ALL_IP_RANGES"]
}
log_config {
enable = true
filter = "ERRORS_ONLY"
}
}
resource "google_compute_firewall" "iap-bastion" {
name = "iap-bastion-${var.environment}"
network = google_compute_network.vpc-network.self_link
allow {
protocol = "tcp"
ports = ["22"]
}
target_tags = ["bastion"]
source_ranges = ["35.235.240.0/20"] # This range contains all IP addresses that IAP uses for TCP forwarding.
}
resource "google_compute_global_address" "private-ip-addr" {
name = "private-ip-addr-${var.environment}"
purpose = "VPC_PEERING"
address_type = "INTERNAL"
prefix_length = 16
network = google_compute_network.vpc-network.id
}
resource "google_service_networking_connection" "service-network-connection" {
network = google_compute_network.vpc-network.id
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = [google_compute_global_address.private-ip-addr.name]
}
The following is the recipe for the sql and network for recipe 1:
resource "random_id" "db_name_suffix" {
byte_length = 2
}
resource "google_sql_database_instance" "sql-db" {
name = "sql-db-${var.environment}-${random_id.db_name_suffix.hex}"
region = var.gcp_region
database_version = var.rds_db_version
deletion_protection = false
depends_on = [google_service_networking_connection.private-vpc-connection]
settings {
tier = var.rds_instance_type
ip_configuration {
ipv4_enabled = false
private_network = google_compute_network.sql-db-network.id
}
}
}
resource "google_sql_user" "sql-db-user" {
name = "user"
instance = google_sql_database_instance.sql-db.name
password = data.vault_generic_secret.postgres_password.data[var.environment]
}
resource "google_compute_network" "sql-db-network" {
name = "sql-db-network-${var.environment}"
auto_create_subnetworks = false
routing_mode = "GLOBAL"
delete_default_routes_on_create = true
}
resource "google_compute_subnetwork" "sql-db-subnet" {
name = "sql-db-subnet-${var.environment}"
ip_cidr_range = var.holocron_cidr
region = var.gcp_region
network = google_compute_network.sql-db-network.name
private_ip_google_access = true
}
resource "google_compute_global_address" "sql-db-private-ip-addr" {
name = "sql-db-private-ip-addr-${var.environment}"
purpose = "VPC_PEERING"
address_type = "INTERNAL"
prefix_length = 16
network = google_compute_network.sql-db-network.id
}
resource "google_compute_network_peering" "sql-db-network-to" {
name = "sql-db-network-to-${var.environment}"
network = google_compute_network.sql-db-network.self_link
peer_network = "https://www.googleapis.com/compute/v1/projects/project/global/networks/vpc-network-development"
}
resource "google_compute_network_peering" "to-sql-db-network" {
name = "to-sql-db-network-${var.environment}"
peer_network = google_compute_network.sql-db-network.self_link
network = "https://www.googleapis.com/compute/v1/projects/project/global/networks/vpc-network-development"
}
resource "google_service_networking_connection" "private-vpc-connection" {
network = google_compute_network.sql-db-network.id
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = [google_compute_global_address.sql-db-private-ip-addr.name]
}
resource "google_service_networking_connection" "service-network-connection" {
network = google_compute_network.sql-db-network.name
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = [google_compute_global_address.sql-db-private-ip-addr.name]
}
Any insight that can be given to help me understand why they have different project ids, and how to get them to not have that, or if that is okay how to get the routes imported correctly would be greatly appreciated.
Thank you,