Terraform-GCP上的循环依赖问题

Question

我正在GCP上配置多个资源，包括一个云SQL(Postgres(数据库和一个VM实例。在terraform apply期间，我正在与Terraform的循环依赖作斗争，如：

• 云SQL(Postgres(需要虚拟机的IP进行IP白名单
• VM使用一个启动脚本，该脚本需要Postgres DB的公共IP

因此，循环依赖。。。你有什么建议在Terraform中解决这个问题吗？

创建GCP VM的文件(包括一个需要Postgres DB IP的启动脚本(

data "template_file" "startup_script_airbyte" {
template = file("${path.module}/sh_scripts/airbyte.sh")
vars = {
db_public_ip = "${google_sql_database_instance.postgres.public_ip_address}"
db_name_prefix = "${var.db_name}"
db_user = "${var.db_user}"
db_password = "${var.db_password}"
}
}
resource "google_compute_instance" "airbyte_instance" {
name                    = "${google_project.data_project.project_id}-airbyte"
machine_type            = local.airbyte_machine_type
project                 = google_project.data_project.project_id
metadata_startup_script = data.template_file.startup_script_airbyte.rendered #file("./sh_scripts/airbyte.sh")
allow_stopping_for_update = true
depends_on = [
google_project_service.data_project_services,
]
boot_disk {
initialize_params {
image = "ubuntu-2004-focal-v20210415"
size  = 50
type  = "pd-balanced"
}
}
network_interface {
network = "default"
access_config {
network_tier = "PREMIUM"
}
}
service_account {
email  = google_service_account.airbyte_sa.email
scopes = ["cloud-platform"]
}
}

创建Postgres DB的脚本(需要上面VM的IP(

resource "google_sql_database_instance" "postgres" {
name = "postgres-instance-${random_id.db_name_suffix.hex}"
project = google_project.data_project.project_id
database_version = "POSTGRES_13"
settings{
tier = "db-f1-micro"
backup_configuration {
enabled = true
start_time = "02:00"
}
database_flags {
name  = "cloudsql.iam_authentication"
value = "on"
}
database_flags {
name  = "max_connections"
value = 30000
}

#Whitelisting the IPs of the GCE VMs in Postgres
ip_configuration {
ipv4_enabled = "true"
authorized_networks {
name = "${google_compute_instance.airbyte_instance.name}"
value = "${google_compute_instance.airbyte_instance.network_interface.0.access_config.0.nat_ip}"
}
}
}
}

Answer 1

克服这一问题的一种方法是使用google_computer_address获取静态公共IP。您可以在创建实例之前执行此操作，然后将其附加到实例。

这样，在创建实例之前，IP可以在Cloud SQL中被列入白名单。

Answer 2

正确的解决方案是在VM中安装Cloud SQL Auth Proxy。那么您就不需要将IP地址列入白名单。这将删除循环依赖项。