google-cloud-platform - Terraform - 重用现有的子网在 GCP 上创建云 sql 实例

Question

我正在尝试使用 terraform 在 GCP 上创建云 sql 实例。我想使用在前面的步骤中创建的现有 VPC 子网，但似乎没有办法引用它。相反，所有示例似乎都需要设置新的 IP 范围。这是我当前创建新 IP 范围的代码:

  provider = google-beta
  project  = "project_name"

  name          = "private_range"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 18
  network       = "projects/project_name/global/networks/vpc_name"
  address       = "192.168.128.0"
}

resource "google_service_networking_connection" "private_vpc_connection" {
  provider = google-beta

  network                 = "projects/project_name/global/networks/vpc_name"
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
}

resource "google_sql_database_instance" "instance" {
  provider = google-beta
  project  = "project_name"

  name   = "db-instance10"
  region = "us-east1"
  database_version = "MYSQL_5_7"

  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = "projects/project_name/global/networks/vpc_name"
    }
  }
}

provider "google-beta" {
  region = "us-east1"
  zone   = "us-east1-c"
}

当我指定与现有子网完全相同的 IP 范围时。我收到错误:

Error: Error waiting to create GlobalAddress: Error waiting for Creating GlobalAddress: Requested range conflicts with other resources: The provided IP range overlaps with existing subnetwork IP range.

似乎没有任何明显的方式来引用现有的子网资源，因为 reserved_peering_ranges 参数似乎只接受 IP 地址范围资源的名称。

以下是现有子网的资源规范:

    creation_timestamp       = "2020-06-03T07:28:05.762-07:00"
    enable_flow_logs         = true
    fingerprint              = "ied1TiEZjgc="
    gateway_address          = "192.168.128.1"
    id                       = "us-east1/vpc_subnet_name"
    ip_cidr_range            = "192.168.128.0/18"
    name                     = "vpc_subnet_name"
    network                  = "https://www.googleapis.com/compute/v1/projects/project_name/global/networks/vpc_name"
    private_ip_google_access = true
    project                  = "project_name"
    region                   = "us-east1"
    secondary_ip_range       = []
    self_link                = "https://www.googleapis.com/compute/v1/projects/project_name/regions/us-east1/subnetworks/vpc_subnet_name"

    log_config {
        aggregation_interval = "INTERVAL_5_SEC"
        flow_sampling        = 0.5
        metadata             = "INCLUDE_ALL_METADATA"
    }
}

Answer 1

通过 private IP 连接到 Cloud sql 实例需要配置 private service access使用 allocated IP address range不得与任何现有 VPC 子网重叠。

专用连接将您的 VPC 网络与服务的 VPC 网络链接起来。此连接允许 VPC 网络中的 VM 实例使用内部 IP 地址访问服务资源，例如具有内部 IP 地址的 Cloud sql 实例。

创建后，分配的 IP 地址范围和连接可以与其他服务重复使用。