fix(infra): remove VPC peering complexity for Cloud SQL access #127
+336
−13
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Manage Cloud SQL instances for dev and prod (preview uses dev via peering) - Auto-generate passwords and store in Secret Manager - Configure minimal resources for testing - Implement bidirectional VPC peering between preview and dev - Organize VPC peering configuration in vpc.tf
- Dev: db-custom-2-3840 (2 vCPUs, 3.75GB RAM, 50GB storage) - Prod: db-custom-4-7680 (4 vCPUs, 7.5GB RAM, 100GB storage) - Enable backups, PITR, and deletion protection for prod
Preview environments can access the dev Cloud SQL instance directly via servicenetworking peering (already configured per-VPC) without needing bidirectional VPC peering between dev and preview VPCs. Changes: - Remove manual preview_vpc_names variable and VPC peering resources - Add database outputs (connection name, private IP) for services - Update deploy.yml to fetch dev DB info for preview environments - Pass dev database connection info to preview terraform runs
Preview Deployment CompleteInfrastructure deployed to preview-pr-127 environment. Access URLs
Note: Custom domain not configured for preview environments. Use Cloud Run URL to access the application. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR simplifies Cloud SQL networking for preview environments by removing the complex bidirectional VPC peering approach from #126.
The Problem:
The original PR required manually maintaining
preview_vpc_namesvariable and redeploying dev whenever a preview environment was created. VPC peering requires both sides to create peering resources, which created an operational burden.The Solution:
Each VPC (dev, preview, prod) already creates a
google_service_networking_connectionto Google's servicenetworking VPC. Since Cloud SQL sits in the servicenetworking VPC, any environment with this connection can already reach Cloud SQL directly - no VPC-to-VPC peering needed.Changes
preview_vpc_namesvariable and all VPC peering resources fromvpc.tfdatabase_private_ip,database_connection_name, etc.) tooutputs.tfdev_database_private_ipanddev_database_connection_namevariables for preview environmentsdeploy.ymlto fetch dev database info before planning preview environmentsHow it works