Skip to content

Commit bc7cde4

Browse files
feng-zhefeng-zhe
authored
Deprecate google_sql_database_instance.settings.ip_configuration's require_ssl in favor of ssl_mode (#11154)
1 parent fa001dc commit bc7cde4

11 files changed

+34
-66
lines changed

‎mmv1/templates/terraform/examples/go/sql_instance_ssl_cert.tf.tmpl

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ resource "google_sql_database_instance" "mysql_instance" {
55
settings {
66
tier = "db-f1-micro"
77
ip_configuration {
8-
require_ssl = "true"
8+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
99
}
1010
}
1111
deletion_protection = "{{index $.Vars "deletion_protection"}}"
@@ -23,7 +23,7 @@ resource "google_sql_database_instance" "postgres_instance" {
2323
settings {
2424
tier = "db-custom-2-7680"
2525
ip_configuration {
26-
require_ssl = "true"
26+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
2727
}
2828
}
2929
deletion_protection = "{{index $.Vars "deletion_protection"}}"
@@ -42,7 +42,7 @@ resource "google_sql_database_instance" "{{$.PrimaryResourceId}}" {
4242
settings {
4343
tier = "db-custom-2-7680"
4444
ip_configuration {
45-
require_ssl = "true"
45+
ssl_mode = "ENCRYPTED_ONLY"
4646
}
4747
}
4848
deletion_protection = "{{index $.Vars "deletion_protection"}}"

‎mmv1/templates/terraform/examples/sql_instance_ssl_cert.tf.erb

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ resource "google_sql_database_instance" "mysql_instance" {
55
settings {
66
tier = "db-f1-micro"
77
ip_configuration {
8-
require_ssl = "true"
8+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
99
}
1010
}
1111
deletion_protection = "<%= ctx[:vars]['deletion_protection'] %>"
@@ -23,7 +23,7 @@ resource "google_sql_database_instance" "postgres_instance" {
2323
settings {
2424
tier = "db-custom-2-7680"
2525
ip_configuration {
26-
require_ssl = "true"
26+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
2727
}
2828
}
2929
deletion_protection = "<%= ctx[:vars]['deletion_protection'] %>"
@@ -42,7 +42,7 @@ resource "google_sql_database_instance" "<%= ctx[:primary_resource_id] %>" {
4242
settings {
4343
tier = "db-custom-2-7680"
4444
ip_configuration {
45-
require_ssl = "true"
45+
ssl_mode = "ENCRYPTED_ONLY"
4646
}
4747
}
4848
deletion_protection = "<%= ctx[:vars]['deletion_protection'] %>"

‎mmv1/third_party/terraform/services/sql/go/resource_sql_database_instance.go.tmpl

+5-17
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,6 @@ var (
7474
ipConfigurationKeys = []string{
7575
"settings.0.ip_configuration.0.authorized_networks",
7676
"settings.0.ip_configuration.0.ipv4_enabled",
77-
"settings.0.ip_configuration.0.require_ssl",
7877
"settings.0.ip_configuration.0.private_network",
7978
"settings.0.ip_configuration.0.allocated_ip_range",
8079
"settings.0.ip_configuration.0.enable_private_path_for_google_cloud_services",
@@ -437,13 +436,6 @@ is set to true. Defaults to ZONAL.`,
437436
AtLeastOneOf: ipConfigurationKeys,
438437
Description: `Whether this Cloud SQL instance should be assigned a public IPV4 address. At least ipv4_enabled must be enabled or a private_network must be configured.`,
439438
},
440-
"require_ssl": {
441-
Type: schema.TypeBool,
442-
Optional: true,
443-
AtLeastOneOf: ipConfigurationKeys,
444-
Description: `Whether SSL connections over IP are enforced or not. To change this field, also set the corresponding value in ssl_mode if it has been set too.`,
445-
Deprecated: "`require_ssl` will be fully deprecated in a future major release. For now, please use `ssl_mode` with a compatible `require_ssl` value instead.",
446-
},
447439
"private_network": {
448440
Type: schema.TypeString,
449441
Optional: true,
@@ -492,7 +484,7 @@ is set to true. Defaults to ZONAL.`,
492484
Optional: true,
493485
Computed: true,
494486
ValidateFunc: validation.StringInSlice([]string{"ALLOW_UNENCRYPTED_AND_ENCRYPTED", "ENCRYPTED_ONLY", "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"}, false),
495-
Description: `Specify how SSL connection should be enforced in DB connections. This field provides more SSL enforcment options compared to require_ssl. To change this field, also set the correspoding value in require_ssl until next major release.`,
487+
Description: `Specify how SSL connection should be enforced in DB connections.`,
496488
AtLeastOneOf: ipConfigurationKeys,
497489
},
498490
},
@@ -1385,20 +1377,21 @@ func expandIpConfiguration(configured []interface{}, databaseVersion string) *sq
13851377

13861378
_ipConfiguration := configured[0].(map[string]interface{})
13871379

1388-
forceSendFields := []string{"Ipv4Enabled", "RequireSsl"}
1380+
forceSendFields := []string{"Ipv4Enabled"}
1381+
nullFields := []string{"RequireSsl"}
13891382

13901383
if !strings.HasPrefix(databaseVersion, "SQLSERVER") {
13911384
forceSendFields = append(forceSendFields, "EnablePrivatePathForGoogleCloudServices")
13921385
}
13931386

13941387
return &sqladmin.IpConfiguration{
13951388
Ipv4Enabled: _ipConfiguration["ipv4_enabled"].(bool),
1396-
RequireSsl: _ipConfiguration["require_ssl"].(bool),
13971389
PrivateNetwork: _ipConfiguration["private_network"].(string),
13981390
AllocatedIpRange: _ipConfiguration["allocated_ip_range"].(string),
13991391
AuthorizedNetworks: expandAuthorizedNetworks(_ipConfiguration["authorized_networks"].(*schema.Set).List()),
14001392
EnablePrivatePathForGoogleCloudServices: _ipConfiguration["enable_private_path_for_google_cloud_services"].(bool),
14011393
ForceSendFields: forceSendFields,
1394+
NullFields: nullFields,
14021395
PscConfig: expandPscConfig(_ipConfiguration["psc_config"].(*schema.Set).List()),
14031396
SslMode: _ipConfiguration["ssl_mode"].(string),
14041397
}
@@ -2241,8 +2234,8 @@ func flattenIpConfiguration(ipConfiguration *sqladmin.IpConfiguration, d *schema
22412234
"ipv4_enabled": ipConfiguration.Ipv4Enabled,
22422235
"private_network": ipConfiguration.PrivateNetwork,
22432236
"allocated_ip_range": ipConfiguration.AllocatedIpRange,
2244-
"require_ssl": ipConfiguration.RequireSsl,
22452237
"enable_private_path_for_google_cloud_services": ipConfiguration.EnablePrivatePathForGoogleCloudServices,
2238+
"ssl_mode": ipConfiguration.SslMode,
22462239
}
22472240

22482241
if ipConfiguration.AuthorizedNetworks != nil {
@@ -2253,11 +2246,6 @@ func flattenIpConfiguration(ipConfiguration *sqladmin.IpConfiguration, d *schema
22532246
data["psc_config"] = flattenPscConfigs(ipConfiguration.PscConfig)
22542247
}
22552248

2256-
// We store the ssl_mode value only if the customer already uses `ssl_mode`.
2257-
if _, ok := d.GetOk("settings.0.ip_configuration.0.ssl_mode"); ok {
2258-
data["ssl_mode"] = ipConfiguration.SslMode
2259-
}
2260-
22612249
return []map[string]interface{}{data}
22622250
}
22632251

‎mmv1/third_party/terraform/services/sql/resource_sql_database_instance.go.erb

+5-17
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,6 @@ var (
7575
ipConfigurationKeys = []string{
7676
"settings.0.ip_configuration.0.authorized_networks",
7777
"settings.0.ip_configuration.0.ipv4_enabled",
78-
"settings.0.ip_configuration.0.require_ssl",
7978
"settings.0.ip_configuration.0.private_network",
8079
"settings.0.ip_configuration.0.allocated_ip_range",
8180
"settings.0.ip_configuration.0.enable_private_path_for_google_cloud_services",
@@ -438,13 +437,6 @@ is set to true. Defaults to ZONAL.`,
438437
AtLeastOneOf: ipConfigurationKeys,
439438
Description: `Whether this Cloud SQL instance should be assigned a public IPV4 address. At least ipv4_enabled must be enabled or a private_network must be configured.`,
440439
},
441-
"require_ssl": {
442-
Type: schema.TypeBool,
443-
Optional: true,
444-
AtLeastOneOf: ipConfigurationKeys,
445-
Description: `Whether SSL connections over IP are enforced or not. To change this field, also set the corresponding value in ssl_mode if it has been set too.`,
446-
Deprecated: "`require_ssl` will be fully deprecated in a future major release. For now, please use `ssl_mode` with a compatible `require_ssl` value instead.",
447-
},
448440
"private_network": {
449441
Type: schema.TypeString,
450442
Optional: true,
@@ -493,7 +485,7 @@ is set to true. Defaults to ZONAL.`,
493485
Optional: true,
494486
Computed: true,
495487
ValidateFunc: validation.StringInSlice([]string{"ALLOW_UNENCRYPTED_AND_ENCRYPTED", "ENCRYPTED_ONLY", "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"}, false),
496-
Description: `Specify how SSL connection should be enforced in DB connections. This field provides more SSL enforcment options compared to require_ssl. To change this field, also set the correspoding value in require_ssl until next major release.`,
488+
Description: `Specify how SSL connection should be enforced in DB connections.`,
497489
AtLeastOneOf: ipConfigurationKeys,
498490
},
499491
},
@@ -1386,20 +1378,21 @@ func expandIpConfiguration(configured []interface{}, databaseVersion string) *sq
13861378

13871379
_ipConfiguration := configured[0].(map[string]interface{})
13881380

1389-
forceSendFields := []string{"Ipv4Enabled", "RequireSsl"}
1381+
forceSendFields := []string{"Ipv4Enabled"}
1382+
nullFields := []string{"RequireSsl"}
13901383

13911384
if !strings.HasPrefix(databaseVersion, "SQLSERVER") {
13921385
forceSendFields = append(forceSendFields, "EnablePrivatePathForGoogleCloudServices")
13931386
}
13941387

13951388
return &sqladmin.IpConfiguration{
13961389
Ipv4Enabled: _ipConfiguration["ipv4_enabled"].(bool),
1397-
RequireSsl: _ipConfiguration["require_ssl"].(bool),
13981390
PrivateNetwork: _ipConfiguration["private_network"].(string),
13991391
AllocatedIpRange: _ipConfiguration["allocated_ip_range"].(string),
14001392
AuthorizedNetworks: expandAuthorizedNetworks(_ipConfiguration["authorized_networks"].(*schema.Set).List()),
14011393
EnablePrivatePathForGoogleCloudServices: _ipConfiguration["enable_private_path_for_google_cloud_services"].(bool),
14021394
ForceSendFields: forceSendFields,
1395+
NullFields: nullFields,
14031396
PscConfig: expandPscConfig(_ipConfiguration["psc_config"].(*schema.Set).List()),
14041397
SslMode: _ipConfiguration["ssl_mode"].(string),
14051398
}
@@ -2242,8 +2235,8 @@ func flattenIpConfiguration(ipConfiguration *sqladmin.IpConfiguration, d *schema
22422235
"ipv4_enabled": ipConfiguration.Ipv4Enabled,
22432236
"private_network": ipConfiguration.PrivateNetwork,
22442237
"allocated_ip_range": ipConfiguration.AllocatedIpRange,
2245-
"require_ssl": ipConfiguration.RequireSsl,
22462238
"enable_private_path_for_google_cloud_services": ipConfiguration.EnablePrivatePathForGoogleCloudServices,
2239+
"ssl_mode": ipConfiguration.SslMode,
22472240
}
22482241

22492242
if ipConfiguration.AuthorizedNetworks != nil {
@@ -2254,11 +2247,6 @@ func flattenIpConfiguration(ipConfiguration *sqladmin.IpConfiguration, d *schema
22542247
data["psc_config"] = flattenPscConfigs(ipConfiguration.PscConfig)
22552248
}
22562249

2257-
// We store the ssl_mode value only if the customer already uses `ssl_mode`.
2258-
if _, ok := d.GetOk("settings.0.ip_configuration.0.ssl_mode"); ok {
2259-
data["ssl_mode"] = ipConfiguration.SslMode
2260-
}
2261-
22622250
return []map[string]interface{}{data}
22632251
}
22642252

‎mmv1/third_party/terraform/services/sql/resource_sql_database_instance_test.go

+7-12
Original file line numberDiff line numberDiff line change
@@ -2344,9 +2344,8 @@ func TestAccSqlDatabaseInstance_updateSslOptionsForPostgreSQL(t *testing.T) {
23442344
// We don't do ImportStateVerify for the ssl_mode because of the implementation. The ssl_mode is expected to be discarded if the local state doesn't have it.
23452345
Steps: []resource.TestStep{
23462346
{
2347-
Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, false, "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
2347+
Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
23482348
Check: resource.ComposeTestCheckFunc(
2349-
resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.require_ssl", "false"),
23502349
resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.ssl_mode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
23512350
),
23522351
},
@@ -2357,9 +2356,8 @@ func TestAccSqlDatabaseInstance_updateSslOptionsForPostgreSQL(t *testing.T) {
23572356
ImportStateVerifyIgnore: []string{"deletion_protection", "settings.0.ip_configuration.0.ssl_mode"},
23582357
},
23592358
{
2360-
Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, false, "ENCRYPTED_ONLY"),
2359+
Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, "ENCRYPTED_ONLY"),
23612360
Check: resource.ComposeTestCheckFunc(
2362-
resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.require_ssl", "false"),
23632361
resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.ssl_mode", "ENCRYPTED_ONLY"),
23642362
),
23652363
},
@@ -2370,9 +2368,8 @@ func TestAccSqlDatabaseInstance_updateSslOptionsForPostgreSQL(t *testing.T) {
23702368
ImportStateVerifyIgnore: []string{"deletion_protection", "settings.0.ip_configuration.0.ssl_mode"},
23712369
},
23722370
{
2373-
Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, true, "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"),
2371+
Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"),
23742372
Check: resource.ComposeTestCheckFunc(
2375-
resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.require_ssl", "true"),
23762373
resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.ssl_mode", "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"),
23772374
),
23782375
},
@@ -2383,9 +2380,8 @@ func TestAccSqlDatabaseInstance_updateSslOptionsForPostgreSQL(t *testing.T) {
23832380
ImportStateVerifyIgnore: []string{"deletion_protection", "settings.0.ip_configuration.0.ssl_mode"},
23842381
},
23852382
{
2386-
Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, false, "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
2383+
Config: testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName, databaseVersion, "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
23872384
Check: resource.ComposeTestCheckFunc(
2388-
resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.require_ssl", "false"),
23892385
resource.TestCheckResourceAttr(resourceName, "settings.0.ip_configuration.0.ssl_mode", "ALLOW_UNENCRYPTED_AND_ENCRYPTED"),
23902386
),
23912387
},
@@ -2399,7 +2395,7 @@ func TestAccSqlDatabaseInstance_updateSslOptionsForPostgreSQL(t *testing.T) {
23992395
})
24002396
}
24012397

2402-
func testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName string, databaseVersion string, requireSsl bool, sslMode string) string {
2398+
func testGoogleSqlDatabaseInstance_setSslOptionsForPostgreSQL(databaseName string, databaseVersion string, sslMode string) string {
24032399
return fmt.Sprintf(`
24042400
resource "google_sql_database_instance" "instance" {
24052401
name = "%s"
@@ -2410,11 +2406,10 @@ resource "google_sql_database_instance" "instance" {
24102406
tier = "db-g1-small"
24112407
ip_configuration {
24122408
ipv4_enabled = true
2413-
require_ssl = %t
24142409
ssl_mode = "%s"
24152410
}
24162411
}
2417-
}`, databaseName, databaseVersion, requireSsl, sslMode)
2412+
}`, databaseName, databaseVersion, sslMode)
24182413
}
24192414

24202415
func testAccSqlDatabaseInstance_sqlMysqlInstancePvpExample(context map[string]interface{}) string {
@@ -2498,7 +2493,7 @@ resource "google_sql_database_instance" "instance" {
24982493
collation = "Polish_CI_AS"
24992494
ip_configuration {
25002495
ipv4_enabled = true
2501-
require_ssl = true
2496+
ssl_mode = "ENCRYPTED_ONLY"
25022497
}
25032498
}
25042499
}

‎mmv1/third_party/terraform/website/docs/r/sql_database_instance.html.markdown

+1-6
Original file line numberDiff line numberDiff line change
@@ -375,12 +375,7 @@ Specifying a network enables private IP.
375375
At least `ipv4_enabled` must be enabled or a `private_network` must be configured.
376376
This setting can be updated, but it cannot be removed after it is set.
377377

378-
* `require_ssl` - (Optional, Deprecated) Whether SSL connections over IP are enforced or not. To change this field, also set the corresponding value in `ssl_mode`. It will be fully deprecated in a future major release. For now, please use `ssl_mode` with a compatible `require_ssl` value instead.
379-
380-
* `ssl_mode` - (Optional) Specify how SSL connection should be enforced in DB connections. This field provides more SSL enforcment options compared to `require_ssl`. To change this field, also set the correspoding value in `require_ssl`.
381-
* For PostgreSQL instances, the value pairs are listed in the [API reference doc](https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/instances#ipconfiguration) for `ssl_mode` field.
382-
* For MySQL instances, use the same value pairs as the PostgreSQL instances.
383-
* For SQL Server instances, set it to `ALLOW_UNENCRYPTED_AND_ENCRYPTED` when `require_ssl=false` and `ENCRYPTED_ONLY` otherwise.
378+
* `ssl_mode` - (Optional) Specify how SSL connection should be enforced in DB connections.
384379

385380
* `allocated_ip_range` - (Optional) The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
386381

‎mmv1/third_party/tgc/sql_database_instance.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -189,10 +189,11 @@ func expandIpConfiguration(configured []interface{}) *sqladmin.IpConfiguration {
189189

190190
return &sqladmin.IpConfiguration{
191191
Ipv4Enabled: _ipConfiguration["ipv4_enabled"].(bool),
192-
RequireSsl: _ipConfiguration["require_ssl"].(bool),
193192
PrivateNetwork: _ipConfiguration["private_network"].(string),
194193
AuthorizedNetworks: expandAuthorizedNetworks(_ipConfiguration["authorized_networks"].(*schema.Set).List()),
195-
ForceSendFields: []string{"Ipv4Enabled", "RequireSsl"},
194+
ForceSendFields: []string{"Ipv4Enabled"},
195+
NullFields: []string{"RequireSsl"},
196+
SslMode: _ipConfiguration["ssl_mode"].(string),
196197
}
197198
}
198199
func expandAuthorizedNetworks(configured []interface{}) []*sqladmin.AclEntry {

‎mmv1/third_party/tgc/tests/data/example_google_datastream_stream.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
}
6060
],
6161
"ipv4Enabled": true,
62-
"requireSsl": false
62+
"requireSsl": null
6363
},
6464
"pricingPlan": "PER_USE",
6565
"storageAutoResize": true,
@@ -155,4 +155,4 @@
155155
"ancestors": ["organizations/{{.OrgID}}"],
156156
"ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}"
157157
}
158-
]
158+
]

‎mmv1/third_party/tgc/tests/data/example_google_datastream_stream_append_only.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@
5959
}
6060
],
6161
"ipv4Enabled": true,
62-
"requireSsl": false
62+
"requireSsl": null
6363
},
6464
"pricingPlan": "PER_USE",
6565
"storageAutoResize": true,
@@ -155,4 +155,4 @@
155155
"ancestors": ["organizations/{{.OrgID}}"],
156156
"ancestry_path": "{{.Ancestry}}/project/{{.Provider.project}}"
157157
}
158-
]
158+
]

‎mmv1/third_party/tgc/tests/data/full_sql_database_instance.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,8 @@
6464
}
6565
],
6666
"ipv4Enabled": true,
67-
"requireSsl": true
67+
"requireSsl": null,
68+
"sslMode": "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
6869
},
6970
"locationPreference": {
7071
"followGaeApplication": "test-follow_gae_application",

0 commit comments

Comments
 (0)