-
Notifications
You must be signed in to change notification settings - Fork 11
/
main.tf
162 lines (137 loc) · 3.42 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
variable "cluster_name" {
type = string
nullable = false
}
variable "sql_user_name" {
type = string
nullable = false
default = "maxroach"
}
# Remember that even variables marked sensitive will show up
# in the Terraform state file. Always follow best practices
# when managing sensitive info.
# https://developer.hashicorp.com/terraform/tutorials/configuration-language/sensitive-variables#sensitive-values-in-state
variable "sql_user_password" {
type = string
nullable = false
sensitive = true
}
variable "cloud_provider" {
type = string
nullable = false
default = "GCP"
}
variable "cloud_provider_regions" {
type = list(string)
nullable = false
default = ["us-east1"]
}
variable "cluster_node_count" {
type = number
nullable = false
default = 1
}
variable "storage_gib" {
type = number
nullable = false
default = 15
}
variable "num_virtual_cpus" {
type = number
nullable = false
default = 2
}
variable "allow_list_name" {
type = string
nullable = false
default = "default-allow-list"
}
variable "os" {
type = string
nullable = true
}
variable "database" {
type = string
nullable = false
}
# A production cluster should be locked down with a more
# targeted allowlist or VPC peering.
variable "cidr_ip" {
type = string
nullable = false
default = "0.0.0.0"
}
variable "cidr_prefix_length" {
type = number
nullable = false
default = 0
}
terraform {
required_providers {
cockroach = {
source = "cockroachdb/cockroach"
}
}
}
provider "cockroach" {
# export COCKROACH_API_KEY with the cockroach cloud API Key
}
resource "cockroach_cluster" "example" {
name = var.cluster_name
cloud_provider = var.cloud_provider
dedicated = {
storage_gib = var.storage_gib
num_virtual_cpus = var.num_virtual_cpus
}
regions = [
for r in var.cloud_provider_regions : {
name = r,
node_count = var.cluster_node_count
}
]
}
data "cockroach_cluster_cert" "example" {
id = cockroach_cluster.example.id
}
resource "cockroach_allow_list" "example" {
name = var.allow_list_name
cidr_ip = var.cidr_ip
cidr_mask = var.cidr_prefix_length
ui = true
sql = true
cluster_id = cockroach_cluster.example.id
}
resource "cockroach_sql_user" "example" {
name = var.sql_user_name
password = var.sql_user_password
cluster_id = cockroach_cluster.example.id
}
resource "cockroach_database" "example" {
name = var.database
cluster_id = cockroach_cluster.example.id
}
data "cockroach_cluster" "example" {
id = cockroach_cluster.example.id
}
data "cockroach_connection_string" "example" {
id = cockroach_cluster.example.id
sql_user = cockroach_sql_user.example.name
database = var.database
# Caution: Including the `password` field will result in
# the password showing up in plain text in the
# connection string output! We recommend following terraform best practices
# for securing sensitive variables.
# https://developer.hashicorp.com/terraform/tutorials/configuration-language/sensitive-variables
#
# password = cockroach_sql_user.example.password
os = var.os
}
output "cluster_status" {
value = data.cockroach_cluster.example.operation_status
}
output "cert" {
value = data.cockroach_cluster_cert.example.cert
}
output "connection_string" {
value = data.cockroach_connection_string.example.connection_string
}