azurerm_postgresql_flexible_server should allow public_network_access_enabled argument as input

[nlighten]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Private endpoints for azurerm_postgresql_flexible_server are currently in preview (GA expected in a month or so). The absence of a public_network_access_enabled input argument prevents the creation of instances with public access disabled in combination with privat eendpoints..

This is due to that fact that value of public_network_access_enabled is computed based on whether or not delegated_subnet_id is passed as input argument.

We would like to propose adding public_network_access_enabled as optional input argument with the current computed value as default for backward compatibility.

New or Affected Resource(s)/Data Source(s)

azurerm_postgresql_flexible_server

Potential Terraform Configuration

resource "azurerm_postgresql_flexible_server" "example" {
  name                   = "example-psqlflexibleserver"
  resource_group_name           = azurerm_resource_group.example.name
  location                      = azurerm_resource_group.example.location
  version                       = "12"
  delegated_subnet_id           = azurerm_subnet.example.id
  private_dns_zone_id           = azurerm_private_dns_zone.example.id
  administrator_login           = "psqladmin"
  administrator_password        = "H@Sh1CoR3!"
  zone                          = "1"
  public_network_access_enabled = false

  storage_mb = 32768

  sku_name   = "GP_Standard_D4s_v3"
  depends_on = [azurerm_private_dns_zone_virtual_network_link.example]

}

References

https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking-private-link

[vakaobr]

Having a related issue, but in my case I don't want to use the private endpoint yet since it is on preview, but now while trying to create a instance (with a replica) using public IP + firewall rules I get:

Message: "Geo-Read replica deployment for server shared-psql-prod with Private Endpoint feature enabled is not supported.

as error.

@rcskosir can we have an idea if the devs are aware of this ? As is now it breaks completely the usability for both group of users who want or not to use the private endpoint feature being in preview + replicas

[nlighten]

@rcskosir Private Endpoints for Postgresql Flexible Server is now GA. Can we remove the preview label?

[rcomanne]

Since Private Endpoints have been GA now for some time, is it possible to implement this?

[joachimsmits]

We see in TF code:    
 if network := props.Network; network != nil {
        publicNetworkAccess := false
        if network.PublicNetworkAccess != nil {
          publicNetworkAccess = *network.PublicNetworkAccess == servers.ServerPublicNetworkAccessStateEnabled
        }
        d.Set("public_network_access_enabled", publicNetworkAccess)
        d.Set("delegated_subnet_id", network.DelegatedSubnetResourceId)
        d.Set("private_dns_zone_id", network.PrivateDnsZoneArmResourceId)
      }

So plz, bring this argument to the front instead of dependent from vent injection.

[PeterNienaber]

For us the public_network_access_enabled input argument is very important to be able to rollout flexible server with Terraform and public access denied because of Azure policies of our company. We have a lot of PostgreSQL Single servers to migrate to flexible servers and we have to start soon. We are now looking to use Bicep instead although Terraform is our preferred tool.

[nlighten]

@PeterNienaber you can consider using azapi Terraform provider. This allows you to do more or less the same as in Bicep but then using Terraform. We are starting to use it more and more in our own modules to avoid the sometimes huge delay in new feature availability in azurerm

[vakaobr]

@nlighten that would be a option to be considered (use azapi) to cover something new, but since Microsoft is already with a date set to remove the single servers, honestly I can't see a reason to a feature so important like disable public access to the databases are not being prioritised on the AzureRM provider.

As stated by @joachimsmits before, the code is already in place (#24708 (comment)), we just need to have the argument available to be used.

This is a issue opened since January, and since March 1st we had 3.94.0/3.95.0/3.96.0/3.97.0/3.97.1 and 3.98.0 versions released. How big would be this change to not being considered as part of any of those releases ?

[NathanDunning]

Agree with the gist of this issue, we are experiencing the same issues in trying to deploy a PFS but require no public network access due to policies set by the company. Would like to have this field configurable as this field is configurable directly via the API: https://learn.microsoft.com/en-us/rest/api/postgresql/flexibleserver/servers/create?view=rest-postgresql-flexibleserver-2022-12-01&tabs=HTTP#network