CloudSQL
This example show how you can use KRO to deploy GCP Cloud SQL instance in 2 regions as a primary and replica instances.
End User: CloudSQL
The administrator needs to install the RGD first.
The end user creates a CloudSQL
resource that looks like this:
apiVersion: kro.run/v1alpha1
kind: CloudSQL
metadata:
name: demo
namespace: config-connector
spec:
name: demo
project: my-gcp-project
primaryRegion: us-central1
replicaRegion: us-west1
The status of the applied resource can be checked using:
kubectl get cloudsqls
kubectl get cloudsql demo -n config-connector -o yaml
Navigate to CloudSQL page in the GCP Console and verify the creation of primary and replica instances.
Once done, the user can delete the CloudSQL
instance:
kubectl delete cloudsql demo -n config-connector
Administrator: ResourceGraphDefinition
The administrator needs to install the RGD in the cluster first before the user can consume it:
kubectl apply -f rgd.yaml
Validate the RGD is installed correctly:
> kubectl get rgd cloudsql.kro.run
NAME APIVERSION KIND STATE AGE
cloudsql.kro.run v1alpha1 CloudSQL Active 44m
Once all user created instances are deleted, the administrator can choose to deleted the RGD.
ResourceGraphDefinition
rgd.yaml
apiVersion: kro.run/v1alpha1
kind: ResourceGraphDefinition
metadata:
name: cloudsql.kro.run
spec:
schema:
apiVersion: v1alpha1
kind: CloudSQL
spec:
name: string
project: string
primaryRegion: string
replicaRegion: string
status:
connectionName: ${sqlPrimary.status.connectionName}
ipAddress: ${sqlPrimary.status.firstIpAddress}
resources:
- id: cloudkmsEnable
template:
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
kind: Service
metadata:
annotations:
cnrm.cloud.google.com/deletion-policy: "abandon"
cnrm.cloud.google.com/disable-dependent-services: "false"
name: cloudkms-enablement
spec:
resourceID: cloudkms.googleapis.com
- id: iamEnable
template:
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
kind: Service
metadata:
annotations:
cnrm.cloud.google.com/deletion-policy: "abandon"
cnrm.cloud.google.com/disable-dependent-services: "false"
name: iam-enablement
spec:
resourceID: iam.googleapis.com
- id: serviceUsageEnable
template:
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
kind: Service
metadata:
annotations:
cnrm.cloud.google.com/deletion-policy: "abandon"
cnrm.cloud.google.com/disable-dependent-services: "false"
name: serviceusage-enablement
spec:
resourceID: serviceusage.googleapis.com
- id: sqlAdminEnable
template:
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
kind: Service
metadata:
annotations:
cnrm.cloud.google.com/deletion-policy: "abandon"
cnrm.cloud.google.com/disable-dependent-services: "false"
name: sqladmin-enablement
spec:
resourceID: sqladmin.googleapis.com
- id: serviceidentity
template:
apiVersion: serviceusage.cnrm.cloud.google.com/v1beta1
kind: ServiceIdentity
metadata:
labels:
enabled-service: ${serviceUsageEnable.metadata.name}
name: sqladmin.googleapis.com
spec:
projectRef:
external: ${schema.spec.project}
- id: keyringPrimary
template:
apiVersion: kms.cnrm.cloud.google.com/v1beta1
kind: KMSKeyRing
metadata:
labels:
enabled-service: ${cloudkmsEnable.metadata.name}
name: ${schema.spec.name}-primary
spec:
location: ${schema.spec.primaryRegion}
- id: keyringReplica
template:
apiVersion: kms.cnrm.cloud.google.com/v1beta1
kind: KMSKeyRing
metadata:
labels:
enabled-service: ${cloudkmsEnable.metadata.name}
name: ${schema.spec.name}-replica
spec:
location: ${schema.spec.replicaRegion}
- id: kmskeyPrimary
template:
apiVersion: kms.cnrm.cloud.google.com/v1beta1
kind: KMSCryptoKey
metadata:
labels:
enabled-service: ${cloudkmsEnable.metadata.name}
failure-zone: ${schema.spec.primaryRegion}
name: ${schema.spec.name}-primary
spec:
keyRingRef:
name: ${keyringPrimary.metadata.name}
#namespace: {{ cloudsqls.metadata.namespace }}
purpose: ENCRYPT_DECRYPT
versionTemplate:
algorithm: GOOGLE_SYMMETRIC_ENCRYPTION
protectionLevel: SOFTWARE
importOnly: false
- id: kmskeyReplica
template:
apiVersion: kms.cnrm.cloud.google.com/v1beta1
kind: KMSCryptoKey
metadata:
labels:
enabled-service: ${cloudkmsEnable.metadata.name}
failure-zone: ${schema.spec.replicaRegion}
name: ${schema.spec.name}-replica
spec:
keyRingRef:
name: ${keyringReplica.metadata.name}
#namespace: {{ cloudsqls.metadata.namespace }}
purpose: ENCRYPT_DECRYPT
versionTemplate:
algorithm: GOOGLE_SYMMETRIC_ENCRYPTION
protectionLevel: SOFTWARE
importOnly: false
- id: iampolicymemberPrimary
template:
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
labels:
enabled-service: ${iamEnable.metadata.name}
name: sql-kms-${schema.spec.primaryRegion}-policybinding
spec:
member: serviceAccount:${serviceidentity.status.email}
role: roles/cloudkms.cryptoKeyEncrypterDecrypter
resourceRef:
kind: KMSCryptoKey
name: ${kmskeyPrimary.metadata.name}-primary
#namespace: {{ cloudsqls.metadata.namespace }}
- id: iampolicymemberReplica
template:
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
name: sql-kms-${schema.spec.replicaRegion}-policybinding
labels:
enabled-service: ${iamEnable.metadata.name}
spec:
member: serviceAccount:${serviceidentity.status.email}
role: roles/cloudkms.cryptoKeyEncrypterDecrypter
resourceRef:
kind: KMSCryptoKey
name: ${kmskeyReplica.metadata.name}-replica
#namespace: {{ cloudsqls.metadata.namespace }}
- id: sqlPrimary
template:
apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLInstance
metadata:
annotations:
cnrm.cloud.google.com/deletion-policy: abandon
labels:
failure-zone: ${schema.spec.primaryRegion}
enabled-service: ${sqlAdminEnable.metadata.name}
name: ${schema.spec.name}-primary
spec:
databaseVersion: POSTGRES_13
encryptionKMSCryptoKeyRef:
external: projects/${schema.spec.project}/locations/${schema.spec.primaryRegion}/keyRings/${keyringPrimary.metadata.name}/cryptoKeys/${kmskeyPrimary.metadata.name}
region: ${schema.spec.primaryRegion}
settings:
availabilityType: REGIONAL
backupConfiguration:
backupRetentionSettings:
retainedBackups: 6
enabled: true
location: us
diskSize: 50
diskType: PD_SSD
maintenanceWindow:
day: 7
hour: 3
tier: db-custom-8-30720
- id: sqlReplica
template:
apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLInstance
metadata:
annotations:
cnrm.cloud.google.com/deletion-policy: abandon
labels:
failure-zone: ${schema.spec.replicaRegion}
enabled-service: ${sqlAdminEnable.metadata.name}
name: ${schema.spec.name}-replica
spec:
databaseVersion: POSTGRES_13
encryptionKMSCryptoKeyRef:
external: projects/${schema.spec.project}/locations/${schema.spec.replicaRegion}/keyRings/${keyringReplica.metadata.name}/cryptoKeys/${kmskeyReplica.metadata.name}
masterInstanceRef:
name: ${schema.spec.name}-primary
#namespace: {{ cloudsqls.metadata.namespace }}
region: ${schema.spec.replicaRegion}
settings:
availabilityType: REGIONAL
diskSize: 50
diskType: PD_SSD
tier: db-custom-8-30720