TerraformとGithub ActionsでCloud RunからPostgreSQLへアクセスする例

.
├── backend.conf
├── cloudrun.tf
├── main.tf
├── registry.tf
├── service_account.tf
├── sql.tf
├── terraform.tfvars
└── variables.tf

terraform {
  required_version = "~> 1.1.9"
  backend "gcs" {
    prefix = "terraform/state"
  }
}

data "google_iam_policy" "cloud_run_public" {
  binding {
    role = "roles/run.invoker"
    members = [
      "allUsers",
    ]
  }
}

resource "google_cloud_run_service_iam_policy" "policy" {
  location = google_cloud_run_service.default.location
  project  = google_cloud_run_service.default.project
  service  = google_cloud_run_service.default.name

  policy_data = data.google_iam_policy.cloud_run_public.policy_data
}

locals {
  cloudrun_roles = [
    "roles/run.developer",
    "roles/iam.serviceAccountUser",
    "roles/cloudsql.client"
  ]
}

resource "google_project_service" "default" {
  project = var.project
  service = "iamcredentials.googleapis.com"
}

resource "google_service_account" "github_actions" {
  project      = var.project
  account_id   = "hello-crud"
  display_name = "hell-crud service account for GitHub Actions"
  description  = "link to Workload Identity Pool used by github actions"
}

resource "google_service_account_iam_member" "github-account-iam" {
  service_account_id = google_service_account.github_actions.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/${var.workload_identity_pool_name}/attribute.repository/${var.repo_name}"
}

resource "google_project_iam_member" "service_account" {
  count   = length(local.cloudrun_roles)
  project = var.project
  role    = element(local.cloudrun_roles, count.index)
  member  = "serviceAccount:${google_service_account.github_actions.email}"
}

output "service_account_github_actions_email" {
  description = "github account for github actions"
  value       = google_service_account.github_actions.email
}

resource "google_sql_database_instance" "postgres" {
  name             = "cloudrun-sql"
  region           = var.location
  database_version = "POSTGRES_13"
  settings {
    tier = "db-f1-micro"
    database_flags {
      name  = "cloudsql.iam_authentication"
      value = "on"
    }
  }

  deletion_protection = "false"
}

resource "google_sql_database" "database" {
  name     = "quickstart_db"
  instance = google_sql_database_instance.postgres.name
}

resource "google_sql_user" "users" {
  name     = "quickstart-user"
  instance = google_sql_database_instance.postgres.name
  type     = "BUILT_IN"
  password = var.db_user_password
}

resource "google_sql_user" "root_user" {
  name     = "postgres"
  instance = google_sql_database_instance.postgres.name
  type     = "BUILT_IN"
  password = var.db_root_user_password
}

resource "google_cloud_run_service" "default" {
  name                       = "run-sql"
  location                   = var.location
  autogenerate_revision_name = true

  template {
    spec {
      containers {
        image = var.container_image
        env {
          name  = "INSTANCE_UNIX_SOCKET"
          value = "/cloudsql/${var.project}:${var.location}:${google_sql_database_instance.postgres.name}"
        }
        env {
          name  = "DB_NAME"
          value = google_sql_database.database.name
        }
        env {
          name  = "DB_USER"
          value = google_sql_user.users.name
        }
        env {
          name  = "DB_PASS"
          value = google_sql_user.users.password
        }
        env {
          name  = "DB_IAM_USER"
          value = "${google_service_account.github_actions.name}@${var.project}.iam"
        }
      }
      service_account_name = google_service_account.github_actions.email
    }
    metadata {
      annotations = {
        "autoscaling.knative.dev/maxScale"      = "1000"
        "run.googleapis.com/cloudsql-instances" = google_sql_database_instance.postgres.connection_name
        "run.googleapis.com/client-name"        = "terraform"
      }
    }
  }
}

output "url" {
  value = google_cloud_run_service.default.status[0].url
}

resource "google_container_registry" "registry" {
  project  = var.project
  location = "ASIA"
}

resource "google_storage_bucket_iam_member" "registry_create" {
  bucket = google_container_registry.registry.id
  role   = "roles/storage.admin"
  member = "serviceAccount:${google_service_account.github_actions.email}"
}

variable "project" {
  description = "A name of a GCP project"
  type        = string
  default     = null
}

variable "location" {
  description = "A location of a cloud run instance"
  type        = string
  default     = "asia-northeast1"
}

variable "repo_name" {
  description = "github repository name"
  default     = "user/repository"
}

variable "container_image" {
  description = "docker container image"
  type        = string
  default     = ""
}

variable "db_user_password" {
  description = "password for the builtin postgresql user"
  default     = ""
}

variable "db_root_user_password" {
  description = "password for the root postgresql user"
  default     = ""
}

variable "workload_identity_pool_name" {
  description = "name of workload identity pool"
  default     = ""
}