add vpc access connector to subnet

src/_artifacts.tf

@@ -10,6 +10,7 @@ resource "massdriver_artifact" "subnetwork" {
  grn = google_compute_subnetwork.main.id
  cidr = google_compute_subnetwork.main.ip_cidr_range
  gcp_global_network_grn = var.gcp_global_network.data.grn
+ vpc_access_connector = google_vpc_access_connector.shared.id
  }
  }
  specs = {

src/_providers.tf

@@ -9,6 +9,10 @@ terraform {
  source = "hashicorp/google"
  version = "~> 4.0"
  }
+ google-beta = {
+ source = "hashicorp/google-beta"
+ version = "~> 4.0"
+ }
  null = {
  source = "hashicorp/null"
  version = "~> 3.0"
@@ -21,3 +25,9 @@ provider "google" {
  credentials = jsonencode(var.gcp_authentication.data)
  region = var.gcp_region
 }
+
+provider "google-beta" {
+ project = var.gcp_authentication.data.project_id
+ credentials = jsonencode(var.gcp_authentication.data)
+ region = var.gcp_region
+}

src/apis.tf

@@ -2,6 +2,7 @@ module "apis" {
  source = "github.com/massdriver-cloud/terraform-modules//gcp-enable-apis?ref=c336d59"
  services = [
  # needed for MD alarms
- "monitoring.googleapis.com"
+ "monitoring.googleapis.com",
+ "vpcaccess.googleapis.com"
  ]
 }

src/vpc_connector.tf

@@ -0,0 +1,65 @@
+# vpc connectors
+# needed for Cloud Run / Cloud Functions to access Redis, Postgres, etc.
+# min $14 a month each
+
+# one per subnet
+# added to the subnet artifact to be shared with serverless apps in that region
+
+# This breaks if someone makes two subnet packages in the same region, in the same VPC.
+# That's pretty unlikely but this should be replaced with md-terraform-utils eventually.
+locals {
+ ranges = {
+ asia-east1 = "10.253.0.0/28"
+ asia-east2 = "10.253.0.16/28"
+ asia-northeast1 = "10.253.0.32/28"
+ asia-northeast2 = "10.253.0.48/28"
+ asia-northeast3 = "10.253.0.64/28"
+ asia-south1 = "10.253.0.80/28"
+ asia-south2 = "10.253.0.96/28"
+ asia-southeast1 = "10.253.0.112/28"
+ asia-southeast2 = "10.253.0.128/28"
+ australia-southeast1 = "10.253.0.144/28"
+ australia-southeast2 = "10.253.0.160/28"
+ europe-central2 = "10.253.0.176/28"
+ europe-north1 = "10.253.0.192/28"
+ europe-southwest1 = "10.253.0.208/28"
+ europe-west1 = "10.253.0.224/28"
+ europe-west2 = "10.253.0.240/28"
+ europe-west3 = "10.254.0.0/28"
+ europe-west4 = "10.254.0.16/28"
+ europe-west6 = "10.254.0.32/28"
+ europe-west8 = "10.254.0.48/28"
+ europe-west9 = "10.254.0.64/28"
+ me-west1 = "10.254.0.80/28"
+ northamerica-northeast1 = "10.254.0.96/28"
+ northamerica-northeast2 = "10.254.0.112/28"
+ southamerica-east1 = "10.254.0.128/28"
+ southamerica-west1 = "10.254.0.144/28"
+ us-central1 = "10.254.0.160/28"
+ us-east1 = "10.254.0.176/28"
+ us-east4 = "10.254.0.192/28"
+ us-east5 = "10.254.0.208/28"
+ us-south1 = "10.254.0.224/28"
+ us-west1 = "10.254.0.240/28"
+ us-west2 = "10.252.0.0/28"
+ us-west3 = "10.252.0.16/28"
+ us-west4 = "10.252.0.32/28"
+ }
+}
+
+# cost per month
+# f1-micro | e2-micro
+# min $13.29 | $14.69
+resource "google_vpc_access_connector" "shared" {
+ provider = google-beta
+ name = var.md_metadata.name_prefix
+ region = var.gcp_region
+ ip_cidr_range = local.ranges[var.gcp_region]
+ # in Mbps
+ min_throughput = 200
+ max_throughput = 500
+ machine_type = "f1-micro"
+ network = var.gcp_global_network.data.grn
+
+ depends_on = [module.apis]
+}