google-cloud-platform - 无法为我的 Postgres Cloud SQL 实例启用私有 IP
问题描述
当我尝试在我的 Cloud SQL 实例(Postgresql 9.6)上启用私有 IP 时,我收到以下错误消息:
Network association failed due to the following error: set Service Networking service account as servicenetworking.serviceAgent role on consumer project
我有一个 VPC,我在“关联网络”下拉列表中选择了它,我也选择了一个托管服务网络,我已经设置了它,所以理论上它应该都可以工作。
我在 IAM 下找不到与错误消息相关的任何内容,无论是服务帐户还是servicenetworking.serviceAgent
权限。
更新 包括相关的 terraform 片段
## VPC Setup
resource "google_compute_network" "my_network" {
project = "${var.project_id}"
name = "vpc-play"
auto_create_subnetworks = "false"
routing_mode = "REGIONAL"
}
# There is a bunch of subnets linked to this network which are not included here
## Managed services network
resource "google_compute_global_address" "default" {
name = "google-managed-services-vpc-${var.project_id}"
project = "${var.project_id}"
provider = "google-beta"
ip_version = "IPV4"
prefix_length = 16
address_type = "INTERNAL"
purpose = "VPC_PEERING"
network = "${google_compute_network.my_network.self_link}"
}
## Error occurs on this step
## Error is : google_service_networking_connection.private_vpc_connection: set Service Networking service account as servicenetworking.serviceAgent role on consumer project
resource "google_service_networking_connection" "private_vpc_connection" {
provider = "google-beta"
network = "${google_compute_network.my_network.self_link}"
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = ["${google_compute_global_address.default.name}"]
}
## Database configuration <-- omitted private ip stuff for now as doesn't even get to creation of this, error in previous step
resource "google_sql_database_instance" "my_db" {
depends_on = ["google_service_networking_connection.private_vpc_connection"]
name = "my_db"
project = "${var.project_id}"
database_version = "POSTGRES_9_6"
region = "${var.region}"
lifecycle {
prevent_destroy = true
}
settings {
tier = "db-f1-micro"
backup_configuration {
enabled = true
start_time = "02:00"
}
maintenance_window {
day = 1
hour = 3
update_track = "stable"
}
ip_configuration {
authorized_networks = [
{
name = "office"
value = "${var.my_ip}"
},
]
}
disk_size = 10
availability_type = "ZONAL"
location_preference {
zone = "${var.zone}"
}
}
}
解决方案
使用私有 IP 创建 Cloud SQL 实例的Terraform 代码有一些错误。第一个是${google_compute_network.private_network.self_link}
变量获取网络的完整名称,这意味着它将类似于www.googleapis.com/compute/v1/projects/PROJECT-ID/global/networks/testnw2
. 该字段中不允许使用此值google_compute_global_address.private_ip_address.network
,因此,您需要将 ${google_compute_network.private_network.self_link} 更改为 ${google_compute_network.private_network.name}。
另一个错误是格式google_sql_database_instance.instance.settings.ip_configuration.private_network
应该是projects/PROJECT_ID/global/networks/NW_ID
. 因此您需要将字段更改为projects/[PROJECT_ID]/global/networks/${google_compute_network.private_network.name}
才能工作。
第三个错误,也是您在初始消息中共享的错误,您需要在 Terraform 代码中设置一个服务帐户以获得适当的权限以避免此错误。请检查共享代码的第一行。
第四个错误是您需要使用 google-beta 提供程序来执行此操作,而不是 google 默认提供的
正如我发布的评论中所讨论的,我"An Unknown Error occurred"
在使用该 Terraform 代码之前看到了该错误,该错误是指在进行 VPC 对等互连时出现的错误。我知道解决这个问题很令人沮丧,因为它没有显示任何有用的信息,但如果您在 Google Cloud Platform Support 中打开工单,我们将能够使用我们的内部工具检查真正的错误。
正如所承诺的,这是我用来创建专用网络并将其附加到创建时的 Google Cloud SQL 实例的代码。
provider "google-beta" {
credentials = "${file("CREDENTIALS.json")}"
project = "PROJECT-ID"
region = "us-central1"
}
resource "google_compute_network" "private_network" {
name = "testnw"
}
resource "google_compute_global_address" "private_ip_address" {
provider="google-beta"
name = "${google_compute_network.private_network.name}"
purpose = "VPC_PEERING"
address_type = "INTERNAL"
prefix_length = 16
network = "${google_compute_network.private_network.name}"
}
resource "google_service_networking_connection" "private_vpc_connection" {
provider="google-beta"
network = "${google_compute_network.private_network.self_link}"
service = "servicenetworking.googleapis.com"
reserved_peering_ranges = ["${google_compute_global_address.private_ip_address.name}"]
}
resource "google_sql_database_instance" "instance" {
provider="google-beta"
depends_on = ["google_service_networking_connection.private_vpc_connection"]
name = "privateinstance"
region = "us-central1"
settings {
tier = "db-f1-micro"
ip_configuration {
ipv4_enabled = "false"
private_network = "projects/PROJECT-ID/global/networks/${google_compute_network.private_network.name}"
}
}
}
推荐阅读
- sql - 以新形式重塑数据,以便为所有可能的情况创建新列
- python - 如何匹配相似(但不相同的字符串)中的标记,以便我可以将 POS 标签从一个字符串共享到另一个字符串?
- sql - 如果父母或孩子的姓名匹配,请选择父母
- jupyter-notebook - 使用 Latax 将 Jupyter 转换为 PDF
- html - 如何移动图像下方的绿色文字?
- javascript - 状态在反应中被覆盖
- ruby-on-rails - 持续调用特定数据属性的父模型是否效率低下?
- ruby - 如何左旋转整数的位
- vba - Selenium VBA:填写 Windows 弹出窗口以上传文件
- vb.net - 如果运行多个单行 If 语句,是否需要多个 Else 语句?