Terraform 无法销毁服务网络连接

Question

我正在使用 terraform 在 GCP 中创建基础设施。当我进行地形应用时，基础设施已成功创建。我还尝试删除基础设施，但脚本无法删除服务网络连接或 VPC 对等连接。

错误：

Unable to remove Service Networking Connection, err: Error waiting for Delete Service Networking Connection: Error code 9, message: Failed to delete connection; Producer services (e.g. CloudSQL, Cloud Memstore, etc.) are still using this connection.

如果我手动删除 VPC 对等连接并释放私有 IP，一切正常。我可以删除基础设施。

我正在使用 GitHub Actions 删除基础设施。它只是执行 terraform destroy 命令

      - name: Terraform destroy
        working-directory: ${{ env.DIR }}
        run: terraform destroy -auto-approve

我为 VPC 和数据库创建了单独的模块。 VPC 模块：

# Creating a custom VPC
resource "google_compute_network" "custom-vpc-network" {
  name                    = var.vpc_name
  project                 = var.project_id
  auto_create_subnetworks = false
  mtu                     = 1460
  routing_mode            = var.route_mode
  description = "Custom VPC for an ecommerce architecture"
}

# Creating a custom subnet
resource "google_compute_subnetwork" "front-end-subnet" {
  ip_cidr_range            = var.ip_address_range_frontend
  region                   = var.project_region
  name                     = var.subnet_name_frontend
  network                  = google_compute_network.custom-vpc-network.name
  description = "subnet for frontend"
  private_ip_google_access = true
  stack_type               = var.stack_type
  log_config {
    aggregation_interval = var.aggregate_interval
    flow_sampling        = 0.5
    metadata             = var.include_all_metadata
  }
}

resource "google_compute_subnetwork" "back-end-subnet" {
  ip_cidr_range            = var.ip_address_range_backend
  region                   = var.project_region
  name                     = var.subnet_name_backend
  network                  = google_compute_network.custom-vpc-network.name
  description = "subnet for backend"
  private_ip_google_access = true
  stack_type               = var.stack_type
  log_config {
    aggregation_interval = var.aggregate_interval
    flow_sampling        = 0.5
    metadata             = var.include_all_metadata
  }
}

resource "google_compute_subnetwork" "database-subnet" {
  ip_cidr_range            = var.ip_address_range_database
  region                   = var.project_region
  name                     = var.subnet_name_database
  network                  = google_compute_network.custom-vpc-network.name
  description = "subnet for database"
  private_ip_google_access = true
  stack_type               = var.stack_type
  log_config {
    aggregation_interval = var.aggregate_interval
    flow_sampling        = 0.5
    metadata             = var.include_all_metadata
  }
}

数据库模块：

resource "google_compute_global_address" "private-ip-address" {
    name = var.private_ip_address
    address_type = var.private_ip_type
    purpose = var.private_ip_purpose
    network = var.network_id  
    prefix_length = 16
    depends_on = [ var.network_id ]
}

resource "google_service_networking_connection" "private-vpc-connection" {
    network = var.network_id
    service = var.service
    reserved_peering_ranges = [google_compute_global_address.private-ip-address.name]
    lifecycle {
      create_before_destroy = true
    }
}

resource "google_sql_database_instance" "sql-instance" {
  name = var.sql_instance
  region = var.project_region
  database_version = var.database_version

  depends_on = [ google_service_networking_connection.private-vpc-connection ]

  settings {
    tier              = var.machine_type
    availability_type = var.availability_type_regional
    edition           = var.edition
    user_labels       = {
      environment = var.environment
    }
    ip_configuration {
      ipv4_enabled      = true
      private_network   = var.network_id
      enable_private_path_for_google_cloud_services = true
    }

    backup_configuration {
      enabled = true
      start_time = var.backup-time
      point_in_time_recovery_enabled = true
    }

    maintenance_window {
      day = 7
      hour = 20
      update_track = var.update_track
    }
  }
  deletion_protection = false
  lifecycle {
    create_before_destroy = true
  }
}

resource "google_sql_database_instance" "sql-instance-read-replica" {
  name = "${var.sql_instance}-replica"
  master_instance_name = google_sql_database_instance.sql-instance.name
  region = var.project_region
  database_version = var.database_version

  settings {
    tier              = var.machine_type
    availability_type = var.availability_type_zonal
    edition           = var.edition
    user_labels       = {
      environment = var.environment
    }
    ip_configuration {
      ipv4_enabled      = true
      private_network   = var.network_id
      enable_private_path_for_google_cloud_services = true
    }
  }
  deletion_protection = false
  lifecycle {
    create_before_destroy = true
  }

}

resource "google_sql_database" "postgresql-database" {
    name = var.postgresql-database
    instance = google_sql_database_instance.sql-instance.name 
}

resource "google_sql_user" "postgresql-user" {
    name = var.db_username_output
    instance = google_sql_database_instance.sql-instance.name
    password = var.db_password_output
}   

我已经添加了依赖项，以确保 terraform 知道删除依赖项的顺序。如果我将依赖项添加到 VPC，我会遇到循环依赖问题。

请告诉我哪里出错了

Answer 1

您面临的问题是因为当您尝试使用 Terraform 销毁 Cloud SQL 实例时，它仍然使用服务网络连接。

尝试从

depends_on

中删除

google_sql_database_instance

。这消除了循环依赖。