runr_private_connection (Resource)

A private connection of a project to a managed PostgreSQL database through Skupper (private database connections): a Skupper Link, a Listener and a credentials Secret in the project namespace of the region the workload runs in. The project's own workload, or with environment one of its environments, gets <env_prefix>DATABASE_URL, <env_prefix>PGHOST, … (env_names); the running workload gets them at once, else with its next deploy. The region must run Skupper v2; global projects cannot have private connections.

The credentials (link_token, database, username, password) live in the region only and never come back from the API: Terraform keeps what it set (the token and the password sensitive), or with link_token_wo / password_wo (Terraform 1.11 and later) no token and password at all — change credentials_wo_version to connect with new ones. RunR cannot change a connection: changing any argument replaces it (its workload is without the connection in between). Needs connections.manage on the project. Import with <project name or id>/<connection name or id> (the project's own workload) or <project name or id>/<environment>/<connection name or id>; the credentials are not imported, the next apply takes the configured ones into the state without replacing the connection.

Example Usage#

# production reaches its managed PostgreSQL privately: ORDERS_DATABASE_URL, ORDERS_PGHOST, …
resource "runr_private_connection" "orders" {
  project_id  = runr_project.api.id
  name        = "orders"
  env_prefix  = "ORDERS_"
  routing_key = "pg-orders"
  link_token  = file("${path.module}/orders-access-token.yaml") # the Skupper v2 AccessToken of the database's site
  database    = "orders"
  username    = "orders_app"
  password    = var.orders_password
}

# staging reaches its own database, never production's. Terraform 1.11 and later: the token and
# the password stay out of the state; bump credentials_wo_version to connect with new ones.
resource "runr_private_connection" "orders_staging" {
  project_id             = runr_project.api.id
  environment            = runr_environment.staging.name
  name                   = "orders"
  env_prefix             = "ORDERS_"
  routing_key            = "pg-orders-staging"
  link_token_wo          = var.orders_staging_token
  database               = "orders"
  username               = "orders_app"
  password_wo            = var.orders_staging_password
  credentials_wo_version = "1"
}

output "orders_connection" {
  value = { host = runr_private_connection.orders.host, status = runr_private_connection.orders.status }
}

variable "orders_password" {
  type      = string
  sensitive = true
}

variable "orders_staging_token" {
  type      = string
  sensitive = true
  ephemeral = true
}

variable "orders_staging_password" {
  type      = string
  sensitive = true
  ephemeral = true
}

Schema#

Required#

database (String) Database name.
name (String) Name, unique per workload (at most 30 characters).
project_id (String) Project id.
routing_key (String) Skupper routing key of the database's connector.
username (String) Database user.

Optional#

NOTE: Write-only arguments are supported in Terraform 1.11 and later.

credentials_wo_version (String) Any string; a change replaces the connection with the current link_token_wo / password_wo.
env_prefix (String) Prefix of the variable names, e.g. ORDERS_ (default none); unique per workload.
environment (String) Environment the connection belongs to (runr_environment.<name>.name or its id); its connection lives in the region that environment runs in, and only its workload gets the variables. Left out (or production): the project's own workload.
link_token (String, Sensitive) The Skupper v2 AccessToken, or Link with its TLS Secret (YAML), the database's site issued. One of link_token and link_token_wo is required.
link_token_wo (String, Sensitive, Write-only) link_token that Terraform never stores (write-only, Terraform 1.11 and later); change credentials_wo_version to use a new one.
password (String, Sensitive) Password of the database user (sensitive). One of password and password_wo is required.
password_wo (String, Sensitive, Write-only) password that Terraform never stores (write-only, Terraform 1.11 and later); change credentials_wo_version to use a new one.
port (Number) Port of the local listener (default 5432).
sslmode (String) PostgreSQL sslmode of the connection (default require).

Read-Only#

env_names (List of String) The variables the workload gets.
host (String) Host name the functions connect to (the Listener's Service).
id (String) Connection id.
link_kind (String) access_token (redeemed into a Link by Skupper) or link.
resource_name (String) Name of its Skupper Link and Listener in the region (<name>-<suffix>).
secret_name (String) The credentials Secret in the region.
status (String) What the region reports: ready, pending or error (read with every refresh).

Import#

Import is supported using the following syntax:

The terraform import command can be used, for example:

# <project name or id>/<connection name or id> (the project's own workload)
terraform import runr_private_connection.orders orders-api/orders

# <project name or id>/<environment>/<connection name or id>. The credentials are not imported:
# the next apply takes the configured ones into the state without replacing the connection.
terraform import runr_private_connection.orders_staging orders-api/staging/orders