GH-4: Use explicit subnets and use Direct VPC for Cloud Run

cloud/schemes/cloud-run/main.tf

@@ -3,19 +3,15 @@ resource "google_project_service" "run" {
   service = "run.googleapis.com"
 }
 
-resource "google_project_service" "vpc_access" {
-  project = var.project
-  service = "vpcaccess.googleapis.com"
-}
-
 resource "google_service_account" "cloud_run_schemes" {
   account_id = "cloud-run-schemes"
 }
 
 resource "google_cloud_run_v2_service" "schemes" {
-  name     = "schemes"
-  project  = var.project
-  location = var.region
+  name         = "schemes"
+  project      = var.project
+  location     = var.region
+  launch_stage = "BETA"
 
   template {
     containers {
@@ -71,8 +67,10 @@ resource "google_cloud_run_v2_service" "schemes" {
       }
     }
     vpc_access {
-      connector = google_vpc_access_connector.cloud_run.id
-      egress    = "PRIVATE_RANGES_ONLY"
+      network_interfaces {
+        subnetwork = google_compute_subnetwork.cloud_run.name
+      }
+      egress = "PRIVATE_RANGES_ONLY"
     }
     service_account = google_service_account.cloud_run_schemes.email
   }
@@ -107,13 +105,11 @@ resource "google_project_iam_member" "cloud_run_artifact_registry_reader" {
   depends_on = [google_project_service.run]
 }
 
-resource "google_vpc_access_connector" "cloud_run" {
+resource "google_compute_subnetwork" "cloud_run" {
   name          = "cloud-run"
-  ip_cidr_range = "10.0.0.0/28"
+  ip_cidr_range = "10.1.0.0/24"
   region        = var.region
   network       = var.vpc_id
-
-  depends_on = [google_project_service.vpc_access]
 }
 
 # secret key

cloud/schemes/cloud-sql/main.tf

@@ -8,8 +8,9 @@ resource "google_sql_database_instance" "main" {
     tier = "db-f1-micro"
 
     ip_configuration {
-      ipv4_enabled    = false
-      private_network = var.vpc_id
+      ipv4_enabled       = false
+      private_network    = var.vpc_id
+      allocated_ip_range = var.vpc_private_ip_address_name
     }
   }
 }

cloud/schemes/cloud-sql/variables.tf

@@ -7,3 +7,8 @@ variable "vpc_id" {
   description = "VPC ID"
   type        = string
 }
+
+variable "vpc_private_ip_address_name" {
+  description = "VPC private services IP address range name"
+  type        = string
+}

cloud/schemes/main.tf

@@ -25,9 +25,10 @@ module "vpc" {
 }
 
 module "cloud_sql" {
-  source = "./cloud-sql"
-  region = local.location
-  vpc_id = module.vpc.id
+  source                      = "./cloud-sql"
+  region                      = local.location
+  vpc_id                      = module.vpc.id
+  vpc_private_ip_address_name = module.vpc.private_ip_address_name
 
   depends_on = [
     module.secret_manager,

cloud/schemes/vpc/main.tf

@@ -19,6 +19,7 @@ resource "google_compute_global_address" "private_ip_address" {
 
   address_type  = "INTERNAL"
   purpose       = "VPC_PEERING"
+  address       = "10.0.0.0"
   prefix_length = 16
 }
 

cloud/schemes/vpc/outputs.tf

@@ -2,3 +2,8 @@ output "id" {
   description = "VPC ID"
   value       = google_compute_network.main.id
 }
+
+output "private_ip_address_name" {
+  description = "VPC private services IP address range name"
+  value       = google_compute_global_address.private_ip_address.name
+}