{"id":20936898,"url":"https://github.com/datafold/terraform-google-datafold","last_synced_at":"2026-04-01T21:28:43.886Z","repository":{"id":227310575,"uuid":"770508295","full_name":"datafold/terraform-google-datafold","owner":"datafold","description":"A terraform module for deploying the Datafold infrastructure on Google cloud.","archived":false,"fork":false,"pushed_at":"2026-03-19T08:27:33.000Z","size":165,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":6,"default_branch":"main","last_synced_at":"2026-03-20T01:46:30.462Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/datafold.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-03-11T17:12:08.000Z","updated_at":"2026-03-19T08:27:35.000Z","dependencies_parsed_at":"2026-02-27T05:02:42.325Z","dependency_job_id":null,"html_url":"https://github.com/datafold/terraform-google-datafold","commit_stats":null,"previous_names":["datafold/terraform-google-datafold"],"tags_count":36,"template":false,"template_full_name":null,"purl":"pkg:github/datafold/terraform-google-datafold","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-google-datafold","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-google-datafold/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-google-datafold/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-google-datafold/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/datafold","download_url":"https://codeload.github.com/datafold/terraform-google-datafold/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/datafold%2Fterraform-google-datafold/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31292273,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-01T21:15:39.731Z","status":"ssl_error","status_checked_at":"2026-04-01T21:15:34.046Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-18T22:29:14.613Z","updated_at":"2026-04-01T21:28:43.862Z","avatar_url":"https://github.com/datafold.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"=======\n# Datafold Google module\n\nThis repository provisions infrastructure resources on Google Cloud for deploying Datafold using the datafold-operator.\n\n## About this module\n\n**⚠️ Important**: This module is now **optional**. If you already have GKE infrastructure in place, you can configure the required resources independently. This module is primarily intended for customers who need to set up the complete infrastructure stack for GKE deployment.\n\nThe module provisions Google Cloud infrastructure resources that are required for Datafold deployment. Application configuration is now managed through the `datafoldapplication` custom resource on the cluster using the datafold-operator, rather than through Terraform application directories.\n\n## Breaking Changes\n\n### Load Balancer Deployment (Default Changed)\n\n**Breaking Change**: The load balancer is **no longer deployed by default**. The default behavior has been toggled to `deploy_lb = false`.\n\n- **Previous behavior**: Load balancer was deployed by default\n- **New behavior**: Load balancer deployment is disabled by default\n- **Action required**: If you need a load balancer, you must explicitly set `deploy_lb = true` in your configuration, so that you don't lose it. (in the case it does happen, you need to redeploy it and then update your DNS to the new LB IP).\n\n### Application Directory Removal\n\n- The \"application\" directory is no longer part of this repository\n- Application configuration is now managed through the `datafoldapplication` custom resource on the cluster\n\n## Prerequisites\n\n* A Google Cloud account, preferably a new isolated one.\n* Terraform \u003e= 1.4.6\n* A customer contract with Datafold\n  * The application does not work without credentials supplied by sales\n* Access to our public helm-charts repository\n\nThe full deployment will create the following resources:\n\n* Google VPC\n* Google subnets\n* Google GCS bucket for clickhouse backups\n* Google Cloud Load Balancer (optional, disabled by default)\n* Google-managed SSL certificate (if load balancer is enabled)\n* Three persistent disk volumes for local data storage\n* Cloud SQL PostgreSQL database\n* A GKE cluster\n* Service accounts for the GKE cluster to perform actions outside of its cluster boundary:\n  * Provisioning persistent disk volumes\n  * Updating Network Endpoint Group to route traffic to pods directly\n  * Managing GCS bucket access for ClickHouse backups\n\n**Infrastructure Dependencies**: For a complete list of required infrastructure resources and detailed deployment guidance, see the [Datafold Dedicated Cloud GCP Deployment Documentation](https://docs.datafold.com/datafold-deployment/dedicated-cloud/gcp).\n\n## Negative scope\n\n* This module will not provision DNS names in your zone.\n\n## How to use this module\n\n* See the example for a potential setup, which has dependencies on our helm-charts\n\nThe example directory contains a single deployment example for infrastructure setup.\n\nSetting up the infrastructure:\n\n* It is easiest if you have full admin access in the target project.\n* Pre-create a symmetric encryption key that is used to encrypt/decrypt secrets of this deployment.\n  * Use the alias instead of the `mrk` link. Put that into `locals.tf`\n* **Certificate Requirements** (depends on load balancer deployment method):\n  * **If deploying load balancer from this Terraform module** (`deploy_lb = true`): Pre-create and validate the SSL certificate in your DNS, then refer to that certificate in main.tf using its domain name (Replace \"datafold.example.com\")\n  * **If deploying load balancer from within Kubernetes**: The certificate will be created automatically, but you must wait for it to become available and then validate it in your DNS after the deployment is complete\n* Change the settings in locals.tf\n  * provider_region = which region you want to deploy in.\n  * project_id = The GCP project ID where you want to deploy.\n  * kms_profile = The profile you want to use to issue the deployments. Targets the deployment account.\n  * kms_key = A pre-created symmetric KMS key. It's only purpose is for encryption/decryption of deployment secrets.\n  * deployment_name = The name of the deployment, used in kubernetes namespace, container naming and datadog \"deployment\" Unified Tag)\n* Run `terraform init` in the infra directory.\n* Run `terraform apply` in `infra` directory. This should complete ok. \n  * Check in the console if you see the GKE cluster, Cloud SQL database, etc.\n  * If you enabled load balancer deployment, check for the load balancer as well.\n  * The configuration values needed for application deployment will be output to the console after the apply completes.\n\n**Application Deployment**: After infrastructure is ready, deploy the application using the datafold-operator. Continue with the [Datafold Helm Charts repository](https://github.com/datafold/helm-charts) to deploy the operator manager and then the application through the operator. The operator is the default and recommended method for deploying Datafold.\n\n## Infrastructure Dependencies\n\nThis module is designed to provide the complete infrastructure stack for Datafold deployment. However, if you already have GKE infrastructure in place, you can choose to configure the required resources independently.\n\n**Required Infrastructure Components**:\n- GKE cluster with appropriate node pools\n- Cloud SQL PostgreSQL database\n- GCS bucket for ClickHouse backups\n- Persistent disks for persistent storage (ClickHouse data, ClickHouse logs, Redis data)\n- IAM roles and service accounts for cluster operations\n- Load balancer (optional, can be managed by Google Cloud Load Balancer Controller)\n- VPC and networking components\n- SSL certificate (validation timing depends on deployment method):\n  - **Terraform-managed LB**: Certificate must be pre-created and validated\n  - **Kubernetes-managed LB**: Certificate created automatically, validated post-deployment\n\n**Alternative Approaches**:\n- **Use this module**: Provides complete infrastructure setup for new deployments\n- **Use existing infrastructure**: Configure required resources manually or through other means\n- **Hybrid approach**: Use this module for some components and existing infrastructure for others\n\nFor detailed specifications of each required component, see the [Datafold Dedicated Cloud GCP Deployment Documentation](https://docs.datafold.com/datafold-deployment/dedicated-cloud/gcp). For application deployment instructions, continue with the [Datafold Helm Charts repository](https://github.com/datafold/helm-charts) to deploy the operator manager and then the application through the operator.\n\n## Detailed Infrastructure Components\n\nBased on the [Datafold GCP Deployment Documentation](https://docs.datafold.com/datafold-deployment/dedicated-cloud/gcp), this module provisions the following detailed infrastructure components:\n\n### Persistent Disks\nThe Datafold application requires 3 persistent disks for storage, each deployed as encrypted Google Compute Engine persistent disks in the primary availability zone:\n\n- **ClickHouse data disk**: Serves as the analytical database storage for Datafold. ClickHouse is a columnar database that excels at analytical queries. The default 40GB allocation usually provides sufficient space for typical deployments, but it can be scaled up based on data volume requirements.\n- **ClickHouse logs disk**: Stores ClickHouse's internal logs and temporary data. The separate logs disk prevents log data from consuming IOPS and I/O performance from actual data storage.\n- **Redis data disk**: Provides persistent storage for Redis, which handles task distribution and distributed locks in the Datafold application. Redis is memory-first but benefits from persistence for data durability across restarts.\n\nAll persistent disks are encrypted by default using Google-managed encryption keys, ensuring data security at rest.\n\n### Load Balancer\nThe load balancer serves as the primary entry point for all external traffic to the Datafold application. The module offers 2 deployment strategies:\n\n- **External Load Balancer Deployment** (the default approach): Creates a Google Cloud Load Balancer through Terraform\n- **Kubernetes-Managed Load Balancer**: Relies on the Google Cloud Load Balancer Controller running within the GKE cluster, deployed by the datafold application resource. This means Kubernetes creates the load balancer for you.\n\n### GKE Cluster\nThe Google Kubernetes Engine (GKE) cluster forms the compute foundation for the Datafold application:\n\n- **Network Architecture**: The entire cluster is deployed into private subnets with Cloud NAT for egress traffic\n- **Security Features**: Workload Identity, Shielded nodes, Binary authorization, Network policy, and Private nodes\n- **Node Management**: Supports up to three managed node pools with automatic scaling\n\n### IAM Roles and Permissions\nThe IAM architecture follows the principle of least privilege:\n\n- **GKE service account**: Basic permissions for logging, monitoring, and storage access\n- **ClickHouse backup service account**: Custom role for ClickHouse to make backups and store them on Cloud Storage\n- **Datafold service accounts**: Pre-defined roles for different application components\n\n### Cloud SQL Database\nThe PostgreSQL Cloud SQL instance serves as the primary relational database:\n\n- **Storage configuration**: Starts with a 20GB initial allocation that can automatically scale up to 100GB\n- **High availability**: Intentionally disabled by default to reduce costs and complexity\n- **Security and encryption**: Always encrypts data at rest using Google-managed encryption keys\n\n### Initializing the application\n\nAfter deploying the application through the operator (see the [Datafold Helm Charts repository](https://github.com/datafold/helm-charts)), establish a shell into the `\u003cdeployment\u003e-dfshell` container. \nIt is likely that the scheduler and server containers are crashing in a loop.\n\nAll we need to do is to run these commands:\n\n1. `./manage.py clickhouse create-tables`\n2. `./manage.py database create-or-upgrade`\n3. `./manage.py installation set-new-deployment-params`\n\nNow all containers should be up and running.\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_dns\"\u003e\u003c/a\u003e [dns](#requirement\\_dns) | 3.2.1 |\n| \u003ca name=\"requirement_google\"\u003e\u003c/a\u003e [google](#requirement\\_google) | \u003e= 6.27.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_google\"\u003e\u003c/a\u003e [google](#provider\\_google) | \u003e= 6.27.0 |\n| \u003ca name=\"provider_random\"\u003e\u003c/a\u003e [random](#provider\\_random) | n/a |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_clickhouse_backup\"\u003e\u003c/a\u003e [clickhouse\\_backup](#module\\_clickhouse\\_backup) | ./modules/clickhouse_backup | n/a |\n| \u003ca name=\"module_database\"\u003e\u003c/a\u003e [database](#module\\_database) | ./modules/database | n/a |\n| \u003ca name=\"module_gke\"\u003e\u003c/a\u003e [gke](#module\\_gke) | ./modules/gke | n/a |\n| \u003ca name=\"module_load_balancer\"\u003e\u003c/a\u003e [load\\_balancer](#module\\_load\\_balancer) | ./modules/load_balancer | n/a |\n| \u003ca name=\"module_networking\"\u003e\u003c/a\u003e [networking](#module\\_networking) | ./modules/networking | n/a |\n| \u003ca name=\"module_project-iam-bindings\"\u003e\u003c/a\u003e [project-iam-bindings](#module\\_project-iam-bindings) | terraform-google-modules/iam/google//modules/projects_iam | n/a |\n| \u003ca name=\"module_project_factory_project_services\"\u003e\u003c/a\u003e [project\\_factory\\_project\\_services](#module\\_project\\_factory\\_project\\_services) | terraform-google-modules/project-factory/google//modules/project_services | ~\u003e 18.0.0 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_add_onprem_support_group\"\u003e\u003c/a\u003e [add\\_onprem\\_support\\_group](#input\\_add\\_onprem\\_support\\_group) | Flag to add onprem support group for datafold-onprem-support@datafold.com | `bool` | `true` | no |\n| \u003ca name=\"input_backup_lifecycle_expiration_days\"\u003e\u003c/a\u003e [backup\\_lifecycle\\_expiration\\_days](#input\\_backup\\_lifecycle\\_expiration\\_days) | Number of days after which clickhouse backup objects will expire and be deleted. | `number` | `6` | no |\n| \u003ca name=\"input_ch_machine_type\"\u003e\u003c/a\u003e [ch\\_machine\\_type](#input\\_ch\\_machine\\_type) | The machine type for the ch GKE cluster nodes | `string` | `\"n2-standard-8\"` | no |\n| \u003ca name=\"input_clickhouse_backup_sa_key\"\u003e\u003c/a\u003e [clickhouse\\_backup\\_sa\\_key](#input\\_clickhouse\\_backup\\_sa\\_key) | SA key from secrets | `string` | `\"\"` | no |\n| \u003ca name=\"input_clickhouse_data_disk_size\"\u003e\u003c/a\u003e [clickhouse\\_data\\_disk\\_size](#input\\_clickhouse\\_data\\_disk\\_size) | Data volume size clickhouse | `number` | `40` | no |\n| \u003ca name=\"input_clickhouse_db\"\u003e\u003c/a\u003e [clickhouse\\_db](#input\\_clickhouse\\_db) | Db for clickhouse. | `string` | `\"clickhouse\"` | no |\n| \u003ca name=\"input_clickhouse_gcs_bucket\"\u003e\u003c/a\u003e [clickhouse\\_gcs\\_bucket](#input\\_clickhouse\\_gcs\\_bucket) | GCS Bucket for clickhouse backups. | `string` | `\"clickhouse-backups-abcguo23\"` | no |\n| \u003ca name=\"input_clickhouse_get_backup_sa_from_secrets_yaml\"\u003e\u003c/a\u003e [clickhouse\\_get\\_backup\\_sa\\_from\\_secrets\\_yaml](#input\\_clickhouse\\_get\\_backup\\_sa\\_from\\_secrets\\_yaml) | Flag to toggle getting clickhouse backup SA from secrets.yaml instead of creating new one | `bool` | `false` | no |\n| \u003ca name=\"input_clickhouse_username\"\u003e\u003c/a\u003e [clickhouse\\_username](#input\\_clickhouse\\_username) | Username for clickhouse. | `string` | `\"clickhouse\"` | no |\n| \u003ca name=\"input_cloud_router_bgp\"\u003e\u003c/a\u003e [cloud\\_router\\_bgp](#input\\_cloud\\_router\\_bgp) | Flag to toggle cloud router bgp | \u003cpre\u003eobject(\u003cbr\u003e    {\u003cbr\u003e      asn = string\u003cbr\u003e      # advertise_mode = optional(string, \"DEFAULT\")\u003cbr\u003e      # advertised_groups = optional(list(string))\u003cbr\u003e      # advertised_ip_ranges = optional(\u003cbr\u003e      #   list(\u003cbr\u003e      #     object({\u003cbr\u003e      #       range = string\u003cbr\u003e      #       description = optional(string)\u003cbr\u003e      #     })\u003cbr\u003e      #   ),\u003cbr\u003e      #   []\u003cbr\u003e      # )\u003cbr\u003e      keepalive_interval = optional(number)\u003cbr\u003e    }\u003cbr\u003e  )\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_cloud_router_nats\"\u003e\u003c/a\u003e [cloud\\_router\\_nats](#input\\_cloud\\_router\\_nats) | NATs to deploy on this router. | \u003cpre\u003elist(object({\u003cbr\u003e    name                                = string\u003cbr\u003e    nat_ip_allocate_option              = optional(string)\u003cbr\u003e    source_subnetwork_ip_ranges_to_nat  = optional(string)\u003cbr\u003e    nat_ips                             = optional(list(string), [])\u003cbr\u003e    min_ports_per_vm                    = optional(number)\u003cbr\u003e    max_ports_per_vm                    = optional(number)\u003cbr\u003e    udp_idle_timeout_sec                = optional(number)\u003cbr\u003e    icmp_idle_timeout_sec               = optional(number)\u003cbr\u003e    tcp_established_idle_timeout_sec    = optional(number)\u003cbr\u003e    tcp_transitory_idle_timeout_sec     = optional(number)\u003cbr\u003e    tcp_time_wait_timeout_sec           = optional(number)\u003cbr\u003e    enable_endpoint_independent_mapping = optional(bool)\u003cbr\u003e    enable_dynamic_port_allocation      = optional(bool)\u003cbr\u003e\u003cbr\u003e    log_config = optional(object({\u003cbr\u003e      enable = optional(bool, true)\u003cbr\u003e      filter = optional(string, \"ALL\")\u003cbr\u003e    }), {})\u003cbr\u003e\u003cbr\u003e    subnetworks = optional(list(object({\u003cbr\u003e      name                     = string\u003cbr\u003e      source_ip_ranges_to_nat  = list(string)\u003cbr\u003e      secondary_ip_range_names = optional(list(string))\u003cbr\u003e    })), [])\u003cbr\u003e\u003cbr\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_common_tags\"\u003e\u003c/a\u003e [common\\_tags](#input\\_common\\_tags) | Common tags to apply to any resource | `map(string)` | n/a | yes |\n| \u003ca name=\"input_create_ssl_cert\"\u003e\u003c/a\u003e [create\\_ssl\\_cert](#input\\_create\\_ssl\\_cert) | True to create the SSL certificate, false if not | `bool` | `false` | no |\n| \u003ca name=\"input_custom_node_pools\"\u003e\u003c/a\u003e [custom\\_node\\_pools](#input\\_custom\\_node\\_pools) | Dynamic extra node pools | \u003cpre\u003elist(object({\u003cbr\u003e    name = string\u003cbr\u003e    enabled = bool\u003cbr\u003e    initial_node_count = number\u003cbr\u003e    machine_type = string\u003cbr\u003e    disk_size_gb = number\u003cbr\u003e    disk_type = string\u003cbr\u003e    spot = bool\u003cbr\u003e    taints = list(object({\u003cbr\u003e      key    = string\u003cbr\u003e      value  = string\u003cbr\u003e      effect = string\u003cbr\u003e    }))\u003cbr\u003e    min_node_count  = number\u003cbr\u003e    max_node_count  = number\u003cbr\u003e    max_surge       = number\u003cbr\u003e    max_unavailable = number\u003cbr\u003e    labels          = map(string)\u003cbr\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_database_edition\"\u003e\u003c/a\u003e [database\\_edition](#input\\_database\\_edition) | The edition of the database (ENTERPRISE or ENTERPRISE\\_PLUS). If null, automatically determined based on version. | `string` | `null` | no |\n| \u003ca name=\"input_database_name\"\u003e\u003c/a\u003e [database\\_name](#input\\_database\\_name) | The name of the database | `string` | `\"datafold\"` | no |\n| \u003ca name=\"input_database_version\"\u003e\u003c/a\u003e [database\\_version](#input\\_database\\_version) | Version of the database | `string` | `\"POSTGRES_15\"` | no |\n| \u003ca name=\"input_datafold_intercom_app_id\"\u003e\u003c/a\u003e [datafold\\_intercom\\_app\\_id](#input\\_datafold\\_intercom\\_app\\_id) | The app id for the intercom. A value other than \"\" will enable this feature. Only used if the customer doesn't use slack. | `string` | `\"\"` | no |\n| \u003ca name=\"input_db_deletion_protection\"\u003e\u003c/a\u003e [db\\_deletion\\_protection](#input\\_db\\_deletion\\_protection) | A flag that sets delete protection (applied in terraform only, not on the cloud). | `bool` | `true` | no |\n| \u003ca name=\"input_default_node_disk_size\"\u003e\u003c/a\u003e [default\\_node\\_disk\\_size](#input\\_default\\_node\\_disk\\_size) | Root disk size for a cluster node | `number` | `40` | no |\n| \u003ca name=\"input_deploy_lb\"\u003e\u003c/a\u003e [deploy\\_lb](#input\\_deploy\\_lb) | Allows a deploy with a not-yet-existing load balancer | `bool` | `true` | no |\n| \u003ca name=\"input_deploy_neg_backend\"\u003e\u003c/a\u003e [deploy\\_neg\\_backend](#input\\_deploy\\_neg\\_backend) | Set this to true to connect the backend service to the NEG that the GKE cluster will create | `bool` | `true` | no |\n| \u003ca name=\"input_deploy_vpc_flow_logs\"\u003e\u003c/a\u003e [deploy\\_vpc\\_flow\\_logs](#input\\_deploy\\_vpc\\_flow\\_logs) | Flag weither or not to deploy vpc flow logs | `bool` | `false` | no |\n| \u003ca name=\"input_deployment_name\"\u003e\u003c/a\u003e [deployment\\_name](#input\\_deployment\\_name) | Name of the current deployment. | `string` | n/a | yes |\n| \u003ca name=\"input_domain_name\"\u003e\u003c/a\u003e [domain\\_name](#input\\_domain\\_name) | Provide valid domain name (used to set host in GCP) | `string` | n/a | yes |\n| \u003ca name=\"input_enable_ch_node_pool\"\u003e\u003c/a\u003e [enable\\_ch\\_node\\_pool](#input\\_enable\\_ch\\_node\\_pool) | Whether to enable the ch node pool | `bool` | `false` | no |\n| \u003ca name=\"input_environment\"\u003e\u003c/a\u003e [environment](#input\\_environment) | Global environment tag to apply on all datadog logs, metrics, etc. | `string` | n/a | yes |\n| \u003ca name=\"input_gcs_path\"\u003e\u003c/a\u003e [gcs\\_path](#input\\_gcs\\_path) | Path in the GCS bucket to the backups | `string` | `\"backups\"` | no |\n| \u003ca name=\"input_github_endpoint\"\u003e\u003c/a\u003e [github\\_endpoint](#input\\_github\\_endpoint) | URL of Github endpoint to connect to. Useful for Github Enterprise. | `string` | `\"\"` | no |\n| \u003ca name=\"input_gitlab_endpoint\"\u003e\u003c/a\u003e [gitlab\\_endpoint](#input\\_gitlab\\_endpoint) | URL of Gitlab endpoint to connect to. Useful for GItlab Enterprise. | `string` | `\"\"` | no |\n| \u003ca name=\"input_host_override\"\u003e\u003c/a\u003e [host\\_override](#input\\_host\\_override) | A valid domain name if they provision their own DNS / routing | `string` | `\"\"` | no |\n| \u003ca name=\"input_k8s_authorized_networks\"\u003e\u003c/a\u003e [k8s\\_authorized\\_networks](#input\\_k8s\\_authorized\\_networks) | Map of CIDR blocks that are able to connect to the K8S control plane | `map(string)` | \u003cpre\u003e{\u003cbr\u003e  \"0.0.0.0/0\": \"public\"\u003cbr\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_k8s_cluster_version\"\u003e\u003c/a\u003e [k8s\\_cluster\\_version](#input\\_k8s\\_cluster\\_version) | The version of Kubernetes to use for the GKE cluster. The patch/GKE specific version will be found automatically. | `string` | `\"1.28.11\"` | no |\n| \u003ca name=\"input_k8s_deletion_protection\"\u003e\u003c/a\u003e [k8s\\_deletion\\_protection](#input\\_k8s\\_deletion\\_protection) | If deletion protection is enabled (terraform feature) | `bool` | `true` | no |\n| \u003ca name=\"input_k8s_maintenance_day\"\u003e\u003c/a\u003e [k8s\\_maintenance\\_day](#input\\_k8s\\_maintenance\\_day) | Day for maintenance window. Valid values are MO,TU,WE,TH,FR,SA,SU | `string` | `\"WE\"` | no |\n| \u003ca name=\"input_k8s_maintenance_end\"\u003e\u003c/a\u003e [k8s\\_maintenance\\_end](#input\\_k8s\\_maintenance\\_end) | The end date and time for the maintenance window. | `string` | `\"2036-01-01T12:00:00Z\"` | no |\n| \u003ca name=\"input_k8s_maintenance_start\"\u003e\u003c/a\u003e [k8s\\_maintenance\\_start](#input\\_k8s\\_maintenance\\_start) | The start date and time for the maintenance window. | `string` | `\"2024-01-01T09:00:00Z\"` | no |\n| \u003ca name=\"input_k8s_node_auto_upgrade\"\u003e\u003c/a\u003e [k8s\\_node\\_auto\\_upgrade](#input\\_k8s\\_node\\_auto\\_upgrade) | Whether to enable auto-upgrade for the GKE cluster nodes | `bool` | `true` | no |\n| \u003ca name=\"input_k8s_node_version\"\u003e\u003c/a\u003e [k8s\\_node\\_version](#input\\_k8s\\_node\\_version) | The version of the nodes | `string` | `\"1.28.11\"` | no |\n| \u003ca name=\"input_lb_app_rules\"\u003e\u003c/a\u003e [lb\\_app\\_rules](#input\\_lb\\_app\\_rules) | Extra rules to apply to the application load balancer for additional filtering | \u003cpre\u003elist(object({\u003cbr\u003e    action         = string\u003cbr\u003e    priority       = number\u003cbr\u003e    description    = string\u003cbr\u003e    match_type     = string       # can be either \"src_ip_ranges\" or \"expr\"\u003cbr\u003e    versioned_expr = string       # optional, only used if match_type is \"src_ip_ranges\"\u003cbr\u003e    src_ip_ranges  = list(string) # optional, only used if match_type is \"src_ip_ranges\"\u003cbr\u003e    expr           = string       # optional, only used if match_type is \"expr\"\u003cbr\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_lb_layer_7_ddos_defence\"\u003e\u003c/a\u003e [lb\\_layer\\_7\\_ddos\\_defence](#input\\_lb\\_layer\\_7\\_ddos\\_defence) | Flag to toggle layer 7 ddos defence | `bool` | `false` | no |\n| \u003ca name=\"input_legacy_naming\"\u003e\u003c/a\u003e [legacy\\_naming](#input\\_legacy\\_naming) | Flag to toggle legacy behavior - like naming of resources | `bool` | `true` | no |\n| \u003ca name=\"input_machine_type\"\u003e\u003c/a\u003e [machine\\_type](#input\\_machine\\_type) | The machine type for the GKE cluster nodes | `string` | `\"e2-highmem-8\"` | no |\n| \u003ca name=\"input_max_node_count\"\u003e\u003c/a\u003e [max\\_node\\_count](#input\\_max\\_node\\_count) | The maximum number of nodes in the cluster | `number` | `6` | no |\n| \u003ca name=\"input_mig_disk_type\"\u003e\u003c/a\u003e [mig\\_disk\\_type](#input\\_mig\\_disk\\_type) | https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance_template#disk_type | `string` | `\"pd-balanced\"` | no |\n| \u003ca name=\"input_postgres_allocated_storage\"\u003e\u003c/a\u003e [postgres\\_allocated\\_storage](#input\\_postgres\\_allocated\\_storage) | The amount of allocated storage for the postgres database | `number` | `20` | no |\n| \u003ca name=\"input_postgres_instance\"\u003e\u003c/a\u003e [postgres\\_instance](#input\\_postgres\\_instance) | GCP instance type for PostgreSQL database.\u003cbr\u003eAvailable instance groups: .\u003cbr\u003eAvailable instance classes: . | `string` | `\"db-custom-2-7680\"` | no |\n| \u003ca name=\"input_postgres_ro_username\"\u003e\u003c/a\u003e [postgres\\_ro\\_username](#input\\_postgres\\_ro\\_username) | Postgres read-only user name | `string` | `\"datafold_ro\"` | no |\n| \u003ca name=\"input_postgres_username\"\u003e\u003c/a\u003e [postgres\\_username](#input\\_postgres\\_username) | The username to use for the postgres CloudSQL database | `string` | `\"datafold\"` | no |\n| \u003ca name=\"input_project_id\"\u003e\u003c/a\u003e [project\\_id](#input\\_project\\_id) | The project to deploy to, if not set the default provider project is used. | `string` | n/a | yes |\n| \u003ca name=\"input_provider_azs\"\u003e\u003c/a\u003e [provider\\_azs](#input\\_provider\\_azs) | Provider AZs list, if empty we get AZs dynamically | `list(string)` | n/a | yes |\n| \u003ca name=\"input_provider_region\"\u003e\u003c/a\u003e [provider\\_region](#input\\_provider\\_region) | Region for deployment in GCP | `string` | n/a | yes |\n| \u003ca name=\"input_redis_data_size\"\u003e\u003c/a\u003e [redis\\_data\\_size](#input\\_redis\\_data\\_size) | Redis volume size | `number` | `50` | no |\n| \u003ca name=\"input_remote_storage\"\u003e\u003c/a\u003e [remote\\_storage](#input\\_remote\\_storage) | Type of remote storage for clickhouse backups. | `string` | `\"gcs\"` | no |\n| \u003ca name=\"input_restricted_roles\"\u003e\u003c/a\u003e [restricted\\_roles](#input\\_restricted\\_roles) | Flag to stop certain IAM related resources from being updated/changed | `bool` | `false` | no |\n| \u003ca name=\"input_restricted_viewer_role\"\u003e\u003c/a\u003e [restricted\\_viewer\\_role](#input\\_restricted\\_viewer\\_role) | Flag to stop certain IAM related resources from being updated/changed | `bool` | `false` | no |\n| \u003ca name=\"input_ssl_cert_name\"\u003e\u003c/a\u003e [ssl\\_cert\\_name](#input\\_ssl\\_cert\\_name) | Provide valid SSL certificate name in GCP OR ssl\\_private\\_key\\_path and ssl\\_cert\\_path | `string` | `\"\"` | no |\n| \u003ca name=\"input_ssl_cert_path\"\u003e\u003c/a\u003e [ssl\\_cert\\_path](#input\\_ssl\\_cert\\_path) | SSL certificate path | `string` | `\"\"` | no |\n| \u003ca name=\"input_ssl_private_key_path\"\u003e\u003c/a\u003e [ssl\\_private\\_key\\_path](#input\\_ssl\\_private\\_key\\_path) | Private SSL key path | `string` | `\"\"` | no |\n| \u003ca name=\"input_vpc_cidr\"\u003e\u003c/a\u003e [vpc\\_cidr](#input\\_vpc\\_cidr) | Network CIDR for VPC | `string` | `\"10.0.0.0/16\"` | no |\n| \u003ca name=\"input_vpc_flow_logs_interval\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_interval](#input\\_vpc\\_flow\\_logs\\_interval) | Interval for vpc flow logs | `string` | `\"INTERVAL_5_SEC\"` | no |\n| \u003ca name=\"input_vpc_flow_logs_sampling\"\u003e\u003c/a\u003e [vpc\\_flow\\_logs\\_sampling](#input\\_vpc\\_flow\\_logs\\_sampling) | Sampling for vpc flow logs | `string` | `\"0.5\"` | no |\n| \u003ca name=\"input_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#input\\_vpc\\_id) | Provide ID of existing VPC if you want to omit creation of new one | `string` | `\"\"` | no |\n| \u003ca name=\"input_vpc_master_cidr_block\"\u003e\u003c/a\u003e [vpc\\_master\\_cidr\\_block](#input\\_vpc\\_master\\_cidr\\_block) | cidr block for k8s master, must be a /28 block. | `string` | `\"192.168.0.0/28\"` | no |\n| \u003ca name=\"input_vpc_secondary_cidr_pods\"\u003e\u003c/a\u003e [vpc\\_secondary\\_cidr\\_pods](#input\\_vpc\\_secondary\\_cidr\\_pods) | Network CIDR for VPC secundary subnet 1 | `string` | `\"/17\"` | no |\n| \u003ca name=\"input_vpc_secondary_cidr_services\"\u003e\u003c/a\u003e [vpc\\_secondary\\_cidr\\_services](#input\\_vpc\\_secondary\\_cidr\\_services) | Network CIDR for VPC secundary subnet 2 | `string` | `\"/17\"` | no |\n| \u003ca name=\"input_whitelist_all_ingress_cidrs_lb\"\u003e\u003c/a\u003e [whitelist\\_all\\_ingress\\_cidrs\\_lb](#input\\_whitelist\\_all\\_ingress\\_cidrs\\_lb) | Normally we filter on the load balancer, but some customers want to filter at the SG/Firewall. This flag will whitelist 0.0.0.0/0 on the load balancer. | `bool` | `false` | no |\n| \u003ca name=\"input_whitelisted_egress_cidrs\"\u003e\u003c/a\u003e [whitelisted\\_egress\\_cidrs](#input\\_whitelisted\\_egress\\_cidrs) | List of Internet addresses to which the application has access | `list(string)` | n/a | yes |\n| \u003ca name=\"input_whitelisted_ingress_cidrs\"\u003e\u003c/a\u003e [whitelisted\\_ingress\\_cidrs](#input\\_whitelisted\\_ingress\\_cidrs) | List of CIDRs that can access the HTTP/HTTPS | `list(string)` | n/a | yes |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_clickhouse_backup_sa\"\u003e\u003c/a\u003e [clickhouse\\_backup\\_sa](#output\\_clickhouse\\_backup\\_sa) | Name of the clickhouse backup Service Account |\n| \u003ca name=\"output_clickhouse_data_size\"\u003e\u003c/a\u003e [clickhouse\\_data\\_size](#output\\_clickhouse\\_data\\_size) | Size in GB of the clickhouse data volume |\n| \u003ca name=\"output_clickhouse_data_volume_id\"\u003e\u003c/a\u003e [clickhouse\\_data\\_volume\\_id](#output\\_clickhouse\\_data\\_volume\\_id) | Volume ID of the clickhouse data PD volume |\n| \u003ca name=\"output_clickhouse_gcs_bucket\"\u003e\u003c/a\u003e [clickhouse\\_gcs\\_bucket](#output\\_clickhouse\\_gcs\\_bucket) | Name of the GCS bucket for the clickhouse backups |\n| \u003ca name=\"output_clickhouse_logs_size\"\u003e\u003c/a\u003e [clickhouse\\_logs\\_size](#output\\_clickhouse\\_logs\\_size) | Size in GB of the clickhouse logs volume |\n| \u003ca name=\"output_clickhouse_logs_volume_id\"\u003e\u003c/a\u003e [clickhouse\\_logs\\_volume\\_id](#output\\_clickhouse\\_logs\\_volume\\_id) | Volume ID of the clickhouse logs PD volume |\n| \u003ca name=\"output_clickhouse_password\"\u003e\u003c/a\u003e [clickhouse\\_password](#output\\_clickhouse\\_password) | Password to use for clickhouse |\n| \u003ca name=\"output_cloud_provider\"\u003e\u003c/a\u003e [cloud\\_provider](#output\\_cloud\\_provider) | The cloud provider creating all the resources |\n| \u003ca name=\"output_cluster_name\"\u003e\u003c/a\u003e [cluster\\_name](#output\\_cluster\\_name) | The name of the GKE cluster that was created |\n| \u003ca name=\"output_db_instance_id\"\u003e\u003c/a\u003e [db\\_instance\\_id](#output\\_db\\_instance\\_id) | The database instance ID |\n| \u003ca name=\"output_deployment_name\"\u003e\u003c/a\u003e [deployment\\_name](#output\\_deployment\\_name) | The name of the deployment |\n| \u003ca name=\"output_domain_name\"\u003e\u003c/a\u003e [domain\\_name](#output\\_domain\\_name) | The domain name on the HTTPS certificate |\n| \u003ca name=\"output_lb_external_ip\"\u003e\u003c/a\u003e [lb\\_external\\_ip](#output\\_lb\\_external\\_ip) | The load balancer IP when it was provisioned. |\n| \u003ca name=\"output_neg_name\"\u003e\u003c/a\u003e [neg\\_name](#output\\_neg\\_name) | The name of the Network Endpoint Group where pods need to be registered from kubernetes. |\n| \u003ca name=\"output_postgres_database_name\"\u003e\u003c/a\u003e [postgres\\_database\\_name](#output\\_postgres\\_database\\_name) | The name of the postgres database |\n| \u003ca name=\"output_postgres_host\"\u003e\u003c/a\u003e [postgres\\_host](#output\\_postgres\\_host) | The hostname of the postgres database |\n| \u003ca name=\"output_postgres_password\"\u003e\u003c/a\u003e [postgres\\_password](#output\\_postgres\\_password) | The postgres password |\n| \u003ca name=\"output_postgres_port\"\u003e\u003c/a\u003e [postgres\\_port](#output\\_postgres\\_port) | The port of the postgres database |\n| \u003ca name=\"output_postgres_username\"\u003e\u003c/a\u003e [postgres\\_username](#output\\_postgres\\_username) | The postgres username |\n| \u003ca name=\"output_redis_data_size\"\u003e\u003c/a\u003e [redis\\_data\\_size](#output\\_redis\\_data\\_size) | The size in GB of the redis data volume |\n| \u003ca name=\"output_redis_data_volume_id\"\u003e\u003c/a\u003e [redis\\_data\\_volume\\_id](#output\\_redis\\_data\\_volume\\_id) | The volume ID of the Redis PD data volume |\n| \u003ca name=\"output_redis_password\"\u003e\u003c/a\u003e [redis\\_password](#output\\_redis\\_password) | The Redis password |\n| \u003ca name=\"output_vpc_cidr\"\u003e\u003c/a\u003e [vpc\\_cidr](#output\\_vpc\\_cidr) | The VPC CIDR range |\n| \u003ca name=\"output_vpc_id\"\u003e\u003c/a\u003e [vpc\\_id](#output\\_vpc\\_id) | The ID of the Google VPC the cluster runs in. |\n| \u003ca name=\"output_vpc_selflink\"\u003e\u003c/a\u003e [vpc\\_selflink](#output\\_vpc\\_selflink) | The ID of the Google VPC the cluster runs in. |\n| \u003ca name=\"output_vpc_subnetwork\"\u003e\u003c/a\u003e [vpc\\_subnetwork](#output\\_vpc\\_subnetwork) | The subnet in which the cluster is created |\n\n\u003c!-- END_TF_DOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatafold%2Fterraform-google-datafold","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdatafold%2Fterraform-google-datafold","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdatafold%2Fterraform-google-datafold/lists"}