Feature/add db and user

stacks/projects/kj-pola-backend-stg/cloud-run.tf

 } 
 module "cloud_run" { 
   source = "github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/cloud-run-v2?ref=v51.0.0" 
   project_id = var.project_id 
   region     = var.region 
   name       = "${var.name.app}-${var.name.component}-${var.name.env}" 
   containers = { 
     app = { 
       image = var.cloud_run_image 
       volume_mounts = { 
         cloudsql = "/cloudsql" 
       } 
       resources = { 
         limits = { 
           cpu    = var.cloud_run_cpu_limit 
           memory = var.cloud_run_memory_limit 
         } 
       } 
     } 
   } 
   volumes = { 
     cloudsql = { 
       cloud_sql_instances = [module.cloudsql.instance_connection_name] 
     } 
   } 
   service_account_config = { 
     name  = local.cloud_run_service_account_name 
     roles = var.cloud_run_service_account_roles 
   } 
   # Terraform does the initial deployment only; CI/CD manages revisions after. 
   managed_revision = false 
   deletion_protection = false 
   service_config = { 
     ingress = "INGRESS_TRAFFIC_ALL" 
     invoker_iam_disabled = true 
     scaling = { 
       min_instance_count = var.cloud_run_min_instances 
       max_instance_count = var.cloud_run_max_instances 
     } 
   } 
   depends_on = [ 
     module.vpc, 
     module.cloudsql 
   ] 
 } 
 module "cloud_run" { 
   source = "github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/cloud-run-v2?ref=v51.0.0" 
   project_id = var.project_id 
   region     = var.region 
   name       = "${var.name.app}-${var.name.component}-${var.name.env}" 
   containers = { 
     app = { 
       image = var.cloud_run_image 
       volume_mounts = { 
         cloudsql = "/cloudsql" 
       } 
       resources = { 
         limits = { 
           cpu    = var.cloud_run_cpu_limit 
           memory = var.cloud_run_memory_limit 
         } 
       } 
     } 
   } 
   volumes = { 
     cloudsql = { 
       cloud_sql_instances = [module.cloudsql.instance_connection_name] 
     } 
   } 
   service_account_config = { 
     name  = local.cloud_run_service_account_name 
     roles = var.cloud_run_service_account_roles 
   } 
   # Terraform does the initial deployment only; CI/CD manages revisions after. 
   managed_revision = false 
   deletion_protection = false 
   service_config = { 
     ingress = "INGRESS_TRAFFIC_ALL" 
     invoker_iam_disabled = true 
     scaling = { 
       min_instance_count = var.cloud_run_min_instances 
       max_instance_count = var.cloud_run_max_instances 
     } 
   } 
   depends_on = [ 
     module.vpc, 
     module.cloudsql 
   ] 
 } 
@@ -1,3 +1,11 @@
+data "google_project" "current" {
+  project_id = var.project_id
+}
+
+locals {
+  cloud_run_service_account_name  = "${var.name.app}-${var.name.component}-${var.name.env}"
+}
+
 module "cloud_run" {
   source = "github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/cloud-run-v2?ref=v51.0.0"
 
@@ -27,14 +35,17 @@ module "cloud_run" {
   }
 
   service_account_config = {
+    name  = local.cloud_run_service_account_name
     roles = var.cloud_run_service_account_roles
   }
 
   # Terraform does the initial deployment only; CI/CD manages revisions after.
   managed_revision = false
+  deletion_protection = false
 
   service_config = {
     ingress = "INGRESS_TRAFFIC_ALL"
+    invoker_iam_disabled = true
     scaling = {
       min_instance_count = var.cloud_run_min_instances
       max_instance_count = var.cloud_run_max_instances
@@ -49,12 +60,12 @@ module "cloud_run" {
 
 # Grant Cloud Run service account permission to read from Artifact Registry in shared project
 # This is needed because the Docker image is in kj-pola-shared-prod project
-resource "google_project_iam_member" "cloud_run_sa_artifact_registry_reader" {
+resource "google_project_iam_member" "cloud_run_service_agent_artifact_registry_reader" {
   project = "kj-pola-shared-prod"
   role    = "roles/artifactregistry.reader"
-  member  = "serviceAccount:${module.cloud_run.service_account_email}"
+  member  = "serviceAccount:service-${data.google_project.current.number}@serverless-robot-prod.iam.gserviceaccount.com"
 
   depends_on = [
-    module.cloud_run
+    module.project_services
   ]
 }

stacks/projects/kj-pola-backend-stg/cloudsql.tf

 } 
 module "cloudsql" { 
   source  = "terraform-google-modules/sql-db/google//modules/postgresql" 
   version = "~> 27.1" 
   project_id = var.project_id 
   region     = var.region 
   name       = "${var.name.app}-${var.name.component}-${var.name.env}-db" 
   database_version = var.cloudsql_database_version 
   tier             = var.cloudsql_tier 
   deletion_protection = var.cloudsql_deletion_protection 
   disk_type             = var.cloudsql_disk_type 
   disk_size             = var.cloudsql_disk_size 
   disk_autoresize       = var.cloudsql_disk_autoresize 
   disk_autoresize_limit = var.cloudsql_disk_autoresize_limit 
   database_flags = [ 
     { 
       name  = "autovacuum" 
       value = "on" 
     }, 
     { 
       name  = "cloudsql.iam_authentication" 
       value = "on" 
     }, 
     { 
       name  = "timezone" 
       value = "Europe/Warsaw" 
     } 
   ] 
   insights_config = var.cloudsql_insights_enabled ? { 
     query_insights_enabled  = true 
     query_string_length     = 1024 
     record_application_tags = false 
     record_client_address   = false 
   } : null 
   backup_configuration = var.cloudsql_backup_enabled ? { 
     enabled                        = true 
     start_time                     = var.cloudsql_backup_start_time 
     point_in_time_recovery_enabled = true 
     transaction_log_retention_days = 7 
     backup_retention_settings = { 
       retained_backups = var.cloudsql_backup_retained_backups 
       retention_unit   = "COUNT" 
     } 
   } : null 
   ip_configuration = { 
     ipv4_enabled                                  = false 
     private_network                               = module.vpc.network.self_link 
     enable_private_path_for_google_cloud_services = true 
   } 
   maintenance_window_day          = var.cloudsql_maintenance_window_day 
   maintenance_window_hour         = var.cloudsql_maintenance_window_hour 
   maintenance_window_update_track = var.cloudsql_maintenance_window_update_track 
   additional_databases = [ 
     { 
       name      = "pola" 
       charset   = "UTF8" 
       collation = "en_US.UTF8" 
     } 
   ] 
   iam_users = [ 
     { 
       id    = "pola" 
       email = "${var.name.app}-${var.name.component}-${var.name.env}@${var.project_id}.iam.gserviceaccount.com" 
       type  = "CLOUD_IAM_SERVICE_ACCOUNT" 
     } 
   ] 
   depends_on = [ 
     module.vpc 
   ] 
 } 
 module "cloudsql" { 
   source  = "terraform-google-modules/sql-db/google//modules/postgresql" 
   version = "~> 27.1" 
   project_id = var.project_id 
   region     = var.region 
   name       = "${var.name.app}-${var.name.component}-${var.name.env}-db" 
   database_version = var.cloudsql_database_version 
   tier             = var.cloudsql_tier 
   deletion_protection = var.cloudsql_deletion_protection 
   disk_type             = var.cloudsql_disk_type 
   disk_size             = var.cloudsql_disk_size 
   disk_autoresize       = var.cloudsql_disk_autoresize 
   disk_autoresize_limit = var.cloudsql_disk_autoresize_limit 
   database_flags = [ 
     { 
       name  = "autovacuum" 
       value = "on" 
     }, 
     { 
       name  = "cloudsql.iam_authentication" 
       value = "on" 
     }, 
     { 
       name  = "timezone" 
       value = "Europe/Warsaw" 
     } 
   ] 
   insights_config = var.cloudsql_insights_enabled ? { 
     query_insights_enabled  = true 
     query_string_length     = 1024 
     record_application_tags = false 
     record_client_address   = false 
   } : null 
   backup_configuration = var.cloudsql_backup_enabled ? { 
     enabled                        = true 
     start_time                     = var.cloudsql_backup_start_time 
     point_in_time_recovery_enabled = true 
     transaction_log_retention_days = 7 
     backup_retention_settings = { 
       retained_backups = var.cloudsql_backup_retained_backups 
       retention_unit   = "COUNT" 
     } 
   } : null 
   ip_configuration = { 
     ipv4_enabled                                  = false 
     private_network                               = module.vpc.network.self_link 
     enable_private_path_for_google_cloud_services = true 
   } 
   maintenance_window_day          = var.cloudsql_maintenance_window_day 
   maintenance_window_hour         = var.cloudsql_maintenance_window_hour 
   maintenance_window_update_track = var.cloudsql_maintenance_window_update_track 
   additional_databases = [ 
     { 
       name      = "pola" 
       charset   = "UTF8" 
       collation = "en_US.UTF8" 
     } 
   ] 
   iam_users = [ 
     { 
       id    = "pola" 
       email = "${var.name.app}-${var.name.component}-${var.name.env}@${var.project_id}.iam.gserviceaccount.com" 
       type  = "CLOUD_IAM_SERVICE_ACCOUNT" 
     } 
   ] 
   depends_on = [ 
     module.vpc 
   ] 
 } 
@@ -21,6 +21,10 @@ module "cloudsql" {
       name  = "autovacuum"
       value = "on"
     },
+    {
+      name  = "cloudsql.iam_authentication"
+      value = "on"
+    },
     {
       name  = "timezone"
       value = "Europe/Warsaw"
@@ -55,6 +59,22 @@ module "cloudsql" {
   maintenance_window_hour         = var.cloudsql_maintenance_window_hour
   maintenance_window_update_track = var.cloudsql_maintenance_window_update_track
 
+  additional_databases = [
+    {
+      name      = "pola"
+      charset   = "UTF8"
+      collation = "en_US.UTF8"
+    }
+  ]
+
+  iam_users = [
+    {
+      id    = "pola"
+      email = "${var.name.app}-${var.name.component}-${var.name.env}@${var.project_id}.iam.gserviceaccount.com"
+      type  = "CLOUD_IAM_SERVICE_ACCOUNT"
+    }
+  ]
+
   depends_on = [
     module.vpc
   ]

stacks/projects/kj-pola-backend-stg/terraform.tfvars

@@ -52,7 +52,7 @@ private_service_access_cidr = "10.1.0.0/24"
 # Cloud SQL Configuration
 cloudsql_database_version                = "POSTGRES_15"
 cloudsql_tier                            = "db-f1-micro"
-cloudsql_deletion_protection             = false
+cloudsql_deletion_protection             = true
 cloudsql_disk_type                       = "PD_SSD"
 cloudsql_disk_size                       = 10
 cloudsql_disk_autoresize                 = true
@@ -75,6 +75,6 @@ cloud_run_service_account_roles = [
   "roles/artifactregistry.reader",
 ]
 cloud_run_min_instances = 0
-cloud_run_max_instances = 1
+cloud_run_max_instances = 2
 cloud_run_cpu_limit     = "1000m"
 cloud_run_memory_limit  = "512Mi"