Using gcp firestore with servicenetworking

Question

Pulumi · Accepted Answer

When using Google Cloud Platform (GCP) services, combining Firestore with Service Networking enables you to manage and connect services with a VPC network. Firestore is a NoSQL document database built for automatic scaling, high performance, and ease of application development. Service Networking allows services within the Google Cloud ecosystem to privately communicate with your VPC network.

Here's how you can set up Firestore in GCP and establish a private connection with VPC via Service Networking:

1. **Create a Firestore Database**: We start by setting up a Firestore Database in native mode. This allows us to work with Firestore documents as NoSQL storage.

2. **Set Up Service Networking Connection**: This involves setting up a private connection between your Google Cloud resources and your VPC, making your database accessible from your VPC network using Private Google Access.

Let's dive into the Pulumi TypeScript code that accomplishes the above tasks:

```typescript
import * as gcp from "@pulumi/gcp";

// Create a Firestore Database in GCP
const firestoreDatabase = new gcp.firestore.Database("my-firestore-db", {
    // Replace with your project, location, etc.
    project: "my-project-id",
    locationId: "us-central1",
    type: "FIRESTORE_NATIVE",
    // Firestore configurations, if any
});

// Service Networking setup to enable a VPC connection
const serviceNetworkingConnection = new gcp.servicenetworking.Connection("my-servicenetworking-connection", {
    network: "default", // Replace with your VPC network name
    service: "servicenetworking.googleapis.com",
    reservedPeeringRanges: ["google-managed-services-default"], // Replace with your address range name
});

// Export the Firestore Database ID for reference
export const firestoreDatabaseId = firestoreDatabase.name;
```

### Explanation:

- We import the necessary GCP modules from Pulumi's GCP package to work with Firestore and service networking.

- The Firestore database is created with the `gcp.firestore.Database` class where you specify your project ID, location, and the type of Firestore you want (`FIRESTORE_NATIVE` for native Firestore mode).

- Service networking connection is managed using `gcp.servicenetworking.Connection`. You need to provide the VPC network name (`default` here for demonstration), the service you are connecting to, and the reserved peering ranges which are the names of the allocated IP address ranges for this service on your VPC.

### What happens next?

After running this program with Pulumi CLI, Pulumi will set up the Firestore database and configure the service networking connection with the specified VPC. Once deployed, the Firestore database will be accessible from resources with Private Google Access within the VPC network. This private access enhances security by ensuring that your Firestore data is not exposed to the internet.

Do note that you should replace the placeholders (like `my-project-id`, `us-central1`, `default`, and `google-managed-services-default`) with actual values that correspond to your GCP project and setup. If you don't have predefined IP ranges, you can create them using the Pulumi resource for creating address ranges before setting up the service networking connection.

Pulumi stacks, which consist of the infrastructure resources you define, are versioned and can be audited through the Pulumi service. Every `pulumi up` will show you a preview of changes, followed by the actual deployment of changes which you approve. This allows you to manage your infrastructure with confidence and version control.