pulumi-gcp 8.19.0a1739290509__py3-none-any.whl → 8.19.1a1739444689__py3-none-any.whl

pulumi_gcp/compute/subnetwork.py

@@ -80,10 +80,11 @@ class SubnetworkArgs:
         :param pulumi.Input[str] private_ipv6_google_access: The private IPv6 google access type for the VMs in this subnet.
         :param pulumi.Input[str] project: The ID of the project in which the resource belongs.
                If it is not provided, the provider project is used.
-        :param pulumi.Input[str] purpose: The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT` or `PRIVATE_NAT`.
+        :param pulumi.Input[str] purpose: The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT`, `PEER_MIGRATION` or `PRIVATE_NAT`.
                A subnet with purpose set to `REGIONAL_MANAGED_PROXY` is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
                A subnetwork in a given region with purpose set to `GLOBAL_MANAGED_PROXY` is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
                A subnetwork with purpose set to `PRIVATE_SERVICE_CONNECT` reserves the subnet for hosting a Private Service Connect published service.
+               A subnetwork with purpose set to `PEER_MIGRATION` is a user created subnetwork that is reserved for migrating resources from one peered network to another.
                A subnetwork with purpose set to `PRIVATE_NAT` is used as source range for Private NAT gateways.
                Note that `REGIONAL_MANAGED_PROXY` is the preferred setting for all regional Envoy load balancers.
                If unspecified, the purpose defaults to `PRIVATE`.
@@ -311,10 +312,11 @@ class SubnetworkArgs:
     @pulumi.getter
     def purpose(self) -> Optional[pulumi.Input[str]]:
         """
-        The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT` or `PRIVATE_NAT`.
+        The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT`, `PEER_MIGRATION` or `PRIVATE_NAT`.
         A subnet with purpose set to `REGIONAL_MANAGED_PROXY` is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
         A subnetwork in a given region with purpose set to `GLOBAL_MANAGED_PROXY` is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
         A subnetwork with purpose set to `PRIVATE_SERVICE_CONNECT` reserves the subnet for hosting a Private Service Connect published service.
+        A subnetwork with purpose set to `PEER_MIGRATION` is a user created subnetwork that is reserved for migrating resources from one peered network to another.
         A subnetwork with purpose set to `PRIVATE_NAT` is used as source range for Private NAT gateways.
         Note that `REGIONAL_MANAGED_PROXY` is the preferred setting for all regional Envoy load balancers.
         If unspecified, the purpose defaults to `PRIVATE`.
@@ -490,10 +492,11 @@ class _SubnetworkState:
         :param pulumi.Input[str] private_ipv6_google_access: The private IPv6 google access type for the VMs in this subnet.
         :param pulumi.Input[str] project: The ID of the project in which the resource belongs.
                If it is not provided, the provider project is used.
-        :param pulumi.Input[str] purpose: The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT` or `PRIVATE_NAT`.
+        :param pulumi.Input[str] purpose: The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT`, `PEER_MIGRATION` or `PRIVATE_NAT`.
                A subnet with purpose set to `REGIONAL_MANAGED_PROXY` is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
                A subnetwork in a given region with purpose set to `GLOBAL_MANAGED_PROXY` is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
                A subnetwork with purpose set to `PRIVATE_SERVICE_CONNECT` reserves the subnet for hosting a Private Service Connect published service.
+               A subnetwork with purpose set to `PEER_MIGRATION` is a user created subnetwork that is reserved for migrating resources from one peered network to another.
                A subnetwork with purpose set to `PRIVATE_NAT` is used as source range for Private NAT gateways.
                Note that `REGIONAL_MANAGED_PROXY` is the preferred setting for all regional Envoy load balancers.
                If unspecified, the purpose defaults to `PRIVATE`.
@@ -803,10 +806,11 @@ class _SubnetworkState:
     @pulumi.getter
     def purpose(self) -> Optional[pulumi.Input[str]]:
         """
-        The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT` or `PRIVATE_NAT`.
+        The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT`, `PEER_MIGRATION` or `PRIVATE_NAT`.
         A subnet with purpose set to `REGIONAL_MANAGED_PROXY` is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
         A subnetwork in a given region with purpose set to `GLOBAL_MANAGED_PROXY` is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
         A subnetwork with purpose set to `PRIVATE_SERVICE_CONNECT` reserves the subnet for hosting a Private Service Connect published service.
+        A subnetwork with purpose set to `PEER_MIGRATION` is a user created subnetwork that is reserved for migrating resources from one peered network to another.
         A subnetwork with purpose set to `PRIVATE_NAT` is used as source range for Private NAT gateways.
         Note that `REGIONAL_MANAGED_PROXY` is the preferred setting for all regional Envoy load balancers.
         If unspecified, the purpose defaults to `PRIVATE`.
@@ -1238,10 +1242,11 @@ class Subnetwork(pulumi.CustomResource):
         :param pulumi.Input[str] private_ipv6_google_access: The private IPv6 google access type for the VMs in this subnet.
         :param pulumi.Input[str] project: The ID of the project in which the resource belongs.
                If it is not provided, the provider project is used.
-        :param pulumi.Input[str] purpose: The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT` or `PRIVATE_NAT`.
+        :param pulumi.Input[str] purpose: The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT`, `PEER_MIGRATION` or `PRIVATE_NAT`.
                A subnet with purpose set to `REGIONAL_MANAGED_PROXY` is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
                A subnetwork in a given region with purpose set to `GLOBAL_MANAGED_PROXY` is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
                A subnetwork with purpose set to `PRIVATE_SERVICE_CONNECT` reserves the subnet for hosting a Private Service Connect published service.
+               A subnetwork with purpose set to `PEER_MIGRATION` is a user created subnetwork that is reserved for migrating resources from one peered network to another.
                A subnetwork with purpose set to `PRIVATE_NAT` is used as source range for Private NAT gateways.
                Note that `REGIONAL_MANAGED_PROXY` is the preferred setting for all regional Envoy load balancers.
                If unspecified, the purpose defaults to `PRIVATE`.
@@ -1673,10 +1678,11 @@ class Subnetwork(pulumi.CustomResource):
         :param pulumi.Input[str] private_ipv6_google_access: The private IPv6 google access type for the VMs in this subnet.
         :param pulumi.Input[str] project: The ID of the project in which the resource belongs.
                If it is not provided, the provider project is used.
-        :param pulumi.Input[str] purpose: The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT` or `PRIVATE_NAT`.
+        :param pulumi.Input[str] purpose: The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT`, `PEER_MIGRATION` or `PRIVATE_NAT`.
                A subnet with purpose set to `REGIONAL_MANAGED_PROXY` is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
                A subnetwork in a given region with purpose set to `GLOBAL_MANAGED_PROXY` is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
                A subnetwork with purpose set to `PRIVATE_SERVICE_CONNECT` reserves the subnet for hosting a Private Service Connect published service.
+               A subnetwork with purpose set to `PEER_MIGRATION` is a user created subnetwork that is reserved for migrating resources from one peered network to another.
                A subnetwork with purpose set to `PRIVATE_NAT` is used as source range for Private NAT gateways.
                Note that `REGIONAL_MANAGED_PROXY` is the preferred setting for all regional Envoy load balancers.
                If unspecified, the purpose defaults to `PRIVATE`.
@@ -1899,10 +1905,11 @@ class Subnetwork(pulumi.CustomResource):
     @pulumi.getter
     def purpose(self) -> pulumi.Output[str]:
         """
-        The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT` or `PRIVATE_NAT`.
+        The purpose of the resource. This field can be either `PRIVATE`, `REGIONAL_MANAGED_PROXY`, `GLOBAL_MANAGED_PROXY`, `PRIVATE_SERVICE_CONNECT`, `PEER_MIGRATION` or `PRIVATE_NAT`.
         A subnet with purpose set to `REGIONAL_MANAGED_PROXY` is a user-created subnetwork that is reserved for regional Envoy-based load balancers.
         A subnetwork in a given region with purpose set to `GLOBAL_MANAGED_PROXY` is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers.
         A subnetwork with purpose set to `PRIVATE_SERVICE_CONNECT` reserves the subnet for hosting a Private Service Connect published service.
+        A subnetwork with purpose set to `PEER_MIGRATION` is a user created subnetwork that is reserved for migrating resources from one peered network to another.
         A subnetwork with purpose set to `PRIVATE_NAT` is used as source range for Private NAT gateways.
         Note that `REGIONAL_MANAGED_PROXY` is the preferred setting for all regional Envoy load balancers.
         If unspecified, the purpose defaults to `PRIVATE`.

pulumi_gcp/container/_inputs.py

@@ -271,6 +271,8 @@ __all__ = [
     'ClusterMonitoringConfigAdvancedDatapathObservabilityConfigArgsDict',
     'ClusterMonitoringConfigManagedPrometheusArgs',
     'ClusterMonitoringConfigManagedPrometheusArgsDict',
+    'ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgs',
+    'ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgsDict',
     'ClusterNetworkPolicyArgs',
     'ClusterNetworkPolicyArgsDict',
     'ClusterNodeConfigArgs',
@@ -8282,17 +8284,25 @@ if not MYPY:
         """
         Whether or not the managed collection is enabled.
         """
+        auto_monitoring_config: NotRequired[pulumi.Input['ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgsDict']]
+        """
+        Configuration options for GKE Auto-Monitoring.
+        """
 elif False:
     ClusterMonitoringConfigManagedPrometheusArgsDict: TypeAlias = Mapping[str, Any]
 
 @pulumi.input_type
 class ClusterMonitoringConfigManagedPrometheusArgs:
     def __init__(__self__, *,
-                 enabled: pulumi.Input[bool]):
+                 enabled: pulumi.Input[bool],
+                 auto_monitoring_config: Optional[pulumi.Input['ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgs']] = None):
         """
         :param pulumi.Input[bool] enabled: Whether or not the managed collection is enabled.
+        :param pulumi.Input['ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgs'] auto_monitoring_config: Configuration options for GKE Auto-Monitoring.
         """
         pulumi.set(__self__, "enabled", enabled)
+        if auto_monitoring_config is not None:
+            pulumi.set(__self__, "auto_monitoring_config", auto_monitoring_config)
 
     @property
     @pulumi.getter
@@ -8306,6 +8316,49 @@ class ClusterMonitoringConfigManagedPrometheusArgs:
     def enabled(self, value: pulumi.Input[bool]):
         pulumi.set(self, "enabled", value)
 
+    @property
+    @pulumi.getter(name="autoMonitoringConfig")
+    def auto_monitoring_config(self) -> Optional[pulumi.Input['ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgs']]:
+        """
+        Configuration options for GKE Auto-Monitoring.
+        """
+        return pulumi.get(self, "auto_monitoring_config")
+
+    @auto_monitoring_config.setter
+    def auto_monitoring_config(self, value: Optional[pulumi.Input['ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgs']]):
+        pulumi.set(self, "auto_monitoring_config", value)
+
+
+if not MYPY:
+    class ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgsDict(TypedDict):
+        scope: pulumi.Input[str]
+        """
+        Whether or not to enable GKE Auto-Monitoring. Supported values include: `ALL`, `NONE`.
+        """
+elif False:
+    ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgsDict: TypeAlias = Mapping[str, Any]
+
+@pulumi.input_type
+class ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgs:
+    def __init__(__self__, *,
+                 scope: pulumi.Input[str]):
+        """
+        :param pulumi.Input[str] scope: Whether or not to enable GKE Auto-Monitoring. Supported values include: `ALL`, `NONE`.
+        """
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> pulumi.Input[str]:
+        """
+        Whether or not to enable GKE Auto-Monitoring. Supported values include: `ALL`, `NONE`.
+        """
+        return pulumi.get(self, "scope")
+
+    @scope.setter
+    def scope(self, value: pulumi.Input[str]):
+        pulumi.set(self, "scope", value)
+
 
 if not MYPY:
     class ClusterNetworkPolicyArgsDict(TypedDict):

pulumi_gcp/container/outputs.py

@@ -144,6 +144,7 @@ __all__ = [
     'ClusterMonitoringConfig',
     'ClusterMonitoringConfigAdvancedDatapathObservabilityConfig',
     'ClusterMonitoringConfigManagedPrometheus',
+    'ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfig',
     'ClusterNetworkPolicy',
     'ClusterNodeConfig',
     'ClusterNodeConfigAdvancedMachineFeatures',
@@ -346,6 +347,7 @@ __all__ = [
     'GetClusterMonitoringConfigResult',
     'GetClusterMonitoringConfigAdvancedDatapathObservabilityConfigResult',
     'GetClusterMonitoringConfigManagedPrometheusResult',
+    'GetClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigResult',
     'GetClusterNetworkPolicyResult',
     'GetClusterNodeConfigResult',
     'GetClusterNodeConfigAdvancedMachineFeatureResult',
@@ -6829,12 +6831,33 @@ class ClusterMonitoringConfigAdvancedDatapathObservabilityConfig(dict):
 
 @pulumi.output_type
 class ClusterMonitoringConfigManagedPrometheus(dict):
+    @staticmethod
+    def __key_warning(key: str):
+        suggest = None
+        if key == "autoMonitoringConfig":
+            suggest = "auto_monitoring_config"
+
+        if suggest:
+            pulumi.log.warn(f"Key '{key}' not found in ClusterMonitoringConfigManagedPrometheus. Access the value via the '{suggest}' property getter instead.")
+
+    def __getitem__(self, key: str) -> Any:
+        ClusterMonitoringConfigManagedPrometheus.__key_warning(key)
+        return super().__getitem__(key)
+
+    def get(self, key: str, default = None) -> Any:
+        ClusterMonitoringConfigManagedPrometheus.__key_warning(key)
+        return super().get(key, default)
+
     def __init__(__self__, *,
-                 enabled: bool):
+                 enabled: bool,
+                 auto_monitoring_config: Optional['outputs.ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfig'] = None):
         """
         :param bool enabled: Whether or not the managed collection is enabled.
+        :param 'ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgs' auto_monitoring_config: Configuration options for GKE Auto-Monitoring.
         """
         pulumi.set(__self__, "enabled", enabled)
+        if auto_monitoring_config is not None:
+            pulumi.set(__self__, "auto_monitoring_config", auto_monitoring_config)
 
     @property
     @pulumi.getter
@@ -6844,6 +6867,32 @@ class ClusterMonitoringConfigManagedPrometheus(dict):
         """
         return pulumi.get(self, "enabled")
 
+    @property
+    @pulumi.getter(name="autoMonitoringConfig")
+    def auto_monitoring_config(self) -> Optional['outputs.ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfig']:
+        """
+        Configuration options for GKE Auto-Monitoring.
+        """
+        return pulumi.get(self, "auto_monitoring_config")
+
+
+@pulumi.output_type
+class ClusterMonitoringConfigManagedPrometheusAutoMonitoringConfig(dict):
+    def __init__(__self__, *,
+                 scope: str):
+        """
+        :param str scope: Whether or not to enable GKE Auto-Monitoring. Supported values include: `ALL`, `NONE`.
+        """
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        Whether or not to enable GKE Auto-Monitoring. Supported values include: `ALL`, `NONE`.
+        """
+        return pulumi.get(self, "scope")
+
 
 @pulumi.output_type
 class ClusterNetworkPolicy(dict):
@@ -17495,12 +17544,23 @@ class GetClusterMonitoringConfigAdvancedDatapathObservabilityConfigResult(dict):
 @pulumi.output_type
 class GetClusterMonitoringConfigManagedPrometheusResult(dict):
     def __init__(__self__, *,
+                 auto_monitoring_configs: Sequence['outputs.GetClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigResult'],
                  enabled: bool):
         """
+        :param Sequence['GetClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigArgs'] auto_monitoring_configs: Configuration for GKE Workload Auto-Monitoring.
         :param bool enabled: Whether or not the managed collection is enabled.
         """
+        pulumi.set(__self__, "auto_monitoring_configs", auto_monitoring_configs)
         pulumi.set(__self__, "enabled", enabled)
 
+    @property
+    @pulumi.getter(name="autoMonitoringConfigs")
+    def auto_monitoring_configs(self) -> Sequence['outputs.GetClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigResult']:
+        """
+        Configuration for GKE Workload Auto-Monitoring.
+        """
+        return pulumi.get(self, "auto_monitoring_configs")
+
     @property
     @pulumi.getter
     def enabled(self) -> bool:
@@ -17510,6 +17570,24 @@ class GetClusterMonitoringConfigManagedPrometheusResult(dict):
         return pulumi.get(self, "enabled")
 
 
+@pulumi.output_type
+class GetClusterMonitoringConfigManagedPrometheusAutoMonitoringConfigResult(dict):
+    def __init__(__self__, *,
+                 scope: str):
+        """
+        :param str scope: The scope of auto-monitoring.
+        """
+        pulumi.set(__self__, "scope", scope)
+
+    @property
+    @pulumi.getter
+    def scope(self) -> str:
+        """
+        The scope of auto-monitoring.
+        """
+        return pulumi.get(self, "scope")
+
+
 @pulumi.output_type
 class GetClusterNetworkPolicyResult(dict):
     def __init__(__self__, *,

pulumi_gcp/datastream/connection_profile.py

@@ -634,18 +634,23 @@ class ConnectionProfile(pulumi.CustomResource):
         import pulumi_gcp as gcp
         import pulumi_random as random
 
-        default = gcp.compute.Network("default", name="my-network")
+        default = gcp.compute.Network("default",
+            name="my-network",
+            auto_create_subnetworks=False)
+        default_subnetwork = gcp.compute.Subnetwork("default",
+            name="my-subnetwork",
+            ip_cidr_range="10.1.0.0/16",
+            region="us-central1",
+            network=default.id)
         private_connection = gcp.datastream.PrivateConnection("private_connection",
-            display_name="Connection profile",
+            display_name="Private connection",
             location="us-central1",
             private_connection_id="my-connection",
-            labels={
-                "key": "value",
-            },
             vpc_peering_config={
                 "vpc": default.id,
                 "subnet": "10.0.0.0/29",
             })
+        nat_vm_ip = gcp.compute.Address("nat_vm_ip", name="nat-vm-ip")
         instance = gcp.sql.DatabaseInstance("instance",
             name="my-instance",
             database_version="POSTGRES_14",
@@ -653,23 +658,9 @@ class ConnectionProfile(pulumi.CustomResource):
             settings={
                 "tier": "db-f1-micro",
                 "ip_configuration": {
-                    "authorized_networks": [
-                        {
-                            "value": "34.71.242.81",
-                        },
-                        {
-                            "value": "34.72.28.29",
-                        },
-                        {
-                            "value": "34.67.6.157",
-                        },
-                        {
-                            "value": "34.67.234.134",
-                        },
-                        {
-                            "value": "34.72.239.218",
-                        },
-                    ],
+                    "authorized_networks": [{
+                        "value": nat_vm_ip.address,
+                    }],
                 },
             },
             deletion_protection=True)
@@ -683,15 +674,61 @@ class ConnectionProfile(pulumi.CustomResource):
             name="user",
             instance=instance.name,
             password=pwd.result)
+        nat_vm = gcp.compute.Instance("nat_vm",
+            name="nat-vm",
+            machine_type="e2-medium",
+            zone="us-central1-a",
+            desired_status="RUNNING",
+            boot_disk={
+                "initialize_params": {
+                    "image": "debian-cloud/debian-12",
+                },
+            },
+            network_interfaces=[{
+                "network": private_connection.vpc_peering_config.vpc,
+                "subnetwork": default_subnetwork.self_link,
+                "access_configs": [{
+                    "nat_ip": nat_vm_ip.address,
+                }],
+            }],
+            metadata_startup_script=instance.public_ip_address.apply(lambda public_ip_address: f\"\"\"#! /bin/bash
+        # See https://cloud.google.com/datastream/docs/private-connectivity#set-up-reverse-proxy
+        export DB_ADDR={public_ip_address}
+        export DB_PORT=5432
+        echo 1 > /proc/sys/net/ipv4/ip_forward
+        md_url_prefix="http://169.254.169.254/computeMetadata/v1/instance"
+        vm_nic_ip="$(curl -H "Metadata-Flavor: Google" ${{md_url_prefix}}/network-interfaces/0/ip)"
+        iptables -t nat -F
+        iptables -t nat -A PREROUTING \\
+             -p tcp --dport $DB_PORT \\
+             -j DNAT \\
+             --to-destination $DB_ADDR
+        iptables -t nat -A POSTROUTING \\
+             -p tcp --dport $DB_PORT \\
+             -j SNAT \\
+             --to-source $vm_nic_ip
+        iptables-save
+        \"\"\"))
+        rules = gcp.compute.Firewall("rules",
+            name="ingress-rule",
+            network=private_connection.vpc_peering_config.vpc,
+            description="Allow traffic into NAT VM",
+            direction="INGRESS",
+            allows=[{
+                "protocol": "tcp",
+                "ports": ["5432"],
+            }],
+            source_ranges=[private_connection.vpc_peering_config.subnet])
         default_connection_profile = gcp.datastream.ConnectionProfile("default",
             display_name="Connection profile",
             location="us-central1",
             connection_profile_id="my-profile",
             postgresql_profile={
-                "hostname": instance.public_ip_address,
+                "hostname": nat_vm.network_interfaces[0].network_ip,
                 "username": user.name,
                 "password": user.password,
                 "database": db.name,
+                "port": 5432,
             },
             private_connectivity={
                 "private_connection": private_connection.id,
@@ -923,18 +960,23 @@ class ConnectionProfile(pulumi.CustomResource):
         import pulumi_gcp as gcp
         import pulumi_random as random
 
-        default = gcp.compute.Network("default", name="my-network")
+        default = gcp.compute.Network("default",
+            name="my-network",
+            auto_create_subnetworks=False)
+        default_subnetwork = gcp.compute.Subnetwork("default",
+            name="my-subnetwork",
+            ip_cidr_range="10.1.0.0/16",
+            region="us-central1",
+            network=default.id)
         private_connection = gcp.datastream.PrivateConnection("private_connection",
-            display_name="Connection profile",
+            display_name="Private connection",
             location="us-central1",
             private_connection_id="my-connection",
-            labels={
-                "key": "value",
-            },
             vpc_peering_config={
                 "vpc": default.id,
                 "subnet": "10.0.0.0/29",
             })
+        nat_vm_ip = gcp.compute.Address("nat_vm_ip", name="nat-vm-ip")
         instance = gcp.sql.DatabaseInstance("instance",
             name="my-instance",
             database_version="POSTGRES_14",
@@ -942,23 +984,9 @@ class ConnectionProfile(pulumi.CustomResource):
             settings={
                 "tier": "db-f1-micro",
                 "ip_configuration": {
-                    "authorized_networks": [
-                        {
-                            "value": "34.71.242.81",
-                        },
-                        {
-                            "value": "34.72.28.29",
-                        },
-                        {
-                            "value": "34.67.6.157",
-                        },
-                        {
-                            "value": "34.67.234.134",
-                        },
-                        {
-                            "value": "34.72.239.218",
-                        },
-                    ],
+                    "authorized_networks": [{
+                        "value": nat_vm_ip.address,
+                    }],
                 },
             },
             deletion_protection=True)
@@ -972,15 +1000,61 @@ class ConnectionProfile(pulumi.CustomResource):
             name="user",
             instance=instance.name,
             password=pwd.result)
+        nat_vm = gcp.compute.Instance("nat_vm",
+            name="nat-vm",
+            machine_type="e2-medium",
+            zone="us-central1-a",
+            desired_status="RUNNING",
+            boot_disk={
+                "initialize_params": {
+                    "image": "debian-cloud/debian-12",
+                },
+            },
+            network_interfaces=[{
+                "network": private_connection.vpc_peering_config.vpc,
+                "subnetwork": default_subnetwork.self_link,
+                "access_configs": [{
+                    "nat_ip": nat_vm_ip.address,
+                }],
+            }],
+            metadata_startup_script=instance.public_ip_address.apply(lambda public_ip_address: f\"\"\"#! /bin/bash
+        # See https://cloud.google.com/datastream/docs/private-connectivity#set-up-reverse-proxy
+        export DB_ADDR={public_ip_address}
+        export DB_PORT=5432
+        echo 1 > /proc/sys/net/ipv4/ip_forward
+        md_url_prefix="http://169.254.169.254/computeMetadata/v1/instance"
+        vm_nic_ip="$(curl -H "Metadata-Flavor: Google" ${{md_url_prefix}}/network-interfaces/0/ip)"
+        iptables -t nat -F
+        iptables -t nat -A PREROUTING \\
+             -p tcp --dport $DB_PORT \\
+             -j DNAT \\
+             --to-destination $DB_ADDR
+        iptables -t nat -A POSTROUTING \\
+             -p tcp --dport $DB_PORT \\
+             -j SNAT \\
+             --to-source $vm_nic_ip
+        iptables-save
+        \"\"\"))
+        rules = gcp.compute.Firewall("rules",
+            name="ingress-rule",
+            network=private_connection.vpc_peering_config.vpc,
+            description="Allow traffic into NAT VM",
+            direction="INGRESS",
+            allows=[{
+                "protocol": "tcp",
+                "ports": ["5432"],
+            }],
+            source_ranges=[private_connection.vpc_peering_config.subnet])
         default_connection_profile = gcp.datastream.ConnectionProfile("default",
             display_name="Connection profile",
             location="us-central1",
             connection_profile_id="my-profile",
             postgresql_profile={
-                "hostname": instance.public_ip_address,
+                "hostname": nat_vm.network_interfaces[0].network_ip,
                 "username": user.name,
                 "password": user.password,
                 "database": db.name,
+                "port": 5432,
             },
             private_connectivity={
                 "private_connection": private_connection.id,

pulumi_gcp/discoveryengine/chat_engine.py

@@ -35,7 +35,7 @@ class ChatEngineArgs:
         :param pulumi.Input['ChatEngineChatEngineConfigArgs'] chat_engine_config: Configurations for a chat Engine.
                Structure is documented below.
         :param pulumi.Input[str] collection_id: The collection ID.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_store_ids: The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`. Adding or removing data stores will force recreation.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_store_ids: The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`.
         :param pulumi.Input[str] display_name: The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.
         :param pulumi.Input[str] engine_id: The ID to use for chat engine.
         :param pulumi.Input[str] location: Location.
@@ -85,7 +85,7 @@ class ChatEngineArgs:
     @pulumi.getter(name="dataStoreIds")
     def data_store_ids(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
         """
-        The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`. Adding or removing data stores will force recreation.
+        The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`.
         """
         return pulumi.get(self, "data_store_ids")
 
@@ -189,7 +189,7 @@ class _ChatEngineState:
         :param pulumi.Input[str] collection_id: The collection ID.
         :param pulumi.Input['ChatEngineCommonConfigArgs'] common_config: Common config spec that specifies the metadata of the engine.
         :param pulumi.Input[str] create_time: Timestamp the Engine was created at.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_store_ids: The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`. Adding or removing data stores will force recreation.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_store_ids: The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`.
         :param pulumi.Input[str] display_name: The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.
         :param pulumi.Input[str] engine_id: The ID to use for chat engine.
         :param pulumi.Input[str] industry_vertical: The industry vertical that the chat engine registers. Vertical on Engine has to match vertical of the DataStore linked
@@ -294,7 +294,7 @@ class _ChatEngineState:
     @pulumi.getter(name="dataStoreIds")
     def data_store_ids(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
         """
-        The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`. Adding or removing data stores will force recreation.
+        The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`.
         """
         return pulumi.get(self, "data_store_ids")
 
@@ -518,7 +518,7 @@ class ChatEngine(pulumi.CustomResource):
                Structure is documented below.
         :param pulumi.Input[str] collection_id: The collection ID.
         :param pulumi.Input[Union['ChatEngineCommonConfigArgs', 'ChatEngineCommonConfigArgsDict']] common_config: Common config spec that specifies the metadata of the engine.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_store_ids: The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`. Adding or removing data stores will force recreation.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_store_ids: The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`.
         :param pulumi.Input[str] display_name: The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.
         :param pulumi.Input[str] engine_id: The ID to use for chat engine.
         :param pulumi.Input[str] industry_vertical: The industry vertical that the chat engine registers. Vertical on Engine has to match vertical of the DataStore linked
@@ -735,7 +735,7 @@ class ChatEngine(pulumi.CustomResource):
         :param pulumi.Input[str] collection_id: The collection ID.
         :param pulumi.Input[Union['ChatEngineCommonConfigArgs', 'ChatEngineCommonConfigArgsDict']] common_config: Common config spec that specifies the metadata of the engine.
         :param pulumi.Input[str] create_time: Timestamp the Engine was created at.
-        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_store_ids: The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`. Adding or removing data stores will force recreation.
+        :param pulumi.Input[Sequence[pulumi.Input[str]]] data_store_ids: The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`.
         :param pulumi.Input[str] display_name: The display name of the engine. Should be human readable. UTF-8 encoded string with limit of 1024 characters.
         :param pulumi.Input[str] engine_id: The ID to use for chat engine.
         :param pulumi.Input[str] industry_vertical: The industry vertical that the chat engine registers. Vertical on Engine has to match vertical of the DataStore linked
@@ -812,7 +812,7 @@ class ChatEngine(pulumi.CustomResource):
     @pulumi.getter(name="dataStoreIds")
     def data_store_ids(self) -> pulumi.Output[Sequence[str]]:
         """
-        The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`. Adding or removing data stores will force recreation.
+        The data stores associated with this engine. Multiple DataStores in the same Collection can be associated here. All listed DataStores must be `SOLUTION_TYPE_CHAT`.
         """
         return pulumi.get(self, "data_store_ids")