在GCP部署SQL数据库实例时遇Error code9报错求助

在GCP上部署SQL数据库实例时触发如下报错：

Error: Error waiting for Create Service Networking Connection: Error code 9, message: Cannot modify allocated ranges in CreateConnection. Please use UpdateConnection.

关联的Terraform代码：

resource "google_compute_network" "vpc" {
  name = "edddddddd-one-vpc"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "public_subnet" {
  name = "edddddddd-public-one-subnet"
  ip_cidr_range = "10.0.0.0/24"
  region = var.region
  network = google_compute_network.vpc.self_link
}

resource "google_compute_subnetwork" "private_subnet" {
  name = "edddddddd-private-one-subnet"
  ip_cidr_range = "10.1.0.0/24"
  region = var.region
  network = google_compute_network.vpc.self_link
  purpose = "PRIVATE_SERVICE_CONNECT"
  private_ip_google_access = true
}

resource "google_compute_global_address" "private_service_access" {
  name = "edddddddd-private-service-access"
  purpose = "VPC_PEERING"
  address_type = "INTERNAL"
  prefix_length = 24
  network = google_compute_network.vpc.name
}

resource "google_service_networking_connection" "private_vpc_connection" {
  network = google_compute_network.vpc.self_link
  service = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.private_service_access.name]
}

resource "google_sql_database_instance" "database" {
  for_each = toset([
    "serv1",
    "serv2",
    "serv3",
  ])

  name = "${each.key}-one-mysql-db"
  region           = var.region
  database_version = "MYSQL_8_0"
  depends_on = [google_service_networking_connection.private_vpc_connection]
  settings {
    tier = "db-n1-standard-2"
    edition = "ENTERPRISE"
    availability_type = "ZONAL"
    location_preference {
      zone = var.zone
    }
    ip_configuration {
      ipv4_enabled = false
      private_network = "projects/${var.gcp_project}/global/networks/${google_compute_subnetwork.private_subnet.name}"
      enable_private_path_for_google_cloud_services = false
    }
  }
}

这个报错的核心逻辑是：当目标VPC与servicenetworking.googleapis.com的 peering 连接已存在时，不能通过CreateConnection操作修改已分配的IP范围，必须切换为UpdateConnection操作。结合代码场景，可按以下步骤修复：

1. 核查现有 peering 连接状态 #

先确认VPC是否已存在服务网络 peering 连接：

gcloud compute networks peerings list --network=edddddddd-one-vpc

如果返回已存在的连接记录，说明Terraform再次执行创建操作时触发了冲突，这就是报错的直接原因。

2. 调整Terraform资源配置 #

方案一：启用连接更新模式 #

在google_service_networking_connection资源中添加update_connection = true参数，让Terraform在连接已存在时自动执行更新而非创建：

resource "google_service_networking_connection" "private_vpc_connection" {
  network = google_compute_network.vpc.self_link
  service = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.private_service_access.name]
  update_connection = true  # 新增该参数
}

方案二：重置现有 peering 连接（允许的前提下） #

如果环境允许重置连接，先手动删除现有 peering 记录，再重新执行Terraform：

gcloud services vpc-peerings delete --service=servicenetworking.googleapis.com --network=edddddddd-one-vpc

执行完成后运行terraform apply，让Terraform重新创建连接并分配IP范围。

3. 修复代码中的潜在错误 #

当前SQL实例配置中，private_network参数错误指向了子网名称，Cloud SQL的私有网络关联是基于VPC层面的，需修改为VPC名称：

ip_configuration {
  ipv4_enabled = false
  private_network = "projects/${var.gcp_project}/global/networks/${google_compute_network.vpc.name}"  # 替换为VPC名称
  enable_private_path_for_google_cloud_services = false
}

这个错误虽不直接触发当前报错，但会导致后续SQL实例无法正确接入私有网络。

内容的提问来源于stack exchange，提问作者devops on the road