managedkafka: add network target fields to cluster

mmv1/products/managedkafka/Cluster.yaml

@@ -77,6 +77,13 @@ samples:
       - name: 'managedkafka_cluster_public'
         resource_id_vars:
           cluster_id: 'my-cluster'
+  - name: 'managedkafka_cluster_network_targets'
+    primary_resource_id: 'example'
+    tgc_skip_test: 'Test data unavailable in CAI yet'
+    steps:
+      - name: 'managedkafka_cluster_network_targets'
+        resource_id_vars:
+          cluster_id: 'my-cluster'
 parameters:
   - name: 'location'
     type: String
@@ -113,6 +120,14 @@ properties:
                   description: "Name of the VPC subnet from which the cluster is accessible. Both broker and bootstrap server IP addresses and DNS entries are automatically created in the subnet. There can only be one subnet per network, and the subnet must be located in the same region as the cluster. The project may differ. The name of the subnet must be in the format `projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET`."
                   required: true
                   diff_suppress_func: 'tpgresource.ProjectNumberDiffSuppress'
+                - name: 'pscResourceTarget'
+                  type: String
+                  description: "The project in which the Private Service Connect (PSC) endpoints for the brokers and bootstrap address of this subnet are created. This is primarily relevant in Shared VPC topologies, where the VPC network resides in a different project than the cluster. If not specified, defaults to `PSC_NETWORK_PROJECT`. The value cannot be changed for a subnet that is already attached to the cluster. Possible values: `PSC_NETWORK_PROJECT`, `PSC_CLUSTER_PROJECT`."
+                  default_from_api: true
+                - name: 'dnsZoneTarget'
+                  type: String
+                  description: "The project in which the private DNS zone for this subnet's network is created. This is primarily relevant in Shared VPC topologies to choose between hosting the zone in the host project (which requires write access on the host project) or in the service project. If not specified, defaults to `DNS_ZONE_NETWORK_PROJECT`. `DNS_ZONE_CLUSTER_PROJECT_MANUAL_BINDING` creates the zone in the cluster's project and skips the automated binding to the VPC network; choose it if the Google-managed service account does not have `dns.networks.bindPrivateDNSZone` on the host project and you intend to perform the binding out-of-band. The value cannot be changed for a subnet that is already attached to the cluster. Possible values: `DNS_ZONE_NETWORK_PROJECT`, `DNS_ZONE_CLUSTER_PROJECT`, `DNS_ZONE_CLUSTER_PROJECT_MANUAL_BINDING`."
+                  default_from_api: true
           - name: 'publicClusterConfig'
             type: NestedObject
             description: "Public connection configuration for the Kafka cluster."

mmv1/templates/terraform/samples/services/managedkafka/managedkafka_cluster_network_targets.tf.tmpl

@@ -0,0 +1,26 @@
+resource "google_managed_kafka_cluster" "{{$.PrimaryResourceId}}" {
+  cluster_id = "{{index $.ResourceIdVars "cluster_id"}}"
+  location = "us-central1"
+  capacity_config {
+    vcpu_count = 3
+    memory_bytes = 3221225472
+  }
+  gcp_config {
+    access_config {
+      network_configs {
+        subnet = "projects/${data.google_project.project.number}/regions/us-central1/subnetworks/default"
+        # In a Shared VPC topology, create the Private Service Connect endpoints
+        # and the private DNS zone in the cluster's (service) project instead of
+        # the network's (host) project.
+        psc_resource_target = "PSC_CLUSTER_PROJECT"
+        dns_zone_target     = "DNS_ZONE_CLUSTER_PROJECT"
+      }
+    }
+  }
+  rebalance_config {
+    mode = "AUTO_REBALANCE_ON_SCALE_UP"
+  }
+}
+
+data "google_project" "project" {
+}