diff --git a/fast/README.md b/fast/README.md
index 7108c04a8..de860a451 100644
--- a/fast/README.md
+++ b/fast/README.md
@@ -32,33 +32,10 @@ A resource factory consumes a simple representation of a resource (e.g., in YAML
FAST uses YAML-based factories to deploy subnets and firewall rules and, as its name suggests, in the [project factory](./stages/03-project-factory/) stage.
-## High level design
+## Stages and high level design
-As mentioned before, fast relies on multiple stages to progressively bring up your GCP organization(s). In this section we briefly describe each stage.
-
-### Organizational level (00-01)
-
-- [Bootstrap](stages/00-bootstrap/README.md)
- Enables critical organization-level functionality that directly depends on Organization Administrator permissions. It has two primary purposes. The first is to bootstrap the resources needed to automate this and the following stages (service accounts, GCS buckets). And secondly, it applies the minimum amount of configuration needed at the organization level to avoid the need to grant organization-level permissions via Organization Administrator later on, and to implement a minimum of security features like sinks and exports from the start.
-- [Resource Management](stages/01-resman/README.md)
- Creates the base resource hierarchy (folders) and the automation resources required to delegate each part of the hierarchy to separate stages. This stage also configures organization-level policies and any exceptions needed by different branches of the resource hierarchy.
-
-### Shared resources (02)
-
-- [Security](stages/02-security/README.md)
- Manages centralized security configurations in a separate stage, typically owned by the security team. This stage implements VPC Security Controls via separate perimeters for environments and central services, and creates projects to host centralized KMS keys used by the whole organization. It's intentionally easy to extend to include other security-related resources, like Secret Manager.
-- Networking ([VPN](02-networking/README.md)/[NVA](02-networking-nva/README.md))
- Manages centralized network resources in a separate stage, and is typically owned by the networking team. This stage implements a hub-and-spoke design, and includes connectivity via VPN to on-premises, and YAML-based factories for firewall rules (hierarchical and VPC-level) and subnets. It's currently available in two versions: [spokes connected via VPN](02-networking/README.md), [and spokes connected via appliances](02-networking-nva/README.md).
-
-### Environment-level resources (03)
-
-- [Project Factory](stages/03-project-factory/prod/README.md)
- YAML-based factory to create and configure application- or team-level projects. Configuration includes VPC-level settings for Shared VPC, service-level configuration for CMEK encryption via centralized keys, and service account creation for workloads and applications. This stage is meant to be used once per environment.
-- Data Platform (in development)
-- GKE Multitenant (in development)
-- GCE Migration (in development)
-
-Please refer to the READMEs of each stage for further details.
+As mentioned before, fast relies on multiple stages to progressively bring up your GCP organization(s).
+Please refer to the [stages](./stages/) section for further details.
## Implementation
diff --git a/fast/stages.png b/fast/stages.png
index 6d1335bbf..238ad5a04 100644
Binary files a/fast/stages.png and b/fast/stages.png differ
diff --git a/fast/stages.svg b/fast/stages.svg
index 15e8195be..f952c8844 100644
--- a/fast/stages.svg
+++ b/fast/stages.svg
@@ -1,1074 +1,1063 @@
diff --git a/fast/stages/00-bootstrap/README.md b/fast/stages/00-bootstrap/README.md
index 7157bb18c..06ee9986e 100644
--- a/fast/stages/00-bootstrap/README.md
+++ b/fast/stages/00-bootstrap/README.md
@@ -305,9 +305,9 @@ Names used in internal references (e.g. `module.foo-prod.id`) are only used by T
| name | description | sensitive | consumers |
|---|---|:---:|---|
-| [billing_dataset](outputs.tf#L91) | BigQuery dataset prepared for billing export. | | |
-| [project_ids](outputs.tf#L96) | Projects created by this stage. | | |
-| [providers](outputs.tf#L107) | Terraform provider files for this stage and dependent stages. | ✓ | stage-01 |
-| [tfvars](outputs.tf#L116) | Terraform variable files for the following stages. | ✓ | |
+| [billing_dataset](outputs.tf#L85) | BigQuery dataset prepared for billing export. | | |
+| [project_ids](outputs.tf#L90) | Projects created by this stage. | | |
+| [providers](outputs.tf#L101) | Terraform provider files for this stage and dependent stages. | ✓ | stage-01 |
+| [tfvars](outputs.tf#L110) | Terraform variable files for the following stages. | ✓ | |
diff --git a/fast/stages/00-bootstrap/outputs.tf b/fast/stages/00-bootstrap/outputs.tf
index d07fdf19d..8912fb873 100644
--- a/fast/stages/00-bootstrap/outputs.tf
+++ b/fast/stages/00-bootstrap/outputs.tf
@@ -42,12 +42,6 @@ locals {
organization = var.organization
prefix = var.prefix
})
- "02-networking-nva" = jsonencode({
- billing_account_id = var.billing_account.id
- custom_roles = module.organization.custom_role_id
- organization = var.organization
- prefix = var.prefix
- })
"02-security" = jsonencode({
billing_account_id = var.billing_account.id
organization = var.organization
diff --git a/fast/stages/01-resman/README.md b/fast/stages/01-resman/README.md
index b83c17a08..46a8a383e 100644
--- a/fast/stages/01-resman/README.md
+++ b/fast/stages/01-resman/README.md
@@ -175,12 +175,12 @@ Due to its simplicity, this stage lends itself easily to customizations: adding
| name | description | sensitive | consumers |
|---|---|:---:|---|
-| [networking](outputs.tf#L88) | Data for the networking stage. | | 02-networking |
-| [project_factories](outputs.tf#L98) | Data for the project factories stage. | | xx-teams |
-| [providers](outputs.tf#L115) | Terraform provider files for this stage and dependent stages. | ✓ | 02-networking · 02-security · xx-sandbox · xx-teams |
-| [sandbox](outputs.tf#L122) | Data for the sandbox stage. | | xx-sandbox |
-| [security](outputs.tf#L132) | Data for the networking stage. | | 02-security |
-| [teams](outputs.tf#L142) | Data for the teams stage. | | |
-| [tfvars](outputs.tf#L155) | Terraform variable files for the following stages. | ✓ | |
+| [networking](outputs.tf#L84) | Data for the networking stage. | | 02-networking |
+| [project_factories](outputs.tf#L94) | Data for the project factories stage. | | xx-teams |
+| [providers](outputs.tf#L111) | Terraform provider files for this stage and dependent stages. | ✓ | 02-networking · 02-security · xx-sandbox · xx-teams |
+| [sandbox](outputs.tf#L118) | Data for the sandbox stage. | | xx-sandbox |
+| [security](outputs.tf#L128) | Data for the networking stage. | | 02-security |
+| [teams](outputs.tf#L138) | Data for the teams stage. | | |
+| [tfvars](outputs.tf#L151) | Terraform variable files for the following stages. | ✓ | |
diff --git a/fast/stages/01-resman/outputs.tf b/fast/stages/01-resman/outputs.tf
index 9edaf64ff..62aed2892 100644
--- a/fast/stages/01-resman/outputs.tf
+++ b/fast/stages/01-resman/outputs.tf
@@ -56,10 +56,6 @@ locals {
folder_id = module.branch-network-folder.id
project_factory_sa = local._project_factory_sas
})
- "02-networkin-nva" = jsonencode({
- folder_id = module.branch-network-folder.id
- project_factory_sa = local._project_factory_sas
- })
"02-security" = jsonencode({
folder_id = module.branch-security-folder.id
kms_restricted_admins = {
diff --git a/fast/stages/02-networking-nva/README.md b/fast/stages/02-networking-nva/README.md
index fb6286e49..3834bf9bf 100644
--- a/fast/stages/02-networking-nva/README.md
+++ b/fast/stages/02-networking-nva/README.md
@@ -1,7 +1,6 @@
# Networking with Network Virtual Appliance
This stage sets up the shared network infrastructure for the whole organization.
-It is an alternative to the [02-networking stage](../02-networking/README.md).
It is designed for those who would like to leverage Network Virtual Appliances (NVAs) between trusted and untrusted areas of the network, for example for Intrusion Prevention System (IPS) purposes.
@@ -161,15 +160,15 @@ If you have set a valid value for `outputs_location` in the bootstrap stage, sim
```bash
# `outputs_location` is set to `../../configs/example`
-ln -s ../../configs/example/02-networking-nva/providers.tf
+ln -s ../../configs/example/02-networking/providers.tf
```
If you have not configured `outputs_location` in bootstrap, you can derive the providers file from that stage outputs:
```bash
cd ../00-bootstrap
-terraform output -json providers | jq -r '.["02-networking-nva"]' \
- > ../02-networking-nva-nva/providers.tf
+terraform output -json providers | jq -r '.["02-networking"]' \
+ > ../02-networking-nva/providers.tf
```
### Variable configuration
@@ -185,8 +184,8 @@ If you have set a valid value for `outputs_location` in the bootstrap and in the
```bash
# `outputs_location` is set to `../../configs/example`
-ln -s ../../configs/example/02-networking-nva/terraform-bootstrap.auto.tfvars.json
-ln -s ../../configs/example/02-networking-nva/terraform-resman.auto.tfvars.json
+ln -s ../../configs/example/02-networking/terraform-bootstrap.auto.tfvars.json
+ln -s ../../configs/example/02-networking/terraform-resman.auto.tfvars.json
```
Please, refer to the [variables](#variables) table below for a map of the variable origins, and use the sections below to understand how to adapt this stage to your networking configuration.
diff --git a/fast/stages/02-networking/.gitignore b/fast/stages/02-networking-vpn/.gitignore
similarity index 100%
rename from fast/stages/02-networking/.gitignore
rename to fast/stages/02-networking-vpn/.gitignore
diff --git a/fast/stages/02-networking/README.md b/fast/stages/02-networking-vpn/README.md
similarity index 100%
rename from fast/stages/02-networking/README.md
rename to fast/stages/02-networking-vpn/README.md
diff --git a/fast/stages/02-networking/data/cidrs.yaml b/fast/stages/02-networking-vpn/data/cidrs.yaml
similarity index 100%
rename from fast/stages/02-networking/data/cidrs.yaml
rename to fast/stages/02-networking-vpn/data/cidrs.yaml
diff --git a/fast/stages/02-networking/data/dashboards/firewall_insights.json b/fast/stages/02-networking-vpn/data/dashboards/firewall_insights.json
similarity index 100%
rename from fast/stages/02-networking/data/dashboards/firewall_insights.json
rename to fast/stages/02-networking-vpn/data/dashboards/firewall_insights.json
diff --git a/fast/stages/02-networking/data/dashboards/vpn.json b/fast/stages/02-networking-vpn/data/dashboards/vpn.json
similarity index 100%
rename from fast/stages/02-networking/data/dashboards/vpn.json
rename to fast/stages/02-networking-vpn/data/dashboards/vpn.json
diff --git a/fast/stages/02-networking/data/firewall-rules/landing/rules.yaml b/fast/stages/02-networking-vpn/data/firewall-rules/landing/rules.yaml
similarity index 100%
rename from fast/stages/02-networking/data/firewall-rules/landing/rules.yaml
rename to fast/stages/02-networking-vpn/data/firewall-rules/landing/rules.yaml
diff --git a/fast/stages/02-networking/data/hierarchical-policy-rules.yaml b/fast/stages/02-networking-vpn/data/hierarchical-policy-rules.yaml
similarity index 100%
rename from fast/stages/02-networking/data/hierarchical-policy-rules.yaml
rename to fast/stages/02-networking-vpn/data/hierarchical-policy-rules.yaml
diff --git a/fast/stages/02-networking/data/subnets/dev/dev-default-ew1.yaml b/fast/stages/02-networking-vpn/data/subnets/dev/dev-default-ew1.yaml
similarity index 100%
rename from fast/stages/02-networking/data/subnets/dev/dev-default-ew1.yaml
rename to fast/stages/02-networking-vpn/data/subnets/dev/dev-default-ew1.yaml
diff --git a/fast/stages/02-networking/data/subnets/landing/landing-default-ew1.yaml b/fast/stages/02-networking-vpn/data/subnets/landing/landing-default-ew1.yaml
similarity index 100%
rename from fast/stages/02-networking/data/subnets/landing/landing-default-ew1.yaml
rename to fast/stages/02-networking-vpn/data/subnets/landing/landing-default-ew1.yaml
diff --git a/fast/stages/02-networking/data/subnets/prod/prod-default-ew1.yaml b/fast/stages/02-networking-vpn/data/subnets/prod/prod-default-ew1.yaml
similarity index 100%
rename from fast/stages/02-networking/data/subnets/prod/prod-default-ew1.yaml
rename to fast/stages/02-networking-vpn/data/subnets/prod/prod-default-ew1.yaml
diff --git a/fast/stages/02-networking/diagram.png b/fast/stages/02-networking-vpn/diagram.png
similarity index 100%
rename from fast/stages/02-networking/diagram.png
rename to fast/stages/02-networking-vpn/diagram.png
diff --git a/fast/stages/02-networking/diagram.svg b/fast/stages/02-networking-vpn/diagram.svg
similarity index 100%
rename from fast/stages/02-networking/diagram.svg
rename to fast/stages/02-networking-vpn/diagram.svg
diff --git a/fast/stages/02-networking/dns-dev.tf b/fast/stages/02-networking-vpn/dns-dev.tf
similarity index 100%
rename from fast/stages/02-networking/dns-dev.tf
rename to fast/stages/02-networking-vpn/dns-dev.tf
diff --git a/fast/stages/02-networking/dns-landing.tf b/fast/stages/02-networking-vpn/dns-landing.tf
similarity index 100%
rename from fast/stages/02-networking/dns-landing.tf
rename to fast/stages/02-networking-vpn/dns-landing.tf
diff --git a/fast/stages/02-networking/dns-prod.tf b/fast/stages/02-networking-vpn/dns-prod.tf
similarity index 100%
rename from fast/stages/02-networking/dns-prod.tf
rename to fast/stages/02-networking-vpn/dns-prod.tf
diff --git a/fast/stages/02-networking/main.tf b/fast/stages/02-networking-vpn/main.tf
similarity index 100%
rename from fast/stages/02-networking/main.tf
rename to fast/stages/02-networking-vpn/main.tf
diff --git a/fast/stages/02-networking/monitoring.tf b/fast/stages/02-networking-vpn/monitoring.tf
similarity index 100%
rename from fast/stages/02-networking/monitoring.tf
rename to fast/stages/02-networking-vpn/monitoring.tf
diff --git a/fast/stages/02-networking/outputs.tf b/fast/stages/02-networking-vpn/outputs.tf
similarity index 100%
rename from fast/stages/02-networking/outputs.tf
rename to fast/stages/02-networking-vpn/outputs.tf
diff --git a/fast/stages/02-networking/test-resources.tf b/fast/stages/02-networking-vpn/test-resources.tf
similarity index 100%
rename from fast/stages/02-networking/test-resources.tf
rename to fast/stages/02-networking-vpn/test-resources.tf
diff --git a/fast/stages/02-networking/variables.tf b/fast/stages/02-networking-vpn/variables.tf
similarity index 100%
rename from fast/stages/02-networking/variables.tf
rename to fast/stages/02-networking-vpn/variables.tf
diff --git a/fast/stages/02-networking/vpc-landing.tf b/fast/stages/02-networking-vpn/vpc-landing.tf
similarity index 100%
rename from fast/stages/02-networking/vpc-landing.tf
rename to fast/stages/02-networking-vpn/vpc-landing.tf
diff --git a/fast/stages/02-networking/vpc-spoke-dev.tf b/fast/stages/02-networking-vpn/vpc-spoke-dev.tf
similarity index 100%
rename from fast/stages/02-networking/vpc-spoke-dev.tf
rename to fast/stages/02-networking-vpn/vpc-spoke-dev.tf
diff --git a/fast/stages/02-networking/vpc-spoke-prod.tf b/fast/stages/02-networking-vpn/vpc-spoke-prod.tf
similarity index 100%
rename from fast/stages/02-networking/vpc-spoke-prod.tf
rename to fast/stages/02-networking-vpn/vpc-spoke-prod.tf
diff --git a/fast/stages/02-networking/vpn-onprem.tf b/fast/stages/02-networking-vpn/vpn-onprem.tf
similarity index 100%
rename from fast/stages/02-networking/vpn-onprem.tf
rename to fast/stages/02-networking-vpn/vpn-onprem.tf
diff --git a/fast/stages/02-networking/vpn-spoke-dev.tf b/fast/stages/02-networking-vpn/vpn-spoke-dev.tf
similarity index 100%
rename from fast/stages/02-networking/vpn-spoke-dev.tf
rename to fast/stages/02-networking-vpn/vpn-spoke-dev.tf
diff --git a/fast/stages/02-networking/vpn-spoke-prod.tf b/fast/stages/02-networking-vpn/vpn-spoke-prod.tf
similarity index 100%
rename from fast/stages/02-networking/vpn-spoke-prod.tf
rename to fast/stages/02-networking-vpn/vpn-spoke-prod.tf
diff --git a/fast/stages/03-project-factory/prod/README.md b/fast/stages/03-project-factory/prod/README.md
index 70b6cfce6..328571a2d 100644
--- a/fast/stages/03-project-factory/prod/README.md
+++ b/fast/stages/03-project-factory/prod/README.md
@@ -28,7 +28,7 @@ The project factory takes care of the following activities:
## How to run this stage
-This stage is meant to be executed after "foundational stages" (i.e., stages [`00-bootstrap`](../../00-bootstrap), [`01-resman`](../../01-resman), [`02-networking`](../../02-networking) and [`02-security`](../../02-security)) have been run.
+This stage is meant to be executed after "foundational stages" (i.e., stages [`00-bootstrap`](../../00-bootstrap), [`01-resman`](../../01-resman), 02-networking (either [VPN](../../02-networking-vpn) or [NVA](../../02-networking-nva)) and [`02-security`](../../02-security)) have been run.
It's of course possible to run this stage in isolation, by making sure the architectural prerequisites are satisfied (e.g., networking), and that the Service Account running the stage is granted the roles/permissions below:
@@ -73,7 +73,7 @@ To avoid the tedious job of filling in the first group of variables with values
If you configured a valid path for `outputs_location` in the bootstrap and networking stage, simply link the relevant `terraform-*.auto.tfvars.json` files from this stage's outputs folder (under the path you specified), where the `*` above is set to the name of the stage that produced it. For this stage, a single `.tfvars` file is available:
```bash
-# Variable `outputs_location` is set to `../../config` in stages 01-bootstrap and 02-networking
+# Variable `outputs_location` is set to `../../config` in stages 01-bootstrap and the 02-networking stage in use
ln -s ../../../config/03-project-factory-prod/terraform-bootstrap.auto.tfvars.json
ln -s ../../../config/03-project-factory-prod/terraform-networking.auto.tfvars.json
```
diff --git a/fast/stages/README.md b/fast/stages/README.md
index 1c5a8144e..4bb70e0a8 100644
--- a/fast/stages/README.md
+++ b/fast/stages/README.md
@@ -17,8 +17,8 @@ Refer to each stage's documentation for a detailed description of its purpose, t
- [Security](02-security/README.md)
Manages centralized security configurations in a separate stage, and is typically owned by the security team. This stage implements VPC Security Controls via separate perimeters for environments and central services, and creates projects to host centralized KMS keys used by the whole organization. It's meant to be easily extended to include other security-related resources which are required, like Secret Manager.
-- Networking ([VPN](02-networking/README.md)/[NVA](02-networking-nva/README.md))
- Manages centralized network resources in a separate stage, and is typically owned by the networking team. This stage implements a hub-and-spoke design, and includes connectivity via VPN to on-premises, and YAML-based factories for firewall rules (hierarchical and VPC-level) and subnets. It's currently available in two versions: [spokes connected via VPN](02-networking/README.md), [and spokes connected via appliances](02-networking-nva/README.md).
+- Networking ([VPN](02-networking-vpn/README.md)/[NVA](02-networking-nva/README.md))
+ Manages centralized network resources in a separate stage, and is typically owned by the networking team. This stage implements a hub-and-spoke design, and includes connectivity via VPN to on-premises, and YAML-based factories for firewall rules (hierarchical and VPC-level) and subnets. It's currently available in two versions: [spokes connected via VPN](02-networking-vpn/README.md), [and spokes connected via appliances](02-networking-nva/README.md).
## Environment-level resources (03)
diff --git a/tests/fast/stages/s02_networking/__init__.py b/tests/fast/stages/s02_networking_vpn/__init__.py
similarity index 100%
rename from tests/fast/stages/s02_networking/__init__.py
rename to tests/fast/stages/s02_networking_vpn/__init__.py
diff --git a/tests/fast/stages/s02_networking/fixture/main.tf b/tests/fast/stages/s02_networking_vpn/fixture/main.tf
similarity index 93%
rename from tests/fast/stages/s02_networking/fixture/main.tf
rename to tests/fast/stages/s02_networking_vpn/fixture/main.tf
index fe1cfbf57..8932a9927 100644
--- a/tests/fast/stages/s02_networking/fixture/main.tf
+++ b/tests/fast/stages/s02_networking_vpn/fixture/main.tf
@@ -15,7 +15,7 @@
*/
module "stage" {
- source = "../../../../../fast/stages/02-networking"
+ source = "../../../../../fast/stages/02-networking-vpn"
billing_account_id = "000000-111111-222222"
organization = {
domain = "gcp-pso-italy.net"
@@ -27,5 +27,5 @@ module "stage" {
dev = "foo@iam"
prod = "bar@iam"
}
- data_dir = "../../../../../fast/stages/02-networking/data/"
+ data_dir = "../../../../../fast/stages/02-networking-vpn/data/"
}
diff --git a/tests/fast/stages/s02_networking/test_plan.py b/tests/fast/stages/s02_networking_vpn/test_plan.py
similarity index 100%
rename from tests/fast/stages/s02_networking/test_plan.py
rename to tests/fast/stages/s02_networking_vpn/test_plan.py