From 54955b3e6df3f480b8d002754edd7855e8c6f7c8 Mon Sep 17 00:00:00 2001 From: Ludovico Magnocavallo Date: Tue, 2 Mar 2021 07:36:06 +0100 Subject: [PATCH] Add support for per-tunnel routers to VPN dynamic and HA (#202) * add optional per-tunnel router to vpn dynamic module * add support for per-tunnel router to VPN HA * fix onprem tests --- modules/net-vpn-dynamic/README.md | 3 ++- modules/net-vpn-dynamic/main.tf | 10 ++++----- modules/net-vpn-dynamic/variables.tf | 1 + modules/net-vpn-ha/README.md | 23 ++++++++++++++------- modules/net-vpn-ha/variables.tf | 3 ++- networking/hub-and-spoke-vpn/main.tf | 4 ++++ networking/onprem-google-access-dns/main.tf | 2 ++ 7 files changed, 31 insertions(+), 15 deletions(-) diff --git a/modules/net-vpn-dynamic/README.md b/modules/net-vpn-dynamic/README.md index c84f2a70e..37b3d3f6e 100644 --- a/modules/net-vpn-dynamic/README.md +++ b/modules/net-vpn-dynamic/README.md @@ -23,6 +23,7 @@ module "vpn-dynamic" { bgp_session_range = "169.254.139.133/30" ike_version = 2 peer_ip = "1.1.1.1" + router = null shared_secret = null bgp_peer_options = { advertise_groups = ["ALL_SUBNETS"] @@ -54,7 +55,7 @@ module "vpn-dynamic" { | *router_asn* | Router ASN used for auto-created router. | number | | 64514 | | *router_create* | Create router. | bool | | true | | *router_name* | Router name used for auto created router, or to specify existing router to use. Leave blank to use VPN name for auto created router. | string | | | -| *tunnels* | VPN tunnel configurations, bgp_peer_options is usually null. | map(object({...})) | | {} | +| *tunnels* | VPN tunnel configurations, bgp_peer_options is usually null. | map(object({...})) | | {} | ## Outputs diff --git a/modules/net-vpn-dynamic/main.tf b/modules/net-vpn-dynamic/main.tf index fb36e31cb..bed5032c4 100644 --- a/modules/net-vpn-dynamic/main.tf +++ b/modules/net-vpn-dynamic/main.tf @@ -83,7 +83,7 @@ resource "google_compute_router" "router" { : var.router_advertise_config.groups ) ) - dynamic advertised_ip_ranges { + dynamic "advertised_ip_ranges" { for_each = ( var.router_advertise_config == null ? {} : ( var.router_advertise_config.mode != "CUSTOM" @@ -106,7 +106,7 @@ resource "google_compute_router_peer" "bgp_peer" { region = var.region project = var.project_id name = "${var.name}-${each.key}" - router = local.router + router = each.value.router == null ? local.router : each.value.router peer_ip_address = each.value.bgp_peer.address peer_asn = each.value.bgp_peer.asn advertised_route_priority = ( @@ -126,7 +126,7 @@ resource "google_compute_router_peer" "bgp_peer" { : each.value.bgp_peer_options.advertise_groups ) ) - dynamic advertised_ip_ranges { + dynamic "advertised_ip_ranges" { for_each = ( each.value.bgp_peer_options == null ? {} : ( each.value.bgp_peer_options.advertise_mode != "CUSTOM" @@ -148,7 +148,7 @@ resource "google_compute_router_interface" "router_interface" { project = var.project_id region = var.region name = "${var.name}-${each.key}" - router = local.router + router = each.value.router == null ? local.router : each.value.router ip_range = each.value.bgp_session_range == "" ? null : each.value.bgp_session_range vpn_tunnel = google_compute_vpn_tunnel.tunnels[each.key].name } @@ -165,7 +165,7 @@ resource "google_compute_vpn_tunnel" "tunnels" { project = var.project_id region = var.region name = "${var.name}-${each.key}" - router = local.router + router = each.value.router == null ? local.router : each.value.router peer_ip = each.value.peer_ip ike_version = each.value.ike_version shared_secret = ( diff --git a/modules/net-vpn-dynamic/variables.tf b/modules/net-vpn-dynamic/variables.tf index 18c470283..3835d1a69 100644 --- a/modules/net-vpn-dynamic/variables.tf +++ b/modules/net-vpn-dynamic/variables.tf @@ -98,6 +98,7 @@ variable "tunnels" { bgp_session_range = string ike_version = number peer_ip = string + router = string shared_secret = string })) default = {} diff --git a/modules/net-vpn-ha/README.md b/modules/net-vpn-ha/README.md index 81c6b5791..64b0cc2f8 100644 --- a/modules/net-vpn-ha/README.md +++ b/modules/net-vpn-ha/README.md @@ -1,5 +1,5 @@ # Cloud VPN HA Module -This module makes it easy to deploy either GCP-to-GCP or GCP-to-On-prem [Cloud HA VPN](https://cloud.google.com/vpn/docs/concepts/overview#ha-vpn). +This module makes it easy to deploy either GCP-to-GCP or GCP-to-On-prem [Cloud HA VPN](https://cloud.google.com/vpn/docs/concepts/overview#ha-vpn). ## Examples @@ -29,9 +29,10 @@ module "vpn_ha-1" { bgp_peer_options = null bgp_session_range = "169.254.1.2/30" ike_version = 2 - vpn_gateway_interface = 0 peer_external_gateway_interface = null + router = null shared_secret = "" + vpn_gateway_interface = 0 } remote-1 = { bgp_peer = { @@ -41,9 +42,10 @@ module "vpn_ha-1" { bgp_peer_options = null bgp_session_range = "169.254.2.2/30" ike_version = 2 - vpn_gateway_interface = 1 peer_external_gateway_interface = null + router = null shared_secret = "" + vpn_gateway_interface = 1 } } } @@ -65,9 +67,10 @@ module "vpn_ha-2" { bgp_peer_options = null bgp_session_range = "169.254.1.1/30" ike_version = 2 - vpn_gateway_interface = 0 peer_external_gateway_interface = null + router = null shared_secret = module.vpn_ha-1.random_secret + vpn_gateway_interface = 0 } remote-1 = { bgp_peer = { @@ -77,14 +80,16 @@ module "vpn_ha-2" { bgp_peer_options = null bgp_session_range = "169.254.2.1/30" ike_version = 2 - vpn_gateway_interface = 1 peer_external_gateway_interface = null + router = null shared_secret = module.vpn_ha-1.random_secret + vpn_gateway_interface = 1 } } } # tftest:modules=2:resources=18 ``` + ### GCP to on-prem ```hcl @@ -111,9 +116,10 @@ module "vpn_ha" { bgp_peer_options = null bgp_session_range = "169.254.1.2/30" ike_version = 2 - vpn_gateway_interface = 0 peer_external_gateway_interface = 0 + router = null shared_secret = "mySecret" + vpn_gateway_interface = 0 } remote-1 = { bgp_peer = { @@ -123,9 +129,10 @@ module "vpn_ha" { bgp_peer_options = null bgp_session_range = "169.254.2.2/30" ike_version = 2 - vpn_gateway_interface = 1 peer_external_gateway_interface = 0 + router = null shared_secret = "mySecret" + vpn_gateway_interface = 1 } } } @@ -148,7 +155,7 @@ module "vpn_ha" { | *router_asn* | Router ASN used for auto-created router. | number | | 64514 | | *router_create* | Create router. | bool | | true | | *router_name* | Router name used for auto created router, or to specify an existing router to use if `router_create` is set to `true`. Leave blank to use VPN name for auto created router. | string | | | -| *tunnels* | VPN tunnel configurations, bgp_peer_options is usually null. | map(object({...})) | | {} | +| *tunnels* | VPN tunnel configurations, bgp_peer_options is usually null. | map(object({...})) | | {} | | *vpn_gateway* | HA VPN Gateway Self Link for using an existing HA VPN Gateway, leave empty if `vpn_gateway_create` is set to `true`. | string | | null | | *vpn_gateway_create* | Create HA VPN Gateway. | bool | | true | diff --git a/modules/net-vpn-ha/variables.tf b/modules/net-vpn-ha/variables.tf index 20bf8a6cd..36e80968b 100644 --- a/modules/net-vpn-ha/variables.tf +++ b/modules/net-vpn-ha/variables.tf @@ -115,9 +115,10 @@ variable "tunnels" { # from the 169.254.0.0/16 block. bgp_session_range = string ike_version = number - vpn_gateway_interface = number peer_external_gateway_interface = number + router = string shared_secret = string + vpn_gateway_interface = number })) default = {} } diff --git a/networking/hub-and-spoke-vpn/main.tf b/networking/hub-and-spoke-vpn/main.tf index d4c7a728f..8050dcf27 100644 --- a/networking/hub-and-spoke-vpn/main.tf +++ b/networking/hub-and-spoke-vpn/main.tf @@ -79,6 +79,7 @@ module "vpn-hub-a" { bgp_session_range = "${cidrhost(var.bgp_interface_ranges.spoke-1, 1)}/30" ike_version = 2 peer_ip = module.vpn-spoke-1.address + router = null shared_secret = "" } } @@ -108,6 +109,7 @@ module "vpn-hub-b" { bgp_session_range = "${cidrhost(var.bgp_interface_ranges.spoke-2, 1)}/30" ike_version = 2 peer_ip = module.vpn-spoke-2.address + router = null shared_secret = "" } } @@ -162,6 +164,7 @@ module "vpn-spoke-1" { bgp_session_range = "${cidrhost(var.bgp_interface_ranges.spoke-1, 2)}/30" ike_version = 2 peer_ip = module.vpn-hub-a.address + router = null shared_secret = module.vpn-hub-a.random_secret } } @@ -225,6 +228,7 @@ module "vpn-spoke-2" { bgp_session_range = "${cidrhost(var.bgp_interface_ranges.spoke-2, 2)}/30" ike_version = 2 peer_ip = module.vpn-hub-b.address + router = null shared_secret = module.vpn-hub-b.random_secret } } diff --git a/networking/onprem-google-access-dns/main.tf b/networking/onprem-google-access-dns/main.tf index 356113d9c..ffb1b002d 100644 --- a/networking/onprem-google-access-dns/main.tf +++ b/networking/onprem-google-access-dns/main.tf @@ -105,6 +105,7 @@ module "vpn1" { bgp_session_range = "${local.bgp_interface_gcp1}/30" ike_version = 2 peer_ip = module.vm-onprem.external_ips.0 + router = null shared_secret = "" } } @@ -136,6 +137,7 @@ module "vpn2" { bgp_session_range = "${local.bgp_interface_gcp2}/30" ike_version = 2 peer_ip = module.vm-onprem.external_ips.0 + router = null shared_secret = "" } }