From c21a59a490c52cfe0c0b003389597fb9a77a6670 Mon Sep 17 00:00:00 2001
From: Simone Ruffilli <sruffilli@google.com>
Date: Sun, 27 Feb 2022 10:04:20 +0100
Subject: [PATCH 1/2] FAST: use preemptable instances for demo NVA. Comment out
 test VMs.

---
 fast/stages/02-networking-nva/nva.tf          |   7 +
 .../02-networking-nva/test-resources.tf       | 212 +++++++++---------
 .../02-networking-vpn/test-resources.tf       | 160 ++++++-------
 3 files changed, 193 insertions(+), 186 deletions(-)

diff --git a/fast/stages/02-networking-nva/nva.tf b/fast/stages/02-networking-nva/nva.tf
index aaf4c6de8..64305e2cc 100644
--- a/fast/stages/02-networking-nva/nva.tf
+++ b/fast/stages/02-networking-nva/nva.tf
@@ -54,6 +54,13 @@ module "nva-template-ew1" {
     size  = 10
   }
   create_template = true
+  instance_type   = "f1-micro"
+  options = {
+    allow_stopping_for_update = true
+    deletion_protection       = false
+    # Creates preemptible instances, cheaper than regular one. Only suitable for testing.
+    preemptible = true
+  }
   metadata = {
     startup-script = templatefile(
       "${path.module}/data/nva-startup-script.tftpl",
diff --git a/fast/stages/02-networking-nva/test-resources.tf b/fast/stages/02-networking-nva/test-resources.tf
index cd9ae9b0a..9c259c7f4 100644
--- a/fast/stages/02-networking-nva/test-resources.tf
+++ b/fast/stages/02-networking-nva/test-resources.tf
@@ -18,32 +18,32 @@
 
 # Untrusted (Landing)
 
-module "test-vm-landing-untrusted-ew1-0" {
-  source     = "../../../modules/compute-vm"
-  project_id = module.landing-project.project_id
-  zone       = "europe-west1-b"
-  name       = "test-vm-lnd-unt-ew1-0"
-  network_interfaces = [{
-    network    = module.landing-untrusted-vpc.self_link
-    subnetwork = module.landing-untrusted-vpc.subnet_self_links["europe-west1/landing-untrusted-default-ew1"]
-    alias_ips  = {}
-    nat        = false
-    addresses  = null
-  }]
-  tags                   = ["ew1", "ssh"]
-  service_account_create = true
-  boot_disk = {
-    image = "projects/debian-cloud/global/images/family/debian-10"
-    type  = "pd-balanced"
-    size  = 10
-  }
-  metadata = {
-    startup-script = <<EOF
-      apt update
-      apt install iputils-ping bind9-dnsutils
-    EOF
-  }
-}
+# module "test-vm-landing-untrusted-ew1-0" {
+#   source     = "../../../modules/compute-vm"
+#   project_id = module.landing-project.project_id
+#   zone       = "europe-west1-b"
+#   name       = "test-vm-lnd-unt-ew1-0"
+#   network_interfaces = [{
+#     network    = module.landing-untrusted-vpc.self_link
+#     subnetwork = module.landing-untrusted-vpc.subnet_self_links["europe-west1/landing-untrusted-default-ew1"]
+#     alias_ips  = {}
+#     nat        = false
+#     addresses  = null
+#   }]
+#   tags                   = ["ew1", "ssh"]
+#   service_account_create = true
+#   boot_disk = {
+#     image = "projects/debian-cloud/global/images/family/debian-10"
+#     type  = "pd-balanced"
+#     size  = 10
+#   }
+#   metadata = {
+#     startup-script = <<EOF
+#       apt update
+#       apt install iputils-ping bind9-dnsutils
+#     EOF
+#   }
+# }
 
 # module "test-vm-landing-untrusted-ew4-0" {
 #   source     = "../../../modules/compute-vm"
@@ -74,32 +74,32 @@ module "test-vm-landing-untrusted-ew1-0" {
 
 # Trusted (hub)
 
-module "test-vm-landing-trusted-ew1-0" {
-  source     = "../../../modules/compute-vm"
-  project_id = module.landing-project.project_id
-  zone       = "europe-west1-b"
-  name       = "test-vm-lnd-tru-ew1-0"
-  network_interfaces = [{
-    network    = module.landing-trusted-vpc.self_link
-    subnetwork = module.landing-trusted-vpc.subnet_self_links["europe-west1/landing-trusted-default-ew1"]
-    alias_ips  = {}
-    nat        = false
-    addresses  = null
-  }]
-  tags                   = ["ew1", "ssh"]
-  service_account_create = true
-  boot_disk = {
-    image = "projects/debian-cloud/global/images/family/debian-10"
-    type  = "pd-balanced"
-    size  = 10
-  }
-  metadata = {
-    startup-script = <<EOF
-      apt update
-      apt install iputils-ping bind9-dnsutils
-    EOF
-  }
-}
+# module "test-vm-landing-trusted-ew1-0" {
+#   source     = "../../../modules/compute-vm"
+#   project_id = module.landing-project.project_id
+#   zone       = "europe-west1-b"
+#   name       = "test-vm-lnd-tru-ew1-0"
+#   network_interfaces = [{
+#     network    = module.landing-trusted-vpc.self_link
+#     subnetwork = module.landing-trusted-vpc.subnet_self_links["europe-west1/landing-trusted-default-ew1"]
+#     alias_ips  = {}
+#     nat        = false
+#     addresses  = null
+#   }]
+#   tags                   = ["ew1", "ssh"]
+#   service_account_create = true
+#   boot_disk = {
+#     image = "projects/debian-cloud/global/images/family/debian-10"
+#     type  = "pd-balanced"
+#     size  = 10
+#   }
+#   metadata = {
+#     startup-script = <<EOF
+#       apt update
+#       apt install iputils-ping bind9-dnsutils
+#     EOF
+#   }
+# }
 
 # module "test-vm-landing-trusted-ew4-0" {
 #   source     = "../../../modules/compute-vm"
@@ -130,33 +130,33 @@ module "test-vm-landing-trusted-ew1-0" {
 
 # Dev spoke
 
-module "test-vm-dev-ew1-0" {
-  source     = "../../../modules/compute-vm"
-  project_id = module.dev-spoke-project.project_id
-  zone       = "europe-west1-b"
-  name       = "test-vm-dev-ew1-0"
-  network_interfaces = [{
-    network = module.dev-spoke-vpc.self_link
-    # change the subnet name to match the values you are actually using
-    subnetwork = module.dev-spoke-vpc.subnet_self_links["europe-west1/dev-default-ew1"]
-    alias_ips  = {}
-    nat        = false
-    addresses  = null
-  }]
-  tags                   = ["ew1", "ssh"]
-  service_account_create = true
-  boot_disk = {
-    image = "projects/debian-cloud/global/images/family/debian-10"
-    type  = "pd-balanced"
-    size  = 10
-  }
-  metadata = {
-    startup-script = <<EOF
-      apt update
-      apt install iputils-ping bind9-dnsutils
-    EOF
-  }
-}
+# module "test-vm-dev-ew1-0" {
+#   source     = "../../../modules/compute-vm"
+#   project_id = module.dev-spoke-project.project_id
+#   zone       = "europe-west1-b"
+#   name       = "test-vm-dev-ew1-0"
+#   network_interfaces = [{
+#     network = module.dev-spoke-vpc.self_link
+#     # change the subnet name to match the values you are actually using
+#     subnetwork = module.dev-spoke-vpc.subnet_self_links["europe-west1/dev-default-ew1"]
+#     alias_ips  = {}
+#     nat        = false
+#     addresses  = null
+#   }]
+#   tags                   = ["ew1", "ssh"]
+#   service_account_create = true
+#   boot_disk = {
+#     image = "projects/debian-cloud/global/images/family/debian-10"
+#     type  = "pd-balanced"
+#     size  = 10
+#   }
+#   metadata = {
+#     startup-script = <<EOF
+#       apt update
+#       apt install iputils-ping bind9-dnsutils
+#     EOF
+#   }
+# }
 
 # module "test-vm-dev-ew4-0" {
 #   source     = "../../../modules/compute-vm"
@@ -188,33 +188,33 @@ module "test-vm-dev-ew1-0" {
 
 # Prod spoke
 
-module "test-vm-prod-ew1-0" {
-  source     = "../../../modules/compute-vm"
-  project_id = module.prod-spoke-project.project_id
-  zone       = "europe-west1-b"
-  name       = "test-vm-prod-ew1-0"
-  network_interfaces = [{
-    network = module.prod-spoke-vpc.self_link
-    # change the subnet name to match the values you are actually using
-    subnetwork = module.prod-spoke-vpc.subnet_self_links["europe-west1/prod-default-ew1"]
-    alias_ips  = {}
-    nat        = false
-    addresses  = null
-  }]
-  tags                   = ["ew1", "ssh"]
-  service_account_create = true
-  boot_disk = {
-    image = "projects/debian-cloud/global/images/family/debian-10"
-    type  = "pd-balanced"
-    size  = 10
-  }
-  metadata = {
-    startup-script = <<EOF
-      apt update
-      apt install iputils-ping bind9-dnsutils
-    EOF
-  }
-}
+# module "test-vm-prod-ew1-0" {
+#   source     = "../../../modules/compute-vm"
+#   project_id = module.prod-spoke-project.project_id
+#   zone       = "europe-west1-b"
+#   name       = "test-vm-prod-ew1-0"
+#   network_interfaces = [{
+#     network = module.prod-spoke-vpc.self_link
+#     # change the subnet name to match the values you are actually using
+#     subnetwork = module.prod-spoke-vpc.subnet_self_links["europe-west1/prod-default-ew1"]
+#     alias_ips  = {}
+#     nat        = false
+#     addresses  = null
+#   }]
+#   tags                   = ["ew1", "ssh"]
+#   service_account_create = true
+#   boot_disk = {
+#     image = "projects/debian-cloud/global/images/family/debian-10"
+#     type  = "pd-balanced"
+#     size  = 10
+#   }
+#   metadata = {
+#     startup-script = <<EOF
+#       apt update
+#       apt install iputils-ping bind9-dnsutils
+#     EOF
+#   }
+# }
 
 # module "test-vm-prod-ew4-0" {
 #   source     = "../../../modules/compute-vm"
diff --git a/fast/stages/02-networking-vpn/test-resources.tf b/fast/stages/02-networking-vpn/test-resources.tf
index e2550588e..8139e7551 100644
--- a/fast/stages/02-networking-vpn/test-resources.tf
+++ b/fast/stages/02-networking-vpn/test-resources.tf
@@ -16,85 +16,85 @@
 
 # tfdoc:file:description temporary instances for testing
 
-module "test-vm-landing-0" {
-  source     = "../../../modules/compute-vm"
-  project_id = module.landing-project.project_id
-  zone       = "europe-west1-b"
-  name       = "test-vm-0"
-  network_interfaces = [{
-    network    = module.landing-vpc.self_link
-    subnetwork = module.landing-vpc.subnet_self_links["europe-west1/landing-default-ew1"]
-    alias_ips  = {}
-    nat        = false
-    addresses  = null
-  }]
-  tags                   = ["ssh"]
-  service_account_create = true
-  boot_disk = {
-    image = "projects/debian-cloud/global/images/family/debian-10"
-    type  = "pd-balanced"
-    size  = 10
-  }
-  metadata = {
-    startup-script = <<EOF
-      apt update
-      apt install iputils-ping 	bind9-dnsutils
-    EOF
-  }
-}
+# module "test-vm-landing-0" {
+#   source     = "../../../modules/compute-vm"
+#   project_id = module.landing-project.project_id
+#   zone       = "europe-west1-b"
+#   name       = "test-vm-0"
+#   network_interfaces = [{
+#     network    = module.landing-vpc.self_link
+#     subnetwork = module.landing-vpc.subnet_self_links["europe-west1/landing-default-ew1"]
+#     alias_ips  = {}
+#     nat        = false
+#     addresses  = null
+#   }]
+#   tags                   = ["ssh"]
+#   service_account_create = true
+#   boot_disk = {
+#     image = "projects/debian-cloud/global/images/family/debian-10"
+#     type  = "pd-balanced"
+#     size  = 10
+#   }
+#   metadata = {
+#     startup-script = <<EOF
+#       apt update
+#       apt install iputils-ping 	bind9-dnsutils
+#     EOF
+#   }
+# }
 
-module "test-vm-dev-0" {
-  source     = "../../../modules/compute-vm"
-  project_id = module.dev-spoke-project.project_id
-  zone       = "europe-west1-b"
-  name       = "test-vm-0"
-  network_interfaces = [{
-    network = module.dev-spoke-vpc.self_link
-    # change the subnet name to match the values you are actually using
-    subnetwork = module.dev-spoke-vpc.subnet_self_links["europe-west1/dev-default-ew1"]
-    alias_ips  = {}
-    nat        = false
-    addresses  = null
-  }]
-  tags                   = ["ssh"]
-  service_account_create = true
-  boot_disk = {
-    image = "projects/debian-cloud/global/images/family/debian-10"
-    type  = "pd-balanced"
-    size  = 10
-  }
-  metadata = {
-    startup-script = <<EOF
-      apt update
-      apt install iputils-ping 	bind9-dnsutils
-    EOF
-  }
-}
+# module "test-vm-dev-0" {
+#   source     = "../../../modules/compute-vm"
+#   project_id = module.dev-spoke-project.project_id
+#   zone       = "europe-west1-b"
+#   name       = "test-vm-0"
+#   network_interfaces = [{
+#     network = module.dev-spoke-vpc.self_link
+#     # change the subnet name to match the values you are actually using
+#     subnetwork = module.dev-spoke-vpc.subnet_self_links["europe-west1/dev-default-ew1"]
+#     alias_ips  = {}
+#     nat        = false
+#     addresses  = null
+#   }]
+#   tags                   = ["ssh"]
+#   service_account_create = true
+#   boot_disk = {
+#     image = "projects/debian-cloud/global/images/family/debian-10"
+#     type  = "pd-balanced"
+#     size  = 10
+#   }
+#   metadata = {
+#     startup-script = <<EOF
+#       apt update
+#       apt install iputils-ping 	bind9-dnsutils
+#     EOF
+#   }
+# }
 
-module "test-vm-prod-0" {
-  source     = "../../../modules/compute-vm"
-  project_id = module.prod-spoke-project.project_id
-  zone       = "europe-west1-b"
-  name       = "test-vm-0"
-  network_interfaces = [{
-    network = module.prod-spoke-vpc.self_link
-    # change the subnet name to match the values you are actually using
-    subnetwork = module.prod-spoke-vpc.subnet_self_links["europe-west1/prod-default-ew1"]
-    alias_ips  = {}
-    nat        = false
-    addresses  = null
-  }]
-  tags                   = ["ssh"]
-  service_account_create = true
-  boot_disk = {
-    image = "projects/debian-cloud/global/images/family/debian-10"
-    type  = "pd-balanced"
-    size  = 10
-  }
-  metadata = {
-    startup-script = <<EOF
-      apt update
-      apt install iputils-ping 	bind9-dnsutils
-    EOF
-  }
-}
+# module "test-vm-prod-0" {
+#   source     = "../../../modules/compute-vm"
+#   project_id = module.prod-spoke-project.project_id
+#   zone       = "europe-west1-b"
+#   name       = "test-vm-0"
+#   network_interfaces = [{
+#     network = module.prod-spoke-vpc.self_link
+#     # change the subnet name to match the values you are actually using
+#     subnetwork = module.prod-spoke-vpc.subnet_self_links["europe-west1/prod-default-ew1"]
+#     alias_ips  = {}
+#     nat        = false
+#     addresses  = null
+#   }]
+#   tags                   = ["ssh"]
+#   service_account_create = true
+#   boot_disk = {
+#     image = "projects/debian-cloud/global/images/family/debian-10"
+#     type  = "pd-balanced"
+#     size  = 10
+#   }
+#   metadata = {
+#     startup-script = <<EOF
+#       apt update
+#       apt install iputils-ping 	bind9-dnsutils
+#     EOF
+#   }
+# }

From 26df0468b6581ca00c39a5c2bc7a57ffcb6e6645 Mon Sep 17 00:00:00 2001
From: Simone Ruffilli <sruffilli@google.com>
Date: Sun, 27 Feb 2022 10:57:21 +0100
Subject: [PATCH 2/2] Adds autohealing to NVA MIGs

---
 fast/stages/02-networking-nva/nva.tf | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/fast/stages/02-networking-nva/nva.tf b/fast/stages/02-networking-nva/nva.tf
index 64305e2cc..1bbc7f813 100644
--- a/fast/stages/02-networking-nva/nva.tf
+++ b/fast/stages/02-networking-nva/nva.tf
@@ -84,8 +84,18 @@ module "nva-mig-ew1" {
   project_id  = module.landing-project.project_id
   regional    = true
   location    = "europe-west1"
-  name        = "nva"
+  name        = "nva-ew1"
   target_size = 2
+  auto_healing_policies = {
+    health_check      = module.nva-mig-ew1.health_check.self_link
+    initial_delay_sec = 30
+  }
+  health_check_config = {
+    type    = "tcp"
+    check   = { port = 22 }
+    config  = {}
+    logging = true
+  }
   default_version = {
     instance_template = module.nva-template-ew1.template.self_link
     name              = "default"
@@ -182,8 +192,18 @@ module "nva-mig-ew4" {
   project_id  = module.landing-project.project_id
   regional    = true
   location    = "europe-west4"
-  name        = "nva"
+  name        = "nva-ew4"
   target_size = 2
+  auto_healing_policies = {
+    health_check      = module.nva-mig-ew4.health_check.self_link
+    initial_delay_sec = 30
+  }
+  health_check_config = {
+    type    = "tcp"
+    check   = { port = 22 }
+    config  = {}
+    logging = true
+  }
   default_version = {
     instance_template = module.nva-template-ew4.template.self_link
     name              = "default"