Add Hybrid NAT support (#2261)
* Updates to support hybid NAT * Fix readme * Fix variable order
This commit is contained in:
Julio Castillo
@@ -6,6 +6,7 @@ Simple Cloud NAT management, with optional router creation.
|
||||
- [Basic Example](#basic-example)
|
||||
- [Subnetwork configuration](#subnetwork-configuration)
|
||||
- [Reserved IPs and custom rules](#reserved-ips-and-custom-rules)
|
||||
- [Hybrid NAT](#hybrid-nat)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
<!-- END TOC -->
|
||||
@@ -102,6 +103,59 @@ module "nat" {
|
||||
}
|
||||
# tftest modules=2 resources=5 inventory=rules.yaml e2e
|
||||
```
|
||||
## Hybrid NAT
|
||||
```hcl
|
||||
module "vpc1" {
|
||||
source = "./fabric/modules/net-vpc"
|
||||
project_id = var.project_id
|
||||
name = "vpc1"
|
||||
subnets = [
|
||||
{
|
||||
ip_cidr_range = "10.0.0.0/24"
|
||||
name = "vpc1-subnet"
|
||||
region = var.region
|
||||
}
|
||||
]
|
||||
subnets_private_nat = [
|
||||
{
|
||||
ip_cidr_range = "192.168.15.0/24"
|
||||
name = "vpc1-nat"
|
||||
region = var.region
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
module "vpc1-nat" {
|
||||
source = "./fabric/modules/net-cloudnat"
|
||||
project_id = var.project_id
|
||||
region = var.region
|
||||
name = "vpc1-nat"
|
||||
type = "PRIVATE"
|
||||
router_network = module.vpc1.id
|
||||
config_source_subnetworks = {
|
||||
all = false
|
||||
subnetworks = [
|
||||
{
|
||||
self_link = module.vpc1.subnet_ids["${var.region}/vpc1-subnet"]
|
||||
}
|
||||
]
|
||||
}
|
||||
config_port_allocation = {
|
||||
enable_endpoint_independent_mapping = false
|
||||
enable_dynamic_port_allocation = true
|
||||
}
|
||||
rules = [
|
||||
{
|
||||
description = "private nat"
|
||||
match = "nexthop.is_hybrid"
|
||||
source_ranges = [
|
||||
module.vpc1.subnets_private_nat["${var.region}/vpc1-nat"].id
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
# tftest modules=2 resources=7 inventory=hybrid.yaml
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
@@ -111,15 +165,16 @@ module "nat" {
|
||||
| [project_id](variables.tf#L82) | Project where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L87) | Region where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [addresses](variables.tf#L17) | Optional list of external address self links. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [config_port_allocation](variables.tf#L23) | Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'. | <code title="object({ enable_endpoint_independent_mapping = optional(bool, true) enable_dynamic_port_allocation = optional(bool, false) min_ports_per_vm = optional(number, 64) max_ports_per_vm = optional(number, 65536) })">object({…})</code> | | <code>{}</code> |
|
||||
| [config_port_allocation](variables.tf#L23) | Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'. | <code title="object({ enable_endpoint_independent_mapping = optional(bool, true) enable_dynamic_port_allocation = optional(bool, false) min_ports_per_vm = optional(number) max_ports_per_vm = optional(number) })">object({…})</code> | | <code>{}</code> |
|
||||
| [config_source_subnetworks](variables.tf#L39) | Subnetwork configuration. | <code title="object({ all = optional(bool, true) primary_ranges_only = optional(bool) subnetworks = optional(list(object({ self_link = string all_ranges = optional(bool, true) secondary_ranges = optional(list(string)) })), []) })">object({…})</code> | | <code>{}</code> |
|
||||
| [config_timeouts](variables.tf#L58) | Timeout configurations. | <code title="object({ icmp = optional(number, 30) tcp_established = optional(number, 1200) tcp_time_wait = optional(number, 120) tcp_transitory = optional(number, 30) udp = optional(number, 30) })">object({…})</code> | | <code>{}</code> |
|
||||
| [config_timeouts](variables.tf#L58) | Timeout configurations. | <code title="object({ icmp = optional(number) tcp_established = optional(number) tcp_time_wait = optional(number) tcp_transitory = optional(number) udp = optional(number) })">object({…})</code> | | <code>{}</code> |
|
||||
| [logging_filter](variables.tf#L71) | Enables logging if not null, value is one of 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', 'ALL'. | <code>string</code> | | <code>null</code> |
|
||||
| [router_asn](variables.tf#L92) | Router ASN used for auto-created router. | <code>number</code> | | <code>null</code> |
|
||||
| [router_create](variables.tf#L98) | Create router. | <code>bool</code> | | <code>true</code> |
|
||||
| [router_name](variables.tf#L104) | Router name, leave blank if router will be created to use auto generated name. | <code>string</code> | | <code>null</code> |
|
||||
| [router_network](variables.tf#L110) | Name of the VPC used for auto-created router. | <code>string</code> | | <code>null</code> |
|
||||
| [rules](variables.tf#L116) | List of rules associated with this NAT. | <code title="list(object({ description = optional(string), match = string source_ips = list(string) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [rules](variables.tf#L116) | List of rules associated with this NAT. | <code title="list(object({ description = optional(string) match = string source_ips = optional(list(string)) source_ranges = optional(list(string)) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [type](variables.tf#L136) | Whether this Cloud NAT is used for public or private IP translation. One of 'PUBLIC' or 'PRIVATE'. | <code>string</code> | | <code>"PUBLIC"</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -47,13 +47,21 @@ resource "google_compute_router" "router" {
|
||||
}
|
||||
|
||||
resource "google_compute_router_nat" "nat" {
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
name = var.name
|
||||
router = local.router_name
|
||||
nat_ips = var.addresses
|
||||
provider = google-beta
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
name = var.name
|
||||
type = var.type
|
||||
router = local.router_name
|
||||
nat_ips = var.addresses
|
||||
nat_ip_allocate_option = (
|
||||
length(var.addresses) > 0 ? "MANUAL_ONLY" : "AUTO_ONLY"
|
||||
var.type == "PRIVATE"
|
||||
? null
|
||||
: (
|
||||
length(var.addresses) > 0
|
||||
? "MANUAL_ONLY"
|
||||
: "AUTO_ONLY"
|
||||
)
|
||||
)
|
||||
source_subnetwork_ip_ranges_to_nat = local.subnet_config
|
||||
icmp_idle_timeout_sec = var.config_timeouts.icmp
|
||||
@@ -114,7 +122,8 @@ resource "google_compute_router_nat" "nat" {
|
||||
description = rules.value.description
|
||||
match = rules.value.match
|
||||
action {
|
||||
source_nat_active_ips = rules.value.source_ips
|
||||
source_nat_active_ips = rules.value.source_ips
|
||||
source_nat_active_ranges = rules.value.source_ranges
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -25,8 +25,8 @@ variable "config_port_allocation" {
|
||||
type = object({
|
||||
enable_endpoint_independent_mapping = optional(bool, true)
|
||||
enable_dynamic_port_allocation = optional(bool, false)
|
||||
min_ports_per_vm = optional(number, 64)
|
||||
max_ports_per_vm = optional(number, 65536)
|
||||
min_ports_per_vm = optional(number)
|
||||
max_ports_per_vm = optional(number)
|
||||
})
|
||||
default = {}
|
||||
nullable = false
|
||||
@@ -58,11 +58,11 @@ output "foo" {
|
||||
variable "config_timeouts" {
|
||||
description = "Timeout configurations."
|
||||
type = object({
|
||||
icmp = optional(number, 30)
|
||||
tcp_established = optional(number, 1200)
|
||||
tcp_time_wait = optional(number, 120)
|
||||
tcp_transitory = optional(number, 30)
|
||||
udp = optional(number, 30)
|
||||
icmp = optional(number)
|
||||
tcp_established = optional(number)
|
||||
tcp_time_wait = optional(number)
|
||||
tcp_transitory = optional(number)
|
||||
udp = optional(number)
|
||||
})
|
||||
default = {}
|
||||
nullable = false
|
||||
@@ -116,10 +116,30 @@ variable "router_network" {
|
||||
variable "rules" {
|
||||
description = "List of rules associated with this NAT."
|
||||
type = list(object({
|
||||
description = optional(string),
|
||||
match = string
|
||||
source_ips = list(string)
|
||||
description = optional(string)
|
||||
match = string
|
||||
source_ips = optional(list(string))
|
||||
source_ranges = optional(list(string))
|
||||
}))
|
||||
default = []
|
||||
nullable = false
|
||||
validation {
|
||||
condition = alltrue([
|
||||
for r in var.rules :
|
||||
r.source_ips != null || r.source_ranges != null
|
||||
])
|
||||
|
||||
error_message = "All rules must specify either source_ips or source_ranges."
|
||||
}
|
||||
}
|
||||
|
||||
variable "type" {
|
||||
description = "Whether this Cloud NAT is used for public or private IP translation. One of 'PUBLIC' or 'PRIVATE'."
|
||||
type = string
|
||||
default = "PUBLIC"
|
||||
nullable = false
|
||||
validation {
|
||||
condition = var.type == "PUBLIC" || var.type == "PRIVATE"
|
||||
error_message = "Field type must be either PUBLIC or PRIVATE."
|
||||
}
|
||||
}
|
||||
|
||||
@@ -662,9 +662,10 @@ module "vpc" {
|
||||
| [shared_vpc_host](variables.tf#L238) | Enable shared VPC for this project. | <code>bool</code> | | <code>false</code> |
|
||||
| [shared_vpc_service_projects](variables.tf#L244) | Shared VPC service projects to register with this host. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [subnets](variables.tf#L250) | Subnet configuration. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) enable_private_access = optional(bool, true) flow_logs_config = optional(object({ aggregation_interval = optional(string) filter_expression = optional(string) flow_sampling = optional(number) metadata = optional(string) metadata_fields = optional(list(string)) })) ipv6 = optional(object({ access_type = optional(string, "INTERNAL") })) secondary_ip_ranges = optional(map(string)) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_proxy_only](variables.tf#L297) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) active = optional(bool, true) global = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_psc](variables.tf#L331) | List of subnets for Private Service Connect service producers. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [vpc_create](variables.tf#L363) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
|
||||
| [subnets_private_nat](variables.tf#L297) | List of private NAT subnets. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_proxy_only](variables.tf#L309) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) active = optional(bool, true) global = optional(bool, false) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnets_psc](variables.tf#L343) | List of subnets for Private Service Connect service producers. | <code title="list(object({ name = string ip_cidr_range = string region = string description = optional(string) iam = optional(map(list(string)), {}) iam_bindings = optional(map(object({ role = string members = list(string) condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) iam_bindings_additive = optional(map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) })), {}) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [vpc_create](variables.tf#L375) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
@@ -684,6 +685,7 @@ module "vpc" {
|
||||
| [subnet_secondary_ranges](outputs.tf#L122) | Map of subnet secondary ranges keyed by name. | |
|
||||
| [subnet_self_links](outputs.tf#L133) | Map of subnet self links keyed by name. | |
|
||||
| [subnets](outputs.tf#L142) | Subnet resources. | |
|
||||
| [subnets_proxy_only](outputs.tf#L151) | L7 ILB or L7 Regional LB subnet resources. | |
|
||||
| [subnets_psc](outputs.tf#L156) | Private Service Connect subnet resources. | |
|
||||
| [subnets_private_nat](outputs.tf#L151) | Private NAT subnet resources. | |
|
||||
| [subnets_proxy_only](outputs.tf#L156) | L7 ILB or L7 Regional LB subnet resources. | |
|
||||
| [subnets_psc](outputs.tf#L161) | Private Service Connect subnet resources. | |
|
||||
<!-- END TFDOC -->
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -148,6 +148,11 @@ output "subnets" {
|
||||
]
|
||||
}
|
||||
|
||||
output "subnets_private_nat" {
|
||||
description = "Private NAT subnet resources."
|
||||
value = { for k, v in google_compute_subnetwork.private_nat : k => v }
|
||||
}
|
||||
|
||||
output "subnets_proxy_only" {
|
||||
description = "L7 ILB or L7 Regional LB subnet resources."
|
||||
value = { for k, v in google_compute_subnetwork.proxy_only : k => v }
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -124,6 +124,10 @@ locals {
|
||||
{ for s in var.subnets_proxy_only : "${s.region}/${s.name}" => s },
|
||||
{ for k, v in local._factory_subnets : k => v if v._is_proxy_only },
|
||||
)
|
||||
subnets_private_nat = merge(
|
||||
{ for s in var.subnets_private_nat : "${s.region}/${s.name}" => s },
|
||||
# { for k, v in local._factory_subnets : k => v if v._is_proxy_only },
|
||||
)
|
||||
subnets_psc = merge(
|
||||
{ for s in var.subnets_psc : "${s.region}/${s.name}" => s },
|
||||
{ for k, v in local._factory_subnets : k => v if v._is_psc }
|
||||
@@ -185,6 +189,20 @@ resource "google_compute_subnetwork" "proxy_only" {
|
||||
role = each.value.active ? "ACTIVE" : "BACKUP"
|
||||
}
|
||||
|
||||
resource "google_compute_subnetwork" "private_nat" {
|
||||
for_each = local.subnets_private_nat
|
||||
project = var.project_id
|
||||
network = local.network.name
|
||||
name = each.value.name
|
||||
region = each.value.region
|
||||
ip_cidr_range = each.value.ip_cidr_range
|
||||
description = coalesce(
|
||||
each.value.description,
|
||||
"Terraform-managed private NAT subnet."
|
||||
)
|
||||
purpose = "PRIVATE_NAT"
|
||||
}
|
||||
|
||||
resource "google_compute_subnetwork" "psc" {
|
||||
for_each = local.subnets_psc
|
||||
project = var.project_id
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/**
|
||||
* Copyright 2023 Google LLC
|
||||
* Copyright 2024 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -294,6 +294,18 @@ variable "subnets" {
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "subnets_private_nat" {
|
||||
description = "List of private NAT subnets."
|
||||
type = list(object({
|
||||
name = string
|
||||
ip_cidr_range = string
|
||||
region = string
|
||||
description = optional(string)
|
||||
}))
|
||||
default = []
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "subnets_proxy_only" {
|
||||
description = "List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active."
|
||||
type = list(object({
|
||||
|
||||
Reference in New Issue
Block a user