Add ability to autogenerate md5 keys in net-vpn-ha (#2748)
* Add ability to optionally generate MD5 secrets in VPN module * Add ability to autogenerate MD5 keys in net-vpn-ha module * restore missing output * fix test counts --------- Co-authored-by: Luca Prete <lucaprete@google.com> Co-authored-by: Ludovico Magnocavallo <ludomagno@google.com>
This commit is contained in:
Luca Prete
@@ -62,7 +62,7 @@ module "vpn-2" {
|
||||
asn = 64514
|
||||
}
|
||||
bgp_session_range = "169.254.1.1/30"
|
||||
shared_secret = module.vpn-1.random_secret
|
||||
shared_secret = module.vpn-1.shared_secrets["remote-0"]
|
||||
vpn_gateway_interface = 0
|
||||
}
|
||||
remote-1 = {
|
||||
@@ -71,12 +71,12 @@ module "vpn-2" {
|
||||
asn = 64514
|
||||
}
|
||||
bgp_session_range = "169.254.2.1/30"
|
||||
shared_secret = module.vpn-1.random_secret
|
||||
shared_secret = module.vpn-1.shared_secrets["remote-1"]
|
||||
vpn_gateway_interface = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=18 inventory=gcp-to-gcp.yaml
|
||||
# tftest modules=2 resources=22 inventory=gcp-to-gcp.yaml
|
||||
```
|
||||
|
||||
Note: When using the `for_each` meta-argument you might experience a Cycle Error due to the multiple `net-vpn-ha` modules referencing each other. To fix this you can create the [google_compute_ha_vpn_gateway](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_ha_vpn_gateway) resources separately and reference them in the `net-vpn-ha` module via the `vpn_gateway` and `peer_gcp_gateway` variables.
|
||||
@@ -146,7 +146,7 @@ module "vpn_ha" {
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=10 inventory=gcp-to-onprem.yaml
|
||||
# tftest modules=1 resources=12 inventory=gcp-to-onprem.yaml
|
||||
```
|
||||
|
||||
### IPv6 (dual-stack)
|
||||
@@ -200,8 +200,10 @@ module "vpn_ha" {
|
||||
stack_type = "IPV4_IPV6"
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=10 intentory=ipv6.yaml
|
||||
# tftest modules=1 resources=12 intentory=ipv6.yaml
|
||||
```
|
||||
|
||||
You can optionally avoid to specify MD5 keys and the module will automatically generate them for you.
|
||||
<!-- BEGIN TFDOC -->
|
||||
## Variables
|
||||
|
||||
@@ -213,7 +215,7 @@ module "vpn_ha" {
|
||||
| [region](variables.tf#L53) | Region used for resources. | <code>string</code> | ✓ | |
|
||||
| [router_config](variables.tf#L58) | Cloud Router configuration for the VPN. If you want to reuse an existing router, set create to false and use name to specify the desired router. | <code title="object({ asn = number create = optional(bool, true) custom_advertise = optional(object({ all_subnets = bool ip_ranges = map(string) })) keepalive = optional(number) name = optional(string) override_name = optional(string) })">object({…})</code> | ✓ | |
|
||||
| [peer_gateways](variables.tf#L27) | Configuration of the (external or GCP) peer gateway. | <code title="map(object({ external = optional(object({ redundancy_type = string interfaces = list(string) description = optional(string, "Terraform managed external VPN gateway") name = optional(string) })) gcp = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tunnels](variables.tf#L74) | VPN tunnel configurations. | <code title="map(object({ bgp_peer = object({ address = string asn = number route_priority = optional(number, 1000) custom_advertise = optional(object({ all_subnets = bool ip_ranges = map(string) })) md5_authentication_key = optional(object({ name = string key = string })) ipv6 = optional(object({ nexthop_address = optional(string) peer_nexthop_address = optional(string) })) name = optional(string) }) bgp_session_range = string ike_version = optional(number, 2) name = optional(string) peer_external_gateway_interface = optional(number) peer_router_interface_name = optional(string) peer_gateway = optional(string, "default") router = optional(string) shared_secret = optional(string) vpn_gateway_interface = number }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tunnels](variables.tf#L74) | VPN tunnel configurations. | <code title="map(object({ bgp_peer = object({ address = string asn = number route_priority = optional(number, 1000) custom_advertise = optional(object({ all_subnets = bool ip_ranges = map(string) })) md5_authentication_key = optional(object({ name = string key = optional(string) })) ipv6 = optional(object({ nexthop_address = optional(string) peer_nexthop_address = optional(string) })) name = optional(string) }) bgp_session_range = string ike_version = optional(number, 2) name = optional(string) peer_external_gateway_interface = optional(number) peer_router_interface_name = optional(string) peer_gateway = optional(string, "default") router = optional(string) shared_secret = optional(string) vpn_gateway_interface = number }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [vpn_gateway](variables.tf#L111) | HA VPN Gateway Self Link for using an existing HA VPN Gateway. Ignored if `vpn_gateway_create` is set to `true`. | <code>string</code> | | <code>null</code> |
|
||||
| [vpn_gateway_create](variables.tf#L117) | Create HA VPN Gateway. Set to null to avoid creation. | <code title="object({ description = optional(string, "Terraform managed external VPN gateway") ipv6 = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
|
||||
@@ -225,12 +227,14 @@ module "vpn_ha" {
|
||||
| [external_gateway](outputs.tf#L25) | External VPN gateway resource. | |
|
||||
| [gateway](outputs.tf#L30) | VPN gateway resource (only if auto-created). | |
|
||||
| [id](outputs.tf#L35) | Fully qualified VPN gateway id. | |
|
||||
| [name](outputs.tf#L42) | VPN gateway name (only if auto-created). . | |
|
||||
| [random_secret](outputs.tf#L47) | Generated secret. | |
|
||||
| [router](outputs.tf#L52) | Router resource (only if auto-created). | |
|
||||
| [router_name](outputs.tf#L57) | Router name. | |
|
||||
| [self_link](outputs.tf#L62) | HA VPN gateway self link. | |
|
||||
| [tunnel_names](outputs.tf#L67) | VPN tunnel names. | |
|
||||
| [tunnel_self_links](outputs.tf#L75) | VPN tunnel self links. | |
|
||||
| [tunnels](outputs.tf#L83) | VPN tunnel resources. | |
|
||||
| [md5_keys](outputs.tf#L42) | BGP tunnels MD5 keys. | |
|
||||
| [name](outputs.tf#L53) | VPN gateway name (only if auto-created). | |
|
||||
| [random_secret](outputs.tf#L58) | Generated secret. | |
|
||||
| [router](outputs.tf#L63) | Router resource (only if auto-created). | |
|
||||
| [router_name](outputs.tf#L68) | Router name. | |
|
||||
| [self_link](outputs.tf#L73) | HA VPN gateway self link. | |
|
||||
| [shared_secrets](outputs.tf#L78) | IPSEC tunnels shared secrets. | |
|
||||
| [tunnel_names](outputs.tf#L86) | VPN tunnel names. | |
|
||||
| [tunnel_self_links](outputs.tf#L94) | VPN tunnel self links. | |
|
||||
| [tunnels](outputs.tf#L102) | VPN tunnel resources. | |
|
||||
<!-- END TFDOC -->
|
||||
|
||||
Reference in New Issue
Block a user