diff --git a/blueprints/apigee/bigquery-analytics/main.tf b/blueprints/apigee/bigquery-analytics/main.tf index 68e672d25..d1149f8ce 100644 --- a/blueprints/apigee/bigquery-analytics/main.tf +++ b/blueprints/apigee/bigquery-analytics/main.tf @@ -287,7 +287,7 @@ resource "local_file" "create_datastore_file" { path = var.path }) filename = "${path.module}/create-datastore.sh" - file_permission = "0777" + file_permission = "0755" } resource "local_file" "deploy_apiproxy_file" { @@ -295,5 +295,5 @@ resource "local_file" "deploy_apiproxy_file" { org_name = module.apigee.org_name }) filename = "${path.module}/deploy-apiproxy.sh" - file_permission = "0777" + file_permission = "0755" } diff --git a/blueprints/apigee/hybrid-gke/ansible.tf b/blueprints/apigee/hybrid-gke/ansible.tf index b7694ab1f..e1f2f7186 100644 --- a/blueprints/apigee/hybrid-gke/ansible.tf +++ b/blueprints/apigee/hybrid-gke/ansible.tf @@ -27,7 +27,7 @@ resource "local_file" "vars_file" { ingress_ip_name = local.ingress_ip_name }) filename = "${path.module}/ansible/vars/vars.yaml" - file_permission = "0666" + file_permission = "0644" } resource "local_file" "gssh_file" { @@ -36,5 +36,5 @@ resource "local_file" "gssh_file" { zone = var.zone }) filename = "${path.module}/ansible/gssh.sh" - file_permission = "0777" + file_permission = "0755" } diff --git a/blueprints/apigee/hybrid-gke/apigee.tf b/blueprints/apigee/hybrid-gke/apigee.tf index b92592aab..c9c6b10d5 100644 --- a/blueprints/apigee/hybrid-gke/apigee.tf +++ b/blueprints/apigee/hybrid-gke/apigee.tf @@ -89,5 +89,5 @@ resource "local_file" "deploy_apiproxy_file" { org = module.project.project_id }) filename = "${path.module}/deploy-apiproxy.sh" - file_permission = "0777" + file_permission = "0755" } diff --git a/blueprints/apigee/network-patterns/nb-glb-psc-neg-sb-psc-ilbl7-hybrid-neg/apiproxy.tf b/blueprints/apigee/network-patterns/nb-glb-psc-neg-sb-psc-ilbl7-hybrid-neg/apiproxy.tf index a94b11eec..c65e08df6 100644 --- a/blueprints/apigee/network-patterns/nb-glb-psc-neg-sb-psc-ilbl7-hybrid-neg/apiproxy.tf +++ b/blueprints/apigee/network-patterns/nb-glb-psc-neg-sb-psc-ilbl7-hybrid-neg/apiproxy.tf @@ -37,5 +37,5 @@ resource "local_file" "deploy_apiproxy_file" { environment = local.environment }) filename = "${path.module}/deploy-apiproxy.sh" - file_permission = "0777" + file_permission = "0755" } diff --git a/blueprints/cloud-operations/adfs/main.tf b/blueprints/cloud-operations/adfs/main.tf index 0a35a90af..b05d09aa3 100644 --- a/blueprints/cloud-operations/adfs/main.tf +++ b/blueprints/cloud-operations/adfs/main.tf @@ -130,7 +130,7 @@ resource "local_file" "vars_file" { adfs_dns_domain_name = var.adfs_dns_domain_name }) filename = "${path.module}/ansible/vars/vars.yaml" - file_permission = "0666" + file_permission = "0644" } resource "local_file" "gssh_file" { @@ -139,5 +139,5 @@ resource "local_file" "gssh_file" { project_id = var.project_id }) filename = "${path.module}/ansible/gssh.sh" - file_permission = "0777" + file_permission = "0755" } diff --git a/blueprints/gke/autopilot/ansible.tf b/blueprints/gke/autopilot/ansible.tf index 393d6009e..091079d3d 100644 --- a/blueprints/gke/autopilot/ansible.tf +++ b/blueprints/gke/autopilot/ansible.tf @@ -24,7 +24,7 @@ resource "local_file" "vars_file" { app_url = local.urls["app"] }) filename = "${path.module}/ansible/vars/vars.yaml" - file_permission = "0666" + file_permission = "0644" } resource "local_file" "gssh_file" { @@ -33,5 +33,5 @@ resource "local_file" "gssh_file" { zone = local.zone }) filename = "${path.module}/ansible/gssh.sh" - file_permission = "0777" + file_permission = "0755" } diff --git a/blueprints/gke/binauthz/main.tf b/blueprints/gke/binauthz/main.tf index 77f7f0e42..2592266d0 100644 --- a/blueprints/gke/binauthz/main.tf +++ b/blueprints/gke/binauthz/main.tf @@ -260,7 +260,7 @@ resource "local_file" "app_file" { image = local.image }) filename = "${path.module}/app/app.yaml" - file_permission = "0666" + file_permission = "0644" } resource "local_file" "rbac_file" { @@ -269,5 +269,5 @@ resource "local_file" "rbac_file" { google_sa = module.app_cb_sa.email }) filename = "${path.module}/tenant-setup.yaml" - file_permission = "0666" + file_permission = "0644" } diff --git a/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible.tf b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible.tf index b239bf094..5f11b4235 100644 --- a/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible.tf +++ b/blueprints/gke/multi-cluster-mesh-gke-fleet-api/ansible.tf @@ -25,7 +25,7 @@ resource "local_file" "vars_file" { project_id = module.fleet_project.project_id }) filename = "${path.module}/ansible/vars/vars.yaml" - file_permission = "0666" + file_permission = "0644" } resource "local_file" "gssh_file" { @@ -34,5 +34,5 @@ resource "local_file" "gssh_file" { zone = var.mgmt_server_config.zone }) filename = "${path.module}/ansible/gssh.sh" - file_permission = "0777" + file_permission = "0755" } diff --git a/modules/cloud-config-container/simple-nva/README.md b/modules/cloud-config-container/simple-nva/README.md index 08a5cd1b9..3fb279c80 100644 --- a/modules/cloud-config-container/simple-nva/README.md +++ b/modules/cloud-config-container/simple-nva/README.md @@ -1,8 +1,14 @@ # Google Simple NVA Module -This module allows for the creation of a NVA (Network Virtual Appliance) to be used for experiments and as a stub for future appliances deployment. +The module allows you to create Network Virtual Appliances (NVAs) as a stub for future appliances deployments. -This NVA can be used to interconnect up to 8 VPCs. +This NVAs can be used to interconnect up to 8 VPCs. + +The NVAs run [Container-Optimized OS (COS)](https://cloud.google.com/container-optimized-os/docs). COS is a Linux-based OS designed for running containers. By default, it only allows SSH ingress connections. To see the exact host firewall configuration, run `sudo iptables -L -v`. More info available in the [official](https://cloud.google.com/container-optimized-os/docs/how-to/firewall) documentation. + +To configure the firewall, you can either +- use the [open_ports](variables.tf#L84) variable +- for a thiner grain control, pass a custom bash script at startup with iptables commands ## Examples @@ -65,10 +71,9 @@ module "vm" { # tftest modules=1 resources=1 ``` -### Example with advanced routing capabilities +### Example with advanced routing capabilities (FRR) -Find below a sample terraform example for bootstrapping a simple NVA powered by [COS](https://cloud.google.com/container-optimized-os/docs) and running [FRRouting](https://frrouting.org/) container. -Please find below a sample frr.conf file based on the documentation available [here](https://docs.frrouting.org/en/latest/basic.html) for hosting a BGP service with ASN 65001 on FRR container establishing a BGP session with a remote neighbor with IP address 10.128.0.2 and ASN 65002. +The sample code brings up [FRRouting](https://frrouting.org/) container. ``` # tftest-file id=frr_conf path=./frr.conf @@ -112,7 +117,7 @@ module "cos-nva" { enable_health_checks = true network_interfaces = local.network_interfaces frr_config = { config_file = "./frr.conf", daemons_enabled = ["bgpd"] } - optional_run_cmds = ["ls -l"] + run_cmds = ["ls -l"] } module "vm" { @@ -134,6 +139,20 @@ module "vm" { } # tftest modules=1 resources=1 files=frr_conf ``` + +The FRR container is managed as a systemd service. To interact with the service, use the standard systemd commands: `sudo systemctl {start|stop|restart} frr`. + +To interact with the FRR CLI run: + +```shell +# get the container ID +CONTAINER_ID =`sudo docker ps -a -q` +sudo docker exec -it $CONTAINER_ID vtysh +``` + +Check FRR running configuration with `show running-config` from vtysh. Please always refer to the official documentation for more information how to deal with vtysh and useful commands. + +Sample frr.conf file is based on the documentation available [here](https://docs.frrouting.org/en/latest/basic.html). It configures a BGP service with ASN 65001 on FRR container establishing a BGP session with a remote neighbor with IP address 10.128.0.2 and ASN 65002. Check BGP status for FRR with `show bgp summary` from vtysh. ## Variables @@ -145,7 +164,8 @@ module "vm" { | [enable_health_checks](variables.tf#L23) | Configures routing to enable responses to health check probes. | bool | | false | | [files](variables.tf#L29) | Map of extra files to create on the instance, path as key. Owner and permissions will use defaults if null. | map(object({…})) | | {} | | [frr_config](variables.tf#L39) | FRR configuration for container running on the NVA. | object({…}) | | null | -| [optional_run_cmds](variables.tf#L84) | Optional Cloud Init run commands to execute. | list(string) | | [] | +| [open_ports](variables.tf#L84) | Optional firewall ports to open. | object({…}) | | {…} | +| [run_cmds](variables.tf#L96) | Optional cloud init run commands to execute. | list(string) | | [] | ## Outputs diff --git a/modules/cloud-config-container/simple-nva/cloud-config.yaml b/modules/cloud-config-container/simple-nva/cloud-config.yaml index 521acd8fc..328ace7e2 100644 --- a/modules/cloud-config-container/simple-nva/cloud-config.yaml +++ b/modules/cloud-config-container/simple-nva/cloud-config.yaml @@ -55,6 +55,12 @@ write_files: ip route add ${route} via `curl http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/${interface.number}/gateway -H "Metadata-Flavor:Google"` dev ${interface.name} %{ endfor ~} %{ endfor ~} +%{ for port in open_tcp_ports ~} + iptables -A INPUT -p tcp --dport ${port} -j ACCEPT +%{ endfor ~} +%{ for port in open_udp_ports ~} + iptables -A INPUT -p udp --dport ${port} -j ACCEPT +%{ endfor ~} bootcmd: - systemctl start node-problem-detector @@ -63,6 +69,6 @@ runcmd: - systemctl daemon-reload - systemctl enable routing - systemctl start routing -%{ for cmd in optional_run_cmds ~} +%{ for cmd in run_cmds ~} - ${cmd} %{ endfor ~} diff --git a/modules/cloud-config-container/simple-nva/main.tf b/modules/cloud-config-container/simple-nva/main.tf index 1fc1b540e..3094dc9f3 100644 --- a/modules/cloud-config-container/simple-nva/main.tf +++ b/modules/cloud-config-container/simple-nva/main.tf @@ -67,29 +67,29 @@ locals { } : {} ) - _frr_daemons = [ - "zebra", - "bgpd", - "ospfd", - "ospf6d", - "ripd", - "ripngd", - "isisd", - "pimd", - "ldpd", - "nhrpd", - "eigrpd", - "babeld", - "sharpd", - "staticd", - "pbrd", - "bfdd", - "fabricd" - ] + _frr_daemons = { + "zebra" : { tcp = [], udp = [] } + "bgpd" : { tcp = ["179"], udp = [] } + "ospfd" : { tcp = [], udp = [] } + "ospf6d" : { tcp = [], udp = [] } + "ripd" : { tcp = [], udp = ["520"] } + "ripngd" : { tcp = [], udp = ["521"] } + "isisd" : { tcp = [], udp = [] } + "pimd" : { tcp = [], udp = [] } + "ldpd" : { tcp = ["646"], udp = ["646"] } + "nhrpd" : { tcp = [], udp = [] } + "eigrpd" : { tcp = [], udp = [] } + "babeld" : { tcp = [], udp = [] } + "sharpd" : { tcp = [], udp = [] } + "staticd" : { tcp = [], udp = [] } + "pbrd" : { tcp = [], udp = [] } + "bfdd" : { tcp = [], udp = ["3784"] } + "fabricd" : { tcp = [], udp = [] } + } _frr_daemons_enabled = try( { - for daemon in local._frr_daemons : + for daemon in keys(local._frr_daemons) : "${daemon}_enabled" => contains(var.frr_config.daemons_enabled, daemon) ? "yes" : "no" }, {}) @@ -103,22 +103,34 @@ locals { } ] - _optional_run_cmds = ( + _run_cmds = ( try(var.frr_config != null, false) - ? concat(["systemctl start frr"], var.optional_run_cmds) - : var.optional_run_cmds + ? concat(["systemctl start frr"], var.run_cmds) + : var.run_cmds ) + _tcp_ports = concat(flatten(try( + [ + for daemon, ports in local._frr_daemons : contains(var.frr_config.daemons_enabled, daemon) ? ports.tcp : [] + ], [])), var.open_ports.tcp) + _template = ( var.cloud_config == null ? "${path.module}/cloud-config.yaml" : var.cloud_config ) + _udp_ports = concat(flatten(try( + [ + for daemon, ports in local._frr_daemons : contains(var.frr_config.daemons_enabled, daemon) ? ports.udp : [] + ], [])), var.open_ports.udp) + cloud_config = templatefile(local._template, { enable_health_checks = var.enable_health_checks files = local._files network_interfaces = local._network_interfaces - optional_run_cmds = local._optional_run_cmds + open_tcp_ports = local._tcp_ports + open_udp_ports = local._udp_ports + run_cmds = local._run_cmds }) } diff --git a/modules/cloud-config-container/simple-nva/variables.tf b/modules/cloud-config-container/simple-nva/variables.tf index 8ff770b2e..20eecd0ab 100644 --- a/modules/cloud-config-container/simple-nva/variables.tf +++ b/modules/cloud-config-container/simple-nva/variables.tf @@ -81,8 +81,20 @@ variable "network_interfaces" { })) } -variable "optional_run_cmds" { - description = "Optional Cloud Init run commands to execute." +variable "open_ports" { + description = "Optional firewall ports to open." + type = object({ + tcp = list(string) + udp = list(string) + }) + default = { + tcp = [] + udp = [] + } +} + +variable "run_cmds" { + description = "Optional cloud init run commands to execute." type = list(string) default = [] }