Refactor onprem VPN vars (#453)
* refactor onprem VPN vars * tfdoc * tfdoc
This commit is contained in:
Ludovico Magnocavallo
committed by
GitHub
GitHub
parent
3717548c25
commit
d8d41638a4
@@ -309,20 +309,20 @@ DNS configurations are centralised in the `dns.tf` file. Spokes delegate DNS res
|
||||
| name | description | type | required | default | producer |
|
||||
|---|---|:---:|:---:|:---:|:---:|
|
||||
| [billing_account_id](variables.tf#L17) | Billing account id. | <code>string</code> | ✓ | | <code>00-bootstrap</code> |
|
||||
| [organization](variables.tf#L99) | Organization details. | <code title="object({ domain = string id = number customer_id = string })">object({…})</code> | ✓ | | <code>00-bootstrap</code> |
|
||||
| [prefix](variables.tf#L115) | Prefix used for resources that need unique names. | <code>string</code> | ✓ | | <code>00-bootstrap</code> |
|
||||
| [custom_adv](variables.tf#L23) | Custom advertisement definitions in name => range format. | <code>map(string)</code> | | <code title="{ cloud_dns = "35.199.192.0/19" googleapis_private = "199.36.153.8/30" googleapis_restricted = "199.36.153.4/30" rfc_1918_10 = "10.0.0.0/8" rfc_1918_172 = "172.16.0.0/16" rfc_1918_192 = "192.168.0.0/16" landing_ew1 = "10.128.0.0/16" landing_ew4 = "10.129.0.0/16" spoke_prod_ew1 = "10.136.0.0/16" spoke_prod_ew4 = "10.137.0.0/16" spoke_dev_ew1 = "10.144.0.0/16" spoke_dev_ew4 = "10.145.0.0/16" }">{…}</code> | |
|
||||
| [data_dir](variables.tf#L42) | Relative path for the folder storing configuration data for network resources. | <code>string</code> | | <code>"data"</code> | |
|
||||
| [dns](variables.tf#L48) | Onprem DNS resolvers | <code>map(list(string))</code> | | <code title="{ onprem = ["10.0.200.3"] }">{…}</code> | |
|
||||
| [folder_id](variables.tf#L56) | Folder to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | <code>string</code> | | <code>null</code> | <code>01-resman</code> |
|
||||
| [gke](variables.tf#L70) | | <code title="map(object({ folder_id = string sa = string gcs = string }))">map(object({…}))</code> | | <code>{}</code> | <code>01-resman</code> |
|
||||
| [l7ilb_subnets](variables.tf#L81) | Subnets used for L7 ILBs. | <code title="map(list(object({ ip_cidr_range = string region = string })))">map(list(object({…})))</code> | | <code title="{ prod = [ { ip_cidr_range = "10.136.240.0/24", region = "europe-west1" }, { ip_cidr_range = "10.137.240.0/24", region = "europe-west4" } ] dev = [ { ip_cidr_range = "10.144.240.0/24", region = "europe-west1" }, { ip_cidr_range = "10.145.240.0/24", region = "europe-west4" } ] }">{…}</code> | |
|
||||
| [outputs_location](variables.tf#L109) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> | | <code>null</code> | |
|
||||
| [project_factory_sa](variables.tf#L121) | IAM emails for project factory service accounts | <code>map(string)</code> | | <code>{}</code> | <code>01-resman</code> |
|
||||
| [psa_ranges](variables.tf#L128) | IP ranges used for Private Service Access (e.g. CloudSQL). | <code>map(map(string))</code> | | <code title="{ prod = { cloudsql-mysql = "10.136.250.0/24" cloudsql-sqlserver = "10.136.251.0/24" } dev = { cloudsql-mysql = "10.144.250.0/24" cloudsql-sqlserver = "10.144.251.0/24" } }">{…}</code> | |
|
||||
| [router_configs](variables.tf#L143) | Configurations for CRs and onprem routers. | <code title="map(object({ adv = object({ custom = list(string) default = bool }) asn = number }))">map(object({…}))</code> | | <code title="{ onprem-ew1 = { asn = "65534" adv = null } landing-ew1 = { asn = "64512", adv = null } landing-ew4 = { asn = "64512", adv = null } spoke-dev-ew1 = { asn = "64513", adv = null } spoke-dev-ew4 = { asn = "64513", adv = null } spoke-prod-ew1 = { asn = "64514", adv = null } spoke-prod-ew4 = { asn = "64514", adv = null } }">{…}</code> | |
|
||||
| [vpn_onprem_configs](variables.tf#L167) | VPN gateway configuration for onprem interconnection. | <code title="map(object({ adv = object({ default = bool custom = list(string) }) session_range = string peer = object({ address = string asn = number secret_id = string }) }))">map(object({…}))</code> | | <code title="{ landing-ew1 = { adv = { default = false custom = [ "cloud_dns", "googleapis_restricted", "googleapis_private", "landing_ew1", "landing_ew4", "spoke_prod_ew1", "spoke_prod_ew4", "spoke_dev_ew1", "spoke_dev_ew4" ] } session_range = "169.254.1.0/29" peer = { address = "8.8.8.8" asn = 65534 secret_id = "foobar" } } }">{…}</code> | |
|
||||
| [vpn_spoke_configs](variables.tf#L207) | VPN gateway configuration for spokes. | <code title="map(object({ adv = object({ default = bool custom = list(string) }) session_range = string }))">map(object({…}))</code> | | <code title="{ landing-ew1 = { adv = { default = false custom = ["rfc_1918_10", "rfc_1918_172", "rfc_1918_192"] } session_range = null # values for the landing router are pulled from the spoke range } landing-ew4 = { adv = { default = false custom = ["rfc_1918_10", "rfc_1918_172", "rfc_1918_192"] } session_range = null # values for the landing router are pulled from the spoke range } dev-ew1 = { adv = { default = false custom = ["spoke_dev_ew1", "spoke_dev_ew4"] } session_range = "169.254.0.0/27" # resize according to required number of tunnels } prod-ew1 = { adv = { default = false custom = ["spoke_prod_ew1", "spoke_prod_ew4"] } session_range = "169.254.0.64/27" # resize according to required number of tunnels } prod-ew4 = { adv = { default = false custom = ["spoke_prod_ew1", "spoke_prod_ew4"] } session_range = "169.254.0.96/27" # resize according to required number of tunnels } }">{…}</code> | |
|
||||
| [organization](variables.tf#L97) | Organization details. | <code title="object({ domain = string id = number customer_id = string })">object({…})</code> | ✓ | | <code>00-bootstrap</code> |
|
||||
| [prefix](variables.tf#L113) | Prefix used for resources that need unique names. | <code>string</code> | ✓ | | <code>00-bootstrap</code> |
|
||||
| [custom_adv](variables.tf#L23) | Custom advertisement definitions in name => range format. | <code>map(string)</code> | | <code title="{ cloud_dns = "35.199.192.0/19" gcp_all = "10.128.0.0/16" gcp_dev = "10.128.32.0/19" gcp_landing = "10.128.0.0/19" gcp_prod = "10.128.0.0/18" googleapis_private = "199.36.153.8/30" googleapis_restricted = "199.36.153.4/30" rfc_1918_10 = "10.0.0.0/8" rfc_1918_172 = "172.16.0.0/16" rfc_1918_192 = "192.168.0.0/16" }">{…}</code> | |
|
||||
| [data_dir](variables.tf#L40) | Relative path for the folder storing configuration data for network resources. | <code>string</code> | | <code>"data"</code> | |
|
||||
| [dns](variables.tf#L46) | Onprem DNS resolvers | <code>map(list(string))</code> | | <code title="{ onprem = ["10.0.200.3"] }">{…}</code> | |
|
||||
| [folder_id](variables.tf#L54) | Folder to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | <code>string</code> | | <code>null</code> | <code>01-resman</code> |
|
||||
| [gke](variables.tf#L68) | | <code title="map(object({ folder_id = string sa = string gcs = string }))">map(object({…}))</code> | | <code>{}</code> | <code>01-resman</code> |
|
||||
| [l7ilb_subnets](variables.tf#L79) | Subnets used for L7 ILBs. | <code title="map(list(object({ ip_cidr_range = string region = string })))">map(list(object({…})))</code> | | <code title="{ prod = [ { ip_cidr_range = "10.136.240.0/24", region = "europe-west1" }, { ip_cidr_range = "10.137.240.0/24", region = "europe-west4" } ] dev = [ { ip_cidr_range = "10.144.240.0/24", region = "europe-west1" }, { ip_cidr_range = "10.145.240.0/24", region = "europe-west4" } ] }">{…}</code> | |
|
||||
| [outputs_location](variables.tf#L107) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | <code>string</code> | | <code>null</code> | |
|
||||
| [project_factory_sa](variables.tf#L119) | IAM emails for project factory service accounts | <code>map(string)</code> | | <code>{}</code> | <code>01-resman</code> |
|
||||
| [psa_ranges](variables.tf#L126) | IP ranges used for Private Service Access (e.g. CloudSQL). | <code>map(map(string))</code> | | <code title="{ prod = { cloudsql-mysql = "10.136.250.0/24" cloudsql-sqlserver = "10.136.251.0/24" } dev = { cloudsql-mysql = "10.144.250.0/24" cloudsql-sqlserver = "10.144.251.0/24" } }">{…}</code> | |
|
||||
| [router_configs](variables.tf#L141) | Configurations for CRs and onprem routers. | <code title="map(object({ adv = object({ custom = list(string) default = bool }) asn = number }))">map(object({…}))</code> | | <code title="{ onprem-ew1 = { asn = "65534" adv = null } landing-ew1 = { asn = "64512", adv = null } landing-ew4 = { asn = "64512", adv = null } spoke-dev-ew1 = { asn = "64513", adv = null } spoke-dev-ew4 = { asn = "64513", adv = null } spoke-prod-ew1 = { asn = "64514", adv = null } spoke-prod-ew4 = { asn = "64514", adv = null } }">{…}</code> | |
|
||||
| [vpn_onprem_configs](variables.tf#L165) | VPN gateway configuration for onprem interconnection. | <code title="map(object({ adv = object({ default = bool custom = list(string) }) peer_external_gateway = object({ redundancy_type = string interfaces = list(object({ id = number ip_address = string })) }) tunnels = list(object({ peer_asn = number secret = string session_range = string vpn_gateway_interface = number })) }))">map(object({…}))</code> | | <code title="{ landing-ew1 = { adv = { default = false custom = [ "cloud_dns", "googleapis_private", "googleapis_restricted", "gcp_all" ] } peer_external_gateway = { redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT" interfaces = [ { id = 0, ip_address = "8.8.8.8" }, ] } tunnels = [ { peer_asn = 65534 secret = "foobar" session_range = "169.254.1.0/30" vpn_gateway_interface = 0 }, { peer_asn = 65534 secret = "foobar" session_range = "169.254.1.4/30" vpn_gateway_interface = 1 } ] } }">{…}</code> | |
|
||||
| [vpn_spoke_configs](variables.tf#L218) | VPN gateway configuration for spokes. | <code title="map(object({ adv = object({ default = bool custom = list(string) }) session_range = string }))">map(object({…}))</code> | | <code title="{ landing-ew1 = { adv = { default = false custom = ["rfc_1918_10", "rfc_1918_172", "rfc_1918_192"] } session_range = null } landing-ew4 = { adv = { default = false custom = ["rfc_1918_10", "rfc_1918_172", "rfc_1918_192"] } session_range = null } dev-ew1 = { adv = { default = false custom = ["gcp_dev"] } session_range = "169.254.0.0/27" } prod-ew1 = { adv = { default = false custom = ["gcp_prod"] } session_range = "169.254.0.64/27" } prod-ew4 = { adv = { default = false custom = ["gcp_prod"] } session_range = "169.254.0.96/27" } }">{…}</code> | |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# skip boilerplate check
|
||||
|
||||
region: europe-west1
|
||||
ip_cidr_range: 10.144.0.0/24
|
||||
ip_cidr_range: 10.128.16.0/24
|
||||
description: Default subnet for dev
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
# skip boilerplate check
|
||||
|
||||
region: europe-west1
|
||||
ip_cidr_range: 10.136.0.0/24
|
||||
ip_cidr_range: 10.128.128.0/24
|
||||
description: Default subnet for prod
|
||||
|
||||
@@ -20,32 +20,21 @@ locals {
|
||||
# define the structures used for BGP peers in the VPN resources
|
||||
bgp_peer_options = {
|
||||
for k, v in var.vpn_spoke_configs :
|
||||
k => var.vpn_spoke_configs[k].adv == null ? null : {
|
||||
k => v.adv == null ? null : {
|
||||
advertise_groups = []
|
||||
advertise_ip_ranges = {
|
||||
for adv in(var.vpn_spoke_configs[k].adv == null ? [] : var.vpn_spoke_configs[k].adv.custom) :
|
||||
for adv in(v.adv == null ? [] : v.adv.custom) :
|
||||
var.custom_adv[adv] => adv
|
||||
}
|
||||
advertise_mode = try(var.vpn_spoke_configs[k].adv.default, false) ? "DEFAULT" : "CUSTOM"
|
||||
advertise_mode = try(v.adv.default, false) ? "DEFAULT" : "CUSTOM"
|
||||
route_priority = null
|
||||
}
|
||||
}
|
||||
bgp_peer_options_onprem = {
|
||||
for k, v in var.vpn_onprem_configs :
|
||||
k => var.vpn_onprem_configs[k].adv == null ? null : {
|
||||
advertise_groups = []
|
||||
advertise_ip_ranges = {
|
||||
for adv in(var.vpn_onprem_configs[k].adv == null ? [] : var.vpn_onprem_configs[k].adv.custom) :
|
||||
var.custom_adv[adv] => adv
|
||||
}
|
||||
advertise_mode = try(var.vpn_onprem_configs[k].adv.default, false) ? "DEFAULT" : "CUSTOM"
|
||||
route_priority = null
|
||||
}
|
||||
}
|
||||
l7ilb_subnets = { for env, v in var.l7ilb_subnets : env => [
|
||||
for s in v : merge(s, {
|
||||
active = true
|
||||
name = "${env}-l7ilb-${s.region}"
|
||||
l7ilb_subnets = {
|
||||
for env, v in var.l7ilb_subnets : env => [
|
||||
for s in v : merge(s, {
|
||||
active = true
|
||||
name = "${env}-l7ilb-${s.region}"
|
||||
})]
|
||||
}
|
||||
region_trigram = {
|
||||
|
||||
@@ -25,17 +25,15 @@ variable "custom_adv" {
|
||||
type = map(string)
|
||||
default = {
|
||||
cloud_dns = "35.199.192.0/19"
|
||||
gcp_all = "10.128.0.0/16"
|
||||
gcp_dev = "10.128.32.0/19"
|
||||
gcp_landing = "10.128.0.0/19"
|
||||
gcp_prod = "10.128.0.0/18"
|
||||
googleapis_private = "199.36.153.8/30"
|
||||
googleapis_restricted = "199.36.153.4/30"
|
||||
rfc_1918_10 = "10.0.0.0/8"
|
||||
rfc_1918_172 = "172.16.0.0/16"
|
||||
rfc_1918_192 = "192.168.0.0/16"
|
||||
landing_ew1 = "10.128.0.0/16"
|
||||
landing_ew4 = "10.129.0.0/16"
|
||||
spoke_prod_ew1 = "10.136.0.0/16"
|
||||
spoke_prod_ew4 = "10.137.0.0/16"
|
||||
spoke_dev_ew1 = "10.144.0.0/16"
|
||||
spoke_dev_ew4 = "10.145.0.0/16"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -171,35 +169,48 @@ variable "vpn_onprem_configs" {
|
||||
default = bool
|
||||
custom = list(string)
|
||||
})
|
||||
session_range = string
|
||||
peer = object({
|
||||
address = string
|
||||
asn = number
|
||||
secret_id = string
|
||||
peer_external_gateway = object({
|
||||
redundancy_type = string
|
||||
interfaces = list(object({
|
||||
id = number
|
||||
ip_address = string
|
||||
}))
|
||||
})
|
||||
tunnels = list(object({
|
||||
peer_asn = number
|
||||
secret = string
|
||||
session_range = string
|
||||
vpn_gateway_interface = number
|
||||
}))
|
||||
}))
|
||||
default = {
|
||||
landing-ew1 = {
|
||||
adv = {
|
||||
default = false
|
||||
custom = [
|
||||
"cloud_dns",
|
||||
"googleapis_restricted",
|
||||
"googleapis_private",
|
||||
"landing_ew1",
|
||||
"landing_ew4",
|
||||
"spoke_prod_ew1",
|
||||
"spoke_prod_ew4",
|
||||
"spoke_dev_ew1",
|
||||
"spoke_dev_ew4"
|
||||
"cloud_dns", "googleapis_private", "googleapis_restricted", "gcp_all"
|
||||
]
|
||||
}
|
||||
session_range = "169.254.1.0/29"
|
||||
peer = {
|
||||
address = "8.8.8.8"
|
||||
asn = 65534
|
||||
secret_id = "foobar"
|
||||
peer_external_gateway = {
|
||||
redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT"
|
||||
interfaces = [
|
||||
{ id = 0, ip_address = "8.8.8.8" },
|
||||
]
|
||||
}
|
||||
tunnels = [
|
||||
{
|
||||
peer_asn = 65534
|
||||
secret = "foobar"
|
||||
session_range = "169.254.1.0/30"
|
||||
vpn_gateway_interface = 0
|
||||
},
|
||||
{
|
||||
peer_asn = 65534
|
||||
secret = "foobar"
|
||||
session_range = "169.254.1.4/30"
|
||||
vpn_gateway_interface = 1
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -219,35 +230,40 @@ variable "vpn_spoke_configs" {
|
||||
default = false
|
||||
custom = ["rfc_1918_10", "rfc_1918_172", "rfc_1918_192"]
|
||||
}
|
||||
session_range = null # values for the landing router are pulled from the spoke range
|
||||
# values for the landing router are pulled from the spoke range
|
||||
session_range = null
|
||||
}
|
||||
landing-ew4 = {
|
||||
adv = {
|
||||
default = false
|
||||
custom = ["rfc_1918_10", "rfc_1918_172", "rfc_1918_192"]
|
||||
}
|
||||
session_range = null # values for the landing router are pulled from the spoke range
|
||||
# values for the landing router are pulled from the spoke range
|
||||
session_range = null
|
||||
}
|
||||
dev-ew1 = {
|
||||
adv = {
|
||||
default = false
|
||||
custom = ["spoke_dev_ew1", "spoke_dev_ew4"]
|
||||
custom = ["gcp_dev"]
|
||||
}
|
||||
session_range = "169.254.0.0/27" # resize according to required number of tunnels
|
||||
# resize according to required number of tunnels
|
||||
session_range = "169.254.0.0/27"
|
||||
}
|
||||
prod-ew1 = {
|
||||
adv = {
|
||||
default = false
|
||||
custom = ["spoke_prod_ew1", "spoke_prod_ew4"]
|
||||
custom = ["gcp_prod"]
|
||||
}
|
||||
session_range = "169.254.0.64/27" # resize according to required number of tunnels
|
||||
# resize according to required number of tunnels
|
||||
session_range = "169.254.0.64/27"
|
||||
}
|
||||
prod-ew4 = {
|
||||
adv = {
|
||||
default = false
|
||||
custom = ["spoke_prod_ew1", "spoke_prod_ew4"]
|
||||
custom = ["gcp_prod"]
|
||||
}
|
||||
session_range = "169.254.0.96/27" # resize according to required number of tunnels
|
||||
# resize according to required number of tunnels
|
||||
session_range = "169.254.0.96/27"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -16,35 +16,45 @@
|
||||
|
||||
# tfdoc:file:description VPN between landing and onprem.
|
||||
|
||||
module "landing-to-onprem-ew1-vpn" {
|
||||
source = "../../../modules/net-vpn-ha"
|
||||
project_id = module.landing-project.project_id
|
||||
network = module.landing-vpc.self_link
|
||||
region = "europe-west1"
|
||||
name = "vpn-to-onprem-ew1"
|
||||
router_create = true
|
||||
router_name = "landing-onprem-vpn-ew1"
|
||||
router_asn = var.router_configs.landing-ew1.asn
|
||||
peer_external_gateway = {
|
||||
redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT"
|
||||
interfaces = [{
|
||||
id = 0
|
||||
# on-prem router ip address
|
||||
ip_address = var.vpn_onprem_configs.landing-ew1.peer.address
|
||||
}]
|
||||
}
|
||||
tunnels = { for t in range(2) : "remote-${t}" => {
|
||||
bgp_peer = {
|
||||
address = cidrhost(var.vpn_onprem_configs.landing-ew1.session_range, 1 + (t * 4))
|
||||
asn = var.vpn_onprem_configs.landing-ew1.peer.asn
|
||||
}
|
||||
bgp_peer_options = local.bgp_peer_options_onprem["landing-ew1"]
|
||||
bgp_session_range = "${cidrhost(var.vpn_onprem_configs.landing-ew1.session_range, 2 + (t * 4))}/30"
|
||||
ike_version = 2
|
||||
peer_external_gateway_interface = 0
|
||||
router = null
|
||||
shared_secret = var.vpn_onprem_configs.landing-ew1.peer.secret_id
|
||||
vpn_gateway_interface = t
|
||||
locals {
|
||||
bgp_peer_options_onprem = {
|
||||
for k, v in var.vpn_onprem_configs :
|
||||
k => v.adv == null ? null : {
|
||||
advertise_groups = []
|
||||
advertise_ip_ranges = {
|
||||
for adv in(v.adv == null ? [] : v.adv.custom) :
|
||||
var.custom_adv[adv] => adv
|
||||
}
|
||||
advertise_mode = try(v.adv.default, false) ? "DEFAULT" : "CUSTOM"
|
||||
route_priority = null
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
module "landing-to-onprem-ew1-vpn" {
|
||||
source = "../../../modules/net-vpn-ha"
|
||||
project_id = module.landing-project.project_id
|
||||
network = module.landing-vpc.self_link
|
||||
region = "europe-west1"
|
||||
name = "vpn-to-onprem-ew1"
|
||||
router_create = true
|
||||
router_name = "landing-onprem-vpn-ew1"
|
||||
router_asn = var.router_configs.landing-ew1.asn
|
||||
peer_external_gateway = var.vpn_onprem_configs.landing-ew1.peer_external_gateway
|
||||
tunnels = {
|
||||
for t in var.vpn_onprem_configs.landing-ew1.tunnels :
|
||||
"remote-${t.vpn_gateway_interface}" => {
|
||||
bgp_peer = {
|
||||
address = cidrhost(t.session_range, 1)
|
||||
asn = t.peer_asn
|
||||
}
|
||||
bgp_peer_options = local.bgp_peer_options_onprem.landing-ew1
|
||||
bgp_session_range = "${cidrhost(t.session_range, 2)}/30"
|
||||
ike_version = 2
|
||||
peer_external_gateway_interface = 0
|
||||
router = null
|
||||
shared_secret = t.secret
|
||||
vpn_gateway_interface = t.vpn_gateway_interface
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user