Add support for cipher suite configuration on net-vpn-* modules (#3790)
This commit is contained in:
David Ferguson
@@ -61,8 +61,8 @@ These modules are used in the examples included in this repository. If you are u
|
||||
- [Service Directory](./service-directory)
|
||||
- [VPC](./net-vpc)
|
||||
- [VPC firewall](./net-vpc-firewall)
|
||||
- [VPN dynamic](./net-vpn-dynamic)
|
||||
- [VPC peering](./net-vpc-peering)
|
||||
- [VPN dynamic](./net-vpn-dynamic)
|
||||
- [VPN HA](./net-vpn-ha)
|
||||
- [VPN static](./net-vpn-static)
|
||||
|
||||
|
||||
@@ -1,10 +1,22 @@
|
||||
# Cloud VPN Dynamic Module
|
||||
|
||||
## Example
|
||||
This module makes it easy to deploy a [Classic VPN](https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/overview#classic-vpn) with dynamic (BGP) routing.
|
||||
|
||||
This example shows how to configure a single VPN tunnel using a couple of extra features
|
||||
<!-- BEGIN TOC -->
|
||||
- [Examples](#examples)
|
||||
- [Classic VPN with single tunnel](#classic-vpn-with-single-tunnel)
|
||||
- [Classic VPN with single tunnel and custom ciphers](#classic-vpn-with-single-tunnel-and-custom-ciphers)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
<!-- END TOC -->
|
||||
|
||||
- custom advertisement on the tunnel's BGP session; if custom advertisement is not needed, simply set the `bgp_peer_options` attribute to `null`
|
||||
## Examples
|
||||
|
||||
### Classic VPN with single tunnel
|
||||
|
||||
This example shows how to configure a single VPN tunnel using a couple of extra features:
|
||||
|
||||
- custom advertisement on the tunnel's BGP session; if custom advertisement is not needed, simply set the `custom_advertise` attribute to `null`
|
||||
- internally generated shared secret, which can be fetched from the module's `random_secret` output for reuse; a predefined secret can be used instead by assigning it to the `shared_secret` attribute
|
||||
|
||||
```hcl
|
||||
@@ -51,10 +63,66 @@ module "vpn-dynamic" {
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=12
|
||||
# tftest modules=2 resources=12 inventory=vpn-single-tunnel.yaml
|
||||
```
|
||||
|
||||
### Classic VPN with single tunnel and custom ciphers
|
||||
|
||||
This example shows how to configure a single VPN tunnel with custom ciphers.
|
||||
|
||||
```hcl
|
||||
module "vm" {
|
||||
source = "./fabric/modules/compute-vm"
|
||||
project_id = "my-project"
|
||||
zone = "europe-west1-b"
|
||||
name = "my-vm"
|
||||
network_interfaces = [{
|
||||
nat = true
|
||||
network = var.vpc.self_link
|
||||
subnetwork = var.subnet.self_link
|
||||
}]
|
||||
service_account = {
|
||||
auto_create = true
|
||||
}
|
||||
}
|
||||
|
||||
module "vpn-dynamic" {
|
||||
source = "./fabric/modules/net-vpn-dynamic"
|
||||
project_id = "my-project"
|
||||
region = "europe-west1"
|
||||
network = var.vpc.name
|
||||
name = "gateway-1"
|
||||
router_config = {
|
||||
asn = 64514
|
||||
}
|
||||
tunnels = {
|
||||
remote-1 = {
|
||||
bgp_peer = {
|
||||
address = "169.254.139.134"
|
||||
asn = 64513
|
||||
custom_advertise = null
|
||||
}
|
||||
bgp_session_range = "169.254.139.133/30"
|
||||
cipher_suite = {
|
||||
phase1 = {
|
||||
dh = ["Group-14"]
|
||||
encryption = ["AES-CBC-256"]
|
||||
integrity = ["HMAC-SHA2-256-128"]
|
||||
prf = ["PRF-HMAC-SHA2-256"]
|
||||
}
|
||||
phase2 = {
|
||||
encryption = ["AES-CBC-128"]
|
||||
integrity = ["HMAC-SHA2-256-128"]
|
||||
pfs = ["Group-14"]
|
||||
}
|
||||
}
|
||||
peer_ip = module.vm.external_ip
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=12 inventory=vpn-single-tunnel-custom-ciphers.yaml
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
|
||||
## Variables
|
||||
|
||||
| name | description | type | required | default |
|
||||
@@ -66,7 +134,7 @@ module "vpn-dynamic" {
|
||||
| [router_config](variables.tf#L49) | Cloud Router configuration for the VPN. If you want to reuse an existing router, set create to false and use name to specify the desired router. | <code title="object({ create = optional(bool, true) asn = number name = optional(string) keepalive = optional(number) custom_advertise = optional(object({ all_subnets = bool ip_ranges = map(string) })) })">object({…})</code> | ✓ | |
|
||||
| [gateway_address](variables.tf#L17) | Optional address assigned to the VPN gateway. Ignored unless gateway_address_create is set to false. | <code>string</code> | | <code>null</code> |
|
||||
| [gateway_address_create](variables.tf#L23) | Create external address assigned to the VPN gateway. Needs to be explicitly set to false to use address in gateway_address variable. | <code>bool</code> | | <code>true</code> |
|
||||
| [tunnels](variables.tf#L64) | VPN tunnel configurations. | <code title="map(object({ bgp_peer = object({ address = string asn = number route_priority = optional(number, 1000) custom_advertise = optional(object({ all_subnets = bool all_vpc_subnets = bool all_peer_vpc_subnets = bool ip_ranges = map(string) })) }) bgp_session_range = string ike_version = optional(number, 2) peer_ip = string router = optional(string) shared_secret = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tunnels](variables.tf#L64) | VPN tunnel configurations. | <code title="map(object({ bgp_peer = object({ address = string asn = number route_priority = optional(number, 1000) custom_advertise = optional(object({ all_subnets = bool all_vpc_subnets = bool all_peer_vpc_subnets = bool ip_ranges = map(string) })) }) bgp_session_range = string cipher_suite = optional(object({ phase1 = optional(object({ dh = optional(list(string)) encryption = optional(list(string)) integrity = optional(list(string)) prf = optional(list(string)) })) phase2 = optional(object({ encryption = optional(list(string)) integrity = optional(list(string)) pfs = optional(list(string)) })) })) ike_version = optional(number, 2) peer_ip = string router = optional(string) shared_secret = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
@@ -83,5 +151,4 @@ module "vpn-dynamic" {
|
||||
| [tunnel_names](outputs.tf#L58) | VPN tunnel names. | |
|
||||
| [tunnel_self_links](outputs.tf#L66) | VPN tunnel self links. | |
|
||||
| [tunnels](outputs.tf#L74) | VPN tunnel resources. | |
|
||||
|
||||
<!-- END TFDOC -->
|
||||
|
||||
@@ -152,7 +152,31 @@ resource "google_compute_vpn_tunnel" "tunnels" {
|
||||
ike_version = each.value.ike_version
|
||||
shared_secret = coalesce(each.value.shared_secret, local.secret)
|
||||
target_vpn_gateway = google_compute_vpn_gateway.gateway.self_link
|
||||
depends_on = [google_compute_forwarding_rule.esp]
|
||||
|
||||
dynamic "cipher_suite" {
|
||||
for_each = each.value.cipher_suite != null ? [each.value.cipher_suite] : []
|
||||
content {
|
||||
dynamic "phase1" {
|
||||
for_each = [cipher_suite.value.phase1]
|
||||
content {
|
||||
dh = try(phase1.value.dh, null)
|
||||
encryption = try(phase1.value.encryption, null)
|
||||
integrity = try(phase1.value.integrity, null)
|
||||
prf = try(phase1.value.prf, null)
|
||||
}
|
||||
}
|
||||
dynamic "phase2" {
|
||||
for_each = [cipher_suite.value.phase2]
|
||||
content {
|
||||
encryption = try(phase2.value.encryption, null)
|
||||
integrity = try(phase2.value.integrity, null)
|
||||
pfs = try(phase2.value.pfs, null)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
depends_on = [google_compute_forwarding_rule.esp]
|
||||
}
|
||||
|
||||
resource "random_id" "secret" {
|
||||
|
||||
@@ -78,10 +78,23 @@ variable "tunnels" {
|
||||
# each BGP session on the same Cloud Router must use a unique /30 CIDR
|
||||
# from the 169.254.0.0/16 block.
|
||||
bgp_session_range = string
|
||||
ike_version = optional(number, 2)
|
||||
peer_ip = string
|
||||
router = optional(string)
|
||||
shared_secret = optional(string)
|
||||
cipher_suite = optional(object({
|
||||
phase1 = optional(object({
|
||||
dh = optional(list(string))
|
||||
encryption = optional(list(string))
|
||||
integrity = optional(list(string))
|
||||
prf = optional(list(string))
|
||||
}))
|
||||
phase2 = optional(object({
|
||||
encryption = optional(list(string))
|
||||
integrity = optional(list(string))
|
||||
pfs = optional(list(string))
|
||||
}))
|
||||
}))
|
||||
ike_version = optional(number, 2)
|
||||
peer_ip = string
|
||||
router = optional(string)
|
||||
shared_secret = optional(string)
|
||||
}))
|
||||
default = {}
|
||||
nullable = false
|
||||
|
||||
@@ -6,6 +6,7 @@ This module makes it easy to deploy either GCP-to-GCP or GCP-to-On-prem [Cloud H
|
||||
- [Examples](#examples)
|
||||
- [GCP to GCP](#gcp-to-gcp)
|
||||
- [GCP to on-prem](#gcp-to-on-prem)
|
||||
- [GCP to on-prem with custom ciphers](#gcp-to-on-prem-with-custom-ciphers)
|
||||
- [IPv6 (dual-stack)](#ipv6-dual-stack)
|
||||
- [Recipes](#recipes)
|
||||
- [Variables](#variables)
|
||||
@@ -135,7 +136,7 @@ module "vpn_ha" {
|
||||
bgp_peer = {
|
||||
address = "169.254.2.1"
|
||||
asn = 64513
|
||||
# Custom learned routes are optional
|
||||
# Custom learned routes are optional
|
||||
custom_learned_ip_ranges = {
|
||||
ip_ranges = {
|
||||
"onprem-range" = "10.128.0.0/16"
|
||||
@@ -157,6 +158,98 @@ module "vpn_ha" {
|
||||
# tftest modules=1 resources=12 inventory=gcp-to-onprem.yaml
|
||||
```
|
||||
|
||||
### GCP to on-prem with custom ciphers
|
||||
|
||||
```hcl
|
||||
module "vpn_ha" {
|
||||
source = "./fabric/modules/net-vpn-ha"
|
||||
project_id = var.project_id
|
||||
region = var.region
|
||||
network = var.vpc.self_link
|
||||
name = "mynet-to-onprem"
|
||||
peer_gateways = {
|
||||
default = {
|
||||
external = {
|
||||
redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT"
|
||||
interfaces = ["8.8.8.8"] # on-prem router ip address
|
||||
}
|
||||
}
|
||||
}
|
||||
router_config = { asn = 64514 }
|
||||
tunnels = {
|
||||
remote-0 = {
|
||||
bgp_peer = {
|
||||
address = "169.254.1.1"
|
||||
asn = 64513
|
||||
# Custom learned routes are optional
|
||||
custom_learned_ip_ranges = {
|
||||
ip_ranges = {
|
||||
"onprem-range" = "10.128.0.0/16"
|
||||
}
|
||||
}
|
||||
# MD5 Authentication is optional
|
||||
md5_authentication_key = {
|
||||
name = "foo"
|
||||
key = "bar"
|
||||
}
|
||||
}
|
||||
bgp_session_range = "169.254.1.2/30"
|
||||
cipher_suite = {
|
||||
phase1 = {
|
||||
dh = ["Group-14"]
|
||||
encryption = ["AES-CBC-256"]
|
||||
integrity = ["HMAC-SHA2-256-128"]
|
||||
prf = ["PRF-HMAC-SHA2-256"]
|
||||
}
|
||||
phase2 = {
|
||||
encryption = ["AES-CBC-128"]
|
||||
integrity = ["HMAC-SHA2-256-128"]
|
||||
pfs = ["Group-14"]
|
||||
}
|
||||
}
|
||||
peer_external_gateway_interface = 0
|
||||
shared_secret = "mySecret"
|
||||
vpn_gateway_interface = 0
|
||||
}
|
||||
remote-1 = {
|
||||
bgp_peer = {
|
||||
address = "169.254.2.1"
|
||||
asn = 64513
|
||||
# Custom learned routes are optional
|
||||
custom_learned_ip_ranges = {
|
||||
ip_ranges = {
|
||||
"onprem-range" = "10.128.0.0/16"
|
||||
}
|
||||
}
|
||||
# MD5 Authentication is optional
|
||||
md5_authentication_key = {
|
||||
name = "foo"
|
||||
key = "bar"
|
||||
}
|
||||
}
|
||||
bgp_session_range = "169.254.2.2/30"
|
||||
cipher_suite = {
|
||||
phase1 = {
|
||||
dh = ["Group-14"]
|
||||
encryption = ["AES-CBC-256"]
|
||||
integrity = ["HMAC-SHA2-256-128"]
|
||||
prf = ["PRF-HMAC-SHA2-256"]
|
||||
}
|
||||
phase2 = {
|
||||
encryption = ["AES-CBC-128"]
|
||||
integrity = ["HMAC-SHA2-256-128"]
|
||||
pfs = ["Group-14"]
|
||||
}
|
||||
}
|
||||
peer_external_gateway_interface = 0
|
||||
shared_secret = "mySecret"
|
||||
vpn_gateway_interface = 1
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=12 inventory=gcp-to-onprem-custom-ciphers.yaml
|
||||
```
|
||||
|
||||
### IPv6 (dual-stack)
|
||||
|
||||
You can optionally set your HA VPN gateway (and BGP sessions) to carry both IPv4 and IPv6 traffic. IPv6 only is not supported.
|
||||
@@ -205,10 +298,10 @@ module "vpn_ha" {
|
||||
}
|
||||
}
|
||||
vpn_gateway_create = {
|
||||
stack_type = "IPV4_IPV6"
|
||||
ipv6 = true
|
||||
}
|
||||
}
|
||||
# tftest modules=1 resources=12 intentory=ipv6.yaml
|
||||
# tftest modules=1 resources=12 inventory=ipv6.yaml
|
||||
```
|
||||
|
||||
You can optionally avoid to specify MD5 keys and the module will automatically generate them for you.
|
||||
@@ -228,9 +321,9 @@ You can optionally avoid to specify MD5 keys and the module will automatically g
|
||||
| [router_config](variables.tf#L72) | Cloud Router configuration for the VPN. If you want to reuse an existing router, set create to false and use name to specify the desired router. | <code title="object({ asn = optional(number) create = optional(bool, true) custom_advertise = optional(object({ all_subnets = bool ip_ranges = map(string) })) keepalive = optional(number) name = optional(string) override_name = optional(string) })">object({…})</code> | ✓ | |
|
||||
| [context](variables.tf#L17) | Context-specific interpolations. | <code title="object({ addresses = optional(map(string), {}) locations = optional(map(string), {}) networks = optional(map(string), {}) project_ids = optional(map(string), {}) routers = optional(map(string), {}) vpn_gateways = optional(map(string), {}) })">object({…})</code> | | <code>{}</code> |
|
||||
| [peer_gateways](variables.tf#L41) | Configuration of the (external or GCP) peer gateway. | <code title="map(object({ external = optional(object({ redundancy_type = string interfaces = list(string) description = optional(string, "Terraform managed external VPN gateway") name = optional(string) })) gcp = optional(string) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tunnels](variables.tf#L88) | VPN tunnel configurations. | <code title="map(object({ bgp_peer = object({ address = string asn = number route_priority = optional(number, 1000) custom_advertise = optional(object({ all_subnets = bool ip_ranges = map(string) })) custom_learned_ip_ranges = optional(object({ route_priority = optional(number, 1000) ip_ranges = map(string) })) md5_authentication_key = optional(object({ name = string key = optional(string) })) ipv6 = optional(object({ nexthop_address = optional(string) peer_nexthop_address = optional(string) })) name = optional(string) }) bgp_session_range = string ike_version = optional(number, 2) name = optional(string) peer_external_gateway_interface = optional(number) peer_router_interface_name = optional(string) peer_gateway = optional(string, "default") router = optional(string) shared_secret = optional(string) vpn_gateway_interface = number }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [vpn_gateway](variables.tf#L129) | HA VPN Gateway Self Link for using an existing HA VPN Gateway. Ignored if `vpn_gateway_create` is set to `true`. | <code>string</code> | | <code>null</code> |
|
||||
| [vpn_gateway_create](variables.tf#L135) | Create HA VPN Gateway. Set to null to avoid creation. | <code title="object({ description = optional(string, "Terraform managed external VPN gateway") ipv6 = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
| [tunnels](variables.tf#L88) | VPN tunnel configurations. | <code title="map(object({ bgp_peer = object({ address = string asn = number route_priority = optional(number, 1000) custom_advertise = optional(object({ all_subnets = bool ip_ranges = map(string) })) custom_learned_ip_ranges = optional(object({ route_priority = optional(number, 1000) ip_ranges = map(string) })) md5_authentication_key = optional(object({ name = string key = optional(string) })) ipv6 = optional(object({ nexthop_address = optional(string) peer_nexthop_address = optional(string) })) name = optional(string) }) bgp_session_range = string cipher_suite = optional(object({ phase1 = optional(object({ dh = optional(list(string)) encryption = optional(list(string)) integrity = optional(list(string)) prf = optional(list(string)) })) phase2 = optional(object({ encryption = optional(list(string)) integrity = optional(list(string)) pfs = optional(list(string)) })) })) ike_version = optional(number, 2) name = optional(string) peer_external_gateway_interface = optional(number) peer_router_interface_name = optional(string) peer_gateway = optional(string, "default") router = optional(string) shared_secret = optional(string) vpn_gateway_interface = number }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [vpn_gateway](variables.tf#L142) | HA VPN Gateway Self Link for using an existing HA VPN Gateway. Ignored if `vpn_gateway_create` is set to `true`. | <code>string</code> | | <code>null</code> |
|
||||
| [vpn_gateway_create](variables.tf#L148) | Create HA VPN Gateway. Set to null to avoid creation. | <code title="object({ description = optional(string, "Terraform managed external VPN gateway") ipv6 = optional(bool, false) })">object({…})</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -189,6 +189,29 @@ resource "google_compute_vpn_tunnel" "tunnels" {
|
||||
ike_version = each.value.ike_version
|
||||
shared_secret = coalesce(each.value.shared_secret, local.secret)
|
||||
vpn_gateway = local.vpn_gateway
|
||||
|
||||
dynamic "cipher_suite" {
|
||||
for_each = each.value.cipher_suite != null ? [each.value.cipher_suite] : []
|
||||
content {
|
||||
dynamic "phase1" {
|
||||
for_each = [cipher_suite.value.phase1]
|
||||
content {
|
||||
dh = try(phase1.value.dh, null)
|
||||
encryption = try(phase1.value.encryption, null)
|
||||
integrity = try(phase1.value.integrity, null)
|
||||
prf = try(phase1.value.prf, null)
|
||||
}
|
||||
}
|
||||
dynamic "phase2" {
|
||||
for_each = [cipher_suite.value.phase2]
|
||||
content {
|
||||
encryption = try(phase2.value.encryption, null)
|
||||
integrity = try(phase2.value.integrity, null)
|
||||
pfs = try(phase2.value.pfs, null)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "random_id" "secret" {
|
||||
|
||||
@@ -112,7 +112,20 @@ variable "tunnels" {
|
||||
})
|
||||
# each BGP session on the same Cloud Router must use a unique /30 CIDR
|
||||
# from the 169.254.0.0/16 block.
|
||||
bgp_session_range = string
|
||||
bgp_session_range = string
|
||||
cipher_suite = optional(object({
|
||||
phase1 = optional(object({
|
||||
dh = optional(list(string))
|
||||
encryption = optional(list(string))
|
||||
integrity = optional(list(string))
|
||||
prf = optional(list(string))
|
||||
}))
|
||||
phase2 = optional(object({
|
||||
encryption = optional(list(string))
|
||||
integrity = optional(list(string))
|
||||
pfs = optional(list(string))
|
||||
}))
|
||||
}))
|
||||
ike_version = optional(number, 2)
|
||||
name = optional(string)
|
||||
peer_external_gateway_interface = optional(number)
|
||||
|
||||
@@ -1,6 +1,18 @@
|
||||
# Cloud VPN Route-based Module
|
||||
|
||||
## Example
|
||||
This module makes it easy to deploy a [Classic VPN](https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/overview#classic-vpn) with static routing.
|
||||
|
||||
<!-- BEGIN TOC -->
|
||||
- [Examples](#examples)
|
||||
- [Classic VPN with single tunnel](#classic-vpn-with-single-tunnel)
|
||||
- [Classic VPN with single tunnel and custom ciphers](#classic-vpn-with-single-tunnel-and-custom-ciphers)
|
||||
- [Variables](#variables)
|
||||
- [Outputs](#outputs)
|
||||
<!-- END TOC -->
|
||||
|
||||
## Examples
|
||||
|
||||
### Classic VPN with single tunnel
|
||||
|
||||
```hcl
|
||||
module "addresses" {
|
||||
@@ -28,10 +40,53 @@ module "vpn" {
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=8
|
||||
# tftest modules=2 resources=8 inventory=vpn-single-tunnel.yaml
|
||||
```
|
||||
|
||||
### Classic VPN with single tunnel and custom ciphers
|
||||
|
||||
```hcl
|
||||
module "addresses" {
|
||||
source = "./fabric/modules/net-address"
|
||||
project_id = var.project_id
|
||||
external_addresses = {
|
||||
vpn = { region = "europe-west1" }
|
||||
}
|
||||
}
|
||||
|
||||
module "vpn" {
|
||||
source = "./fabric/modules/net-vpn-static"
|
||||
project_id = var.project_id
|
||||
region = var.region
|
||||
network = var.vpc.self_link
|
||||
name = "remote"
|
||||
gateway_address_create = false
|
||||
gateway_address = module.addresses.external_addresses["vpn"].address
|
||||
remote_ranges = ["10.10.0.0/24"]
|
||||
tunnels = {
|
||||
remote-0 = {
|
||||
cipher_suite = {
|
||||
phase1 = {
|
||||
dh = ["Group-14"]
|
||||
encryption = ["AES-CBC-256"]
|
||||
integrity = ["HMAC-SHA2-256-128"]
|
||||
prf = ["PRF-HMAC-SHA2-256"]
|
||||
}
|
||||
phase2 = {
|
||||
encryption = ["AES-CBC-128"]
|
||||
integrity = ["HMAC-SHA2-256-128"]
|
||||
pfs = ["Group-14"]
|
||||
}
|
||||
}
|
||||
peer_ip = "1.1.1.1"
|
||||
shared_secret = "mysecret"
|
||||
traffic_selectors = { local = ["0.0.0.0/0"], remote = ["0.0.0.0/0"] }
|
||||
}
|
||||
}
|
||||
}
|
||||
# tftest modules=2 resources=8 inventory=vpn-single-tunnel-custom-ciphers.yaml
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
|
||||
## Variables
|
||||
|
||||
| name | description | type | required | default |
|
||||
@@ -44,7 +99,7 @@ module "vpn" {
|
||||
| [gateway_address_create](variables.tf#L23) | Create external address assigned to the VPN gateway. Needs to be explicitly set to false to use address in gateway_address variable. | <code>bool</code> | | <code>true</code> |
|
||||
| [remote_ranges](variables.tf#L49) | Remote IP CIDR ranges. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [route_priority](variables.tf#L56) | Route priority, defaults to 1000. | <code>number</code> | | <code>1000</code> |
|
||||
| [tunnels](variables.tf#L62) | VPN tunnel configurations. | <code title="map(object({ ike_version = optional(number, 2) peer_ip = string shared_secret = optional(string) traffic_selectors = object({ local = list(string) remote = list(string) }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [tunnels](variables.tf#L62) | VPN tunnel configurations. | <code title="map(object({ cipher_suite = optional(object({ phase1 = optional(object({ dh = optional(list(string)) encryption = optional(list(string)) integrity = optional(list(string)) prf = optional(list(string)) })) phase2 = optional(object({ encryption = optional(list(string)) integrity = optional(list(string)) pfs = optional(list(string)) })) })) ike_version = optional(number, 2) peer_ip = string shared_secret = optional(string) traffic_selectors = object({ local = list(string) remote = list(string) }) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
@@ -59,5 +114,4 @@ module "vpn" {
|
||||
| [tunnel_names](outputs.tf#L47) | VPN tunnel names. | |
|
||||
| [tunnel_self_links](outputs.tf#L55) | VPN tunnel self links. | |
|
||||
| [tunnels](outputs.tf#L63) | VPN tunnel resources. | |
|
||||
|
||||
<!-- END TFDOC -->
|
||||
|
||||
@@ -93,7 +93,31 @@ resource "google_compute_vpn_tunnel" "tunnels" {
|
||||
ike_version = each.value.ike_version
|
||||
shared_secret = coalesce(each.value.shared_secret, local.secret)
|
||||
target_vpn_gateway = google_compute_vpn_gateway.gateway.self_link
|
||||
depends_on = [google_compute_forwarding_rule.esp]
|
||||
|
||||
dynamic "cipher_suite" {
|
||||
for_each = each.value.cipher_suite != null ? [each.value.cipher_suite] : []
|
||||
content {
|
||||
dynamic "phase1" {
|
||||
for_each = [cipher_suite.value.phase1]
|
||||
content {
|
||||
dh = try(phase1.value.dh, null)
|
||||
encryption = try(phase1.value.encryption, null)
|
||||
integrity = try(phase1.value.integrity, null)
|
||||
prf = try(phase1.value.prf, null)
|
||||
}
|
||||
}
|
||||
dynamic "phase2" {
|
||||
for_each = [cipher_suite.value.phase2]
|
||||
content {
|
||||
encryption = try(phase2.value.encryption, null)
|
||||
integrity = try(phase2.value.integrity, null)
|
||||
pfs = try(phase2.value.pfs, null)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
depends_on = [google_compute_forwarding_rule.esp]
|
||||
}
|
||||
|
||||
resource "random_id" "secret" {
|
||||
|
||||
@@ -62,6 +62,19 @@ variable "route_priority" {
|
||||
variable "tunnels" {
|
||||
description = "VPN tunnel configurations."
|
||||
type = map(object({
|
||||
cipher_suite = optional(object({
|
||||
phase1 = optional(object({
|
||||
dh = optional(list(string))
|
||||
encryption = optional(list(string))
|
||||
integrity = optional(list(string))
|
||||
prf = optional(list(string))
|
||||
}))
|
||||
phase2 = optional(object({
|
||||
encryption = optional(list(string))
|
||||
integrity = optional(list(string))
|
||||
pfs = optional(list(string))
|
||||
}))
|
||||
}))
|
||||
ike_version = optional(number, 2)
|
||||
peer_ip = string
|
||||
shared_secret = optional(string)
|
||||
|
||||
@@ -0,0 +1,297 @@
|
||||
# Copyright 2026 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.vm.google_compute_instance.default[0]:
|
||||
advanced_machine_features: []
|
||||
allow_stopping_for_update: true
|
||||
attached_disk: []
|
||||
boot_disk:
|
||||
- auto_delete: true
|
||||
disk_encryption_key_raw: null
|
||||
disk_encryption_key_rsa: null
|
||||
disk_encryption_service_account: null
|
||||
force_attach: null
|
||||
initialize_params:
|
||||
- enable_confidential_compute: null
|
||||
image: projects/debian-cloud/global/images/family/debian-11
|
||||
resource_manager_tags: null
|
||||
size: 10
|
||||
source_image_encryption_key: []
|
||||
source_snapshot_encryption_key: []
|
||||
storage_pool: null
|
||||
type: pd-balanced
|
||||
interface: null
|
||||
mode: READ_WRITE
|
||||
can_ip_forward: false
|
||||
deletion_protection: false
|
||||
description: Managed by the compute-vm Terraform module.
|
||||
desired_status: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
enable_display: false
|
||||
hostname: null
|
||||
instance_encryption_key: []
|
||||
key_revocation_action_type: NONE
|
||||
labels: null
|
||||
machine_type: f1-micro
|
||||
metadata: null
|
||||
metadata_startup_script: null
|
||||
name: my-vm
|
||||
network_interface:
|
||||
- access_config:
|
||||
- public_ptr_domain_name: null
|
||||
alias_ip_range: []
|
||||
ipv6_access_config: []
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
nic_type: null
|
||||
queue_count: null
|
||||
security_policy: null
|
||||
subnetwork: subnet_self_link
|
||||
network_performance_config: []
|
||||
params: []
|
||||
partner_metadata: null
|
||||
project: my-project
|
||||
resource_policies: null
|
||||
scheduling:
|
||||
- automatic_restart: true
|
||||
availability_domain: null
|
||||
graceful_shutdown: []
|
||||
host_error_timeout_seconds: null
|
||||
instance_termination_action: null
|
||||
local_ssd_recovery_timeout: []
|
||||
maintenance_interval: null
|
||||
max_run_duration: []
|
||||
min_node_cpus: null
|
||||
node_affinities: []
|
||||
on_host_maintenance: MIGRATE
|
||||
on_instance_stop_action: []
|
||||
preemptible: false
|
||||
provisioning_model: STANDARD
|
||||
skip_guest_os_shutdown: false
|
||||
termination_time: null
|
||||
scratch_disk: []
|
||||
service_account:
|
||||
- email: tf-vm-my-vm@my-project.iam.gserviceaccount.com
|
||||
scopes:
|
||||
- https://www.googleapis.com/auth/cloud-platform
|
||||
- https://www.googleapis.com/auth/userinfo.email
|
||||
shielded_instance_config: []
|
||||
tags: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
zone: europe-west1-b
|
||||
module.vm.google_service_account.service_account[0]:
|
||||
account_id: tf-vm-my-vm
|
||||
create_ignore_already_exists: null
|
||||
description: null
|
||||
disabled: false
|
||||
display_name: Terraform VM my-vm.
|
||||
email: tf-vm-my-vm@my-project.iam.gserviceaccount.com
|
||||
member: serviceAccount:tf-vm-my-vm@my-project.iam.gserviceaccount.com
|
||||
project: my-project
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_address.gateway[0]:
|
||||
address_type: EXTERNAL
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ip_collection: null
|
||||
ip_version: null
|
||||
ipv6_endpoint_type: null
|
||||
labels: null
|
||||
name: vpn-gateway-1
|
||||
network: null
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_forwarding_rule.esp:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: ESP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-gateway-1-esp
|
||||
no_automate_dns_zone: null
|
||||
ports: null
|
||||
project: my-project
|
||||
recreate_closed_psc: false
|
||||
region: europe-west1
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_forwarding_rule.udp-4500:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: UDP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-gateway-1-udp-4500
|
||||
no_automate_dns_zone: null
|
||||
port_range: '4500'
|
||||
ports: null
|
||||
project: my-project
|
||||
recreate_closed_psc: false
|
||||
region: europe-west1
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_forwarding_rule.udp-500:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: UDP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-gateway-1-udp-500
|
||||
no_automate_dns_zone: null
|
||||
port_range: '500'
|
||||
ports: null
|
||||
project: my-project
|
||||
recreate_closed_psc: false
|
||||
region: europe-west1
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_router.router[0]:
|
||||
bgp:
|
||||
- advertise_mode: DEFAULT
|
||||
advertised_groups: []
|
||||
advertised_ip_ranges: []
|
||||
asn: 64514
|
||||
keepalive_interval: 20
|
||||
description: null
|
||||
encrypted_interconnect_router: null
|
||||
md5_authentication_keys: []
|
||||
name: vpn-gateway-1
|
||||
network: vpc-name
|
||||
params: []
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_router_interface.router_interface["remote-1"]:
|
||||
interconnect_attachment: null
|
||||
ip_range: 169.254.139.133/30
|
||||
name: gateway-1-remote-1
|
||||
private_ip_address: null
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
router: vpn-gateway-1
|
||||
subnetwork: null
|
||||
timeouts: null
|
||||
vpn_tunnel: gateway-1-remote-1
|
||||
module.vpn-dynamic.google_compute_router_peer.bgp_peer["remote-1"]:
|
||||
advertise_mode: DEFAULT
|
||||
advertised_groups: []
|
||||
advertised_ip_ranges: []
|
||||
advertised_route_priority: 1000
|
||||
custom_learned_ip_ranges: []
|
||||
custom_learned_route_priority: null
|
||||
enable: true
|
||||
enable_ipv6: false
|
||||
export_policies: null
|
||||
import_policies: null
|
||||
interface: gateway-1-remote-1
|
||||
md5_authentication_key: []
|
||||
name: gateway-1-remote-1
|
||||
peer_asn: 64513
|
||||
peer_ip_address: 169.254.139.134
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
router: vpn-gateway-1
|
||||
router_appliance_instance: null
|
||||
timeouts: null
|
||||
zero_advertised_route_priority: null
|
||||
zero_custom_learned_route_priority: false
|
||||
module.vpn-dynamic.google_compute_vpn_gateway.gateway:
|
||||
description: null
|
||||
name: gateway-1
|
||||
network: vpc-name
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_vpn_tunnel.tunnels["remote-1"]:
|
||||
cipher_suite:
|
||||
- phase1:
|
||||
- dh:
|
||||
- Group-14
|
||||
encryption:
|
||||
- AES-CBC-256
|
||||
integrity:
|
||||
- HMAC-SHA2-256-128
|
||||
prf:
|
||||
- PRF-HMAC-SHA2-256
|
||||
phase2:
|
||||
- encryption:
|
||||
- AES-CBC-128
|
||||
integrity:
|
||||
- HMAC-SHA2-256-128
|
||||
pfs:
|
||||
- Group-14
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ike_version: 2
|
||||
labels: null
|
||||
name: gateway-1-remote-1
|
||||
peer_external_gateway: null
|
||||
peer_external_gateway_interface: null
|
||||
peer_gcp_gateway: null
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
router: vpn-gateway-1
|
||||
shared_secret_wo: null
|
||||
shared_secret_wo_version: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
vpn_gateway: null
|
||||
vpn_gateway_interface: null
|
||||
module.vpn-dynamic.random_id.secret:
|
||||
byte_length: 8
|
||||
keepers: null
|
||||
prefix: null
|
||||
|
||||
counts:
|
||||
google_compute_address: 1
|
||||
google_compute_forwarding_rule: 3
|
||||
google_compute_instance: 1
|
||||
google_compute_router_interface: 1
|
||||
google_compute_router_peer: 1
|
||||
google_compute_router: 1
|
||||
google_compute_vpn_gateway: 1
|
||||
google_compute_vpn_tunnel: 1
|
||||
google_service_account: 1
|
||||
modules: 2
|
||||
random_id: 1
|
||||
resources: 12
|
||||
|
||||
outputs: {}
|
||||
284
tests/modules/net_vpn_dynamic/examples/vpn-single-tunnel.yaml
Normal file
284
tests/modules/net_vpn_dynamic/examples/vpn-single-tunnel.yaml
Normal file
@@ -0,0 +1,284 @@
|
||||
# Copyright 2026 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.vm.google_compute_instance.default[0]:
|
||||
advanced_machine_features: []
|
||||
allow_stopping_for_update: true
|
||||
attached_disk: []
|
||||
boot_disk:
|
||||
- auto_delete: true
|
||||
disk_encryption_key_raw: null
|
||||
disk_encryption_key_rsa: null
|
||||
disk_encryption_service_account: null
|
||||
force_attach: null
|
||||
initialize_params:
|
||||
- enable_confidential_compute: null
|
||||
image: projects/debian-cloud/global/images/family/debian-11
|
||||
resource_manager_tags: null
|
||||
size: 10
|
||||
source_image_encryption_key: []
|
||||
source_snapshot_encryption_key: []
|
||||
storage_pool: null
|
||||
type: pd-balanced
|
||||
interface: null
|
||||
mode: READ_WRITE
|
||||
can_ip_forward: false
|
||||
deletion_protection: false
|
||||
description: Managed by the compute-vm Terraform module.
|
||||
desired_status: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
enable_display: false
|
||||
hostname: null
|
||||
instance_encryption_key: []
|
||||
key_revocation_action_type: NONE
|
||||
labels: null
|
||||
machine_type: f1-micro
|
||||
metadata: null
|
||||
metadata_startup_script: null
|
||||
name: my-vm
|
||||
network_interface:
|
||||
- access_config:
|
||||
- public_ptr_domain_name: null
|
||||
alias_ip_range: []
|
||||
ipv6_access_config: []
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
nic_type: null
|
||||
queue_count: null
|
||||
security_policy: null
|
||||
subnetwork: subnet_self_link
|
||||
network_performance_config: []
|
||||
params: []
|
||||
partner_metadata: null
|
||||
project: my-project
|
||||
resource_policies: null
|
||||
scheduling:
|
||||
- automatic_restart: true
|
||||
availability_domain: null
|
||||
graceful_shutdown: []
|
||||
host_error_timeout_seconds: null
|
||||
instance_termination_action: null
|
||||
local_ssd_recovery_timeout: []
|
||||
maintenance_interval: null
|
||||
max_run_duration: []
|
||||
min_node_cpus: null
|
||||
node_affinities: []
|
||||
on_host_maintenance: MIGRATE
|
||||
on_instance_stop_action: []
|
||||
preemptible: false
|
||||
provisioning_model: STANDARD
|
||||
skip_guest_os_shutdown: false
|
||||
termination_time: null
|
||||
scratch_disk: []
|
||||
service_account:
|
||||
- email: tf-vm-my-vm@my-project.iam.gserviceaccount.com
|
||||
scopes:
|
||||
- https://www.googleapis.com/auth/cloud-platform
|
||||
- https://www.googleapis.com/auth/userinfo.email
|
||||
shielded_instance_config: []
|
||||
tags: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
zone: europe-west1-b
|
||||
module.vm.google_service_account.service_account[0]:
|
||||
account_id: tf-vm-my-vm
|
||||
create_ignore_already_exists: null
|
||||
description: null
|
||||
disabled: false
|
||||
display_name: Terraform VM my-vm.
|
||||
email: tf-vm-my-vm@my-project.iam.gserviceaccount.com
|
||||
member: serviceAccount:tf-vm-my-vm@my-project.iam.gserviceaccount.com
|
||||
project: my-project
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_address.gateway[0]:
|
||||
address_type: EXTERNAL
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ip_collection: null
|
||||
ip_version: null
|
||||
ipv6_endpoint_type: null
|
||||
labels: null
|
||||
name: vpn-gateway-1
|
||||
network: null
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_forwarding_rule.esp:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: ESP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-gateway-1-esp
|
||||
no_automate_dns_zone: null
|
||||
ports: null
|
||||
project: my-project
|
||||
recreate_closed_psc: false
|
||||
region: europe-west1
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_forwarding_rule.udp-4500:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: UDP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-gateway-1-udp-4500
|
||||
no_automate_dns_zone: null
|
||||
port_range: '4500'
|
||||
ports: null
|
||||
project: my-project
|
||||
recreate_closed_psc: false
|
||||
region: europe-west1
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_forwarding_rule.udp-500:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: UDP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-gateway-1-udp-500
|
||||
no_automate_dns_zone: null
|
||||
port_range: '500'
|
||||
ports: null
|
||||
project: my-project
|
||||
recreate_closed_psc: false
|
||||
region: europe-west1
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_router.router[0]:
|
||||
bgp:
|
||||
- advertise_mode: DEFAULT
|
||||
advertised_groups: []
|
||||
advertised_ip_ranges: []
|
||||
asn: 64514
|
||||
keepalive_interval: 20
|
||||
description: null
|
||||
encrypted_interconnect_router: null
|
||||
md5_authentication_keys: []
|
||||
name: vpn-gateway-1
|
||||
network: vpc-name
|
||||
params: []
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_router_interface.router_interface["remote-1"]:
|
||||
interconnect_attachment: null
|
||||
ip_range: 169.254.139.133/30
|
||||
name: gateway-1-remote-1
|
||||
private_ip_address: null
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
router: vpn-gateway-1
|
||||
subnetwork: null
|
||||
timeouts: null
|
||||
vpn_tunnel: gateway-1-remote-1
|
||||
module.vpn-dynamic.google_compute_router_peer.bgp_peer["remote-1"]:
|
||||
advertise_mode: CUSTOM
|
||||
advertised_groups:
|
||||
- ALL_SUBNETS
|
||||
advertised_ip_ranges:
|
||||
- description: Advertised range description
|
||||
range: 192.168.0.0/24
|
||||
advertised_route_priority: 1000
|
||||
custom_learned_ip_ranges: []
|
||||
custom_learned_route_priority: null
|
||||
enable: true
|
||||
enable_ipv6: false
|
||||
export_policies: null
|
||||
import_policies: null
|
||||
interface: gateway-1-remote-1
|
||||
md5_authentication_key: []
|
||||
name: gateway-1-remote-1
|
||||
peer_asn: 64513
|
||||
peer_ip_address: 169.254.139.134
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
router: vpn-gateway-1
|
||||
router_appliance_instance: null
|
||||
timeouts: null
|
||||
zero_advertised_route_priority: null
|
||||
zero_custom_learned_route_priority: false
|
||||
module.vpn-dynamic.google_compute_vpn_gateway.gateway:
|
||||
description: null
|
||||
name: gateway-1
|
||||
network: vpc-name
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
timeouts: null
|
||||
module.vpn-dynamic.google_compute_vpn_tunnel.tunnels["remote-1"]:
|
||||
cipher_suite: []
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ike_version: 2
|
||||
labels: null
|
||||
name: gateway-1-remote-1
|
||||
peer_external_gateway: null
|
||||
peer_external_gateway_interface: null
|
||||
peer_gcp_gateway: null
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
router: vpn-gateway-1
|
||||
shared_secret_wo: null
|
||||
shared_secret_wo_version: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
vpn_gateway: null
|
||||
vpn_gateway_interface: null
|
||||
module.vpn-dynamic.random_id.secret:
|
||||
byte_length: 8
|
||||
keepers: null
|
||||
prefix: null
|
||||
|
||||
counts:
|
||||
google_compute_address: 1
|
||||
google_compute_forwarding_rule: 3
|
||||
google_compute_instance: 1
|
||||
google_compute_router_interface: 1
|
||||
google_compute_router_peer: 1
|
||||
google_compute_router: 1
|
||||
google_compute_vpn_gateway: 1
|
||||
google_compute_vpn_tunnel: 1
|
||||
google_service_account: 1
|
||||
modules: 2
|
||||
random_id: 1
|
||||
resources: 12
|
||||
|
||||
outputs: {}
|
||||
@@ -214,3 +214,5 @@ counts:
|
||||
modules: 2
|
||||
random_id: 6
|
||||
resources: 22
|
||||
|
||||
outputs: {}
|
||||
|
||||
@@ -0,0 +1,232 @@
|
||||
# Copyright 2026 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.vpn_ha.google_compute_external_vpn_gateway.external_gateway["default"]:
|
||||
description: Terraform managed external VPN gateway
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: "true"
|
||||
interface:
|
||||
- id: 0
|
||||
ip_address: 8.8.8.8
|
||||
ipv6_address: null
|
||||
labels: null
|
||||
name: mynet-to-onprem-default
|
||||
project: project-id
|
||||
redundancy_type: SINGLE_IP_INTERNALLY_REDUNDANT
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: "true"
|
||||
timeouts: null
|
||||
module.vpn_ha.google_compute_ha_vpn_gateway.ha_gateway[0]:
|
||||
description: Terraform managed external VPN gateway
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: "true"
|
||||
gateway_ip_version: IPV4
|
||||
labels: null
|
||||
name: mynet-to-onprem
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
stack_type: IPV4_ONLY
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: "true"
|
||||
timeouts: null
|
||||
module.vpn_ha.google_compute_router.router[0]:
|
||||
bgp:
|
||||
- advertise_mode: DEFAULT
|
||||
advertised_groups: []
|
||||
advertised_ip_ranges: []
|
||||
asn: 64514
|
||||
keepalive_interval: 20
|
||||
description: null
|
||||
encrypted_interconnect_router: null
|
||||
md5_authentication_keys: []
|
||||
name: vpn-mynet-to-onprem
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
timeouts: null
|
||||
module.vpn_ha.google_compute_router_interface.router_interface["remote-0"]:
|
||||
interconnect_attachment: null
|
||||
ip_range: 169.254.1.2/30
|
||||
name: mynet-to-onprem-remote-0
|
||||
private_ip_address: null
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
subnetwork: null
|
||||
timeouts: null
|
||||
vpn_tunnel: mynet-to-onprem-remote-0
|
||||
module.vpn_ha.google_compute_router_interface.router_interface["remote-1"]:
|
||||
interconnect_attachment: null
|
||||
ip_range: 169.254.2.2/30
|
||||
name: mynet-to-onprem-remote-1
|
||||
private_ip_address: null
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
subnetwork: null
|
||||
timeouts: null
|
||||
vpn_tunnel: mynet-to-onprem-remote-1
|
||||
module.vpn_ha.google_compute_router_peer.bgp_peer["remote-0"]:
|
||||
advertise_mode: DEFAULT
|
||||
advertised_groups: []
|
||||
advertised_ip_ranges: []
|
||||
advertised_route_priority: 1000
|
||||
custom_learned_ip_ranges:
|
||||
- range: 10.128.0.0/16
|
||||
custom_learned_route_priority: 1000
|
||||
enable: true
|
||||
enable_ipv6: false
|
||||
export_policies: null
|
||||
import_policies: null
|
||||
interface: mynet-to-onprem-remote-0
|
||||
md5_authentication_key:
|
||||
- key: bar
|
||||
name: foo
|
||||
name: mynet-to-onprem-remote-0
|
||||
peer_asn: 64513
|
||||
peer_ip_address: 169.254.1.1
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
router_appliance_instance: null
|
||||
timeouts: null
|
||||
zero_advertised_route_priority: null
|
||||
zero_custom_learned_route_priority: false
|
||||
module.vpn_ha.google_compute_router_peer.bgp_peer["remote-1"]:
|
||||
advertise_mode: DEFAULT
|
||||
advertised_groups: []
|
||||
advertised_ip_ranges: []
|
||||
advertised_route_priority: 1000
|
||||
custom_learned_ip_ranges:
|
||||
- range: 10.128.0.0/16
|
||||
custom_learned_route_priority: 1000
|
||||
enable: true
|
||||
enable_ipv6: false
|
||||
export_policies: null
|
||||
import_policies: null
|
||||
interface: mynet-to-onprem-remote-1
|
||||
md5_authentication_key:
|
||||
- key: bar
|
||||
name: foo
|
||||
name: mynet-to-onprem-remote-1
|
||||
peer_asn: 64513
|
||||
peer_ip_address: 169.254.2.1
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
router_appliance_instance: null
|
||||
timeouts: null
|
||||
zero_advertised_route_priority: null
|
||||
zero_custom_learned_route_priority: false
|
||||
module.vpn_ha.google_compute_vpn_tunnel.tunnels["remote-0"]:
|
||||
cipher_suite:
|
||||
- phase1:
|
||||
- dh:
|
||||
- Group-14
|
||||
encryption:
|
||||
- AES-CBC-256
|
||||
integrity:
|
||||
- HMAC-SHA2-256-128
|
||||
prf:
|
||||
- PRF-HMAC-SHA2-256
|
||||
phase2:
|
||||
- encryption:
|
||||
- AES-CBC-128
|
||||
integrity:
|
||||
- HMAC-SHA2-256-128
|
||||
pfs:
|
||||
- Group-14
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: "true"
|
||||
ike_version: 2
|
||||
labels: null
|
||||
name: mynet-to-onprem-remote-0
|
||||
peer_external_gateway_interface: 0
|
||||
peer_gcp_gateway: null
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
shared_secret: mySecret
|
||||
shared_secret_wo: null
|
||||
shared_secret_wo_version: null
|
||||
target_vpn_gateway: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: "true"
|
||||
timeouts: null
|
||||
vpn_gateway_interface: 0
|
||||
module.vpn_ha.google_compute_vpn_tunnel.tunnels["remote-1"]:
|
||||
cipher_suite:
|
||||
- phase1:
|
||||
- dh:
|
||||
- Group-14
|
||||
encryption:
|
||||
- AES-CBC-256
|
||||
integrity:
|
||||
- HMAC-SHA2-256-128
|
||||
prf:
|
||||
- PRF-HMAC-SHA2-256
|
||||
phase2:
|
||||
- encryption:
|
||||
- AES-CBC-128
|
||||
integrity:
|
||||
- HMAC-SHA2-256-128
|
||||
pfs:
|
||||
- Group-14
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: "true"
|
||||
ike_version: 2
|
||||
labels: null
|
||||
name: mynet-to-onprem-remote-1
|
||||
peer_external_gateway_interface: 0
|
||||
peer_gcp_gateway: null
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
shared_secret: mySecret
|
||||
shared_secret_wo: null
|
||||
shared_secret_wo_version: null
|
||||
target_vpn_gateway: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: "true"
|
||||
timeouts: null
|
||||
vpn_gateway_interface: 1
|
||||
module.vpn_ha.random_id.md5_keys["remote-0"]:
|
||||
byte_length: 12
|
||||
keepers: null
|
||||
prefix: null
|
||||
module.vpn_ha.random_id.md5_keys["remote-1"]:
|
||||
byte_length: 12
|
||||
keepers: null
|
||||
prefix: null
|
||||
module.vpn_ha.random_id.secret:
|
||||
byte_length: 8
|
||||
keepers: null
|
||||
prefix: null
|
||||
|
||||
counts:
|
||||
google_compute_external_vpn_gateway: 1
|
||||
google_compute_ha_vpn_gateway: 1
|
||||
google_compute_router: 1
|
||||
google_compute_router_interface: 2
|
||||
google_compute_router_peer: 2
|
||||
google_compute_vpn_tunnel: 2
|
||||
modules: 1
|
||||
random_id: 3
|
||||
resources: 12
|
||||
|
||||
outputs: {}
|
||||
@@ -196,3 +196,5 @@ counts:
|
||||
modules: 1
|
||||
random_id: 3
|
||||
resources: 12
|
||||
|
||||
outputs: {}
|
||||
|
||||
@@ -15,20 +15,33 @@
|
||||
values:
|
||||
module.vpn_ha.google_compute_external_vpn_gateway.external_gateway["default"]:
|
||||
description: Terraform managed external VPN gateway
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
interface:
|
||||
- id: 0
|
||||
ip_address: 8.8.8.8
|
||||
ipv6_address: null
|
||||
labels: null
|
||||
name: mynet-to-onprem-default
|
||||
project: project-id
|
||||
redundancy_type: SINGLE_IP_INTERNALLY_REDUNDANT
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
module.vpn_ha.google_compute_ha_vpn_gateway.ha_gateway[0]:
|
||||
description: Terraform managed external VPN gateway
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
gateway_ip_version: IPV4
|
||||
labels: null
|
||||
name: mynet-to-onprem
|
||||
network: projects/xxx/global/networks/aaa
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
project: project-id
|
||||
region: region
|
||||
region: europe-west8
|
||||
stack_type: IPV4_IPV6
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
module.vpn_ha.google_compute_router.router[0]:
|
||||
bgp:
|
||||
- advertise_mode: DEFAULT
|
||||
@@ -38,19 +51,23 @@ values:
|
||||
keepalive_interval: 20
|
||||
description: null
|
||||
encrypted_interconnect_router: null
|
||||
md5_authentication_keys: []
|
||||
name: vpn-mynet-to-onprem
|
||||
network: projects/xxx/global/networks/aaa
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
params: []
|
||||
project: project-id
|
||||
region: region
|
||||
region: europe-west8
|
||||
timeouts: null
|
||||
module.vpn_ha.google_compute_router_interface.router_interface["remote-0"]:
|
||||
interconnect_attachment: null
|
||||
ip_range: 169.254.1.2/30
|
||||
name: mynet-to-onprem-remote-0
|
||||
private_ip_address: null
|
||||
project: project-id
|
||||
region: region
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
subnetwork: null
|
||||
timeouts: null
|
||||
vpn_tunnel: mynet-to-onprem-remote-0
|
||||
module.vpn_ha.google_compute_router_interface.router_interface["remote-1"]:
|
||||
interconnect_attachment: null
|
||||
@@ -58,66 +75,109 @@ values:
|
||||
name: mynet-to-onprem-remote-1
|
||||
private_ip_address: null
|
||||
project: project-id
|
||||
region: region
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
subnetwork: null
|
||||
timeouts: null
|
||||
vpn_tunnel: mynet-to-onprem-remote-1
|
||||
module.vpn_ha.google_compute_router_peer.bgp_peer["remote-0"]:
|
||||
advertise_mode: DEFAULT
|
||||
advertised_groups: []
|
||||
advertised_ip_ranges: []
|
||||
advertised_route_priority: 1000
|
||||
custom_learned_ip_ranges: []
|
||||
custom_learned_route_priority: null
|
||||
enable: true
|
||||
enable_ipv6: true
|
||||
export_policies: null
|
||||
import_policies: null
|
||||
interface: mynet-to-onprem-remote-0
|
||||
md5_authentication_key: []
|
||||
name: mynet-to-onprem-remote-0
|
||||
peer_asn: 64513
|
||||
peer_ip_address: 169.254.1.1
|
||||
project: project-id
|
||||
region: region
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
router_appliance_instance: null
|
||||
timeouts: null
|
||||
zero_advertised_route_priority: null
|
||||
zero_custom_learned_route_priority: false
|
||||
module.vpn_ha.google_compute_router_peer.bgp_peer["remote-1"]:
|
||||
advertise_mode: DEFAULT
|
||||
advertised_groups: []
|
||||
advertised_ip_ranges: []
|
||||
advertised_route_priority: 1000
|
||||
custom_learned_ip_ranges: []
|
||||
custom_learned_route_priority: null
|
||||
enable: true
|
||||
enable_ipv6: true
|
||||
export_policies: null
|
||||
import_policies: null
|
||||
interface: mynet-to-onprem-remote-1
|
||||
ipv6_nexthop_address: 2600:2d00:0:2::1
|
||||
md5_authentication_key: []
|
||||
name: mynet-to-onprem-remote-1
|
||||
peer_asn: 64513
|
||||
peer_ip_address: 169.254.2.1
|
||||
peer_ipv6_nexthop_address: 2600:2d00:0:3::1
|
||||
project: project-id
|
||||
region: region
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
router_appliance_instance: null
|
||||
timeouts: null
|
||||
zero_advertised_route_priority: null
|
||||
zero_custom_learned_route_priority: false
|
||||
module.vpn_ha.google_compute_vpn_tunnel.tunnels["remote-0"]:
|
||||
cipher_suite: []
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ike_version: 2
|
||||
labels: null
|
||||
name: mynet-to-onprem-remote-0
|
||||
peer_external_gateway_interface: 0
|
||||
peer_gcp_gateway: null
|
||||
project: project-id
|
||||
region: region
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
shared_secret: mySecret
|
||||
shared_secret_wo: null
|
||||
shared_secret_wo_version: null
|
||||
target_vpn_gateway: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
vpn_gateway_interface: 0
|
||||
module.vpn_ha.google_compute_vpn_tunnel.tunnels["remote-1"]:
|
||||
cipher_suite: []
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ike_version: 2
|
||||
labels: null
|
||||
name: mynet-to-onprem-remote-1
|
||||
peer_external_gateway_interface: 0
|
||||
peer_gcp_gateway: null
|
||||
project: project-id
|
||||
region: region
|
||||
region: europe-west8
|
||||
router: vpn-mynet-to-onprem
|
||||
shared_secret: mySecret
|
||||
shared_secret_wo: null
|
||||
shared_secret_wo_version: null
|
||||
target_vpn_gateway: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
vpn_gateway_interface: 1
|
||||
module.vpn_ha.random_id.md5_keys["remote-0"]:
|
||||
byte_length: 12
|
||||
keepers: null
|
||||
prefix: null
|
||||
module.vpn_ha.random_id.md5_keys["remote-1"]:
|
||||
byte_length: 12
|
||||
keepers: null
|
||||
prefix: null
|
||||
module.vpn_ha.random_id.secret:
|
||||
byte_length: 8
|
||||
keepers: null
|
||||
@@ -126,10 +186,12 @@ values:
|
||||
counts:
|
||||
google_compute_external_vpn_gateway: 1
|
||||
google_compute_ha_vpn_gateway: 1
|
||||
google_compute_router: 1
|
||||
google_compute_router_interface: 2
|
||||
google_compute_router_peer: 2
|
||||
google_compute_router: 1
|
||||
google_compute_vpn_tunnel: 2
|
||||
modules: 1
|
||||
random_id: 3
|
||||
resources: 12
|
||||
|
||||
outputs: {}
|
||||
|
||||
@@ -0,0 +1,172 @@
|
||||
# Copyright 2026 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.addresses.google_compute_address.external["vpn"]:
|
||||
address_type: EXTERNAL
|
||||
description: Terraform managed.
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ip_collection: null
|
||||
ip_version: null
|
||||
ipv6_endpoint_type: null
|
||||
labels: null
|
||||
name: vpn
|
||||
network: null
|
||||
project: project-id
|
||||
region: europe-west1
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
module.vpn.google_compute_forwarding_rule.esp:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: ESP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-remote-esp
|
||||
no_automate_dns_zone: null
|
||||
ports: null
|
||||
project: project-id
|
||||
recreate_closed_psc: false
|
||||
region: europe-west8
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn.google_compute_forwarding_rule.udp-4500:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: UDP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-remote-udp-4500
|
||||
no_automate_dns_zone: null
|
||||
port_range: '4500'
|
||||
ports: null
|
||||
project: project-id
|
||||
recreate_closed_psc: false
|
||||
region: europe-west8
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn.google_compute_forwarding_rule.udp-500:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: UDP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-remote-udp-500
|
||||
no_automate_dns_zone: null
|
||||
port_range: '500'
|
||||
ports: null
|
||||
project: project-id
|
||||
recreate_closed_psc: false
|
||||
region: europe-west8
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn.google_compute_route.route["remote-0-10-10-0-0-24"]:
|
||||
description: null
|
||||
dest_range: 10.10.0.0/24
|
||||
name: vpn-remote-remote-0-10-10-0-0-24
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
next_hop_gateway: null
|
||||
next_hop_ilb: null
|
||||
next_hop_instance: null
|
||||
params: []
|
||||
priority: 1000
|
||||
project: project-id
|
||||
tags: null
|
||||
timeouts: null
|
||||
module.vpn.google_compute_vpn_gateway.gateway:
|
||||
description: null
|
||||
name: remote
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
timeouts: null
|
||||
module.vpn.google_compute_vpn_tunnel.tunnels["remote-0"]:
|
||||
cipher_suite:
|
||||
- phase1:
|
||||
- dh:
|
||||
- Group-14
|
||||
encryption:
|
||||
- AES-CBC-256
|
||||
integrity:
|
||||
- HMAC-SHA2-256-128
|
||||
prf:
|
||||
- PRF-HMAC-SHA2-256
|
||||
phase2:
|
||||
- encryption:
|
||||
- AES-CBC-128
|
||||
integrity:
|
||||
- HMAC-SHA2-256-128
|
||||
pfs:
|
||||
- Group-14
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ike_version: 2
|
||||
labels: null
|
||||
local_traffic_selector:
|
||||
- 0.0.0.0/0
|
||||
name: remote-remote-0
|
||||
peer_external_gateway: null
|
||||
peer_external_gateway_interface: null
|
||||
peer_gcp_gateway: null
|
||||
peer_ip: 1.1.1.1
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
remote_traffic_selector:
|
||||
- 0.0.0.0/0
|
||||
router: null
|
||||
shared_secret: mysecret
|
||||
shared_secret_wo: null
|
||||
shared_secret_wo_version: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
vpn_gateway: null
|
||||
vpn_gateway_interface: null
|
||||
module.vpn.random_id.secret:
|
||||
byte_length: 8
|
||||
keepers: null
|
||||
prefix: null
|
||||
|
||||
counts:
|
||||
google_compute_address: 1
|
||||
google_compute_forwarding_rule: 3
|
||||
google_compute_route: 1
|
||||
google_compute_vpn_gateway: 1
|
||||
google_compute_vpn_tunnel: 1
|
||||
modules: 2
|
||||
random_id: 1
|
||||
resources: 8
|
||||
|
||||
outputs: {}
|
||||
156
tests/modules/net_vpn_static/examples/vpn-single-tunnel.yaml
Normal file
156
tests/modules/net_vpn_static/examples/vpn-single-tunnel.yaml
Normal file
@@ -0,0 +1,156 @@
|
||||
# Copyright 2026 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.addresses.google_compute_address.external["vpn"]:
|
||||
address_type: EXTERNAL
|
||||
description: Terraform managed.
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ip_collection: null
|
||||
ip_version: null
|
||||
ipv6_endpoint_type: null
|
||||
labels: null
|
||||
name: vpn
|
||||
network: null
|
||||
project: project-id
|
||||
region: europe-west1
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
module.vpn.google_compute_forwarding_rule.esp:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: ESP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-remote-esp
|
||||
no_automate_dns_zone: null
|
||||
ports: null
|
||||
project: project-id
|
||||
recreate_closed_psc: false
|
||||
region: europe-west8
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn.google_compute_forwarding_rule.udp-4500:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: UDP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-remote-udp-4500
|
||||
no_automate_dns_zone: null
|
||||
port_range: '4500'
|
||||
ports: null
|
||||
project: project-id
|
||||
recreate_closed_psc: false
|
||||
region: europe-west8
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn.google_compute_forwarding_rule.udp-500:
|
||||
all_ports: null
|
||||
allow_global_access: null
|
||||
allow_psc_global_access: null
|
||||
backend_service: null
|
||||
description: null
|
||||
ip_collection: null
|
||||
ip_protocol: UDP
|
||||
is_mirroring_collector: null
|
||||
labels: null
|
||||
load_balancing_scheme: EXTERNAL
|
||||
name: vpn-remote-udp-500
|
||||
no_automate_dns_zone: null
|
||||
port_range: '500'
|
||||
ports: null
|
||||
project: project-id
|
||||
recreate_closed_psc: false
|
||||
region: europe-west8
|
||||
service_label: null
|
||||
source_ip_ranges: null
|
||||
timeouts: null
|
||||
module.vpn.google_compute_route.route["remote-0-10-10-0-0-24"]:
|
||||
description: null
|
||||
dest_range: 10.10.0.0/24
|
||||
name: vpn-remote-remote-0-10-10-0-0-24
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
next_hop_gateway: null
|
||||
next_hop_ilb: null
|
||||
next_hop_instance: null
|
||||
params: []
|
||||
priority: 1000
|
||||
project: project-id
|
||||
tags: null
|
||||
timeouts: null
|
||||
module.vpn.google_compute_vpn_gateway.gateway:
|
||||
description: null
|
||||
name: remote
|
||||
network: https://www.googleapis.com/compute/v1/projects/xxx/global/networks/aaa
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
timeouts: null
|
||||
module.vpn.google_compute_vpn_tunnel.tunnels["remote-0"]:
|
||||
cipher_suite: []
|
||||
description: null
|
||||
effective_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
ike_version: 2
|
||||
labels: null
|
||||
local_traffic_selector:
|
||||
- 0.0.0.0/0
|
||||
name: remote-remote-0
|
||||
peer_external_gateway: null
|
||||
peer_external_gateway_interface: null
|
||||
peer_gcp_gateway: null
|
||||
peer_ip: 1.1.1.1
|
||||
project: project-id
|
||||
region: europe-west8
|
||||
remote_traffic_selector:
|
||||
- 0.0.0.0/0
|
||||
router: null
|
||||
shared_secret: mysecret
|
||||
shared_secret_wo: null
|
||||
shared_secret_wo_version: null
|
||||
terraform_labels:
|
||||
goog-terraform-provisioned: 'true'
|
||||
timeouts: null
|
||||
vpn_gateway: null
|
||||
vpn_gateway_interface: null
|
||||
module.vpn.random_id.secret:
|
||||
byte_length: 8
|
||||
keepers: null
|
||||
prefix: null
|
||||
|
||||
counts:
|
||||
google_compute_address: 1
|
||||
google_compute_forwarding_rule: 3
|
||||
google_compute_route: 1
|
||||
google_compute_vpn_gateway: 1
|
||||
google_compute_vpn_tunnel: 1
|
||||
modules: 2
|
||||
random_id: 1
|
||||
resources: 8
|
||||
|
||||
outputs: {}
|
||||
Reference in New Issue
Block a user