kovagoadi/hunfabric
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for cipher suite configuration on net-vpn-* modules (#3790)

Browse Source
This commit is contained in:
David Ferguson
2026-03-17 08:39:07 +00:00
committed by GitHub
parent bd87710eea
commit ea4469e19c
18 changed files with 1568 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/README.md
View File

@@ -61,8 +61,8 @@ These modules are used in the examples included in this repository. If you are u
- [Service Directory](./service-directory)
- [VPC](./net-vpc)
- [VPC firewall](./net-vpc-firewall)
- [VPN dynamic](./net-vpn-dynamic)
- [VPC peering](./net-vpc-peering)
- [VPN dynamic](./net-vpn-dynamic)
- [VPN HA](./net-vpn-ha)
- [VPN static](./net-vpn-static)

81
modules/net-vpn-dynamic/README.md
View File

@@ -1,10 +1,22 @@
# Cloud VPN Dynamic Module
## Example
This module makes it easy to deploy a [Classic VPN](https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/overview#classic-vpn) with dynamic (BGP) routing.
This example shows how to configure a single VPN tunnel using a couple of extra features
<!-- BEGIN TOC -->
- [Examples](#examples)
- [Classic VPN with single tunnel](#classic-vpn-with-single-tunnel)
- [Classic VPN with single tunnel and custom ciphers](#classic-vpn-with-single-tunnel-and-custom-ciphers)
- [Variables](#variables)
- [Outputs](#outputs)
<!-- END TOC -->
- custom advertisement on the tunnel's BGP session; if custom advertisement is not needed, simply set the `bgp_peer_options` attribute to `null`
## Examples
### Classic VPN with single tunnel
This example shows how to configure a single VPN tunnel using a couple of extra features:
- custom advertisement on the tunnel's BGP session; if custom advertisement is not needed, simply set the `custom_advertise` attribute to `null`
- internally generated shared secret, which can be fetched from the module's `random_secret` output for reuse; a predefined secret can be used instead by assigning it to the `shared_secret` attribute
```hcl
@@ -51,10 +63,66 @@ module "vpn-dynamic" {
}
}
}
# tftest modules=2 resources=12
# tftest modules=2 resources=12 inventory=vpn-single-tunnel.yaml
```
### Classic VPN with single tunnel and custom ciphers
This example shows how to configure a single VPN tunnel with custom ciphers.
```hcl
module "vm" {
source = "./fabric/modules/compute-vm"
project_id = "my-project"
zone = "europe-west1-b"
name = "my-vm"
network_interfaces = [{
nat = true
network = var.vpc.self_link
subnetwork = var.subnet.self_link
}]
service_account = {
auto_create = true
}
}
module "vpn-dynamic" {
source = "./fabric/modules/net-vpn-dynamic"
project_id = "my-project"
region = "europe-west1"
network = var.vpc.name
name = "gateway-1"
router_config = {
asn = 64514
}
tunnels = {
remote-1 = {
bgp_peer = {
address = "169.254.139.134"
asn = 64513
custom_advertise = null
}
bgp_session_range = "169.254.139.133/30"
cipher_suite = {
phase1 = {
dh = ["Group-14"]
encryption = ["AES-CBC-256"]
integrity = ["HMAC-SHA2-256-128"]
prf = ["PRF-HMAC-SHA2-256"]
}
phase2 = {
encryption = ["AES-CBC-128"]
integrity = ["HMAC-SHA2-256-128"]
pfs = ["Group-14"]
}
}
peer_ip = module.vm.external_ip
}
}
}
# tftest modules=2 resources=12 inventory=vpn-single-tunnel-custom-ciphers.yaml
```
<!-- BEGIN TFDOC -->
## Variables
| name | description | type | required | default |
@@ -66,7 +134,7 @@ module "vpn-dynamic" {
| [router_config](variables.tf#L49) | Cloud Router configuration for the VPN. If you want to reuse an existing router, set create to false and use name to specify the desired router. | <code title="object&#40;&#123;&#10; create &#61; optional&#40;bool, true&#41;&#10; asn &#61; number&#10; name &#61; optional&#40;string&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ | |
| [gateway_address](variables.tf#L17) | Optional address assigned to the VPN gateway. Ignored unless gateway_address_create is set to false. | <code>string</code> | | <code>null</code> |
| [gateway_address_create](variables.tf#L23) | Create external address assigned to the VPN gateway. Needs to be explicitly set to false to use address in gateway_address variable. | <code>bool</code> | | <code>true</code> |
| [tunnels](variables.tf#L64) | VPN tunnel configurations. | <code title="map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_ip &#61; string&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [tunnels](variables.tf#L64) | VPN tunnel configurations. | <code title="map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; all_vpc_subnets &#61; bool&#10; all_peer_vpc_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; cipher_suite &#61; optional&#40;object&#40;&#123;&#10; phase1 &#61; optional&#40;object&#40;&#123;&#10; dh &#61; optional&#40;list&#40;string&#41;&#41;&#10; encryption &#61; optional&#40;list&#40;string&#41;&#41;&#10; integrity &#61; optional&#40;list&#40;string&#41;&#41;&#10; prf &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#41;&#10; phase2 &#61; optional&#40;object&#40;&#123;&#10; encryption &#61; optional&#40;list&#40;string&#41;&#41;&#10; integrity &#61; optional&#40;list&#40;string&#41;&#41;&#10; pfs &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_ip &#61; string&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
## Outputs
@@ -83,5 +151,4 @@ module "vpn-dynamic" {
| [tunnel_names](outputs.tf#L58) | VPN tunnel names. | |
| [tunnel_self_links](outputs.tf#L66) | VPN tunnel self links. | |
| [tunnels](outputs.tf#L74) | VPN tunnel resources. | |
<!-- END TFDOC -->

26
modules/net-vpn-dynamic/main.tf
View File

@@ -152,7 +152,31 @@ resource "google_compute_vpn_tunnel" "tunnels" {
ike_version = each.value.ike_version
shared_secret = coalesce(each.value.shared_secret, local.secret)
target_vpn_gateway = google_compute_vpn_gateway.gateway.self_link
depends_on = [google_compute_forwarding_rule.esp]
dynamic "cipher_suite" {
for_each = each.value.cipher_suite != null ? [each.value.cipher_suite] : []
content {
dynamic "phase1" {
for_each = [cipher_suite.value.phase1]
content {
dh = try(phase1.value.dh, null)
encryption = try(phase1.value.encryption, null)
integrity = try(phase1.value.integrity, null)
prf = try(phase1.value.prf, null)
}
}
dynamic "phase2" {
for_each = [cipher_suite.value.phase2]
content {
encryption = try(phase2.value.encryption, null)
integrity = try(phase2.value.integrity, null)
pfs = try(phase2.value.pfs, null)
}
}
}
}
depends_on = [google_compute_forwarding_rule.esp]
}
resource "random_id" "secret" {

21
modules/net-vpn-dynamic/variables.tf
View File

@@ -78,10 +78,23 @@ variable "tunnels" {
# each BGP session on the same Cloud Router must use a unique /30 CIDR
# from the 169.254.0.0/16 block.
bgp_session_range = string
ike_version = optional(number, 2)
peer_ip = string
router = optional(string)
shared_secret = optional(string)
cipher_suite = optional(object({
phase1 = optional(object({
dh = optional(list(string))
encryption = optional(list(string))
integrity = optional(list(string))
prf = optional(list(string))
}))
phase2 = optional(object({
encryption = optional(list(string))
integrity = optional(list(string))
pfs = optional(list(string))
}))
}))
ike_version = optional(number, 2)
peer_ip = string
router = optional(string)
shared_secret = optional(string)
}))
default = {}
nullable = false

105
modules/net-vpn-ha/README.md
View File

@@ -6,6 +6,7 @@ This module makes it easy to deploy either GCP-to-GCP or GCP-to-On-prem [Cloud H
- [Examples](#examples)
- [GCP to GCP](#gcp-to-gcp)
- [GCP to on-prem](#gcp-to-on-prem)
- [GCP to on-prem with custom ciphers](#gcp-to-on-prem-with-custom-ciphers)
- [IPv6 (dual-stack)](#ipv6-dual-stack)
- [Recipes](#recipes)
- [Variables](#variables)
@@ -135,7 +136,7 @@ module "vpn_ha" {
bgp_peer = {
address = "169.254.2.1"
asn = 64513
# Custom learned routes are optional
# Custom learned routes are optional
custom_learned_ip_ranges = {
ip_ranges = {
"onprem-range" = "10.128.0.0/16"
@@ -157,6 +158,98 @@ module "vpn_ha" {
# tftest modules=1 resources=12 inventory=gcp-to-onprem.yaml
```
### GCP to on-prem with custom ciphers
```hcl
module "vpn_ha" {
source = "./fabric/modules/net-vpn-ha"
project_id = var.project_id
region = var.region
network = var.vpc.self_link
name = "mynet-to-onprem"
peer_gateways = {
default = {
external = {
redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT"
interfaces = ["8.8.8.8"] # on-prem router ip address
}
}
}
router_config = { asn = 64514 }
tunnels = {
remote-0 = {
bgp_peer = {
address = "169.254.1.1"
asn = 64513
# Custom learned routes are optional
custom_learned_ip_ranges = {
ip_ranges = {
"onprem-range" = "10.128.0.0/16"
}
}
# MD5 Authentication is optional
md5_authentication_key = {
name = "foo"
key = "bar"
}
}
bgp_session_range = "169.254.1.2/30"
cipher_suite = {
phase1 = {
dh = ["Group-14"]
encryption = ["AES-CBC-256"]
integrity = ["HMAC-SHA2-256-128"]
prf = ["PRF-HMAC-SHA2-256"]
}
phase2 = {
encryption = ["AES-CBC-128"]
integrity = ["HMAC-SHA2-256-128"]
pfs = ["Group-14"]
}
}
peer_external_gateway_interface = 0
shared_secret = "mySecret"
vpn_gateway_interface = 0
}
remote-1 = {
bgp_peer = {
address = "169.254.2.1"
asn = 64513
# Custom learned routes are optional
custom_learned_ip_ranges = {
ip_ranges = {
"onprem-range" = "10.128.0.0/16"
}
}
# MD5 Authentication is optional
md5_authentication_key = {
name = "foo"
key = "bar"
}
}
bgp_session_range = "169.254.2.2/30"
cipher_suite = {
phase1 = {
dh = ["Group-14"]
encryption = ["AES-CBC-256"]
integrity = ["HMAC-SHA2-256-128"]
prf = ["PRF-HMAC-SHA2-256"]
}
phase2 = {
encryption = ["AES-CBC-128"]
integrity = ["HMAC-SHA2-256-128"]
pfs = ["Group-14"]
}
}
peer_external_gateway_interface = 0
shared_secret = "mySecret"
vpn_gateway_interface = 1
}
}
}
# tftest modules=1 resources=12 inventory=gcp-to-onprem-custom-ciphers.yaml
```
### IPv6 (dual-stack)
You can optionally set your HA VPN gateway (and BGP sessions) to carry both IPv4 and IPv6 traffic. IPv6 only is not supported.
@@ -205,10 +298,10 @@ module "vpn_ha" {
}
}
vpn_gateway_create = {
stack_type = "IPV4_IPV6"
ipv6 = true
}
}
# tftest modules=1 resources=12 intentory=ipv6.yaml
# tftest modules=1 resources=12 inventory=ipv6.yaml
```
You can optionally avoid to specify MD5 keys and the module will automatically generate them for you.
@@ -228,9 +321,9 @@ You can optionally avoid to specify MD5 keys and the module will automatically g
| [router_config](variables.tf#L72) | Cloud Router configuration for the VPN. If you want to reuse an existing router, set create to false and use name to specify the desired router. | <code title="object&#40;&#123;&#10; asn &#61; optional&#40;number&#41;&#10; create &#61; optional&#40;bool, true&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; keepalive &#61; optional&#40;number&#41;&#10; name &#61; optional&#40;string&#41;&#10; override_name &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | ✓ | |
| [context](variables.tf#L17) | Context-specific interpolations. | <code title="object&#40;&#123;&#10; addresses &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; locations &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; networks &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; project_ids &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; routers &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10; vpn_gateways &#61; optional&#40;map&#40;string&#41;, &#123;&#125;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [peer_gateways](variables.tf#L41) | Configuration of the (external or GCP) peer gateway. | <code title="map&#40;object&#40;&#123;&#10; external &#61; optional&#40;object&#40;&#123;&#10; redundancy_type &#61; string&#10; interfaces &#61; list&#40;string&#41;&#10; description &#61; optional&#40;string, &#34;Terraform managed external VPN gateway&#34;&#41;&#10; name &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; gcp &#61; optional&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [tunnels](variables.tf#L88) | VPN tunnel configurations. | <code title="map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; custom_learned_ip_ranges &#61; optional&#40;object&#40;&#123;&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; md5_authentication_key &#61; optional&#40;object&#40;&#123;&#10; name &#61; string&#10; key &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; ipv6 &#61; optional&#40;object&#40;&#123;&#10; nexthop_address &#61; optional&#40;string&#41;&#10; peer_nexthop_address &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; name &#61; optional&#40;string&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; name &#61; optional&#40;string&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_router_interface_name &#61; optional&#40;string&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [vpn_gateway](variables.tf#L129) | HA VPN Gateway Self Link for using an existing HA VPN Gateway. Ignored if `vpn_gateway_create` is set to `true`. | <code>string</code> | | <code>null</code> |
| [vpn_gateway_create](variables.tf#L135) | Create HA VPN Gateway. Set to null to avoid creation. | <code title="object&#40;&#123;&#10; description &#61; optional&#40;string, &#34;Terraform managed external VPN gateway&#34;&#41;&#10; ipv6 &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [tunnels](variables.tf#L88) | VPN tunnel configurations. | <code title="map&#40;object&#40;&#123;&#10; bgp_peer &#61; object&#40;&#123;&#10; address &#61; string&#10; asn &#61; number&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; custom_advertise &#61; optional&#40;object&#40;&#123;&#10; all_subnets &#61; bool&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; custom_learned_ip_ranges &#61; optional&#40;object&#40;&#123;&#10; route_priority &#61; optional&#40;number, 1000&#41;&#10; ip_ranges &#61; map&#40;string&#41;&#10; &#125;&#41;&#41;&#10; md5_authentication_key &#61; optional&#40;object&#40;&#123;&#10; name &#61; string&#10; key &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; ipv6 &#61; optional&#40;object&#40;&#123;&#10; nexthop_address &#61; optional&#40;string&#41;&#10; peer_nexthop_address &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; name &#61; optional&#40;string&#41;&#10; &#125;&#41;&#10; bgp_session_range &#61; string&#10; cipher_suite &#61; optional&#40;object&#40;&#123;&#10; phase1 &#61; optional&#40;object&#40;&#123;&#10; dh &#61; optional&#40;list&#40;string&#41;&#41;&#10; encryption &#61; optional&#40;list&#40;string&#41;&#41;&#10; integrity &#61; optional&#40;list&#40;string&#41;&#41;&#10; prf &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#41;&#10; phase2 &#61; optional&#40;object&#40;&#123;&#10; encryption &#61; optional&#40;list&#40;string&#41;&#41;&#10; integrity &#61; optional&#40;list&#40;string&#41;&#41;&#10; pfs &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; name &#61; optional&#40;string&#41;&#10; peer_external_gateway_interface &#61; optional&#40;number&#41;&#10; peer_router_interface_name &#61; optional&#40;string&#41;&#10; peer_gateway &#61; optional&#40;string, &#34;default&#34;&#41;&#10; router &#61; optional&#40;string&#41;&#10; shared_secret &#61; optional&#40;string&#41;&#10; vpn_gateway_interface &#61; number&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [vpn_gateway](variables.tf#L142) | HA VPN Gateway Self Link for using an existing HA VPN Gateway. Ignored if `vpn_gateway_create` is set to `true`. | <code>string</code> | | <code>null</code> |
| [vpn_gateway_create](variables.tf#L148) | Create HA VPN Gateway. Set to null to avoid creation. | <code title="object&#40;&#123;&#10; description &#61; optional&#40;string, &#34;Terraform managed external VPN gateway&#34;&#41;&#10; ipv6 &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
## Outputs

23
modules/net-vpn-ha/main.tf
View File

@@ -189,6 +189,29 @@ resource "google_compute_vpn_tunnel" "tunnels" {
ike_version = each.value.ike_version
shared_secret = coalesce(each.value.shared_secret, local.secret)
vpn_gateway = local.vpn_gateway
dynamic "cipher_suite" {
for_each = each.value.cipher_suite != null ? [each.value.cipher_suite] : []
content {
dynamic "phase1" {
for_each = [cipher_suite.value.phase1]
content {
dh = try(phase1.value.dh, null)
encryption = try(phase1.value.encryption, null)
integrity = try(phase1.value.integrity, null)
prf = try(phase1.value.prf, null)
}
}
dynamic "phase2" {
for_each = [cipher_suite.value.phase2]
content {
encryption = try(phase2.value.encryption, null)
integrity = try(phase2.value.integrity, null)
pfs = try(phase2.value.pfs, null)
}
}
}
}
}
resource "random_id" "secret" {

15
modules/net-vpn-ha/variables.tf
View File

@@ -112,7 +112,20 @@ variable "tunnels" {
})
# each BGP session on the same Cloud Router must use a unique /30 CIDR
# from the 169.254.0.0/16 block.
bgp_session_range = string
bgp_session_range = string
cipher_suite = optional(object({
phase1 = optional(object({
dh = optional(list(string))
encryption = optional(list(string))
integrity = optional(list(string))
prf = optional(list(string))
}))
phase2 = optional(object({
encryption = optional(list(string))
integrity = optional(list(string))
pfs = optional(list(string))
}))
}))
ike_version = optional(number, 2)
name = optional(string)
peer_external_gateway_interface = optional(number)

64
modules/net-vpn-static/README.md
View File

@@ -1,6 +1,18 @@
# Cloud VPN Route-based Module
## Example
This module makes it easy to deploy a [Classic VPN](https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/overview#classic-vpn) with static routing.
<!-- BEGIN TOC -->
- [Examples](#examples)
- [Classic VPN with single tunnel](#classic-vpn-with-single-tunnel)
- [Classic VPN with single tunnel and custom ciphers](#classic-vpn-with-single-tunnel-and-custom-ciphers)
- [Variables](#variables)
- [Outputs](#outputs)
<!-- END TOC -->
## Examples
### Classic VPN with single tunnel
```hcl
module "addresses" {
@@ -28,10 +40,53 @@ module "vpn" {
}
}
}
# tftest modules=2 resources=8
# tftest modules=2 resources=8 inventory=vpn-single-tunnel.yaml
```
### Classic VPN with single tunnel and custom ciphers
```hcl
module "addresses" {
source = "./fabric/modules/net-address"
project_id = var.project_id
external_addresses = {
vpn = { region = "europe-west1" }
}
}
module "vpn" {
source = "./fabric/modules/net-vpn-static"
project_id = var.project_id
region = var.region
network = var.vpc.self_link
name = "remote"
gateway_address_create = false
gateway_address = module.addresses.external_addresses["vpn"].address
remote_ranges = ["10.10.0.0/24"]
tunnels = {
remote-0 = {
cipher_suite = {
phase1 = {
dh = ["Group-14"]
encryption = ["AES-CBC-256"]
integrity = ["HMAC-SHA2-256-128"]
prf = ["PRF-HMAC-SHA2-256"]
}
phase2 = {
encryption = ["AES-CBC-128"]
integrity = ["HMAC-SHA2-256-128"]
pfs = ["Group-14"]
}
}
peer_ip = "1.1.1.1"
shared_secret = "mysecret"
traffic_selectors = { local = ["0.0.0.0/0"], remote = ["0.0.0.0/0"] }
}
}
}
# tftest modules=2 resources=8 inventory=vpn-single-tunnel-custom-ciphers.yaml
```
<!-- BEGIN TFDOC -->
## Variables
| name | description | type | required | default |
@@ -44,7 +99,7 @@ module "vpn" {
| [gateway_address_create](variables.tf#L23) | Create external address assigned to the VPN gateway. Needs to be explicitly set to false to use address in gateway_address variable. | <code>bool</code> | | <code>true</code> |
| [remote_ranges](variables.tf#L49) | Remote IP CIDR ranges. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [route_priority](variables.tf#L56) | Route priority, defaults to 1000. | <code>number</code> | | <code>1000</code> |
| [tunnels](variables.tf#L62) | VPN tunnel configurations. | <code title="map&#40;object&#40;&#123;&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_ip &#61; string&#10; shared_secret &#61; optional&#40;string&#41;&#10; traffic_selectors &#61; object&#40;&#123;&#10; local &#61; list&#40;string&#41;&#10; remote &#61; list&#40;string&#41;&#10; &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [tunnels](variables.tf#L62) | VPN tunnel configurations. | <code title="map&#40;object&#40;&#123;&#10; cipher_suite &#61; optional&#40;object&#40;&#123;&#10; phase1 &#61; optional&#40;object&#40;&#123;&#10; dh &#61; optional&#40;list&#40;string&#41;&#41;&#10; encryption &#61; optional&#40;list&#40;string&#41;&#41;&#10; integrity &#61; optional&#40;list&#40;string&#41;&#41;&#10; prf &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#41;&#10; phase2 &#61; optional&#40;object&#40;&#123;&#10; encryption &#61; optional&#40;list&#40;string&#41;&#41;&#10; integrity &#61; optional&#40;list&#40;string&#41;&#41;&#10; pfs &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;&#10; ike_version &#61; optional&#40;number, 2&#41;&#10; peer_ip &#61; string&#10; shared_secret &#61; optional&#40;string&#41;&#10; traffic_selectors &#61; object&#40;&#123;&#10; local &#61; list&#40;string&#41;&#10; remote &#61; list&#40;string&#41;&#10; &#125;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
## Outputs
@@ -59,5 +114,4 @@ module "vpn" {
| [tunnel_names](outputs.tf#L47) | VPN tunnel names. | |
| [tunnel_self_links](outputs.tf#L55) | VPN tunnel self links. | |
| [tunnels](outputs.tf#L63) | VPN tunnel resources. | |
<!-- END TFDOC -->

26
modules/net-vpn-static/main.tf
View File

@@ -93,7 +93,31 @@ resource "google_compute_vpn_tunnel" "tunnels" {
ike_version = each.value.ike_version
shared_secret = coalesce(each.value.shared_secret, local.secret)
target_vpn_gateway = google_compute_vpn_gateway.gateway.self_link
depends_on = [google_compute_forwarding_rule.esp]
dynamic "cipher_suite" {
for_each = each.value.cipher_suite != null ? [each.value.cipher_suite] : []
content {
dynamic "phase1" {
for_each = [cipher_suite.value.phase1]
content {
dh = try(phase1.value.dh, null)
encryption = try(phase1.value.encryption, null)
integrity = try(phase1.value.integrity, null)
prf = try(phase1.value.prf, null)
}
}
dynamic "phase2" {
for_each = [cipher_suite.value.phase2]
content {
encryption = try(phase2.value.encryption, null)
integrity = try(phase2.value.integrity, null)
pfs = try(phase2.value.pfs, null)
}
}
}
}
depends_on = [google_compute_forwarding_rule.esp]
}
resource "random_id" "secret" {

13
modules/net-vpn-static/variables.tf
View File

@@ -62,6 +62,19 @@ variable "route_priority" {
variable "tunnels" {
description = "VPN tunnel configurations."
type = map(object({
cipher_suite = optional(object({
phase1 = optional(object({
dh = optional(list(string))
encryption = optional(list(string))
integrity = optional(list(string))
prf = optional(list(string))
}))
phase2 = optional(object({
encryption = optional(list(string))
integrity = optional(list(string))
pfs = optional(list(string))
}))
}))
ike_version = optional(number, 2)
peer_ip = string
shared_secret = optional(string)