fc84c4f60d
This pull request introduces the `net-vpc-factory` module. This new factory handles: * Project setup (most of what's supported by the `project` module) * VPC setup * Routing * Subnets * Connectivity options * NCC (hub, VPC spokes and VPN hybrid spokes) * Peerings * VPN (GCP-to-onprem and GCP-to-GCP) * NAT (everything supported by the `net-cloudnat` module) * DNS (everything supported by the `dns` module) * Firewall (everything supported by the `net-vpc-firewall` module)
112 lines
4.0 KiB
HCL
112 lines
4.0 KiB
HCL
/**
|
|
* Copyright 2025 Google LLC
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
# tfdoc:file:description VPN factory.
|
|
|
|
locals {
|
|
routers = merge(flatten([
|
|
for factory_key, factory_config in local.network_projects : [
|
|
for vpc_key, vpc_config in try(factory_config.vpc_config, {}) : [
|
|
for router_key, router_config in try(vpc_config.routers, {}) : {
|
|
"${factory_key}/${vpc_key}/${router_key}" = merge(router_config, {
|
|
vpc_self_link = module.vpc["${factory_key}/${vpc_key}"].self_link
|
|
project_id = module.projects[factory_key].id
|
|
custom_advertise = try(router_config.custom_advertise, {})
|
|
advertise_mode = try(router_config.custom_advertise != null, false) ? "CUSTOM" : "DEFAULT"
|
|
advertised_groups = try(router_config.custom_advertise.all_subnets, false) ? ["ALL_SUBNETS"] : []
|
|
keepalive = try(router_config.keepalive, null)
|
|
asn = try(router_config.asn, null)
|
|
})
|
|
}
|
|
]
|
|
]
|
|
])...)
|
|
|
|
vpns = merge(flatten([
|
|
for factory_key, factory_config in local.network_projects : [
|
|
for vpc_key, vpc_config in try(factory_config.vpc_config, {}) : [
|
|
for k, v in try(vpc_config.vpn_config, {}) : {
|
|
"${factory_key}/${vpc_key}/${k}" = merge(v, {
|
|
vpc_name = module.vpc["${factory_key}/${vpc_key}"].name
|
|
vpn_name = replace("${factory_key}/${vpc_key}/${k}", "/", "-")
|
|
project_id = module.projects[factory_key].id
|
|
},
|
|
{
|
|
router_config = merge(v.router_config,
|
|
try(v.router_config.create, false) == false && can(v.router_config.name) ? {
|
|
name = try(google_compute_router.default[v.router_config.name].name, v.router_config.name)
|
|
} : {}
|
|
)
|
|
}
|
|
)
|
|
}
|
|
]
|
|
]
|
|
])...)
|
|
}
|
|
|
|
resource "google_compute_router" "default" {
|
|
for_each = local.routers
|
|
name = replace(each.key, "/", "-")
|
|
project = each.value.project_id
|
|
region = each.value.region
|
|
network = each.value.vpc_self_link
|
|
bgp {
|
|
advertise_mode = each.value.advertise_mode
|
|
advertised_groups = each.value.advertised_groups
|
|
dynamic "advertised_ip_ranges" {
|
|
for_each = try(each.value.custom_advertise.ip_ranges, {})
|
|
iterator = range
|
|
content {
|
|
range = range.key
|
|
description = range.value
|
|
}
|
|
}
|
|
keepalive_interval = each.value.keepalive
|
|
asn = each.value.asn
|
|
}
|
|
}
|
|
|
|
resource "google_compute_ha_vpn_gateway" "default" {
|
|
for_each = local.vpns
|
|
project = each.value.project_id
|
|
region = each.value.region
|
|
name = replace(each.key, "/", "-")
|
|
network = each.value.vpc_name
|
|
stack_type = try(each.value.stack_type, null)
|
|
depends_on = [module.vpc]
|
|
}
|
|
|
|
module "vpn-ha" {
|
|
source = "../net-vpn-ha"
|
|
for_each = local.vpns
|
|
project_id = each.value.project_id
|
|
name = replace(each.key, "/", "-")
|
|
network = each.value.vpc_name
|
|
region = each.value.region
|
|
router_config = each.value.router_config
|
|
tunnels = each.value.tunnels
|
|
vpn_gateway = google_compute_ha_vpn_gateway.default[each.key].id
|
|
vpn_gateway_create = null
|
|
peer_gateways = {
|
|
for k, gw in each.value.peer_gateways : k => {
|
|
for gw_type, value in gw : gw_type => (
|
|
gw_type == "gcp" ? try(google_compute_ha_vpn_gateway.default[value].id, value) : value
|
|
)
|
|
}
|
|
}
|
|
}
|