hunfabric/modules/on-prem-in-a-box/README.md

On-prem-in-a-box Module

This module allows emulating an on-premise enviroment in a single GCE VM, by connecting a Docker Network to a VPC via a static or dynamic (BGP) VPN connection implemented with Strongswan. It provides a good playground for testing private access and hybrid DNS connectivity between on-premise and Google Cloud.

To see this module in action, please refer to the folowing end-to-end network examples:

• hub-and-spoke-peerings

TODO

• describe how to check and troubleshoot the onprem VPN and services
• add support for service account, scopes and network tags
• allow passing in arbitrary CoreDNS configurations instead of tweaking a default one via variables

Examples

Static VPN Gateway

module "cloud-vpn" {
  source     = "modules/net-vpn-static/"
  project_id = "<PROJECT_ID>"
  region     = "europe-west4"
  network    = "vpn-network"
  name       = "cloud-net-to-on-prem"
  remote_ranges = ["192.168.192.0/24"]
  tunnels = {
    remote-0 = {
      ike_version       = 2
      peer_ip           = module.on-prem.external_address
      shared_secret     = ""
      traffic_selectors = { local = ["0.0.0.0/0"], remote = null }
    }
  }
}

module "on-prem" {
  source = "modules/on-prem-in-a-box/"

  name                    = "onprem-instance"
  project_id              = "<PROJECT_ID>"
  zone                    = "europe-west4-b"
  network                 = <NETWORK_NAME>
  subnet_self_link        = "https://www.googleapis.com/compute/v1/projects/<PROJECT_ID>/regions/europe-west4/subnetworks/<SUBNETWORK_NAME>"
  vpn_gateway_type        = "static"
  peer_ip                 = module.cloud-vpn.address
  local_ip_cidr_range     = "192.168.192.0/24"
  shared_secret           = module.cloud-vpn.random_secret
  remote_ip_cidr_ranges   = "172.16.0.0/24,172.16.1.0/24,172.16.2.0/24"
}

Dynamic VPN Gateway

module "cloud-vpn" {
  source     = "modules/net-vpn-dynamic/"
  project_id = "<PROJECT_ID>"
  region     = "europe-west4"
  network    = "vpn-network"
  name       = "cloud-net-to-on-prem"
  router_asn = 65001
  tunnels = {
    remote-1 = {
      bgp_peer = {
        address = "169.254.0.2"
        asn     = 65002
      }
      bgp_session_range = "169.254.0.1/30"
      ike_version       = 2
      peer_ip           = module.on-prem.external_address
      shared_secret     = null
      bgp_peer_options = {
        advertise_groups = ["ALL_SUBNETS"]
        advertise_ip_ranges = {
        }
        advertise_mode = "DEFAULT"
        route_priority = 1000
      }
    }
  }
}

module "on-prem" {
  source = "modules/on-prem-in-a-box/"

  name                    = "onprem-instance"
  project_id              = "<PROJECT_ID>"
  zone                    = "europe-west4-b"
  network                 = "<NETWORK_NAME>"
  subnet_self_link        = "https://www.googleapis.com/compute/v1/projects/<PROJECT_ID>/regions/europe-west4/subnetworks/<SUBNETWORK_NAME>"
  vpn_gateway_type        = "dynamic"
  peer_ip                 = module.cloud-vpn.address
  local_ip_cidr_range     = "192.168.192.0/24"
  shared_secret           = module.cloud-vpn.random_secret
  peer_bgp_session_range  = "169.254.0.1/30"
  local_bgp_session_range = "169.254.0.2/30"
  peer_bgp_asn            = 65001
  local_bgp_asn           = 65002
}

Variables

name	description	type	required	default
network	VPC network name.	string	✓
project_id	Project id.	string	✓
subnet_self_link	VPC subnet self link.	string	✓
vpn_config	VPN configuration, type must be one of 'dynamic' or 'static'.	object({...})	✓
zone	Compute zone.	string	✓
coredns_config	CoreDNS configuration, set to null to use default.	string		null
dns_domain	DNS domain used for on-prem host records.	string		onprem.example.com
local_ip_cidr_range	IP CIDR range used for the Docker onprem network.	string		192.168.192.0/24
machine_type	Machine type.	string		g1-small
name	On-prem-in-a-box compute instance name.	string		onprem
network_tags	Network tags.	list(string)		["ssh"]
service_account	Service account customization.	object({...})		...
vpn_dynamic_config	BGP configuration for dynamic VPN, ignored if VPN type is 'static'.	object({...})		...
vpn_static_ranges	Remote CIDR ranges for static VPN, ignored if VPN type is 'dynamic'.	list(string)		[]

Outputs

name	description	sensitive
dns_ip_address	None
external_address	None
instance_name	None
internal_address	None
toolbox_ip_address	None
vpn_ip_address	None
web_ip_address	None