Skip to content

Commit 70501ec

Browse files
gaspar-chilingarovbharathkkb
gaspar-chilingarov
authored and
bharathkkb
committed
feat: implement support for Partner Interconnect (terraform-google-modules#345)
1 parent 02a4ac5 commit 70501ec

34 files changed

+773
-38
lines changed

‎1-org/envs/shared/README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@
2121
| enable\_hub\_and\_spoke | Enable Hub-and-Spoke architecture. | `bool` | `false` | no |
2222
| enable\_os\_login\_policy | Enable OS Login policy. | `bool` | `false` | no |
2323
| folder\_prefix | Name prefix to use for folders created. | `string` | `"fldr"` | no |
24-
| interconnect\_project\_alert\_pubsub\_topic | The name of the Cloud Pub/Sub topic where budget related messages will be published, in the form of `projects/{project_id}/topics/{topic_id}` for the interconnect project. | `string` | `null` | no |
25-
| interconnect\_project\_alert\_spent\_percents | A list of percentages of the budget to alert on when threshold is exceeded for the interconnect project. | `list(number)` | <pre>[<br> 0.5,<br> 0.75,<br> 0.9,<br> 0.95<br>]</pre> | no |
26-
| interconnect\_project\_budget\_amount | The amount to use as the budget for the interconnect project. | `number` | `1000` | no |
24+
| interconnect\_project\_alert\_pubsub\_topic | The name of the Cloud Pub/Sub topic where budget related messages will be published, in the form of `projects/{project_id}/topics/{topic_id}` for the Dedicated Interconnect project. | `string` | `null` | no |
25+
| interconnect\_project\_alert\_spent\_percents | A list of percentages of the budget to alert on when threshold is exceeded for the Dedicated Interconnect project. | `list(number)` | <pre>[<br> 0.5,<br> 0.75,<br> 0.9,<br> 0.95<br>]</pre> | no |
26+
| interconnect\_project\_budget\_amount | The amount to use as the budget for the Dedicated Interconnect project. | `number` | `1000` | no |
2727
| log\_export\_storage\_force\_destroy | (Optional) If set to true, delete all contents when destroying the resource; otherwise, destroying the resource will fail if contents are present. | `bool` | `false` | no |
2828
| log\_export\_storage\_location | The location of the storage bucket used to export logs. | `string` | `"US"` | no |
2929
| log\_export\_storage\_retention\_policy | Configuration of the bucket's data retention policy for how long objects in the bucket should be retained. | <pre>object({<br> is_locked = bool<br> retention_period_days = number<br> })</pre> | `null` | no |
@@ -59,7 +59,7 @@
5959
| common\_folder\_name | The common folder name |
6060
| dns\_hub\_project\_id | The DNS hub project ID |
6161
| domains\_to\_allow | The list of domains to allow users from in IAM. |
62-
| interconnect\_project\_id | The interconnect project ID |
62+
| interconnect\_project\_id | The Dedicated Interconnect project ID |
6363
| logs\_export\_pubsub\_topic | The Pub/Sub topic for destination of log exports |
6464
| logs\_export\_storage\_bucket\_name | The storage bucket for destination of log exports |
6565
| org\_audit\_logs\_project\_id | The org audit logs project ID |

‎1-org/envs/shared/outputs.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ output "org_secrets_project_id" {
5656

5757
output "interconnect_project_id" {
5858
value = module.interconnect.project_id
59-
description = "The interconnect project ID"
59+
description = "The Dedicated Interconnect project ID"
6060
}
6161

6262
output "scc_notifications_project_id" {

‎1-org/envs/shared/variables.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -190,19 +190,19 @@ variable "restricted_net_hub_project_budget_amount" {
190190
}
191191

192192
variable "interconnect_project_alert_spent_percents" {
193-
description = "A list of percentages of the budget to alert on when threshold is exceeded for the interconnect project."
193+
description = "A list of percentages of the budget to alert on when threshold is exceeded for the Dedicated Interconnect project."
194194
type = list(number)
195195
default = [0.5, 0.75, 0.9, 0.95]
196196
}
197197

198198
variable "interconnect_project_alert_pubsub_topic" {
199-
description = "The name of the Cloud Pub/Sub topic where budget related messages will be published, in the form of `projects/{project_id}/topics/{topic_id}` for the interconnect project."
199+
description = "The name of the Cloud Pub/Sub topic where budget related messages will be published, in the form of `projects/{project_id}/topics/{topic_id}` for the Dedicated Interconnect project."
200200
type = string
201201
default = null
202202
}
203203

204204
variable "interconnect_project_budget_amount" {
205-
description = "The amount to use as the budget for the interconnect project."
205+
description = "The amount to use as the budget for the Dedicated Interconnect project."
206206
type = number
207207
default = 1000
208208
}

‎3-networks/README.md

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
The purpose of this step is to:
44

55
- Setup the global [DNS Hub](https://cloud.google.com/blog/products/networking/cloud-forwarding-peering-and-zones).
6-
- Setup base and restricted shared VPCs with default DNS, NAT (optional), Private Service networking, VPC service controls, onprem dedicated interconnect and baseline firewall rules for each environment.
6+
- Setup base and restricted shared VPCs with default DNS, NAT (optional), Private Service networking, VPC service controls, onprem Dedicated or Partner Interconnect and baseline firewall rules for each environment.
77

88
## Prerequisites
99

@@ -22,9 +22,17 @@ If you have the prerequisites listed in the [Dedicated Interconnect README](./mo
2222
1. Update the file `interconnect.tf` with values that are valid for your environment for the interconnects, locations, candidate subnetworks, vlan_tag8021q and peer info.
2323
1. The candidate subnetworks and vlan_tag8021q variables can be set to `null` to allow the interconnect module to auto generate these values.
2424

25+
### Using Partner Interconnect
26+
27+
If you have the prerequisites listed in the [Partner Interconnect README](./modules/partner_interconnect/README.md) follow this steps to enable Partner Interconnect to access onprem.
28+
29+
1. Rename `partner_interconnect.tf.example` to `partner_interconnect.tf` and `interconnect.auto.tfvars.example` to `interconnect.auto.tfvars` in the environment folder in `3-networks/envs/<environment>` .
30+
1. Update the file `partner_interconnect.tf` with values that are valid for your environment for the VLAN attachments, locations, candidate subnetworks.
31+
1. The candidate subnetworks variable can be set to `null` to allow the interconnect module to auto generate this value.
32+
2533
### OPTIONAL - Using High Availability VPN
2634

27-
If you are not able to use dedicated interconnect, you can also use an HA VPN to access onprem.
35+
If you are not able to use Dedicated or Partner Interconnect, you can also use an HA Cloud VPN to access onprem.
2836

2937
1. Rename `vpn.tf.example` to `vpn.tf` in each environment folder in `3-networks/envs/<ENV>`.
3038
1. Create secret for VPN private preshared key `echo '<YOUR-PRESHARED-KEY-SECRET>' | gcloud secrets create <VPN_PRIVATE_PSK_SECRET_NAME> --project <ENV_SECRETS_PROJECT> --replication-policy=automatic --data-file=-`.

‎3-networks/envs/development/README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# 3-networks/development
22

3-
The purpose of this step is to set up base and restricted shared VPCs with default DNS, NAT (optional), Private Service networking, VPC service controls, onprem dedicated interconnect, onprem VPN and baseline firewall rules for environment development.
3+
The purpose of this step is to set up base and restricted shared VPCs with default DNS, NAT (optional), Private Service networking, VPC service controls, onprem Dedicated Interconnect, onprem VPN and baseline firewall rules for environment development.
44

55
## Prerequisites
66

@@ -22,6 +22,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
2222
| dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
2323
| domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
2424
| enable\_hub\_and\_spoke | Enable Hub-and-Spoke architecture. | `bool` | `false` | no |
25+
| enable\_partner\_interconnect | Enable Partner Interconnect in the environment. | `bool` | `false` | no |
2526
| firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
2627
| folder\_prefix | Name prefix to use for folders created. | `string` | `"fldr"` | no |
2728
| nat\_bgp\_asn | BGP ASN for first NAT cloud routes. | `number` | `64514` | no |
@@ -32,6 +33,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
3233
| optional\_fw\_rules\_enabled | Toggle creation of optional firewall rules: IAP SSH, IAP RDP and Internal & Global load balancing health check and load balancing IP ranges. | `bool` | `false` | no |
3334
| org\_id | Organization ID | `string` | n/a | yes |
3435
| parent\_folder | Optional - if using a folder for testing. | `string` | `""` | no |
36+
| preactivate\_partner\_interconnect | Preactivate Partner Interconnect VLAN attachment in the environment. | `bool` | `false` | no |
3537
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetworks. | `bool` | `true` | no |
3638
| terraform\_service\_account | Service account email of the account to impersonate to run Terraform. | `string` | n/a | yes |
3739
| windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |

‎3-networks/envs/development/interconnect.auto.tfvars.example

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
enable_partner_interconnect = true
3+
preactivate_partner_interconnect = true
4+

‎3-networks/envs/development/main.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ locals {
2222
base_project_id = data.google_projects.base_host_project.projects[0].project_id
2323
parent_id = var.parent_folder != "" ? "folders/${var.parent_folder}" : "organizations/${var.org_id}"
2424
mode = var.enable_hub_and_spoke ? "spoke" : null
25+
bgp_asn_number = var.enable_partner_interconnect ? "16550" : "64514"
2526
}
2627

2728
data "google_active_folder" "env" {
@@ -59,7 +60,7 @@ module "restricted_shared_vpc" {
5960
private_service_cidr = "10.0.176.0/20"
6061
org_id = var.org_id
6162
parent_folder = var.parent_folder
62-
bgp_asn_subnet = "64514"
63+
bgp_asn_subnet = local.bgp_asn_number
6364
default_region1 = var.default_region1
6465
default_region2 = var.default_region2
6566
domain = var.domain
@@ -121,7 +122,7 @@ module "base_shared_vpc" {
121122
default_region1 = var.default_region1
122123
default_region2 = var.default_region2
123124
domain = var.domain
124-
bgp_asn_subnet = "64514"
125+
bgp_asn_subnet = local.bgp_asn_number
125126
windows_activation_enabled = var.windows_activation_enabled
126127
dns_enable_inbound_forwarding = var.dns_enable_inbound_forwarding
127128
dns_enable_logging = var.dns_enable_logging

‎3-networks/envs/development/partner_interconnect.tf.example

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
/**
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
module "shared_restricted_interconnect" {
18+
source = "../../modules/partner_interconnect"
19+
20+
org_id = var.org_id
21+
parent_folder = var.parent_folder
22+
vpc_name = "${local.environment_code}-shared-restricted"
23+
environment = local.env
24+
enable_hub_and_spoke = var.enable_hub_and_spoke
25+
vpc_type = "restricted"
26+
preactivate = var.preactivate_partner_interconnect
27+
28+
region1 = var.default_region1
29+
region1_router1_name = module.restricted_shared_vpc.region1_router1.router.name
30+
region1_interconnect1_location = "las-zone1-770"
31+
region1_router2_name = module.restricted_shared_vpc.region1_router2.router.name
32+
region1_interconnect2_location = "las-zone1-770"
33+
34+
region2 = var.default_region2
35+
region2_router1_name = module.restricted_shared_vpc.region2_router1.router.name
36+
region2_interconnect1_location = "lax-zone2-19"
37+
region2_router2_name = module.restricted_shared_vpc.region2_router2.router.name
38+
region2_interconnect2_location = "lax-zone1-403"
39+
40+
folder_prefix = var.folder_prefix
41+
42+
cloud_router_labels = {
43+
vlan_1 = "cr5",
44+
vlan_2 = "cr6",
45+
vlan_3 = "cr7",
46+
vlan_4 = "cr8"
47+
}
48+
}
49+
50+
module "shared_base_interconnect" {
51+
source = "../../modules/partner_interconnect"
52+
53+
org_id = var.org_id
54+
parent_folder = var.parent_folder
55+
vpc_name = "${local.environment_code}-shared-base"
56+
environment = local.env
57+
enable_hub_and_spoke = var.enable_hub_and_spoke
58+
vpc_type = "base"
59+
preactivate = var.preactivate_partner_interconnect
60+
61+
region1 = var.default_region1
62+
region1_router1_name = module.base_shared_vpc.region1_router1.router.name
63+
region1_interconnect1_location = "las-zone1-770"
64+
region1_router2_name = module.base_shared_vpc.region1_router2.router.name
65+
region1_interconnect2_location = "las-zone1-770"
66+
67+
region2 = var.default_region2
68+
region2_router1_name = module.base_shared_vpc.region2_router1.router.name
69+
region2_interconnect1_location = "lax-zone2-19"
70+
region2_router2_name = module.base_shared_vpc.region2_router2.router.name
71+
region2_interconnect2_location = "lax-zone1-403"
72+
73+
folder_prefix = var.folder_prefix
74+
75+
cloud_router_labels = {
76+
vlan_1 = "cr1",
77+
vlan_2 = "cr2",
78+
vlan_3 = "cr3",
79+
vlan_4 = "cr4"
80+
}
81+
}

‎3-networks/envs/development/variables.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,3 +127,15 @@ variable "enable_hub_and_spoke" {
127127
type = bool
128128
default = false
129129
}
130+
131+
variable "enable_partner_interconnect" {
132+
description = "Enable Partner Interconnect in the environment."
133+
type = bool
134+
default = false
135+
}
136+
137+
variable "preactivate_partner_interconnect" {
138+
description = "Preactivate Partner Interconnect VLAN attachment in the environment."
139+
type = bool
140+
default = false
141+
}

‎3-networks/envs/non-production/README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# 3-networks/non-production
22

3-
The purpose of this step is to set up base and restricted shared VPCs with default DNS, NAT (optional), Private Service networking, VPC service controls, onprem dedicated interconnect, onprem VPN and baseline firewall rules for environment non-production.
3+
The purpose of this step is to set up base and restricted shared VPCs with default DNS, NAT (optional), Private Service networking, VPC service controls, onprem Dedicated Interconnect, onprem VPN and baseline firewall rules for environment non-production.
44

55
## Prerequisites
66

@@ -22,6 +22,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
2222
| dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
2323
| domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
2424
| enable\_hub\_and\_spoke | Enable Hub-and-Spoke architecture. | `bool` | `false` | no |
25+
| enable\_partner\_interconnect | Enable Partner Interconnect in the environment. | `bool` | `false` | no |
2526
| firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
2627
| folder\_prefix | Name prefix to use for folders created. | `string` | `"fldr"` | no |
2728
| nat\_bgp\_asn | BGP ASN for first NAT cloud routes. | `number` | `64514` | no |
@@ -32,6 +33,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
3233
| optional\_fw\_rules\_enabled | Toggle creation of optional firewall rules: IAP SSH, IAP RDP and Internal & Global load balancing health check and load balancing IP ranges. | `bool` | `false` | no |
3334
| org\_id | Organization ID | `string` | n/a | yes |
3435
| parent\_folder | Optional - if using a folder for testing. | `string` | `""` | no |
36+
| preactivate\_partner\_interconnect | Preactivate Partner Interconnect VLAN attachment in the environment. | `bool` | `false` | no |
3537
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetworks. | `bool` | `true` | no |
3638
| terraform\_service\_account | Service account email of the account to impersonate to run Terraform. | `string` | n/a | yes |
3739
| windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |

‎3-networks/envs/non-production/interconnect.auto.tfvars.example

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
enable_partner_interconnect = true
3+
preactivate_partner_interconnect = true
4+

‎3-networks/envs/non-production/main.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ locals {
2222
base_project_id = data.google_projects.base_host_project.projects[0].project_id
2323
parent_id = var.parent_folder != "" ? "folders/${var.parent_folder}" : "organizations/${var.org_id}"
2424
mode = var.enable_hub_and_spoke ? "spoke" : null
25+
bgp_asn_number = var.enable_partner_interconnect ? "16550" : "64514"
2526
}
2627

2728
data "google_active_folder" "env" {
@@ -48,7 +49,6 @@ data "google_projects" "base_host_project" {
4849
/******************************************
4950
Restricted shared VPC
5051
*****************************************/
51-
5252
module "restricted_shared_vpc" {
5353
source = "../../modules/restricted_shared_vpc"
5454
project_id = local.restricted_project_id
@@ -60,7 +60,7 @@ module "restricted_shared_vpc" {
6060
private_service_cidr = "10.0.112.0/20"
6161
org_id = var.org_id
6262
parent_folder = var.parent_folder
63-
bgp_asn_subnet = "64514"
63+
bgp_asn_subnet = local.bgp_asn_number
6464
default_region1 = var.default_region1
6565
default_region2 = var.default_region2
6666
domain = var.domain
@@ -122,7 +122,7 @@ module "base_shared_vpc" {
122122
default_region1 = var.default_region1
123123
default_region2 = var.default_region2
124124
domain = var.domain
125-
bgp_asn_subnet = "64514"
125+
bgp_asn_subnet = local.bgp_asn_number
126126
windows_activation_enabled = var.windows_activation_enabled
127127
dns_enable_inbound_forwarding = var.dns_enable_inbound_forwarding
128128
dns_enable_logging = var.dns_enable_logging

0 commit comments

Comments
 (0)