Skip to content

Commit b3b9145

Browse files
LuizSDCitdaniel-cit
LuizSDCit
and
daniel-cit
authored
feat: Feature/private service connect module (terraform-google-modules#722)
* create the private service connector module * fixes the domain for dns * Fixes an warning regarding parameters suage * fixes the test * fix Copyright year * remove unused variables at private service connect module * add global_address_id output * fix lint * add private_service_connect_ip variable * fix lint issues Co-authored-by: Daniel da Silva Andrade <[email protected]>
1 parent 78c7d90 commit b3b9145

File tree

12 files changed

+320
-218
lines changed

12 files changed

+320
-218
lines changed

‎3-networks/modules/base_shared_vpc/dns.tf

Lines changed: 0 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -50,105 +50,6 @@ resource "google_dns_policy" "default_policy" {
5050
}
5151
}
5252

53-
/******************************************
54-
Private Google APIs DNS Zone & records.
55-
*****************************************/
56-
57-
module "private_googleapis" {
58-
source = "terraform-google-modules/cloud-dns/google"
59-
version = "~> 4.0"
60-
project_id = var.project_id
61-
type = "private"
62-
name = "dz-${var.environment_code}-shared-base-apis"
63-
domain = "googleapis.com."
64-
description = "Private DNS zone to configure private.googleapis.com"
65-
66-
private_visibility_config_networks = [
67-
module.main.network_self_link
68-
]
69-
70-
recordsets = [
71-
{
72-
name = "*"
73-
type = "CNAME"
74-
ttl = 300
75-
records = ["private.googleapis.com."]
76-
},
77-
{
78-
name = "private"
79-
type = "A"
80-
ttl = 300
81-
records = ["199.36.153.8", "199.36.153.9", "199.36.153.10", "199.36.153.11"]
82-
},
83-
]
84-
}
85-
86-
/******************************************
87-
Private GCR DNS Zone & records.
88-
*****************************************/
89-
90-
module "base_gcr" {
91-
source = "terraform-google-modules/cloud-dns/google"
92-
version = "~> 3.1"
93-
project_id = var.project_id
94-
type = "private"
95-
name = "dz-${var.environment_code}-shared-base-gcr"
96-
domain = "gcr.io."
97-
description = "Private DNS zone to configure gcr.io"
98-
99-
private_visibility_config_networks = [
100-
module.main.network_self_link
101-
]
102-
103-
recordsets = [
104-
{
105-
name = "*"
106-
type = "CNAME"
107-
ttl = 300
108-
records = ["gcr.io."]
109-
},
110-
{
111-
name = ""
112-
type = "A"
113-
ttl = 300
114-
records = ["199.36.153.8", "199.36.153.9", "199.36.153.10", "199.36.153.11"]
115-
},
116-
]
117-
}
118-
119-
/***********************************************
120-
Private Artifact Registry DNS Zone & records.
121-
***********************************************/
122-
123-
module "base_pkg_dev" {
124-
source = "terraform-google-modules/cloud-dns/google"
125-
version = "~> 3.1"
126-
project_id = var.project_id
127-
type = "private"
128-
name = "dz-${var.environment_code}-shared-base-pkg-dev"
129-
domain = "pkg.dev."
130-
description = "Private DNS zone to configure pkg.dev"
131-
132-
private_visibility_config_networks = [
133-
module.main.network_self_link
134-
]
135-
136-
recordsets = [
137-
{
138-
name = "*"
139-
type = "CNAME"
140-
ttl = 300
141-
records = ["pkg.dev."]
142-
},
143-
{
144-
name = ""
145-
type = "A"
146-
ttl = 300
147-
records = ["199.36.153.8", "199.36.153.9", "199.36.153.10", "199.36.153.11"]
148-
},
149-
]
150-
}
151-
15253
/******************************************
15354
Creates DNS Peering to DNS HUB
15455
*****************************************/

‎3-networks/modules/base_shared_vpc/main.tf

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ locals {
1818
mode = var.mode == null ? "" : var.mode == "hub" ? "-hub" : "-spoke"
1919
vpc_name = "${var.environment_code}-shared-base${local.mode}"
2020
network_name = "vpc-${local.vpc_name}"
21-
private_googleapis_cidr = "199.36.153.8/30"
21+
private_googleapis_cidr = module.private_service_connect.private_service_connect_ip
2222
}
2323

2424
/******************************************
@@ -52,13 +52,6 @@ module "main" {
5252
secondary_ranges = var.secondary_ranges
5353

5454
routes = concat(
55-
[{
56-
name = "rt-${local.vpc_name}-1000-all-default-private-api"
57-
description = "Route through IGW to allow private google api access."
58-
destination_range = "199.36.153.8/30"
59-
next_hop_internet = "true"
60-
priority = "1000"
61-
}],
6255
var.nat_enabled ?
6356
[
6457
{

‎3-networks/modules/base_shared_vpc/private_service_connect.tf

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
18+
module "private_service_connect" {
19+
source = "../private_service_connect"
20+
project_id = var.project_id
21+
network_id = module.main.network_self_link
22+
environment_code = var.environment_code
23+
network_self_link = module.main.network_self_link
24+
private_service_connect_ip = "10.3.0.5"
25+
forwarding_rule_target = "all-apis"
26+
}

‎3-networks/modules/private_service_connect/dns.tf

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/******************************************
18+
Private Google APIs DNS Zone & records.
19+
*****************************************/
20+
21+
module "googleapis" {
22+
source = "terraform-google-modules/cloud-dns/google"
23+
version = "~> 4.0"
24+
project_id = var.project_id
25+
type = "private"
26+
name = "dz-${var.environment_code}-shared-${local.vpc_type}-apis"
27+
domain = "googleapis.com."
28+
description = "Private DNS zone to configure ${local.googleapis_url}"
29+
30+
private_visibility_config_networks = [
31+
var.network_self_link
32+
]
33+
34+
recordsets = [
35+
{
36+
name = "*"
37+
type = "CNAME"
38+
ttl = 300
39+
records = [local.googleapis_url]
40+
},
41+
{
42+
name = local.recordsets_name
43+
type = "A"
44+
ttl = 300
45+
records = [var.private_service_connect_ip]
46+
},
47+
]
48+
}
49+
50+
/******************************************
51+
GCR DNS Zone & records.
52+
*****************************************/
53+
54+
module "gcr" {
55+
source = "terraform-google-modules/cloud-dns/google"
56+
version = "~> 3.1"
57+
project_id = var.project_id
58+
type = "private"
59+
name = "dz-${var.environment_code}-shared-${local.vpc_type}-gcr"
60+
domain = "gcr.io."
61+
description = "Private DNS zone to configure gcr.io"
62+
63+
private_visibility_config_networks = [
64+
var.network_self_link
65+
]
66+
67+
recordsets = [
68+
{
69+
name = "*"
70+
type = "CNAME"
71+
ttl = 300
72+
records = ["gcr.io."]
73+
},
74+
{
75+
name = ""
76+
type = "A"
77+
ttl = 300
78+
records = [var.private_service_connect_ip]
79+
},
80+
]
81+
}
82+
83+
/***********************************************
84+
Artifact Registry DNS Zone & records.
85+
***********************************************/
86+
87+
module "pkg_dev" {
88+
source = "terraform-google-modules/cloud-dns/google"
89+
version = "~> 3.1"
90+
project_id = var.project_id
91+
type = "private"
92+
name = "dz-${var.environment_code}-shared-${local.vpc_type}-pkg-dev"
93+
domain = "pkg.dev."
94+
description = "Private DNS zone to configure pkg.dev"
95+
96+
private_visibility_config_networks = [
97+
var.network_self_link
98+
]
99+
100+
recordsets = [
101+
{
102+
name = "*"
103+
type = "CNAME"
104+
ttl = 300
105+
records = ["pkg.dev."]
106+
},
107+
{
108+
name = ""
109+
type = "A"
110+
ttl = 300
111+
records = [var.private_service_connect_ip]
112+
},
113+
]
114+
}

‎3-networks/modules/private_service_connect/main.tf

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
locals {
18+
vpc_type = var.forwarding_rule_target == "vpc-sc" ? "restricted" : "base"
19+
googleapis_url = var.forwarding_rule_target == "vpc-sc" ? "restricted.googleapis.com." : "private.googleapis.com."
20+
recordsets_name = split(".", local.googleapis_url)[0]
21+
}
22+
23+
resource "google_compute_global_address" "private_service_connect" {
24+
provider = google-beta
25+
project = var.project_id
26+
name = "global-psconnect-ip"
27+
address_type = "INTERNAL"
28+
purpose = "PRIVATE_SERVICE_CONNECT"
29+
network = var.network_id
30+
address = var.private_service_connect_ip
31+
}
32+
33+
resource "google_compute_global_forwarding_rule" "forwarding_rule_private_service_connect" {
34+
provider = google-beta
35+
project = var.project_id
36+
name = "globalrule"
37+
target = var.forwarding_rule_target
38+
network = var.network_id
39+
ip_address = google_compute_global_address.private_service_connect.id
40+
load_balancing_scheme = ""
41+
}

‎3-networks/modules/private_service_connect/outputs.tf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
output "private_service_connect_ip" {
18+
value = var.private_service_connect_ip
19+
description = "The private service connect ip"
20+
21+
depends_on = [
22+
google_compute_global_forwarding_rule.forwarding_rule_private_service_connect
23+
]
24+
}
25+
26+
output "global_address_id" {
27+
value = google_compute_global_address.private_service_connect.id
28+
description = "An identifier for the global address created for the private service connect with format `projects/{{project}}/global/addresses/{{name}}`"
29+
}

‎3-networks/modules/private_service_connect/variables.tf

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/**
2+
* Copyright 2022 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
variable "project_id" {
18+
description = "Project ID for Private Service Connect."
19+
type = string
20+
}
21+
22+
variable "network_id" {
23+
description = "Network ID for Private Service Connect."
24+
type = string
25+
}
26+
27+
variable "network_self_link" {
28+
description = "Network self link for Private Service Connect."
29+
type = string
30+
}
31+
32+
variable "environment_code" {
33+
description = "A short form of the folder level resources (environment) within the Google Cloud organization."
34+
type = string
35+
}
36+
37+
variable "private_service_connect_ip" {
38+
description = "The internal IP to be used for the private service connect."
39+
type = string
40+
}
41+
42+
variable "forwarding_rule_target" {
43+
description = "Target resource to receive the matched traffic. Only `all-apis` and `vpc-sc` are valid."
44+
type = string
45+
46+
validation {
47+
condition = var.forwarding_rule_target == "all-apis" || var.forwarding_rule_target == "vpc-sc"
48+
error_message = "For forwarding_rule_target only `all-apis` and `vpc-sc` are valid."
49+
}
50+
}

0 commit comments

Comments
 (0)