Skip to content

Commit cdb97bf

Browse files
LuizSDCitbharathkkb
LuizSDCit
and
bharathkkb
authored
feat: Refactor/centralized network variable (terraform-google-modules#665)
* Add base env module * change the module to call the base env * fix the daniel reviews * add description to the variable * Remove others variable and hard code the value * fix the docs remove the params * hardcode the preactivate_partner_interconnectvariable * Fix the readme with the new source of files * Update 3-networks/README.md Co-authored-by: Bharath KKB <[email protected]> * Update 3-networks/README.md Co-authored-by: Bharath KKB <[email protected]> * Update 3-networks/README.md Co-authored-by: Bharath KKB <[email protected]> * accept some reviews * remove the enable_partner_interconnectvariable * fix the lint * fix the test * put the enable partner interconnect variable in the env module * hardcode the value of enable_partnet_interconnection Co-authored-by: Bharath KKB <[email protected]>
1 parent 3f61dba commit cdb97bf

35 files changed

+612
-1408
lines changed

‎3-networks/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,23 +86,23 @@ You need to set variables `enable_hub_and_spoke` and `enable_hub_and_spoke_trans
8686

8787
If you provisioned the prerequisites listed in the [Dedicated Interconnect README](./modules/dedicated_interconnect/README.md), follow these steps to enable Dedicated Interconnect to access on-premises resources.
8888

89-
1. Rename `interconnect.tf.example` to `interconnect.tf` in each environment folder in `3-networks/envs/<ENV>`.
89+
1. Rename `interconnect.tf.example` to `interconnect.tf` in base_env folder in `3-networks/modules/base_env`.
9090
1. Update the file `interconnect.tf` with values that are valid for your environment for the interconnects, locations, candidate subnetworks, vlan_tag8021q and peer info.
9191
1. The candidate subnetworks and vlan_tag8021q variables can be set to `null` to allow the interconnect module to auto generate these values.
9292

9393
### Using Partner Interconnect
9494

9595
If you provisioned the prerequisites listed in the [Partner Interconnect README](./modules/partner_interconnect/README.md) follow this steps to enable Partner Interconnect to access on-premises resources.
9696

97-
1. Rename `partner_interconnect.tf.example` to `partner_interconnect.tf` and `interconnect.auto.tfvars.example` to `interconnect.auto.tfvars` in the environment folder in `3-networks/envs/<environment>` .
97+
1. Rename `partner_interconnect.tf.example` to `partner_interconnect.tf` in the base-env folder in `3-networks/modules/base_env` .
9898
1. Update the file `partner_interconnect.tf` with values that are valid for your environment for the VLAN attachments, locations, and candidate subnetworks.
9999
1. The candidate subnetworks variable can be set to `null` to allow the interconnect module to auto generate this value.
100100

101101
### OPTIONAL - Using High Availability VPN
102102

103103
If you are not able to use Dedicated or Partner Interconnect, you can also use an HA Cloud VPN to access on-premises resources.
104104

105-
1. Rename `vpn.tf.example` to `vpn.tf` in each environment folder in `3-networks/envs/<ENV>`.
105+
1. Rename `vpn.tf.example` to `vpn.tf` in base-env folder in `3-networks/modules/base_env`.
106106
1. Create secret for VPN private preshared key.
107107
```
108108
echo '<YOUR-PRESHARED-KEY-SECRET>' | gcloud secrets create <VPN_PRIVATE_PSK_SECRET_NAME> --project <ENV_SECRETS_PROJECT> --replication-policy=automatic --data-file=-

‎3-networks/common.auto.example.tfvars

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,6 @@ org_id = "000000000000"
1818

1919
terraform_service_account = "[email protected]"
2020

21-
default_region1 = "us-central1"
22-
23-
default_region2 = "us-west1"
24-
2521
// The DNS name of peering managed zone. Must end with a period.
2622
domain = "example.com."
2723

‎3-networks/envs/development/README.md

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,27 +16,13 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
1616
| Name | Description | Type | Default | Required |
1717
|------|-------------|------|---------|:--------:|
1818
| access\_context\_manager\_policy\_id | The id of the default Access Context Manager policy created in step `1-org`. Can be obtained by running `gcloud access-context-manager policies list --organization YOUR_ORGANIZATION_ID --format="value(name)"`. | `number` | n/a | yes |
19-
| default\_region1 | First subnet region. The shared vpc modules only configures two regions. | `string` | n/a | yes |
20-
| default\_region2 | Second subnet region. The shared vpc modules only configures two regions. | `string` | n/a | yes |
21-
| dns\_enable\_inbound\_forwarding | Toggle inbound query forwarding for VPC DNS. | `bool` | `true` | no |
22-
| dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
2319
| domain | The DNS name of peering managed zone, for instance 'example.com.'. Must end with a period. | `string` | n/a | yes |
2420
| enable\_hub\_and\_spoke | Enable Hub-and-Spoke architecture. | `bool` | `false` | no |
2521
| enable\_hub\_and\_spoke\_transitivity | Enable transitivity via gateway VMs on Hub-and-Spoke architecture. | `bool` | `false` | no |
26-
| enable\_partner\_interconnect | Enable Partner Interconnect in the environment. | `bool` | `false` | no |
27-
| firewall\_enable\_logging | Toggle firewall logging for VPC Firewalls. | `bool` | `true` | no |
2822
| folder\_prefix | Name prefix to use for folders created. Should be the same in all steps. | `string` | `"fldr"` | no |
29-
| nat\_bgp\_asn | BGP ASN for first NAT cloud routes. | `number` | `64514` | no |
30-
| nat\_enabled | Toggle creation of NAT cloud router. | `bool` | `false` | no |
31-
| nat\_num\_addresses | Number of external IPs to reserve for Cloud NAT. | `number` | `2` | no |
32-
| nat\_num\_addresses\_region1 | Number of external IPs to reserve for first Cloud NAT. | `number` | `2` | no |
33-
| nat\_num\_addresses\_region2 | Number of external IPs to reserve for second Cloud NAT. | `number` | `2` | no |
3423
| org\_id | Organization ID | `string` | n/a | yes |
3524
| parent\_folder | Optional - for an organization with existing projects or for development/validation. It will place all the example foundation resources under the provided folder instead of the root organization. The value is the numeric folder ID. The folder must already exist. Must be the same value used in previous step. | `string` | `""` | no |
36-
| preactivate\_partner\_interconnect | Preactivate Partner Interconnect VLAN attachment in the environment. | `bool` | `false` | no |
37-
| subnetworks\_enable\_logging | Toggle subnetworks flow logging for VPC Subnetworks. | `bool` | `true` | no |
3825
| terraform\_service\_account | Service account email of the account to impersonate to run Terraform. | `string` | n/a | yes |
39-
| windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |
4026

4127
## Outputs
4228

‎3-networks/envs/development/interconnect.auto.tfvars.example

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎3-networks/envs/development/main.tf

Lines changed: 34 additions & 146 deletions
Original file line numberDiff line numberDiff line change
@@ -15,184 +15,72 @@
1515
*/
1616

1717
locals {
18-
environment_code = "d"
19-
env = "development"
20-
restricted_project_id = data.google_projects.restricted_host_project.projects[0].project_id
21-
restricted_project_number = data.google_project.restricted_host_project.number
22-
base_project_id = data.google_projects.base_host_project.projects[0].project_id
23-
parent_id = var.parent_folder != "" ? "folders/${var.parent_folder}" : "organizations/${var.org_id}"
24-
mode = var.enable_hub_and_spoke ? "spoke" : null
25-
bgp_asn_number = var.enable_partner_interconnect ? "16550" : "64514"
26-
enable_transitivity = var.enable_hub_and_spoke && var.enable_hub_and_spoke_transitivity
18+
env = "development"
19+
environment_code = substr(local.env, 0, 1)
20+
default_region1 = "us-west1"
21+
default_region2 = "us-central1"
2722
/*
2823
* Base network ranges
2924
*/
30-
base_subnet_aggregates = ["10.0.0.0/16", "10.1.0.0/16", "100.64.0.0/16", "100.65.0.0/16"]
31-
base_hub_subnet_ranges = ["10.0.0.0/24", "10.1.0.0/24"]
3225
base_private_service_cidr = "10.16.64.0/21"
3326
base_subnet_primary_ranges = {
34-
(var.default_region1) = "10.0.64.0/21"
35-
(var.default_region2) = "10.1.64.0/21"
27+
(local.default_region1) = "10.0.64.0/21"
28+
(local.default_region2) = "10.1.64.0/21"
3629
}
3730
base_subnet_secondary_ranges = {
38-
(var.default_region1) = [
31+
(local.default_region1) = [
3932
{
40-
range_name = "rn-${local.environment_code}-shared-base-${var.default_region1}-gke-pod"
33+
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-pod"
4134
ip_cidr_range = "100.64.64.0/21"
4235
},
4336
{
44-
range_name = "rn-${local.environment_code}-shared-base-${var.default_region1}-gke-svc"
37+
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-svc"
4538
ip_cidr_range = "100.64.72.0/21"
4639
}
4740
]
4841
}
4942
/*
5043
* Restricted network ranges
5144
*/
52-
restricted_subnet_aggregates = ["10.8.0.0/16", "10.9.0.0/16", "100.72.0.0/16", "100.73.0.0/16"]
53-
restricted_hub_subnet_ranges = ["10.8.0.0/24", "10.9.0.0/24"]
5445
restricted_private_service_cidr = "10.24.64.0/21"
5546
restricted_subnet_primary_ranges = {
56-
(var.default_region1) = "10.8.64.0/21"
57-
(var.default_region2) = "10.9.64.0/21"
47+
(local.default_region1) = "10.8.64.0/21"
48+
(local.default_region2) = "10.9.64.0/21"
5849
}
5950
restricted_subnet_secondary_ranges = {
60-
(var.default_region1) = [
51+
(local.default_region1) = [
6152
{
62-
range_name = "rn-${local.environment_code}-shared-restricted-${var.default_region1}-gke-pod"
53+
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-pod"
6354
ip_cidr_range = "100.72.64.0/21"
6455
},
6556
{
66-
range_name = "rn-${local.environment_code}-shared-restricted-${var.default_region1}-gke-svc"
57+
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-svc"
6758
ip_cidr_range = "100.72.72.0/21"
6859
}
6960
]
7061
}
7162
}
7263

73-
data "google_active_folder" "env" {
74-
display_name = "${var.folder_prefix}-${local.env}"
75-
parent = local.parent_id
76-
}
77-
78-
/******************************************
79-
VPC Host Projects
80-
*****************************************/
81-
82-
data "google_projects" "restricted_host_project" {
83-
filter = "parent.id:${split("/", data.google_active_folder.env.name)[1]} labels.application_name=restricted-shared-vpc-host labels.environment=${local.env} lifecycleState=ACTIVE"
84-
}
85-
86-
data "google_project" "restricted_host_project" {
87-
project_id = data.google_projects.restricted_host_project.projects[0].project_id
88-
}
89-
90-
data "google_projects" "base_host_project" {
91-
filter = "parent.id:${split("/", data.google_active_folder.env.name)[1]} labels.application_name=base-shared-vpc-host labels.environment=${local.env} lifecycleState=ACTIVE"
92-
}
93-
94-
/******************************************
95-
Restricted shared VPC
96-
*****************************************/
97-
module "restricted_shared_vpc" {
98-
source = "../../modules/restricted_shared_vpc"
99-
project_id = local.restricted_project_id
100-
project_number = local.restricted_project_number
101-
environment_code = local.environment_code
102-
access_context_manager_policy_id = var.access_context_manager_policy_id
103-
restricted_services = ["bigquery.googleapis.com", "storage.googleapis.com"]
104-
members = ["serviceAccount:${var.terraform_service_account}"]
105-
private_service_cidr = local.restricted_private_service_cidr
106-
org_id = var.org_id
107-
parent_folder = var.parent_folder
108-
bgp_asn_subnet = local.bgp_asn_number
109-
default_region1 = var.default_region1
110-
default_region2 = var.default_region2
111-
domain = var.domain
112-
dns_enable_inbound_forwarding = var.dns_enable_inbound_forwarding
113-
dns_enable_logging = var.dns_enable_logging
114-
firewall_enable_logging = var.firewall_enable_logging
115-
windows_activation_enabled = var.windows_activation_enabled
116-
nat_enabled = var.nat_enabled
117-
nat_bgp_asn = var.nat_bgp_asn
118-
nat_num_addresses_region1 = var.nat_num_addresses_region1
119-
nat_num_addresses_region2 = var.nat_num_addresses_region2
120-
folder_prefix = var.folder_prefix
121-
mode = local.mode
64+
module "base_env" {
65+
source = "../../modules/base_env"
12266

123-
subnets = [
124-
{
125-
subnet_name = "sb-${local.environment_code}-shared-restricted-${var.default_region1}"
126-
subnet_ip = local.restricted_subnet_primary_ranges[var.default_region1]
127-
subnet_region = var.default_region1
128-
subnet_private_access = "true"
129-
subnet_flow_logs = var.subnetworks_enable_logging
130-
description = "First ${local.env} subnet example."
131-
},
132-
{
133-
subnet_name = "sb-${local.environment_code}-shared-restricted-${var.default_region2}"
134-
subnet_ip = local.restricted_subnet_primary_ranges[var.default_region2]
135-
subnet_region = var.default_region2
136-
subnet_private_access = "true"
137-
subnet_flow_logs = var.subnetworks_enable_logging
138-
description = "Second ${local.env} subnet example."
139-
}
140-
]
141-
secondary_ranges = {
142-
"sb-${local.environment_code}-shared-restricted-${var.default_region1}" = local.restricted_subnet_secondary_ranges[var.default_region1]
143-
}
144-
allow_all_ingress_ranges = local.enable_transitivity ? local.restricted_hub_subnet_ranges : null
145-
allow_all_egress_ranges = local.enable_transitivity ? local.restricted_subnet_aggregates : null
146-
}
67+
env = local.env
68+
environment_code = local.environment_code
69+
org_id = var.org_id
70+
access_context_manager_policy_id = var.access_context_manager_policy_id
71+
terraform_service_account = var.terraform_service_account
72+
default_region1 = local.default_region1
73+
default_region2 = local.default_region2
74+
domain = var.domain
75+
parent_folder = var.parent_folder
76+
enable_hub_and_spoke = var.enable_hub_and_spoke
77+
enable_partner_interconnect = false
78+
enable_hub_and_spoke_transitivity = var.enable_hub_and_spoke_transitivity
79+
base_private_service_cidr = local.base_private_service_cidr
80+
base_subnet_primary_ranges = local.base_subnet_primary_ranges
81+
base_subnet_secondary_ranges = local.base_subnet_secondary_ranges
82+
restricted_private_service_cidr = local.restricted_private_service_cidr
83+
restricted_subnet_primary_ranges = local.restricted_subnet_primary_ranges
84+
restricted_subnet_secondary_ranges = local.restricted_subnet_secondary_ranges
14785

148-
/******************************************
149-
Base shared VPC
150-
*****************************************/
151-
152-
module "base_shared_vpc" {
153-
source = "../../modules/base_shared_vpc"
154-
project_id = local.base_project_id
155-
environment_code = local.environment_code
156-
private_service_cidr = local.base_private_service_cidr
157-
org_id = var.org_id
158-
parent_folder = var.parent_folder
159-
default_region1 = var.default_region1
160-
default_region2 = var.default_region2
161-
domain = var.domain
162-
bgp_asn_subnet = local.bgp_asn_number
163-
dns_enable_inbound_forwarding = var.dns_enable_inbound_forwarding
164-
dns_enable_logging = var.dns_enable_logging
165-
firewall_enable_logging = var.firewall_enable_logging
166-
windows_activation_enabled = var.windows_activation_enabled
167-
nat_enabled = var.nat_enabled
168-
nat_bgp_asn = var.nat_bgp_asn
169-
nat_num_addresses_region1 = var.nat_num_addresses_region1
170-
nat_num_addresses_region2 = var.nat_num_addresses_region2
171-
nat_num_addresses = var.nat_num_addresses
172-
folder_prefix = var.folder_prefix
173-
mode = local.mode
174-
175-
subnets = [
176-
{
177-
subnet_name = "sb-${local.environment_code}-shared-base-${var.default_region1}"
178-
subnet_ip = local.base_subnet_primary_ranges[var.default_region1]
179-
subnet_region = var.default_region1
180-
subnet_private_access = "true"
181-
subnet_flow_logs = var.subnetworks_enable_logging
182-
description = "First ${local.env} subnet example."
183-
},
184-
{
185-
subnet_name = "sb-${local.environment_code}-shared-base-${var.default_region2}"
186-
subnet_ip = local.base_subnet_primary_ranges[var.default_region2]
187-
subnet_region = var.default_region2
188-
subnet_private_access = "true"
189-
subnet_flow_logs = var.subnetworks_enable_logging
190-
description = "Second ${local.env} subnet example."
191-
}
192-
]
193-
secondary_ranges = {
194-
"sb-${local.environment_code}-shared-base-${var.default_region1}" = local.base_subnet_secondary_ranges[var.default_region1]
195-
}
196-
allow_all_ingress_ranges = local.enable_transitivity ? local.base_hub_subnet_ranges : null
197-
allow_all_egress_ranges = local.enable_transitivity ? local.base_subnet_aggregates : null
19886
}

‎3-networks/envs/development/outputs.tf

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,47 +19,47 @@
1919
*********************/
2020

2121
output "restricted_host_project_id" {
22-
value = local.restricted_project_id
22+
value = module.base_env.restricted_host_project_id
2323
description = "The restricted host project ID"
2424
}
2525

2626
output "restricted_network_name" {
27-
value = module.restricted_shared_vpc.network_name
27+
value = module.base_env.restricted_network_name
2828
description = "The name of the VPC being created"
2929
}
3030

3131
output "restricted_network_self_link" {
32-
value = module.restricted_shared_vpc.network_self_link
32+
value = module.base_env.restricted_network_self_link
3333
description = "The URI of the VPC being created"
3434
}
3535

3636
output "restricted_subnets_names" {
37-
value = module.restricted_shared_vpc.subnets_names
37+
value = module.base_env.restricted_subnets_names
3838
description = "The names of the subnets being created"
3939
}
4040

4141
output "restricted_subnets_ips" {
42-
value = module.restricted_shared_vpc.subnets_ips
42+
value = module.base_env.restricted_subnets_ips
4343
description = "The IPs and CIDRs of the subnets being created"
4444
}
4545

4646
output "restricted_subnets_self_links" {
47-
value = module.restricted_shared_vpc.subnets_self_links
47+
value = module.base_env.restricted_subnets_self_links
4848
description = "The self-links of subnets being created"
4949
}
5050

5151
output "restricted_subnets_secondary_ranges" {
52-
value = module.restricted_shared_vpc.subnets_secondary_ranges
52+
value = module.base_env.restricted_subnets_secondary_ranges
5353
description = "The secondary ranges associated with these subnets"
5454
}
5555

5656
output "restricted_access_level_name" {
57-
value = module.restricted_shared_vpc.access_level_name
57+
value = module.base_env.restricted_access_level_name
5858
description = "Access context manager access level name"
5959
}
6060

6161
output "restricted_service_perimeter_name" {
62-
value = module.restricted_shared_vpc.service_perimeter_name
62+
value = module.base_env.restricted_service_perimeter_name
6363
description = "Access context manager service perimeter name"
6464
}
6565

@@ -68,36 +68,36 @@ output "restricted_service_perimeter_name" {
6868
*****************************************/
6969

7070
output "base_host_project_id" {
71-
value = local.base_project_id
71+
value = module.base_env.base_host_project_id
7272
description = "The base host project ID"
7373
}
7474

7575
output "base_network_name" {
76-
value = module.base_shared_vpc.network_name
76+
value = module.base_env.base_network_name
7777
description = "The name of the VPC being created"
7878
}
7979

8080
output "base_network_self_link" {
81-
value = module.base_shared_vpc.network_self_link
81+
value = module.base_env.base_network_self_link
8282
description = "The URI of the VPC being created"
8383
}
8484

8585
output "base_subnets_names" {
86-
value = module.base_shared_vpc.subnets_names
86+
value = module.base_env.base_subnets_names
8787
description = "The names of the subnets being created"
8888
}
8989

9090
output "base_subnets_ips" {
91-
value = module.base_shared_vpc.subnets_ips
91+
value = module.base_env.base_subnets_ips
9292
description = "The IPs and CIDRs of the subnets being created"
9393
}
9494

9595
output "base_subnets_self_links" {
96-
value = module.base_shared_vpc.subnets_self_links
96+
value = module.base_env.base_subnets_self_links
9797
description = "The self-links of subnets being created"
9898
}
9999

100100
output "base_subnets_secondary_ranges" {
101-
value = module.base_shared_vpc.subnets_secondary_ranges
101+
value = module.base_env.base_subnets_secondary_ranges
102102
description = "The secondary ranges associated with these subnets"
103103
}

0 commit comments

Comments
 (0)