2022-01-19 05:17:20 -08:00
|
|
|
/**
|
|
|
|
* Copyright 2022 Google LLC
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
|
|
|
variable "billing_account_id" {
|
|
|
|
# tfdoc:variable:source 00-bootstrap
|
|
|
|
description = "Billing account id."
|
|
|
|
type = string
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "custom_adv" {
|
|
|
|
description = "Custom advertisement definitions in name => range format."
|
|
|
|
type = map(string)
|
|
|
|
default = {
|
|
|
|
cloud_dns = "35.199.192.0/19"
|
2022-01-24 05:40:49 -08:00
|
|
|
gcp_all = "10.128.0.0/16"
|
|
|
|
gcp_dev = "10.128.32.0/19"
|
|
|
|
gcp_landing = "10.128.0.0/19"
|
2022-01-27 04:18:29 -08:00
|
|
|
gcp_prod = "10.128.64.0/19"
|
2022-01-19 05:17:20 -08:00
|
|
|
googleapis_private = "199.36.153.8/30"
|
|
|
|
googleapis_restricted = "199.36.153.4/30"
|
|
|
|
rfc_1918_10 = "10.0.0.0/8"
|
|
|
|
rfc_1918_172 = "172.16.0.0/16"
|
|
|
|
rfc_1918_192 = "192.168.0.0/16"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "data_dir" {
|
|
|
|
description = "Relative path for the folder storing configuration data for network resources."
|
|
|
|
type = string
|
|
|
|
default = "data"
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "dns" {
|
|
|
|
description = "Onprem DNS resolvers"
|
|
|
|
type = map(list(string))
|
|
|
|
default = {
|
|
|
|
onprem = ["10.0.200.3"]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "folder_id" {
|
|
|
|
# tfdoc:variable:source 01-resman
|
|
|
|
description = "Folder to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created."
|
|
|
|
type = string
|
|
|
|
default = null
|
|
|
|
validation {
|
|
|
|
condition = (
|
|
|
|
var.folder_id == null ||
|
|
|
|
can(regex("folders/[0-9]{8,}", var.folder_id))
|
|
|
|
)
|
|
|
|
error_message = "Invalid folder_id. Should be in 'folders/nnnnnnnnnnn' format."
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "gke" {
|
|
|
|
#tfdoc:variable:source 01-resman
|
|
|
|
description = ""
|
|
|
|
type = map(object({
|
|
|
|
folder_id = string
|
|
|
|
sa = string
|
|
|
|
gcs = string
|
|
|
|
}))
|
|
|
|
default = {}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "l7ilb_subnets" {
|
|
|
|
description = "Subnets used for L7 ILBs."
|
|
|
|
type = map(list(object({
|
|
|
|
ip_cidr_range = string
|
|
|
|
region = string
|
|
|
|
})))
|
|
|
|
default = {
|
|
|
|
prod = [
|
2022-01-27 04:18:29 -08:00
|
|
|
{ ip_cidr_range = "10.128.92.0/24", region = "europe-west1" },
|
|
|
|
{ ip_cidr_range = "10.128.93.0/24", region = "europe-west4" }
|
2022-01-19 05:17:20 -08:00
|
|
|
]
|
|
|
|
dev = [
|
2022-01-27 04:18:29 -08:00
|
|
|
{ ip_cidr_range = "10.128.60.0/24", region = "europe-west1" },
|
|
|
|
{ ip_cidr_range = "10.128.61.0/24", region = "europe-west4" }
|
2022-01-19 05:17:20 -08:00
|
|
|
]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "organization" {
|
|
|
|
# tfdoc:variable:source 00-bootstrap
|
|
|
|
description = "Organization details."
|
|
|
|
type = object({
|
|
|
|
domain = string
|
|
|
|
id = number
|
|
|
|
customer_id = string
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "outputs_location" {
|
|
|
|
description = "Path where providers and tfvars files for the following stages are written. Leave empty to disable."
|
|
|
|
type = string
|
|
|
|
default = null
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "prefix" {
|
|
|
|
# tfdoc:variable:source 00-bootstrap
|
|
|
|
description = "Prefix used for resources that need unique names."
|
|
|
|
type = string
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "project_factory_sa" {
|
|
|
|
# tfdoc:variable:source 01-resman
|
|
|
|
description = "IAM emails for project factory service accounts"
|
|
|
|
type = map(string)
|
|
|
|
default = {}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "psa_ranges" {
|
|
|
|
description = "IP ranges used for Private Service Access (e.g. CloudSQL)."
|
|
|
|
type = map(map(string))
|
|
|
|
default = {
|
|
|
|
prod = {
|
2022-01-27 04:18:29 -08:00
|
|
|
cloudsql-mysql = "10.128.94.0/24"
|
|
|
|
cloudsql-sqlserver = "10.128.95.0/24"
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
|
|
|
dev = {
|
2022-01-27 04:18:29 -08:00
|
|
|
cloudsql-mysql = "10.128.62.0/24"
|
|
|
|
cloudsql-sqlserver = "10.128.63.0/24"
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "router_configs" {
|
|
|
|
description = "Configurations for CRs and onprem routers."
|
|
|
|
type = map(object({
|
|
|
|
adv = object({
|
|
|
|
custom = list(string)
|
|
|
|
default = bool
|
|
|
|
})
|
|
|
|
asn = number
|
|
|
|
}))
|
|
|
|
default = {
|
|
|
|
onprem-ew1 = {
|
|
|
|
asn = "65534"
|
|
|
|
adv = null
|
|
|
|
# adv = { default = false, custom = [] }
|
|
|
|
}
|
|
|
|
landing-ew1 = { asn = "64512", adv = null }
|
|
|
|
landing-ew4 = { asn = "64512", adv = null }
|
|
|
|
spoke-dev-ew1 = { asn = "64513", adv = null }
|
|
|
|
spoke-dev-ew4 = { asn = "64513", adv = null }
|
|
|
|
spoke-prod-ew1 = { asn = "64514", adv = null }
|
|
|
|
spoke-prod-ew4 = { asn = "64514", adv = null }
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "vpn_onprem_configs" {
|
|
|
|
description = "VPN gateway configuration for onprem interconnection."
|
|
|
|
type = map(object({
|
|
|
|
adv = object({
|
|
|
|
default = bool
|
|
|
|
custom = list(string)
|
|
|
|
})
|
2022-01-24 05:40:49 -08:00
|
|
|
peer_external_gateway = object({
|
|
|
|
redundancy_type = string
|
|
|
|
interfaces = list(object({
|
|
|
|
id = number
|
|
|
|
ip_address = string
|
|
|
|
}))
|
2022-01-19 05:17:20 -08:00
|
|
|
})
|
2022-01-24 05:40:49 -08:00
|
|
|
tunnels = list(object({
|
2022-01-25 06:35:01 -08:00
|
|
|
peer_asn = number
|
|
|
|
peer_external_gateway_interface = number
|
|
|
|
secret = string
|
|
|
|
session_range = string
|
|
|
|
vpn_gateway_interface = number
|
2022-01-24 05:40:49 -08:00
|
|
|
}))
|
2022-01-19 05:17:20 -08:00
|
|
|
}))
|
|
|
|
default = {
|
|
|
|
landing-ew1 = {
|
|
|
|
adv = {
|
|
|
|
default = false
|
|
|
|
custom = [
|
2022-01-24 05:40:49 -08:00
|
|
|
"cloud_dns", "googleapis_private", "googleapis_restricted", "gcp_all"
|
2022-01-19 05:17:20 -08:00
|
|
|
]
|
|
|
|
}
|
2022-01-24 05:40:49 -08:00
|
|
|
peer_external_gateway = {
|
|
|
|
redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT"
|
|
|
|
interfaces = [
|
|
|
|
{ id = 0, ip_address = "8.8.8.8" },
|
|
|
|
]
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
2022-01-24 05:40:49 -08:00
|
|
|
tunnels = [
|
|
|
|
{
|
2022-01-25 06:35:01 -08:00
|
|
|
peer_asn = 65534
|
|
|
|
peer_external_gateway_interface = 0
|
|
|
|
secret = "foobar"
|
|
|
|
session_range = "169.254.1.0/30"
|
|
|
|
vpn_gateway_interface = 0
|
2022-01-24 05:40:49 -08:00
|
|
|
},
|
|
|
|
{
|
2022-01-25 06:35:01 -08:00
|
|
|
peer_asn = 65534
|
|
|
|
peer_external_gateway_interface = 0
|
|
|
|
secret = "foobar"
|
|
|
|
session_range = "169.254.1.4/30"
|
|
|
|
vpn_gateway_interface = 1
|
2022-01-24 05:40:49 -08:00
|
|
|
}
|
|
|
|
]
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
variable "vpn_spoke_configs" {
|
|
|
|
description = "VPN gateway configuration for spokes."
|
|
|
|
type = map(object({
|
|
|
|
adv = object({
|
|
|
|
default = bool
|
|
|
|
custom = list(string)
|
|
|
|
})
|
|
|
|
session_range = string
|
|
|
|
}))
|
|
|
|
default = {
|
|
|
|
landing-ew1 = {
|
|
|
|
adv = {
|
|
|
|
default = false
|
|
|
|
custom = ["rfc_1918_10", "rfc_1918_172", "rfc_1918_192"]
|
|
|
|
}
|
2022-01-24 05:40:49 -08:00
|
|
|
# values for the landing router are pulled from the spoke range
|
|
|
|
session_range = null
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
|
|
|
landing-ew4 = {
|
|
|
|
adv = {
|
|
|
|
default = false
|
|
|
|
custom = ["rfc_1918_10", "rfc_1918_172", "rfc_1918_192"]
|
|
|
|
}
|
2022-01-24 05:40:49 -08:00
|
|
|
# values for the landing router are pulled from the spoke range
|
|
|
|
session_range = null
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
|
|
|
dev-ew1 = {
|
|
|
|
adv = {
|
|
|
|
default = false
|
2022-01-24 05:40:49 -08:00
|
|
|
custom = ["gcp_dev"]
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
2022-01-24 05:40:49 -08:00
|
|
|
# resize according to required number of tunnels
|
|
|
|
session_range = "169.254.0.0/27"
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
|
|
|
prod-ew1 = {
|
|
|
|
adv = {
|
|
|
|
default = false
|
2022-01-24 05:40:49 -08:00
|
|
|
custom = ["gcp_prod"]
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
2022-01-24 05:40:49 -08:00
|
|
|
# resize according to required number of tunnels
|
|
|
|
session_range = "169.254.0.64/27"
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
|
|
|
prod-ew4 = {
|
|
|
|
adv = {
|
|
|
|
default = false
|
2022-01-24 05:40:49 -08:00
|
|
|
custom = ["gcp_prod"]
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
2022-01-24 05:40:49 -08:00
|
|
|
# resize according to required number of tunnels
|
|
|
|
session_range = "169.254.0.96/27"
|
2022-01-19 05:17:20 -08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|