From f19ab4872f816cecb866e0b635e302236a444eef Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Thu, 14 Sep 2023 17:20:37 +0200 Subject: [PATCH 1/2] Embed subnet-level IAM in the variables controlling creation of subnets This moves the top-level `iam`, `iam_bindings` and `iam_bindings_additive` variables into subnet-level attributes. This change also allows setting permissions to PSC or proxy-only subnets As part of this change, the factory interface is more aligned with the rest of the modules using a `factories_config` variable. In the future we can add a cidrs template similar to the firewall policy module --- modules/net-vpc/README.md | 41 ++++----- modules/net-vpc/subnets.tf | 167 +++++++++++++++++++++-------------- modules/net-vpc/variables.tf | 109 ++++++++++++++--------- 3 files changed, 186 insertions(+), 131 deletions(-) diff --git a/modules/net-vpc/README.md b/modules/net-vpc/README.md index 3be4d37d..a51b0713 100644 --- a/modules/net-vpc/README.md +++ b/modules/net-vpc/README.md @@ -539,30 +539,27 @@ module "vpc" { | name | description | type | required | default | |---|---|:---:|:---:|:---:| -| [name](variables.tf#L93) | The name of the network being created. | string | ✓ | | -| [project_id](variables.tf#L109) | The ID of the project where this VPC will be created. | string | ✓ | | +| [name](variables.tf#L95) | The name of the network being created. | string | ✓ | | +| [project_id](variables.tf#L111) | The ID of the project where this VPC will be created. | string | ✓ | | | [auto_create_subnetworks](variables.tf#L17) | Set to true to create an auto mode subnet, defaults to custom mode. | bool | | false | | [create_googleapis_routes](variables.tf#L23) | Toggle creation of googleapis private/restricted routes. Disabled when vpc creation is turned off, or when set to null. | object({…}) | | {} | -| [data_folder](variables.tf#L34) | An optional folder containing the subnet configurations in YaML format. | string | | null | -| [delete_default_routes_on_create](variables.tf#L40) | Set to true to delete the default routes at creation time. | bool | | false | -| [description](variables.tf#L46) | An optional description of this resource (triggers recreation on change). | string | | "Terraform-managed." | -| [dns_policy](variables.tf#L52) | DNS policy setup for the VPC. | object({…}) | | null | -| [firewall_policy_enforcement_order](variables.tf#L65) | Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'. | string | | "AFTER_CLASSIC_FIREWALL" | -| [ipv6_config](variables.tf#L77) | Optional IPv6 configuration for this network. | object({…}) | | {} | -| [mtu](variables.tf#L87) | Maximum Transmission Unit in bytes. The minimum value for this field is 1460 (the default) and the maximum value is 1500 bytes. | number | | null | -| [peering_config](variables.tf#L98) | VPC peering configuration. | object({…}) | | null | -| [psa_config](variables.tf#L114) | The Private Service Access configuration for Service Networking. | object({…}) | | null | -| [routes](variables.tf#L124) | Network routes, keyed by name. | map(object({…})) | | {} | -| [routing_mode](variables.tf#L145) | The network routing mode (default 'GLOBAL'). | string | | "GLOBAL" | -| [shared_vpc_host](variables.tf#L155) | Enable shared VPC for this project. | bool | | false | -| [shared_vpc_service_projects](variables.tf#L161) | Shared VPC service projects to register with this host. | list(string) | | [] | -| [subnet_iam](variables.tf#L167) | Subnet IAM bindings in {REGION/NAME => {ROLE => [MEMBERS]} format. | map(map(list(string))) | | {} | -| [subnet_iam_bindings](variables.tf#L173) | Authoritative IAM bindings in {REGION/NAME => {ROLE => {members = [], condition = {}}}}. | map(map(object({…}))) | | {} | -| [subnet_iam_bindings_additive](variables.tf#L187) | Individual additive IAM bindings. Keys are arbitrary. | map(object({…})) | | {} | -| [subnets](variables.tf#L203) | Subnet configuration. | list(object({…})) | | [] | -| [subnets_proxy_only](variables.tf#L230) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | list(object({…})) | | [] | -| [subnets_psc](variables.tf#L244) | List of subnets for Private Service Connect service producers. | list(object({…})) | | [] | -| [vpc_create](variables.tf#L256) | Create VPC. When set to false, uses a data source to reference existing VPC. | bool | | true | +| [delete_default_routes_on_create](variables.tf#L34) | Set to true to delete the default routes at creation time. | bool | | false | +| [description](variables.tf#L40) | An optional description of this resource (triggers recreation on change). | string | | "Terraform-managed." | +| [dns_policy](variables.tf#L46) | DNS policy setup for the VPC. | object({…}) | | null | +| [factories_config](variables.tf#L59) | Paths to data files and folders that enable factory functionality. | object({…}) | | null | +| [firewall_policy_enforcement_order](variables.tf#L67) | Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'. | string | | "AFTER_CLASSIC_FIREWALL" | +| [ipv6_config](variables.tf#L79) | Optional IPv6 configuration for this network. | object({…}) | | {} | +| [mtu](variables.tf#L89) | Maximum Transmission Unit in bytes. The minimum value for this field is 1460 (the default) and the maximum value is 1500 bytes. | number | | null | +| [peering_config](variables.tf#L100) | VPC peering configuration. | object({…}) | | null | +| [psa_config](variables.tf#L116) | The Private Service Access configuration for Service Networking. | object({…}) | | null | +| [routes](variables.tf#L126) | Network routes, keyed by name. | map(object({…})) | | {} | +| [routing_mode](variables.tf#L147) | The network routing mode (default 'GLOBAL'). | string | | "GLOBAL" | +| [shared_vpc_host](variables.tf#L157) | Enable shared VPC for this project. | bool | | false | +| [shared_vpc_service_projects](variables.tf#L163) | Shared VPC service projects to register with this host. | list(string) | | [] | +| [subnets](variables.tf#L169) | Subnet configuration. | list(object({…})) | | [] | +| [subnets_proxy_only](variables.tf#L215) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | list(object({…})) | | [] | +| [subnets_psc](variables.tf#L248) | List of subnets for Private Service Connect service producers. | list(object({…})) | | [] | +| [vpc_create](variables.tf#L279) | Create VPC. When set to false, uses a data source to reference existing VPC. | bool | | true | ## Outputs diff --git a/modules/net-vpc/subnets.tf b/modules/net-vpc/subnets.tf index 2dc1c33d..dfca6fd7 100644 --- a/modules/net-vpc/subnets.tf +++ b/modules/net-vpc/subnets.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2023 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -18,68 +18,112 @@ locals { _factory_data = { - for f in try(fileset(var.data_folder, "**/*.yaml"), []) : - trimsuffix(basename(f), ".yaml") => yamldecode(file("${var.data_folder}/${f}")) + for f in try(fileset(var.factories_config.subnets_folder, "**/*.yaml"), []) : + trimsuffix(basename(f), ".yaml") => yamldecode(file("${var.factories_config.subnets_folder}/${f}")) } _factory_subnets = { - for k, v in local._factory_data : "${v.region}/${try(v.name, k)}" => { - name = try(v.name, k) - ip_cidr_range = v.ip_cidr_range - region = v.region + for k, v in local._factory_data : + "${v.region}/${try(v.name, k)}" => { + active = try(v.active, true) description = try(v.description, null) enable_private_access = try(v.enable_private_access, true) - flow_logs_config = try(v.flow_logs, null) - ipv6 = try(v.ipv6, null) - secondary_ip_ranges = try(v.secondary_ip_ranges, null) - iam = try(v.iam, []) - iam_members = try(v.iam_members, []) - purpose = try(v.purpose, null) - active = try(v.active, null) - global = null + flow_logs_config = can(v.flow_logs) ? { + aggregation_interval = try(v.flow_logs_config.aggregation_interval, null) + filter_expression = try(v.flow_logs_config.filter_expression, null) + flow_sampling = try(v.flow_logs_config.flow_sampling, null) + metadata = try(v.flow_logs_config.metadata, null) + metadata_fields = try(v.flow_logs_config.metadata_fields, null) + } : null + global = try(v.global, false) + ip_cidr_range = v.ip_cidr_range + ipv6 = can(v.ipv6) ? { + access_type = try(v.ipv6.access_type, "INTERNAL") + } : null + name = try(v.name, k) + region = v.region + secondary_ip_ranges = try(v.secondary_ip_ranges, null) + iam = try(v.iam, {}) + iam_bindings = can(v.iam_bindings) ? { + for k2, v2 in v.iam_bindings : + k2 => { + members = v2.members + condition = can(v2.condition) ? { + expression = v2.condition.expression + title = v2.condition.title + description = try(v2.condition.description, null) + } : null + } + } : {} + iam_bindings_additive = can(v.iam_bindings_additive) ? { + for k2, v2 in v.iam_bindings_additive : + k2 => { + member = v2.member + role = v2.role + condition = can(v2.condition) ? { + expression = v2.condition.expression + title = v2.condition.title + description = try(v2.condition.description, null) + } : null + } + } : {} + _is_regular = !try(v.psc == true, false) && !try(v.proxy_only == true, false) + _is_psc = try(v.psc == true, false) + _is_proxy_only = try(v.proxy_only == true, false) } } - _factory_subnets_iam = [ - for k, v in local._factory_subnets : { - subnet = k - role = "roles/compute.networkUser" - members = v.iam - } if v.purpose == null && v.iam != null - ] - _subnet_iam = flatten([ - for subnet, roles in(var.subnet_iam == null ? {} : var.subnet_iam) : [ - for role, members in roles : { - members = members - role = role - subnet = subnet - } - ] - ]) - subnet_iam = concat( - [for k in local._factory_subnets_iam : k if length(k.members) > 0], - local._subnet_iam + + all_subnets = merge( + { for k, v in google_compute_subnetwork.subnetwork : k => v }, + { for k, v in google_compute_subnetwork.proxy_only : k => v }, + { for k, v in google_compute_subnetwork.psc : k => v } ) + subnet_iam = flatten(concat( + [ + for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [ + for role, members in s.iam : + { + role = role + members = members + subnet = "${s.region}/${s.name}" + } + ] + ], + )) subnet_iam_bindings = flatten([ - for subnet, roles in(var.subnet_iam_bindings == null ? {} : var.subnet_iam_bindings) : [ - for role, data in roles : { + for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [ + for role, data in s.iam_bindings : { role = role - subnet = subnet + subnet = "${s.region}/${s.name}" members = data.members condition = data.condition } ] ]) + # note: all additive bindings share a single namespace for the key. + # In other words, if you have multiple additive bindings with the + # same name, only one will be used + subnet_iam_bindings_additive = merge([ + for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : { + for key, data in s.iam_bindings_additive : + key => { + role = data.role + subnet = "${s.region}/${s.name}" + member = data.member + condition = data.condition + } + } + ]...) subnets = merge( { for s in var.subnets : "${s.region}/${s.name}" => s }, - { for k, v in local._factory_subnets : k => v if v.purpose == null } + { for k, v in local._factory_subnets : k => v if v._is_regular } ) subnets_proxy_only = merge( { for s in var.subnets_proxy_only : "${s.region}/${s.name}" => s }, - { for k, v in local._factory_subnets : k => v if v.purpose == "REGIONAL_MANAGED_PROXY" }, - { for k, v in local._factory_subnets : k => v if v.purpose == "GLOBAL_MANAGED_PROXY" } + { for k, v in local._factory_subnets : k => v if v._is_proxy_only }, ) subnets_psc = merge( { for s in var.subnets_psc : "${s.region}/${s.name}" => s }, - { for k, v in local._factory_subnets : k => v if v.purpose == "PRIVATE_SERVICE_CONNECT" } + { for k, v in local._factory_subnets : k => v if v._is_psc } ) } @@ -130,19 +174,12 @@ resource "google_compute_subnetwork" "proxy_only" { name = each.value.name region = each.value.region ip_cidr_range = each.value.ip_cidr_range - description = ( - each.value.description == null - ? "Terraform-managed proxy-only subnet for Regional HTTPS, Internal HTTPS or Cross-Regional HTTPS Internal LB." - : each.value.description + description = coalesce( + each.value.description, + "Terraform-managed proxy-only subnet for Regional HTTPS, Internal HTTPS or Cross-Regional HTTPS Internal LB." ) - purpose = try( - each.value.purpose, - each.value.global == true - ? "GLOBAL_MANAGED_PROXY" - : "REGIONAL_MANAGED_PROXY" - ) - - role = each.value.active != false ? "ACTIVE" : "BACKUP" + purpose = each.value.global ? "GLOBAL_MANAGED_PROXY" : "REGIONAL_MANAGED_PROXY" + role = each.value.active ? "ACTIVE" : "BACKUP" } resource "google_compute_subnetwork" "psc" { @@ -152,22 +189,22 @@ resource "google_compute_subnetwork" "psc" { name = each.value.name region = each.value.region ip_cidr_range = each.value.ip_cidr_range - description = ( - each.value.description == null - ? "Terraform-managed subnet for Private Service Connect (PSC NAT)." - : each.value.description + description = coalesce( + each.value.description, + "Terraform-managed subnet for Private Service Connect (PSC NAT)." ) purpose = "PRIVATE_SERVICE_CONNECT" } + resource "google_compute_subnetwork_iam_binding" "authoritative" { for_each = { for binding in local.subnet_iam : "${binding.subnet}.${binding.role}" => binding } project = var.project_id - subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name - region = google_compute_subnetwork.subnetwork[each.value.subnet].region + subnetwork = local.all_subnets[each.value.subnet].name + region = local.all_subnets[each.value.subnet].region role = each.value.role members = each.value.members } @@ -178,8 +215,8 @@ resource "google_compute_subnetwork_iam_binding" "bindings" { "${binding.subnet}.${binding.role}.${try(binding.condition.title, "")}" => binding } project = var.project_id - subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name - region = google_compute_subnetwork.subnetwork[each.value.subnet].region + subnetwork = local.all_subnets[each.value.subnet].name + region = local.all_subnets[each.value.subnet].region role = each.value.role members = each.value.members dynamic "condition" { @@ -192,13 +229,11 @@ resource "google_compute_subnetwork_iam_binding" "bindings" { } } -# TODO: merge factory subnet IAM members - resource "google_compute_subnetwork_iam_member" "bindings" { - for_each = var.subnet_iam_bindings_additive + for_each = local.subnet_iam_bindings_additive project = var.project_id - subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name - region = google_compute_subnetwork.subnetwork[each.value.subnet].region + subnetwork = local.all_subnets[each.value.subnet].name + region = local.all_subnets[each.value.subnet].region role = each.value.role member = each.value.member dynamic "condition" { diff --git a/modules/net-vpc/variables.tf b/modules/net-vpc/variables.tf index 30d7afd3..439b5a56 100644 --- a/modules/net-vpc/variables.tf +++ b/modules/net-vpc/variables.tf @@ -31,12 +31,6 @@ variable "create_googleapis_routes" { default = {} } -variable "data_folder" { - description = "An optional folder containing the subnet configurations in YaML format." - type = string - default = null -} - variable "delete_default_routes_on_create" { description = "Set to true to delete the default routes at creation time." type = bool @@ -62,6 +56,14 @@ variable "dns_policy" { default = null } +variable "factories_config" { + description = "Paths to data files and folders that enable factory functionality." + type = object({ + subnets_folder = string + }) + default = null +} + variable "firewall_policy_enforcement_order" { description = "Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'." type = string @@ -164,42 +166,6 @@ variable "shared_vpc_service_projects" { default = [] } -variable "subnet_iam" { - description = "Subnet IAM bindings in {REGION/NAME => {ROLE => [MEMBERS]} format." - type = map(map(list(string))) - default = {} -} - -variable "subnet_iam_bindings" { - description = "Authoritative IAM bindings in {REGION/NAME => {ROLE => {members = [], condition = {}}}}." - type = map(map(object({ - members = list(string) - condition = optional(object({ - expression = string - title = string - description = optional(string) - })) - }))) - nullable = false - default = {} -} - -variable "subnet_iam_bindings_additive" { - description = "Individual additive IAM bindings. Keys are arbitrary." - type = map(object({ - member = string - role = string - subnet = string - condition = optional(object({ - expression = string - title = string - description = optional(string) - })) - })) - nullable = false - default = {} -} - variable "subnets" { description = "Subnet configuration." type = list(object({ @@ -222,6 +188,25 @@ variable "subnets" { # enable_private_access = optional(string) })) secondary_ip_ranges = optional(map(string)) + + iam = optional(map(list(string)), {}) + iam_bindings = optional(map(object({ + members = list(string) + condition = optional(object({ + expression = string + title = string + description = optional(string) + })) + })), {}) + iam_bindings_additive = optional(map(object({ + member = string + role = string + condition = optional(object({ + expression = string + title = string + description = optional(string) + })) + })), {}) })) default = [] nullable = false @@ -234,8 +219,27 @@ variable "subnets_proxy_only" { ip_cidr_range = string region = string description = optional(string) - active = bool + active = optional(bool, true) global = optional(bool, false) + + iam = optional(map(list(string)), {}) + iam_bindings = optional(map(object({ + members = list(string) + condition = optional(object({ + expression = string + title = string + description = optional(string) + })) + })), {}) + iam_bindings_additive = optional(map(object({ + member = string + role = string + condition = optional(object({ + expression = string + title = string + description = optional(string) + })) + })), {}) })) default = [] nullable = false @@ -248,6 +252,25 @@ variable "subnets_psc" { ip_cidr_range = string region = string description = optional(string) + + iam = optional(map(list(string)), {}) + iam_bindings = optional(map(object({ + members = list(string) + condition = optional(object({ + expression = string + title = string + description = optional(string) + })) + })), {}) + iam_bindings_additive = optional(map(object({ + member = string + role = string + condition = optional(object({ + expression = string + title = string + description = optional(string) + })) + })), {}) })) default = [] nullable = false From f3be29cbc9f7e495ab624c2f7eff49cf000a364a Mon Sep 17 00:00:00 2001 From: Julio Castillo Date: Fri, 15 Sep 2023 00:07:08 +0200 Subject: [PATCH 2/2] Fix tests --- blueprints/networking/shared-vpc-gke/main.tf | 32 +++---- fast/stages/2-networking-a-peering/landing.tf | 4 +- .../2-networking-a-peering/spoke-dev.tf | 14 +-- .../2-networking-a-peering/spoke-prod.tf | 14 +-- fast/stages/2-networking-b-vpn/landing.tf | 4 +- fast/stages/2-networking-b-vpn/spoke-dev.tf | 14 +-- fast/stages/2-networking-b-vpn/spoke-prod.tf | 14 +-- fast/stages/2-networking-c-nva/landing.tf | 8 +- fast/stages/2-networking-c-nva/spoke-dev.tf | 12 ++- fast/stages/2-networking-c-nva/spoke-prod.tf | 12 ++- .../2-networking-d-separate-envs/spoke-dev.tf | 14 +-- .../spoke-prod.tf | 14 +-- fast/stages/2-networking-e-nva-bgp/landing.tf | 8 +- .../2-networking-e-nva-bgp/spoke-dev.tf | 12 ++- .../2-networking-e-nva-bgp/spoke-prod.tf | 12 ++- modules/net-vpc/README.md | 93 +++++++++---------- modules/net-vpc/subnets.tf | 2 +- 17 files changed, 155 insertions(+), 128 deletions(-) diff --git a/blueprints/networking/shared-vpc-gke/main.tf b/blueprints/networking/shared-vpc-gke/main.tf index 302ce735..88f48463 100644 --- a/blueprints/networking/shared-vpc-gke/main.tf +++ b/blueprints/networking/shared-vpc-gke/main.tf @@ -1,4 +1,4 @@ -# Copyright 2022 Google LLC +# Copyright 2023 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -102,6 +102,11 @@ module "vpc-shared" { ip_cidr_range = var.ip_ranges.gce name = "gce" region = var.region + iam = { + "roles/compute.networkUser" = concat(var.owners_gce, [ + "serviceAccount:${module.project-svc-gce.service_accounts.cloud_services}", + ]) + } }, { ip_cidr_range = var.ip_ranges.gke @@ -111,24 +116,17 @@ module "vpc-shared" { pods = var.ip_secondary_ranges.gke-pods services = var.ip_secondary_ranges.gke-services } + iam = { + "roles/compute.networkUser" = concat(var.owners_gke, [ + "serviceAccount:${module.project-svc-gke.service_accounts.cloud_services}", + "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}", + ]) + "roles/compute.securityAdmin" = [ + "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}", + ] + } } ] - subnet_iam = { - "${var.region}/gce" = { - "roles/compute.networkUser" = concat(var.owners_gce, [ - "serviceAccount:${module.project-svc-gce.service_accounts.cloud_services}", - ]) - } - "${var.region}/gke" = { - "roles/compute.networkUser" = concat(var.owners_gke, [ - "serviceAccount:${module.project-svc-gke.service_accounts.cloud_services}", - "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}", - ]) - "roles/compute.securityAdmin" = [ - "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}", - ] - } - } } module "vpc-shared-firewall" { diff --git a/fast/stages/2-networking-a-peering/landing.tf b/fast/stages/2-networking-a-peering/landing.tf index 013c6e86..e2309f1b 100644 --- a/fast/stages/2-networking-a-peering/landing.tf +++ b/fast/stages/2-networking-a-peering/landing.tf @@ -55,7 +55,9 @@ module "landing-vpc" { private = true restricted = true } - data_folder = "${var.factories_config.data_dir}/subnets/landing" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing" + } } module "landing-firewall" { diff --git a/fast/stages/2-networking-a-peering/spoke-dev.tf b/fast/stages/2-networking-a-peering/spoke-dev.tf index 838ba6a4..bfff002b 100644 --- a/fast/stages/2-networking-a-peering/spoke-dev.tf +++ b/fast/stages/2-networking-a-peering/spoke-dev.tf @@ -46,12 +46,14 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" - psa_config = try(var.psa_ranges.dev, null) + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } + psa_config = try(var.psa_ranges.dev, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-a-peering/spoke-prod.tf b/fast/stages/2-networking-a-peering/spoke-prod.tf index 7569647e..505005bd 100644 --- a/fast/stages/2-networking-a-peering/spoke-prod.tf +++ b/fast/stages/2-networking-a-peering/spoke-prod.tf @@ -45,12 +45,14 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" - psa_config = try(var.psa_ranges.prod, null) + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } + psa_config = try(var.psa_ranges.prod, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-b-vpn/landing.tf b/fast/stages/2-networking-b-vpn/landing.tf index 013c6e86..e2309f1b 100644 --- a/fast/stages/2-networking-b-vpn/landing.tf +++ b/fast/stages/2-networking-b-vpn/landing.tf @@ -55,7 +55,9 @@ module "landing-vpc" { private = true restricted = true } - data_folder = "${var.factories_config.data_dir}/subnets/landing" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing" + } } module "landing-firewall" { diff --git a/fast/stages/2-networking-b-vpn/spoke-dev.tf b/fast/stages/2-networking-b-vpn/spoke-dev.tf index 838ba6a4..bfff002b 100644 --- a/fast/stages/2-networking-b-vpn/spoke-dev.tf +++ b/fast/stages/2-networking-b-vpn/spoke-dev.tf @@ -46,12 +46,14 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" - psa_config = try(var.psa_ranges.dev, null) + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } + psa_config = try(var.psa_ranges.dev, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-b-vpn/spoke-prod.tf b/fast/stages/2-networking-b-vpn/spoke-prod.tf index 7569647e..505005bd 100644 --- a/fast/stages/2-networking-b-vpn/spoke-prod.tf +++ b/fast/stages/2-networking-b-vpn/spoke-prod.tf @@ -45,12 +45,14 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" - psa_config = try(var.psa_ranges.prod, null) + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } + psa_config = try(var.psa_ranges.prod, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-c-nva/landing.tf b/fast/stages/2-networking-c-nva/landing.tf index e7329a43..fb19c31b 100644 --- a/fast/stages/2-networking-c-nva/landing.tf +++ b/fast/stages/2-networking-c-nva/landing.tf @@ -54,7 +54,9 @@ module "landing-untrusted-vpc" { logging = false } create_googleapis_routes = null - data_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted" + } } module "landing-untrusted-firewall" { @@ -110,7 +112,9 @@ module "landing-trusted-vpc" { name = "prod-trusted-landing-0" delete_default_routes_on_create = true mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/landing-trusted" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing-trusted" + } dns_policy = { inbound = true } diff --git a/fast/stages/2-networking-c-nva/spoke-dev.tf b/fast/stages/2-networking-c-nva/spoke-dev.tf index a90d25aa..0f6e8b8f 100644 --- a/fast/stages/2-networking-c-nva/spoke-dev.tf +++ b/fast/stages/2-networking-c-nva/spoke-dev.tf @@ -45,11 +45,13 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } delete_default_routes_on_create = true psa_config = try(var.psa_ranges.dev, null) # Set explicit routes for googleapis; send everything else to NVAs diff --git a/fast/stages/2-networking-c-nva/spoke-prod.tf b/fast/stages/2-networking-c-nva/spoke-prod.tf index 8dd5af44..98959509 100644 --- a/fast/stages/2-networking-c-nva/spoke-prod.tf +++ b/fast/stages/2-networking-c-nva/spoke-prod.tf @@ -44,11 +44,13 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } delete_default_routes_on_create = true psa_config = try(var.psa_ranges.prod, null) # Set explicit routes for googleapis; send everything else to NVAs diff --git a/fast/stages/2-networking-d-separate-envs/spoke-dev.tf b/fast/stages/2-networking-d-separate-envs/spoke-dev.tf index b5b485be..61562f44 100644 --- a/fast/stages/2-networking-d-separate-envs/spoke-dev.tf +++ b/fast/stages/2-networking-d-separate-envs/spoke-dev.tf @@ -46,12 +46,14 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" - psa_config = try(var.psa_ranges.dev, null) + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } + psa_config = try(var.psa_ranges.dev, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-d-separate-envs/spoke-prod.tf b/fast/stages/2-networking-d-separate-envs/spoke-prod.tf index bf43728d..7b42f546 100644 --- a/fast/stages/2-networking-d-separate-envs/spoke-prod.tf +++ b/fast/stages/2-networking-d-separate-envs/spoke-prod.tf @@ -45,12 +45,14 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" - psa_config = try(var.psa_ranges.prod, null) + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } + psa_config = try(var.psa_ranges.prod, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-e-nva-bgp/landing.tf b/fast/stages/2-networking-e-nva-bgp/landing.tf index ab6c94eb..07331717 100644 --- a/fast/stages/2-networking-e-nva-bgp/landing.tf +++ b/fast/stages/2-networking-e-nva-bgp/landing.tf @@ -55,7 +55,9 @@ module "landing-untrusted-vpc" { logging = false } create_googleapis_routes = null - data_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted" + } } module "landing-untrusted-firewall" { @@ -111,7 +113,9 @@ module "landing-trusted-vpc" { name = "prod-trusted-landing-0" delete_default_routes_on_create = true mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/landing-trusted" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing-trusted" + } dns_policy = { inbound = true } diff --git a/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf b/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf index 0c70b550..56b65e39 100644 --- a/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf +++ b/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf @@ -45,11 +45,13 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } delete_default_routes_on_create = true psa_config = try(var.psa_ranges.dev, null) # Set explicit routes for googleapis; send everything else to NVAs diff --git a/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf b/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf index c0ba4414..6ae49dee 100644 --- a/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf +++ b/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf @@ -44,11 +44,13 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } delete_default_routes_on_create = true psa_config = try(var.psa_ranges.prod, null) # Set explicit routes for googleapis; send everything else to NVAs diff --git a/modules/net-vpc/README.md b/modules/net-vpc/README.md index a51b0713..976dd3fd 100644 --- a/modules/net-vpc/README.md +++ b/modules/net-vpc/README.md @@ -112,38 +112,34 @@ module "vpc" { name = "subnet-1" region = "europe-west1" ip_cidr_range = "10.0.1.0/24" + iam = { + "roles/compute.networkUser" = [ + "user:user1@example.com", "group:group1@example.com" + ] + } + iam_bindings = { + "roles/compute.networkUser" = { + members = ["group:group2@example.com"] + condition = { + expression = "resource.matchTag('123456789012/env', 'prod')" + title = "test_condition" + } + } + } }, { name = "subnet-2" region = "europe-west1" ip_cidr_range = "10.0.1.0/24" - } - ] - subnet_iam = { - "europe-west1/subnet-1" = { - "roles/compute.networkUser" = [ - "user:user1@example.com", "group:group1@example.com" - ] - } - } - subnet_iam_bindings = { - "europe-west1/subnet-1" = { - "roles/compute.networkUser" = { - members = ["group:group2@example.com"] - condition = { - expression = "resource.matchTag('123456789012/env', 'prod')" - title = "test_condition" + iam_bindings_additive = { + subnet-2-am1 = { + member = "user:am1@example.com" + role = "roles/compute.networkUser" + subnet = "europe-west1/subnet-2" } } } - } - subnet_iam_bindings_additive = { - subnet-2-am1 = { - member = "user:am1@example.com" - role = "roles/compute.networkUser" - subnet = "europe-west1/subnet-2" - } - } + ] } # tftest modules=1 resources=8 inventory=subnet-iam.yaml ``` @@ -212,6 +208,15 @@ module "vpc-host" { pods = "172.16.0.0/20" services = "192.168.0.0/24" } + iam = { + "roles/compute.networkUser" = [ + local.service_project_1.cloud_services_service_account, + local.service_project_1.gke_service_account + ] + "roles/compute.securityAdmin" = [ + local.service_project_1.gke_service_account + ] + } } ] shared_vpc_host = true @@ -219,17 +224,6 @@ module "vpc-host" { local.service_project_1.project_id, local.service_project_2.project_id ] - subnet_iam = { - "europe-west1/subnet-1" = { - "roles/compute.networkUser" = [ - local.service_project_1.cloud_services_service_account, - local.service_project_1.gke_service_account - ] - "roles/compute.securityAdmin" = [ - local.service_project_1.gke_service_account - ] - } - } } # tftest modules=1 resources=9 inventory=shared-vpc.yaml ``` @@ -350,10 +344,12 @@ The `net-vpc` module includes a subnet factory (see [Resource Factories](../../b ```hcl module "vpc" { - source = "./fabric/modules/net-vpc" - project_id = "my-project" - name = "my-network" - data_folder = "config/subnets" + source = "./fabric/modules/net-vpc" + project_id = "my-project" + name = "my-network" + factories_config = { + subnets_folder = "config/subnets" + } } # tftest modules=1 resources=10 files=subnet-simple,subnet-simple-2,subnet-detailed,subnet-proxy,subnet-proxy-global,subnet-psc inventory=factory.yaml ``` @@ -379,38 +375,39 @@ description: Sample description ip_cidr_range: 10.0.0.0/24 # optional attributes enable_private_access: false # defaults to true -iam: # grant roles/compute.networkUser - - group:lorem@example.com - - serviceAccount:fbz@prj.iam.gserviceaccount.com - - user:foobar@example.com +iam: + roles/compute.networkUser: + - group:lorem@example.com + - serviceAccount:fbz@prj.iam.gserviceaccount.com + - user:foobar@example.com secondary_ip_ranges: # map of secondary ip ranges secondary-range-a: 192.168.0.0/24 -flow_logs: # enable, set to empty map to use defaults +flow_logs_config: # enable, set to empty map to use defaults aggregation_interval: "INTERVAL_5_SEC" flow_sampling: 0.5 metadata: "INCLUDE_ALL_METADATA" - filter_expression: null ``` ```yaml # tftest-file id=subnet-proxy path=config/subnets/subnet-proxy.yaml region: europe-west4 ip_cidr_range: 10.1.0.0/24 -purpose: REGIONAL_MANAGED_PROXY +proxy_only: true ``` ```yaml # tftest-file id=subnet-proxy-global path=config/subnets/subnet-proxy-global.yaml region: australia-southeast2 ip_cidr_range: 10.4.0.0/24 -purpose: GLOBAL_MANAGED_PROXY +proxy_only: true +global: true ``` ```yaml # tftest-file id=subnet-psc path=config/subnets/subnet-psc.yaml region: europe-west4 ip_cidr_range: 10.2.0.0/24 -purpose: PRIVATE_SERVICE_CONNECT +psc: true ``` ### Custom Routes diff --git a/modules/net-vpc/subnets.tf b/modules/net-vpc/subnets.tf index dfca6fd7..f0065039 100644 --- a/modules/net-vpc/subnets.tf +++ b/modules/net-vpc/subnets.tf @@ -27,7 +27,7 @@ locals { active = try(v.active, true) description = try(v.description, null) enable_private_access = try(v.enable_private_access, true) - flow_logs_config = can(v.flow_logs) ? { + flow_logs_config = can(v.flow_logs_config) ? { aggregation_interval = try(v.flow_logs_config.aggregation_interval, null) filter_expression = try(v.flow_logs_config.filter_expression, null) flow_sampling = try(v.flow_logs_config.flow_sampling, null)