Merge branch 'master' into master
This commit is contained in:
commit
0ad21351c0
|
@ -59,6 +59,11 @@ module "branch-security-sa" {
|
|||
try(module.branch-security-sa-cicd.0.iam_email, null)
|
||||
])
|
||||
}
|
||||
iam_project_roles = {
|
||||
(var.automation.project_id) = [
|
||||
"roles/serviceusage.serviceUsageConsumer",
|
||||
]
|
||||
}
|
||||
iam_storage_roles = {
|
||||
(var.automation.outputs_bucket) = ["roles/storage.objectAdmin"]
|
||||
}
|
||||
|
|
|
@ -62,12 +62,12 @@ The commands to link or copy the provider and terraform variable files can be ea
|
|||
|
||||
# copy and paste the following commands for '3-project-factory'
|
||||
|
||||
ln -s /home/ludomagno/fast-config/providers/3-project-factory-providers.tf ./
|
||||
ln -s /home/ludomagno/fast-config/tfvars/globals.auto.tfvars.json ./
|
||||
ln -s /home/ludomagno/fast-config/tfvars/0-bootstrap.auto.tfvars.json ./
|
||||
ln -s /home/ludomagno/fast-config/tfvars/1-resman.auto.tfvars.json ./
|
||||
ln -s /home/ludomagno/fast-config/tfvars/2-networking.auto.tfvars.json ./
|
||||
ln -s /home/ludomagno/fast-config/tfvars/2-security.auto.tfvars.json ./
|
||||
ln -s ~/fast-config/providers/3-project-factory-providers.tf ./
|
||||
ln -s ~/fast-config/tfvars/globals.auto.tfvars.json ./
|
||||
ln -s ~/fast-config/tfvars/0-bootstrap.auto.tfvars.json ./
|
||||
ln -s ~/fast-config/tfvars/1-resman.auto.tfvars.json ./
|
||||
ln -s ~/fast-config/tfvars/2-networking.auto.tfvars.json ./
|
||||
ln -s ~/fast-config/tfvars/2-security.auto.tfvars.json ./
|
||||
```
|
||||
|
||||
```bash
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
Simple Cloud NAT management, with optional router creation.
|
||||
|
||||
## Example
|
||||
## Basic Example
|
||||
|
||||
```hcl
|
||||
module "nat" {
|
||||
|
@ -14,25 +14,67 @@ module "nat" {
|
|||
}
|
||||
# tftest modules=1 resources=2
|
||||
```
|
||||
|
||||
# Reserved IPs and custom rules
|
||||
|
||||
```hcl
|
||||
module "addresses" {
|
||||
source = "./fabric/modules/net-address"
|
||||
project_id = "my-project"
|
||||
external_addresses = {
|
||||
a1 = "europe-west1"
|
||||
a2 = "europe-west1"
|
||||
a3 = "europe-west1"
|
||||
}
|
||||
}
|
||||
|
||||
module "nat" {
|
||||
source = "./fabric/modules/net-cloudnat"
|
||||
project_id = "my-project"
|
||||
region = "europe-west1"
|
||||
name = "nat"
|
||||
router_network = "my-vpc"
|
||||
addresses = [
|
||||
module.addresses.external_addresses["a1"].self_link,
|
||||
module.addresses.external_addresses["a3"].self_link
|
||||
]
|
||||
|
||||
config_port_allocation = {
|
||||
enable_endpoint_independent_mapping = false
|
||||
}
|
||||
|
||||
rules = [
|
||||
{
|
||||
description = "rule1"
|
||||
match = "destination.ip == '8.8.8.8'"
|
||||
source_ips = [
|
||||
module.addresses.external_addresses["a2"].self_link
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
# tftest modules=2 resources=5 inventory=rules.yaml
|
||||
```
|
||||
<!-- BEGIN TFDOC -->
|
||||
|
||||
## Variables
|
||||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [config_port_allocation](variables.tf#L23) | Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'. | <code title="object({ enable_endpoint_independent_mapping = optional(bool, true) enable_dynamic_port_allocation = optional(bool, false) min_ports_per_vm = optional(number, 64) max_ports_per_vm = optional(number, 65536) }) default = { enable_endpoint_independent_mapping = true enable_dynamic_port_allocation = false min_ports_per_vm = 64 max_ports_per_vm = 65536 }">object({…}</code> | ✓ | |
|
||||
| [name](variables.tf#L73) | Name of the Cloud NAT resource. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L78) | Project where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L83) | Region where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L63) | Name of the Cloud NAT resource. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L68) | Project where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [region](variables.tf#L73) | Region where resources will be created. | <code>string</code> | ✓ | |
|
||||
| [addresses](variables.tf#L17) | Optional list of external address self links. | <code>list(string)</code> | | <code>[]</code> |
|
||||
| [config_source_subnets](variables.tf#L45) | Subnetwork configuration (ALL_SUBNETWORKS_ALL_IP_RANGES, ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, LIST_OF_SUBNETWORKS). | <code>string</code> | | <code>"ALL_SUBNETWORKS_ALL_IP_RANGES"</code> |
|
||||
| [config_timeouts](variables.tf#L51) | Timeout configurations. | <code title="object({ icmp = number tcp_established = number tcp_transitory = number udp = number })">object({…})</code> | | <code title="{ icmp = 30 tcp_established = 1200 tcp_transitory = 30 udp = 30 }">{…}</code> |
|
||||
| [logging_filter](variables.tf#L67) | Enables logging if not null, value is one of 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', 'ALL'. | <code>string</code> | | <code>null</code> |
|
||||
| [router_asn](variables.tf#L88) | Router ASN used for auto-created router. | <code>number</code> | | <code>64514</code> |
|
||||
| [router_create](variables.tf#L94) | Create router. | <code>bool</code> | | <code>true</code> |
|
||||
| [router_name](variables.tf#L100) | Router name, leave blank if router will be created to use auto generated name. | <code>string</code> | | <code>null</code> |
|
||||
| [router_network](variables.tf#L106) | Name of the VPC used for auto-created router. | <code>string</code> | | <code>null</code> |
|
||||
| [subnetworks](variables.tf#L112) | Subnetworks to NAT, only used when config_source_subnets equals LIST_OF_SUBNETWORKS. | <code title="list(object({ self_link = string, config_source_ranges = list(string) secondary_ranges = list(string) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [config_port_allocation](variables.tf#L23) | Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'. | <code title="object({ enable_endpoint_independent_mapping = optional(bool, true) enable_dynamic_port_allocation = optional(bool, false) min_ports_per_vm = optional(number, 64) max_ports_per_vm = optional(number, 65536) })">object({…})</code> | | <code>{}</code> |
|
||||
| [config_source_subnets](variables.tf#L39) | Subnetwork configuration (ALL_SUBNETWORKS_ALL_IP_RANGES, ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, LIST_OF_SUBNETWORKS). | <code>string</code> | | <code>"ALL_SUBNETWORKS_ALL_IP_RANGES"</code> |
|
||||
| [config_timeouts](variables.tf#L45) | Timeout configurations. | <code title="object({ icmp = optional(number, 30) tcp_established = optional(number, 1200) tcp_transitory = optional(number, 30) udp = optional(number, 30) })">object({…})</code> | | <code>{}</code> |
|
||||
| [logging_filter](variables.tf#L57) | Enables logging if not null, value is one of 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', 'ALL'. | <code>string</code> | | <code>null</code> |
|
||||
| [router_asn](variables.tf#L78) | Router ASN used for auto-created router. | <code>number</code> | | <code>64514</code> |
|
||||
| [router_create](variables.tf#L84) | Create router. | <code>bool</code> | | <code>true</code> |
|
||||
| [router_name](variables.tf#L90) | Router name, leave blank if router will be created to use auto generated name. | <code>string</code> | | <code>null</code> |
|
||||
| [router_network](variables.tf#L96) | Name of the VPC used for auto-created router. | <code>string</code> | | <code>null</code> |
|
||||
| [rules](variables.tf#L102) | List of rules associated with this NAT. | <code title="list(object({ description = optional(string), match = string source_ips = list(string) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
| [subnetworks](variables.tf#L113) | Subnetworks to NAT, only used when config_source_subnets equals LIST_OF_SUBNETWORKS. | <code title="list(object({ self_link = string, config_source_ranges = list(string) secondary_ranges = list(string) }))">list(object({…}))</code> | | <code>[]</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
* Copyright 2023 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
|
@ -63,5 +63,17 @@ resource "google_compute_router_nat" "nat" {
|
|||
secondary_ip_range_names = subnetwork.value.secondary_ranges
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "rules" {
|
||||
for_each = { for i, r in var.rules : i => r }
|
||||
content {
|
||||
rule_number = rules.key
|
||||
description = rules.value.description
|
||||
match = rules.value.match
|
||||
action {
|
||||
source_nat_active_ips = rules.value.source_ips
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
@ -1,5 +1,5 @@
|
|||
/**
|
||||
* Copyright 2022 Google LLC
|
||||
* Copyright 2023 Google LLC
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
|
@ -28,14 +28,8 @@ variable "config_port_allocation" {
|
|||
min_ports_per_vm = optional(number, 64)
|
||||
max_ports_per_vm = optional(number, 65536)
|
||||
})
|
||||
|
||||
default = {
|
||||
enable_endpoint_independent_mapping = true
|
||||
enable_dynamic_port_allocation = false
|
||||
min_ports_per_vm = 64
|
||||
max_ports_per_vm = 65536
|
||||
}
|
||||
|
||||
default = {}
|
||||
nullable = false
|
||||
validation {
|
||||
condition = var.config_port_allocation.enable_dynamic_port_allocation ? var.config_port_allocation.enable_endpoint_independent_mapping == false : true
|
||||
error_message = "You must set enable_endpoint_independent_mapping to false to set enable_dynamic_port_allocation to true."
|
||||
|
@ -51,17 +45,13 @@ variable "config_source_subnets" {
|
|||
variable "config_timeouts" {
|
||||
description = "Timeout configurations."
|
||||
type = object({
|
||||
icmp = number
|
||||
tcp_established = number
|
||||
tcp_transitory = number
|
||||
udp = number
|
||||
icmp = optional(number, 30)
|
||||
tcp_established = optional(number, 1200)
|
||||
tcp_transitory = optional(number, 30)
|
||||
udp = optional(number, 30)
|
||||
})
|
||||
default = {
|
||||
icmp = 30
|
||||
tcp_established = 1200
|
||||
tcp_transitory = 30
|
||||
udp = 30
|
||||
}
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "logging_filter" {
|
||||
|
@ -109,6 +99,17 @@ variable "router_network" {
|
|||
default = null
|
||||
}
|
||||
|
||||
variable "rules" {
|
||||
description = "List of rules associated with this NAT."
|
||||
type = list(object({
|
||||
description = optional(string),
|
||||
match = string
|
||||
source_ips = list(string)
|
||||
}))
|
||||
default = []
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "subnetworks" {
|
||||
description = "Subnetworks to NAT, only used when config_source_subnets equals LIST_OF_SUBNETWORKS."
|
||||
type = list(object({
|
||||
|
|
|
@ -46,12 +46,13 @@ module "peering-a-c" {
|
|||
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [local_network](variables.tf#L30) | Resource link of the network to add a peering to. | <code>string</code> | ✓ | |
|
||||
| [peer_network](variables.tf#L41) | Resource link of the peer network. | <code>string</code> | ✓ | |
|
||||
| [local_network](variables.tf#L36) | Resource link of the network to add a peering to. | <code>string</code> | ✓ | |
|
||||
| [peer_network](variables.tf#L47) | Resource link of the peer network. | <code>string</code> | ✓ | |
|
||||
| [export_local_custom_routes](variables.tf#L18) | Export custom routes to peer network from local network. | <code>bool</code> | | <code>false</code> |
|
||||
| [export_peer_custom_routes](variables.tf#L24) | Export custom routes to local network from peer network. | <code>bool</code> | | <code>false</code> |
|
||||
| [peer_create_peering](variables.tf#L35) | Create the peering on the remote side. If false, only the peering from this network to the remote network is created. | <code>bool</code> | | <code>true</code> |
|
||||
| [prefix](variables.tf#L46) | Optional name prefix for the network peerings. | <code>string</code> | | <code>null</code> |
|
||||
| [export_public_ip_routes](variables.tf#L30) | Export subnet routes with public ip. | <code>bool</code> | | <code>true</code> |
|
||||
| [peer_create_peering](variables.tf#L41) | Create the peering on the remote side. If false, only the peering from this network to the remote network is created. | <code>bool</code> | | <code>true</code> |
|
||||
| [prefix](variables.tf#L52) | Optional name prefix for the network peerings. | <code>string</code> | | <code>null</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
|
|
@ -21,20 +21,22 @@ locals {
|
|||
}
|
||||
|
||||
resource "google_compute_network_peering" "local_network_peering" {
|
||||
name = "${local.prefix}${local.local_network_name}-${local.peer_network_name}"
|
||||
network = var.local_network
|
||||
peer_network = var.peer_network
|
||||
export_custom_routes = var.export_local_custom_routes
|
||||
import_custom_routes = var.export_peer_custom_routes
|
||||
name = "${local.prefix}${local.local_network_name}-${local.peer_network_name}"
|
||||
network = var.local_network
|
||||
peer_network = var.peer_network
|
||||
export_custom_routes = var.export_local_custom_routes
|
||||
import_custom_routes = var.export_peer_custom_routes
|
||||
export_subnet_routes_with_public_ip = var.export_public_ip_routes
|
||||
}
|
||||
|
||||
resource "google_compute_network_peering" "peer_network_peering" {
|
||||
count = var.peer_create_peering ? 1 : 0
|
||||
name = "${local.prefix}${local.peer_network_name}-${local.local_network_name}"
|
||||
network = var.peer_network
|
||||
peer_network = var.local_network
|
||||
export_custom_routes = var.export_peer_custom_routes
|
||||
import_custom_routes = var.export_local_custom_routes
|
||||
count = var.peer_create_peering ? 1 : 0
|
||||
name = "${local.prefix}${local.peer_network_name}-${local.local_network_name}"
|
||||
network = var.peer_network
|
||||
peer_network = var.local_network
|
||||
export_custom_routes = var.export_peer_custom_routes
|
||||
import_custom_routes = var.export_local_custom_routes
|
||||
export_subnet_routes_with_public_ip = var.export_public_ip_routes
|
||||
|
||||
depends_on = [google_compute_network_peering.local_network_peering]
|
||||
}
|
||||
|
|
|
@ -27,6 +27,12 @@ variable "export_peer_custom_routes" {
|
|||
default = false
|
||||
}
|
||||
|
||||
variable "export_public_ip_routes" {
|
||||
description = "Export subnet routes with public ip."
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "local_network" {
|
||||
description = "Resource link of the network to add a peering to."
|
||||
type = string
|
||||
|
|
|
@ -0,0 +1,55 @@
|
|||
# Copyright 2023 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
values:
|
||||
module.addresses.google_compute_address.external["a1"]:
|
||||
address_type: EXTERNAL
|
||||
name: a1
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
module.addresses.google_compute_address.external["a2"]:
|
||||
address_type: EXTERNAL
|
||||
name: a2
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
module.addresses.google_compute_address.external["a3"]:
|
||||
address_type: EXTERNAL
|
||||
name: a3
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
module.nat.google_compute_router.router[0]:
|
||||
name: nat-nat
|
||||
network: my-vpc
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
module.nat.google_compute_router_nat.nat:
|
||||
enable_dynamic_port_allocation: false
|
||||
enable_endpoint_independent_mapping: false
|
||||
icmp_idle_timeout_sec: 30
|
||||
name: nat
|
||||
nat_ip_allocate_option: MANUAL_ONLY
|
||||
project: my-project
|
||||
region: europe-west1
|
||||
router: nat-nat
|
||||
rules:
|
||||
- action:
|
||||
- source_nat_drain_ips: []
|
||||
description: rule1
|
||||
match: destination.ip == '8.8.8.8'
|
||||
rule_number: 0
|
||||
|
||||
counts:
|
||||
google_compute_address: 3
|
||||
google_compute_router: 1
|
||||
google_compute_router_nat: 1
|
Loading…
Reference in New Issue