Merge pull request #1590 from GoogleCloudPlatform/elia-gcve

GCVE module first release
2023-08-21 09:05:44 +02:00 · 2023-08-21 09:05:44 +02:00 · 46af8b7956
parent 0d17af7967 49a4550b5d
commit 46af8b7956
9 changed files with 469 additions and 1 deletions
--- a/README.md
+++ b/README.md
@ -31,7 +31,7 @@ Currently available modules:

 - **foundational** - [billing budget](./modules/billing-budget), [Cloud Identity group](./modules/cloud-identity-group/), [folder](./modules/folder), [service accounts](./modules/iam-service-account), [logging bucket](./modules/logging-bucket), [organization](./modules/organization), [project](./modules/project), [projects-data-source](./modules/projects-data-source)
 - **networking** - [DNS](./modules/dns), [DNS Response Policy](./modules/dns-response-policy/), [Cloud Endpoints](./modules/endpoints), [address reservation](./modules/net-address), [NAT](./modules/net-cloudnat), [VLAN Attachment](./modules/net-vlan-attachment/), [External Application LB](./modules/net-lb-app-ext/), [External Passthrough Network LB](./modules/net-lb-ext), [Firewall policy](./modules/net-firewall-policy), [Internal Application LB](./modules/net-lb-app-int), [Internal Passthrough Network LB](./modules/net-lb-int), [Internal Proxy Network LB](./modules/net-lb-proxy-int), [IPSec over Interconnect](./modules/net-ipsec-over-interconnect), [VPC](./modules/net-vpc), [VPC firewall](./modules/net-vpc-firewall), [VPC peering](./modules/net-vpc-peering), [VPN dynamic](./modules/net-vpn-dynamic), [HA VPN](./modules/net-vpn-ha), [VPN static](./modules/net-vpn-static), [Service Directory](./modules/service-directory), [Secure Web Proxy](./modules/net-swp)
- **compute** - [VM/VM group](./modules/compute-vm), [MIG](./modules/compute-mig), [COS container](./modules/cloud-config-container/cos-generic-metadata/) (coredns, mysql, onprem, squid), [GKE cluster](./modules/gke-cluster-standard), [GKE hub](./modules/gke-hub), [GKE nodepool](./modules/gke-nodepool)
+- **compute** - [VM/VM group](./modules/compute-vm), [MIG](./modules/compute-mig), [COS container](./modules/cloud-config-container/cos-generic-metadata/) (coredns, mysql, onprem, squid), [GKE cluster](./modules/gke-cluster-standard), [GKE hub](./modules/gke-hub), [GKE nodepool](./modules/gke-nodepool), [GCVE private cloud](./modules/gcve-private-cloud)
 - **data** - [AlloyDB instance](./modules/alloydb-instance), [BigQuery dataset](./modules/bigquery-dataset), [Bigtable instance](./modules/bigtable-instance), [Dataplex](./modules/dataplex), [Dataplex DataScan](./modules/dataplex-datascan/), [Cloud SQL instance](./modules/cloudsql-instance), [Data Catalog Policy Tag](./modules/data-catalog-policy-tag), [Datafusion](./modules/datafusion), [Dataproc](./modules/dataproc), [GCS](./modules/gcs), [Pub/Sub](./modules/pubsub)
 - **development** - [API Gateway](./modules/api-gateway), [Apigee](./modules/apigee), [Artifact Registry](./modules/artifact-registry), [Container Registry](./modules/container-registry), [Cloud Source Repository](./modules/source-repository)
 - **security** - [Binauthz](./modules/binauthz/), [KMS](./modules/kms), [SecretManager](./modules/secret-manager), [VPC Service Control](./modules/vpc-sc)
--- a/modules/README.md
+++ b/modules/README.md
@ -70,6 +70,7 @@ These modules are used in the examples included in this repository. If you are u
 - [GKE standard cluster](./gke-cluster-standard)
 - [GKE hub](./gke-hub)
 - [GKE nodepool](./gke-nodepool)
+- [GCVE private cloud](./gcve-private-cloud)

 ## Data

--- a/modules/gcve-private-cloud/README.md
+++ b/modules/gcve-private-cloud/README.md
@ -0,0 +1,100 @@
+# Google Cloud VMWare Engine Private Cloud Module
+
+This module implements the creation and management of a Google Cloud VMWare Engine Private Cloud with its management cluster. If configured, it also creates the VMWare engine network or it can work with an existing one. The creation of the private connection with the user VPC requires the execution of the  [Google SDK command](https://cloud.google.com/sdk/gcloud/reference/vmware/private-connections/create#--routing-mode) the module provides as an output.
+
+To understand the limits and to propertly configure the vSphere/vSAN subnets CIDR range please refer to the [GCVE public documetation](https://cloud.google.com/vmware-engine/docs/quickstart-networking-requirements).
+
+Be aware that the deployment of this module might require up to 2 hours depending on the selected private cloud target zone.
+
+<!-- BEGIN TOC -->
+- [Limitations](#limitations)
+- [Basic Private Cloud Creation](#basic-private-cloud-creation)
+- [Private Cloud Creation with custom nodes and cores count](#private-cloud-creation-with-custom-nodes-and-cores-count)
+- [Variables](#variables)
+- [Outputs](#outputs)
+<!-- END TOC -->
+
+## Limitations
+At the moment this module doesn't support the following use cases:
+- Single node private cloud
+- Stretched private cloud
+
+## Basic Private Cloud Creation
+
+```hcl
+module "gcve-pc" {
+  source     = "./fabric/modules/gcve-private-cloud"
+  name       = "gcve-pc"
+  project_id = "gcve-test-project"
+  zone       = "europe-west8-a"
+  cidr       = "192.168.0.0/24"
+
+  private_connections = {
+    transit-conn1 = {
+      name                = "transit-conn1"
+      network_self_link   = "projects/test-prj-gcve-01/global/networks/default"
+      tenant_host_project = "g39a814990532d10ap-tp"
+      type                = "PRIVATE_SERVICE_ACCESS"
+      routing_mode        = "REGIONAL"
+    }
+  }
+}
+# tftest modules=1 resources=2 inventory=basic.yaml
+```
+## Private Cloud Creation with custom nodes and cores count
+
+```hcl
+module "gcve-pc" {
+  source     = "./fabric/modules/gcve-private-cloud"
+  name       = "gcve-pc"
+  project_id = "gcve-test-project"
+  zone       = "europe-west8-a"
+  cidr       = "192.168.0.0/24"
+
+  management_cluster_config = {
+    node_type_id      = "standard-72"
+    node_count        = 6
+    custom_core_count = 28
+  }
+
+  private_connections = {
+    transit-conn1 = {
+      name                = "transit-conn1"
+      network_self_link   = "projects/test-prj-gcve-01/global/networks/default"
+      tenant_host_project = "g39a814990532d10ap-tp"
+      type                = "PRIVATE_SERVICE_ACCESS"
+      routing_mode        = "REGIONAL"
+    }
+  }
+}
+# tftest modules=1 resources=2 inventory=custom.yaml
+```
+<!-- BEGIN TFDOC -->
+## Variables
+
+| name | description | type | required | default |
+|---|---|:---:|:---:|:---:|
+| [cidr](variables.tf#L16) | vSphere/vSAN subnets CIDR range. To undersatnd the limits, please refer to [GCVE network requirements](https://cloud.google.com/vmware-engine/docs/quickstart-networking-requirements). | <code>string</code> | ✓ |  |
+| [name](variables.tf#L42) | Private cloud name. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L84) | Project id. | <code>string</code> | ✓ |  |
+| [zone](variables.tf#L101) | Private cloud zone. | <code>string</code> | ✓ |  |
+| [description](variables.tf#L21) | Private cloud description. | <code>string</code> |  | <code>&#34;Terraform-managed.&#34;</code> |
+| [management_cluster_config](variables.tf#L27) | Management cluster configuration. | <code title="object&#40;&#123;&#10;  node_type_id      &#61; string&#10;  node_count        &#61; number,&#10;  custom_core_count &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  node_type_id      &#61; &#34;standard-72&#34;,&#10;  node_count        &#61; 3,&#10;  custom_core_count &#61; null&#10;&#125;">&#123;&#8230;&#125;</code> |
+| [private_connections](variables.tf#L47) | VMWare private connections configuration. It is used to create the gcloud command printed as output. | <code title="map&#40;object&#40;&#123;&#10;  name                &#61; string&#10;  network_self_link   &#61; string&#10;  peering_name        &#61; optional&#40;string&#41;&#10;  tenant_host_project &#61; optional&#40;string&#41;&#10;  description         &#61; optional&#40;string, &#34;Terraform-managed.&#34;&#41;&#10;  type                &#61; optional&#40;string, &#34;PRIVATE_SERVICE_ACCESS&#34;&#41;&#10;  routing_mode        &#61; optional&#40;string, &#34;REGIONAL&#34;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [vmw_network_create](variables.tf#L89) | Create the VMware Engine network. When set to false, it uses a data source to reference an existing VMware Engine network. | <code>bool</code> |  | <code>true</code> |
+| [vmw_network_description](variables.tf#L95) |  VMware Engine network description. | <code>string</code> |  | <code>&#34;Terraform-managed.&#34;</code> |
+
+## Outputs
+
+| name | description | sensitive |
+|---|---|:---:|
+| [hcx](outputs.tf#L17) | Details about a HCX Cloud Manager appliance. |  |
+| [id](outputs.tf#L22) | ID of the private cloud. |  |
+| [management_cluster](outputs.tf#L27) | Details of the management cluster of the private cloud. |  |
+| [network_config](outputs.tf#L32) | Details about the network configuration of the private cloud. |  |
+| [nsx](outputs.tf#L37) | Details about a NSX Manager appliance. |  |
+| [private-cloud](outputs.tf#L42) | The private cloud resource. |  |
+| [private_connections_setup](outputs.tf#L47) | Cloud SDK commands for the private connections manual setup. |  |
+| [state](outputs.tf#L63) | Details about the state of the private cloud. |  |
+| [vcenter](outputs.tf#L68) | Details about a vCenter Server management appliance. |  |
+<!-- END TFDOC -->
--- a/modules/gcve-private-cloud/main.tf
+++ b/modules/gcve-private-cloud/main.tf
@ -0,0 +1,75 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+  region = regex("([a-z]*-[a-z]*[0-9]{1,2})-([a-z])", var.zone)[0]
+  vmw_network = (
+    var.vmw_network_create
+    ? try(google_vmwareengine_network.private-cloud-network.0, null)
+    : try(data.google_vmwareengine_network.private-cloud-network.0, null)
+  )
+  tenant_host_project = {
+    for k, v in var.private_connections : k => v.tenant_host_project == null
+    ? regex("(.*)/projects/([a-z0-9-]*)/(.*)", "${data.google_compute_network_peering.psa_peering[k].peer_network}")[1]
+    : v.tenant_host_project
+  }
+}
+
+data "google_vmwareengine_network" "private-cloud-network" {
+  count    = var.vmw_network_create ? 0 : 1
+  provider = google-beta
+  project  = var.project_id
+  name     = "${local.region}-default"
+  location = local.region
+}
+
+data "google_compute_network_peering" "psa_peering" {
+  for_each = { for k, v in var.private_connections : k => v if v.tenant_host_project == null }
+  name     = each.value.peering_name
+  network  = each.value.network_self_link
+}
+
+resource "google_vmwareengine_private_cloud" "private-cloud" {
+  provider    = google-beta
+  project     = var.project_id
+  location    = var.zone
+  name        = var.name
+  description = var.description
+
+  network_config {
+    management_cidr       = var.cidr
+    vmware_engine_network = local.vmw_network.id
+  }
+
+  management_cluster {
+    cluster_id = "${var.name}-mgmt-cluster"
+    node_type_configs {
+      node_type_id      = var.management_cluster_config.node_type_id
+      node_count        = var.management_cluster_config.node_count
+      custom_core_count = var.management_cluster_config.custom_core_count
+    }
+  }
+}
+
+resource "google_vmwareengine_network" "private-cloud-network" {
+  count       = var.vmw_network_create ? 1 : 0
+  provider    = google-beta
+  project     = var.project_id
+  name        = "${local.region}-default"
+  location    = local.region
+  type        = "LEGACY"
+  description = var.vmw_network_description
+}
--- a/modules/gcve-private-cloud/outputs.tf
+++ b/modules/gcve-private-cloud/outputs.tf
@ -0,0 +1,71 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "hcx" {
+  description = "Details about a HCX Cloud Manager appliance."
+  value       = google_vmwareengine_private_cloud.private-cloud.hcx
+}
+
+output "id" {
+  description = "ID of the private cloud."
+  value       = google_vmwareengine_private_cloud.private-cloud.id
+}
+
+output "management_cluster" {
+  description = "Details of the management cluster of the private cloud."
+  value       = google_vmwareengine_private_cloud.private-cloud.management_cluster
+}
+
+output "network_config" {
+  description = "Details about the network configuration of the private cloud."
+  value       = google_vmwareengine_private_cloud.private-cloud.network_config
+}
+
+output "nsx" {
+  description = "Details about a NSX Manager appliance."
+  value       = google_vmwareengine_private_cloud.private-cloud.nsx
+}
+
+output "private-cloud" {
+  description = "The private cloud resource."
+  value       = google_vmwareengine_private_cloud.private-cloud
+}
+
+output "private_connections_setup" {
+  description = "Cloud SDK commands for the private connections manual setup."
+  value = {
+    for k, v in var.private_connections : k => <<EOT
+    gcloud vmware private-connections create ${v.name} \
+  --location=${local.region} \
+  --project=${var.project_id} \
+  --vmware-engine-network=${local.region}-default \ 
+  --description="${v.description}" \
+  --routing-mode=${v.routing_mode} \
+  --service-project=${local.tenant_host_project[k]} \ 
+  --type=${v.type}
+  EOT
+  }
+}
+
+output "state" {
+  description = "Details about the state of the private cloud."
+  value       = google_vmwareengine_private_cloud.private-cloud.state
+}
+
+output "vcenter" {
+  description = "Details about a vCenter Server management appliance."
+  value       = google_vmwareengine_private_cloud.private-cloud.vcenter
+}
--- a/modules/gcve-private-cloud/variables.tf
+++ b/modules/gcve-private-cloud/variables.tf
@ -0,0 +1,108 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+variable "cidr" {
+  description = "vSphere/vSAN subnets CIDR range. To undersatnd the limits, please refer to [GCVE network requirements](https://cloud.google.com/vmware-engine/docs/quickstart-networking-requirements)."
+  type        = string
+}
+
+variable "description" {
+  description = "Private cloud description."
+  type        = string
+  default     = "Terraform-managed."
+}
+
+variable "management_cluster_config" {
+  description = "Management cluster configuration."
+  type = object({
+    node_type_id      = string
+    node_count        = number,
+    custom_core_count = number
+  })
+  default = {
+    node_type_id      = "standard-72",
+    node_count        = 3,
+    custom_core_count = null
+  }
+  nullable = false
+}
+
+variable "name" {
+  description = "Private cloud name."
+  type        = string
+}
+
+variable "private_connections" {
+  description = "VMWare private connections configuration. It is used to create the gcloud command printed as output."
+  type = map(object({
+    name                = string
+    network_self_link   = string
+    peering_name        = optional(string)
+    tenant_host_project = optional(string)
+    description         = optional(string, "Terraform-managed.")
+    type                = optional(string, "PRIVATE_SERVICE_ACCESS")
+    routing_mode        = optional(string, "REGIONAL")
+  }))
+  default  = {}
+  nullable = false
+  validation {
+    condition = alltrue([
+      for k, v in var.private_connections :
+      (v.peering_name != null) != (v.tenant_host_project != null)
+      ]
+    )
+    error_message = "Both peering_name and tenant_host_project variables have been set. Only one variable is allowed."
+  }
+  validation {
+    condition = alltrue([
+      for r in var.private_connections :
+      contains(["GLOBAL", "REGIONAL"], r.routing_mode)
+    ])
+    error_message = "Routing mode must be one of GLOBAL, REGIONAL."
+  }
+  validation {
+    condition = alltrue([
+      for r in var.private_connections :
+      contains(["DELL_POWERSCALE", "NETAPP_CLOUD_VOLUMES", "PRIVATE_SERVICE_ACCESS", "THIRD_PARTY_SERVICE"], r.type)
+    ])
+    error_message = "Type must be one of DELL_POWERSCALE, NETAPP_CLOUD_VOLUMES, PRIVATE_SERVICE_ACCESS, THIRD_PARTY_SERVICE."
+  }
+}
+
+variable "project_id" {
+  description = "Project id."
+  type        = string
+}
+
+variable "vmw_network_create" {
+  description = "Create the VMware Engine network. When set to false, it uses a data source to reference an existing VMware Engine network."
+  type        = bool
+  default     = true
+}
+
+variable "vmw_network_description" {
+  description = " VMware Engine network description."
+  type        = string
+  default     = "Terraform-managed."
+}
+
+variable "zone" {
+  description = "Private cloud zone."
+  type        = string
+}
+
+
+
+
--- a/modules/gcve-private-cloud/versions.tf
+++ b/modules/gcve-private-cloud/versions.tf
@ -0,0 +1,29 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+terraform {
+  required_version = ">= 1.4.4"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">= 4.76.0" # tftest
+    }
+    google-beta = {
+      source  = "hashicorp/google-beta"
+      version = ">= 4.76.0" # tftest
+    }
+  }
+}
+
+
--- a/tests/modules/gcve_private_cloud/examples/basic.yaml
+++ b/tests/modules/gcve_private_cloud/examples/basic.yaml
@ -0,0 +1,42 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  module.gcve-pc.google_vmwareengine_network.private-cloud-network[0]:
+    description: Terraform-managed.
+    location: europe-west8
+    name: europe-west8-default
+    project: gcve-test-project
+    timeouts: null
+    type: LEGACY
+  module.gcve-pc.google_vmwareengine_private_cloud.private-cloud:
+    description: Terraform-managed.
+    location: europe-west8-a
+    management_cluster:
+    - cluster_id: gcve-pc-mgmt-cluster
+      node_type_configs:
+      - custom_core_count: 0
+        node_count: 3
+        node_type_id: standard-72
+    name: gcve-pc
+    network_config:
+    - management_cidr: 192.168.0.0/24
+    project: gcve-test-project
+    timeouts: null
+
+counts:
+  google_vmwareengine_network: 1
+  google_vmwareengine_private_cloud: 1
+  modules: 1
+  resources: 2
--- a/tests/modules/gcve_private_cloud/examples/custom.yaml
+++ b/tests/modules/gcve_private_cloud/examples/custom.yaml
@ -0,0 +1,42 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  module.gcve-pc.google_vmwareengine_network.private-cloud-network[0]:
+    description: Terraform-managed.
+    location: europe-west8
+    name: europe-west8-default
+    project: gcve-test-project
+    timeouts: null
+    type: LEGACY
+  module.gcve-pc.google_vmwareengine_private_cloud.private-cloud:
+    description: Terraform-managed.
+    location: europe-west8-a
+    management_cluster:
+    - cluster_id: gcve-pc-mgmt-cluster
+      node_type_configs:
+      - custom_core_count: 28
+        node_count: 6
+        node_type_id: standard-72
+    name: gcve-pc
+    network_config:
+    - management_cidr: 192.168.0.0/24
+    project: gcve-test-project
+    timeouts: null
+
+counts:
+  google_vmwareengine_network: 1
+  google_vmwareengine_private_cloud: 1
+  modules: 1
+  resources: 2