diff --git a/fast/stages/2-networking-a-peering/README.md b/fast/stages/2-networking-a-peering/README.md index 25d40431..be27cabd 100644 --- a/fast/stages/2-networking-a-peering/README.md +++ b/fast/stages/2-networking-a-peering/README.md @@ -366,9 +366,9 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS | name | description | modules | resources | |---|---|---|---| -| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns | | -| [dns-landing.tf](./dns-landing.tf) | Landing DNS zones and peerings setup. | dns · dns-response-policy | | -| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns | | +| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns | google_dns_policy | +| [dns-landing.tf](./dns-landing.tf) | Landing DNS zones and peerings setup. | dns · dns-response-policy | google_dns_policy | +| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns | google_dns_policy | | [main.tf](./main.tf) | Networking folder and hierarchical policy. | folder · net-firewall-policy | | | [monitoring-vpn-onprem.tf](./monitoring-vpn-onprem.tf) | VPN monitoring alerts. | | google_monitoring_alert_policy | | [monitoring.tf](./monitoring.tf) | Network monitoring dashboards. | | google_monitoring_dashboard | @@ -389,20 +389,20 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS |---|---|:---:|:---:|:---:|:---:| | [automation](variables.tf#L42) | Automation resources created by the bootstrap stage. | object({…}) | ✓ | | 0-bootstrap | | [billing_account](variables.tf#L50) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | object({…}) | ✓ | | 0-bootstrap | -| [folder_ids](variables.tf#L101) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | -| [organization](variables.tf#L121) | Organization details. | object({…}) | ✓ | | 0-bootstrap | -| [prefix](variables.tf#L137) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | +| [folder_ids](variables.tf#L103) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | +| [organization](variables.tf#L123) | Organization details. | object({…}) | ✓ | | 0-bootstrap | +| [prefix](variables.tf#L139) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | -| [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | -| [groups](variables.tf#L111) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | -| [outputs_location](variables.tf#L131) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | +| [dns](variables.tf#L72) | DNS configuration. | object({…}) | | {} | | +| [factories_config](variables.tf#L82) | Configuration for network resource factories. | object({…}) | | {…} | | +| [groups](variables.tf#L113) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | +| [outputs_location](variables.tf#L133) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | | [peering_configs](variables-peerings.tf#L19) | Peering configurations. | object({…}) | | {} | | -| [psa_ranges](variables.tf#L148) | IP ranges used for Private Service Access (CloudSQL, etc.). | object({…}) | | null | | -| [regions](variables.tf#L167) | Region definitions. | object({…}) | | {…} | | -| [service_accounts](variables.tf#L179) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | -| [vpn_onprem_primary_config](variables.tf#L193) | VPN gateway configuration for onprem interconnection in the primary region. | object({…}) | | null | | +| [psa_ranges](variables.tf#L150) | IP ranges used for Private Service Access (CloudSQL, etc.). | object({…}) | | null | | +| [regions](variables.tf#L169) | Region definitions. | object({…}) | | {…} | | +| [service_accounts](variables.tf#L181) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | +| [vpn_onprem_primary_config](variables.tf#L195) | VPN gateway configuration for onprem interconnection in the primary region. | object({…}) | | null | | ## Outputs diff --git a/fast/stages/2-networking-a-peering/dns-dev.tf b/fast/stages/2-networking-a-peering/dns-dev.tf index f40281fb..c91e959b 100644 --- a/fast/stages/2-networking-a-peering/dns-dev.tf +++ b/fast/stages/2-networking-a-peering/dns-dev.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -75,3 +75,15 @@ module "dev-dns-peer-landing-rev-10" { } } } + +# DNS policy to enable query logging + +resource "google_dns_policy" "dev-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.dev-spoke-project.project_id + enable_logging = true + networks { + network_url = module.dev-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-a-peering/dns-landing.tf b/fast/stages/2-networking-a-peering/dns-landing.tf index dcdb5cee..25fa33e4 100644 --- a/fast/stages/2-networking-a-peering/dns-landing.tf +++ b/fast/stages/2-networking-a-peering/dns-landing.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,13 +25,14 @@ moved { module "landing-dns-fwd-onprem-example" { source = "../../../modules/dns" + count = length(var.dns.resolvers) > 0 ? 1 : 0 project_id = module.landing-project.project_id name = "example-com" zone_config = { domain = "onprem.example.com." forwarding = { client_networks = [module.landing-vpc.self_link] - forwarders = { for ip in var.dns.onprem : ip => null } + forwarders = { for ip in var.dns.resolvers : ip => null } } } } @@ -43,13 +44,14 @@ moved { module "landing-dns-fwd-onprem-rev-10" { source = "../../../modules/dns" + count = length(var.dns.resolvers) > 0 ? 1 : 0 project_id = module.landing-project.project_id name = "root-reverse-10" zone_config = { domain = "10.in-addr.arpa." forwarding = { client_networks = [module.landing-vpc.self_link] - forwarders = { for ip in var.dns.onprem : ip => null } + forwarders = { for ip in var.dns.resolvers : ip => null } } } } @@ -85,3 +87,15 @@ module "landing-dns-policy-googleapis" { } rules_file = var.factories_config.dns_policy_rules_file } + +# DNS policy to enable query logging + +resource "google_dns_policy" "landing-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.landing-project.project_id + enable_logging = true + networks { + network_url = module.landing-vpc.id + } +} diff --git a/fast/stages/2-networking-a-peering/dns-prod.tf b/fast/stages/2-networking-a-peering/dns-prod.tf index 6bd34be8..f09e16f9 100644 --- a/fast/stages/2-networking-a-peering/dns-prod.tf +++ b/fast/stages/2-networking-a-peering/dns-prod.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -75,3 +75,15 @@ module "prod-dns-peer-landing-rev-10" { } } } + +# DNS policy to enable query logging + +resource "google_dns_policy" "prod-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.prod-spoke-project.project_id + enable_logging = true + networks { + network_url = module.prod-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-a-peering/variables.tf b/fast/stages/2-networking-a-peering/variables.tf index 4def0c3f..6eaa2d45 100644 --- a/fast/stages/2-networking-a-peering/variables.tf +++ b/fast/stages/2-networking-a-peering/variables.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,11 +70,13 @@ variable "custom_roles" { } variable "dns" { - description = "Onprem DNS resolvers." - type = map(list(string)) - default = { - onprem = ["10.0.200.3"] - } + description = "DNS configuration." + type = object({ + enable_logging = optional(bool, true) + resolvers = optional(list(string), []) + }) + default = {} + nullable = false } variable "factories_config" { diff --git a/fast/stages/2-networking-b-vpn/README.md b/fast/stages/2-networking-b-vpn/README.md index 880f771b..4a440474 100644 --- a/fast/stages/2-networking-b-vpn/README.md +++ b/fast/stages/2-networking-b-vpn/README.md @@ -388,9 +388,9 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS | name | description | modules | resources | |---|---|---|---| -| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns | | -| [dns-landing.tf](./dns-landing.tf) | Landing DNS zones and peerings setup. | dns · dns-response-policy | | -| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns | | +| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns | google_dns_policy | +| [dns-landing.tf](./dns-landing.tf) | Landing DNS zones and peerings setup. | dns · dns-response-policy | google_dns_policy | +| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns | google_dns_policy | | [main.tf](./main.tf) | Networking folder and hierarchical policy. | folder · net-firewall-policy | | | [monitoring-vpn.tf](./monitoring-vpn.tf) | VPN monitoring alerts. | | google_monitoring_alert_policy | | [monitoring.tf](./monitoring.tf) | Network monitoring dashboards. | | google_monitoring_dashboard | @@ -413,20 +413,20 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS |---|---|:---:|:---:|:---:|:---:| | [automation](variables.tf#L42) | Automation resources created by the bootstrap stage. | object({…}) | ✓ | | 0-bootstrap | | [billing_account](variables.tf#L50) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | object({…}) | ✓ | | 0-bootstrap | -| [folder_ids](variables.tf#L101) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | -| [organization](variables.tf#L121) | Organization details. | object({…}) | ✓ | | 0-bootstrap | -| [prefix](variables.tf#L137) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | +| [folder_ids](variables.tf#L103) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | +| [organization](variables.tf#L123) | Organization details. | object({…}) | ✓ | | 0-bootstrap | +| [prefix](variables.tf#L139) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | -| [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | -| [groups](variables.tf#L111) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | -| [outputs_location](variables.tf#L131) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | -| [psa_ranges](variables.tf#L148) | IP ranges used for Private Service Access (CloudSQL, etc.). | object({…}) | | null | | -| [regions](variables.tf#L167) | Region definitions. | object({…}) | | {…} | | -| [service_accounts](variables.tf#L179) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | +| [dns](variables.tf#L72) | DNS configuration. | object({…}) | | {} | | +| [factories_config](variables.tf#L82) | Configuration for network resource factories. | object({…}) | | {…} | | +| [groups](variables.tf#L113) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | +| [outputs_location](variables.tf#L133) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | +| [psa_ranges](variables.tf#L150) | IP ranges used for Private Service Access (CloudSQL, etc.). | object({…}) | | null | | +| [regions](variables.tf#L169) | Region definitions. | object({…}) | | {…} | | +| [service_accounts](variables.tf#L181) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | | [vpn_configs](variables-vpn.tf#L17) | Hub to spokes VPN configurations. | object({…}) | | {} | | -| [vpn_onprem_primary_config](variables.tf#L193) | VPN gateway configuration for onprem interconnection in the primary region. | object({…}) | | null | | +| [vpn_onprem_primary_config](variables.tf#L195) | VPN gateway configuration for onprem interconnection in the primary region. | object({…}) | | null | | ## Outputs diff --git a/fast/stages/2-networking-b-vpn/dns-dev.tf b/fast/stages/2-networking-b-vpn/dns-dev.tf index f40281fb..c91e959b 100644 --- a/fast/stages/2-networking-b-vpn/dns-dev.tf +++ b/fast/stages/2-networking-b-vpn/dns-dev.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -75,3 +75,15 @@ module "dev-dns-peer-landing-rev-10" { } } } + +# DNS policy to enable query logging + +resource "google_dns_policy" "dev-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.dev-spoke-project.project_id + enable_logging = true + networks { + network_url = module.dev-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-b-vpn/dns-landing.tf b/fast/stages/2-networking-b-vpn/dns-landing.tf index dcdb5cee..25fa33e4 100644 --- a/fast/stages/2-networking-b-vpn/dns-landing.tf +++ b/fast/stages/2-networking-b-vpn/dns-landing.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,13 +25,14 @@ moved { module "landing-dns-fwd-onprem-example" { source = "../../../modules/dns" + count = length(var.dns.resolvers) > 0 ? 1 : 0 project_id = module.landing-project.project_id name = "example-com" zone_config = { domain = "onprem.example.com." forwarding = { client_networks = [module.landing-vpc.self_link] - forwarders = { for ip in var.dns.onprem : ip => null } + forwarders = { for ip in var.dns.resolvers : ip => null } } } } @@ -43,13 +44,14 @@ moved { module "landing-dns-fwd-onprem-rev-10" { source = "../../../modules/dns" + count = length(var.dns.resolvers) > 0 ? 1 : 0 project_id = module.landing-project.project_id name = "root-reverse-10" zone_config = { domain = "10.in-addr.arpa." forwarding = { client_networks = [module.landing-vpc.self_link] - forwarders = { for ip in var.dns.onprem : ip => null } + forwarders = { for ip in var.dns.resolvers : ip => null } } } } @@ -85,3 +87,15 @@ module "landing-dns-policy-googleapis" { } rules_file = var.factories_config.dns_policy_rules_file } + +# DNS policy to enable query logging + +resource "google_dns_policy" "landing-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.landing-project.project_id + enable_logging = true + networks { + network_url = module.landing-vpc.id + } +} diff --git a/fast/stages/2-networking-b-vpn/dns-prod.tf b/fast/stages/2-networking-b-vpn/dns-prod.tf index 6bd34be8..f09e16f9 100644 --- a/fast/stages/2-networking-b-vpn/dns-prod.tf +++ b/fast/stages/2-networking-b-vpn/dns-prod.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -75,3 +75,15 @@ module "prod-dns-peer-landing-rev-10" { } } } + +# DNS policy to enable query logging + +resource "google_dns_policy" "prod-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.prod-spoke-project.project_id + enable_logging = true + networks { + network_url = module.prod-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-b-vpn/variables.tf b/fast/stages/2-networking-b-vpn/variables.tf index 4def0c3f..6eaa2d45 100644 --- a/fast/stages/2-networking-b-vpn/variables.tf +++ b/fast/stages/2-networking-b-vpn/variables.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,11 +70,13 @@ variable "custom_roles" { } variable "dns" { - description = "Onprem DNS resolvers." - type = map(list(string)) - default = { - onprem = ["10.0.200.3"] - } + description = "DNS configuration." + type = object({ + enable_logging = optional(bool, true) + resolvers = optional(list(string), []) + }) + default = {} + nullable = false } variable "factories_config" { diff --git a/fast/stages/2-networking-c-nva/README.md b/fast/stages/2-networking-c-nva/README.md index 67408916..79019c0e 100644 --- a/fast/stages/2-networking-c-nva/README.md +++ b/fast/stages/2-networking-c-nva/README.md @@ -436,9 +436,9 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS | name | description | modules | resources | |---|---|---|---| -| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns | | -| [dns-landing.tf](./dns-landing.tf) | Landing DNS zones and peerings setup. | dns · dns-response-policy | | -| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns | | +| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns | google_dns_policy | +| [dns-landing.tf](./dns-landing.tf) | Landing DNS zones and peerings setup. | dns · dns-response-policy | google_dns_policy | +| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns | google_dns_policy | | [main.tf](./main.tf) | Networking folder and hierarchical policy. | folder · net-firewall-policy | | | [monitoring-vpn-onprem.tf](./monitoring-vpn-onprem.tf) | VPN monitoring alerts. | | google_monitoring_alert_policy | | [monitoring.tf](./monitoring.tf) | Network monitoring dashboards. | | google_monitoring_dashboard | @@ -458,22 +458,22 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS |---|---|:---:|:---:|:---:|:---:| | [automation](variables.tf#L42) | Automation resources created by the bootstrap stage. | object({…}) | ✓ | | 0-bootstrap | | [billing_account](variables.tf#L50) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | object({…}) | ✓ | | 0-bootstrap | -| [folder_ids](variables.tf#L101) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | -| [organization](variables.tf#L144) | Organization details. | object({…}) | ✓ | | 0-bootstrap | -| [prefix](variables.tf#L160) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | +| [folder_ids](variables.tf#L103) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | +| [organization](variables.tf#L146) | Organization details. | object({…}) | ✓ | | 0-bootstrap | +| [prefix](variables.tf#L162) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | -| [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | -| [gcp_ranges](variables.tf#L111) | GCP address ranges in name => range format. | map(string) | | {…} | | -| [groups](variables.tf#L126) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | -| [onprem_cidr](variables.tf#L136) | Onprem addresses in name => range format. | map(string) | | {…} | | -| [outputs_location](variables.tf#L154) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | -| [psa_ranges](variables.tf#L171) | IP ranges used for Private Service Access (e.g. CloudSQL). Ranges is in name => range format. | object({…}) | | null | | -| [regions](variables.tf#L190) | Region definitions. | object({…}) | | {…} | | -| [service_accounts](variables.tf#L202) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | -| [vpn_onprem_primary_config](variables.tf#L216) | VPN gateway configuration for onprem interconnection in the primary region. | object({…}) | | null | | -| [vpn_onprem_secondary_config](variables.tf#L259) | VPN gateway configuration for onprem interconnection in the secondary region. | object({…}) | | null | | +| [dns](variables.tf#L72) | DNS configuration. | object({…}) | | {} | | +| [factories_config](variables.tf#L82) | Configuration for network resource factories. | object({…}) | | {…} | | +| [gcp_ranges](variables.tf#L113) | GCP address ranges in name => range format. | map(string) | | {…} | | +| [groups](variables.tf#L128) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | +| [onprem_cidr](variables.tf#L138) | Onprem addresses in name => range format. | map(string) | | {…} | | +| [outputs_location](variables.tf#L156) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | +| [psa_ranges](variables.tf#L173) | IP ranges used for Private Service Access (e.g. CloudSQL). Ranges is in name => range format. | object({…}) | | null | | +| [regions](variables.tf#L192) | Region definitions. | object({…}) | | {…} | | +| [service_accounts](variables.tf#L204) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | +| [vpn_onprem_primary_config](variables.tf#L218) | VPN gateway configuration for onprem interconnection in the primary region. | object({…}) | | null | | +| [vpn_onprem_secondary_config](variables.tf#L261) | VPN gateway configuration for onprem interconnection in the secondary region. | object({…}) | | null | | ## Outputs diff --git a/fast/stages/2-networking-c-nva/dns-dev.tf b/fast/stages/2-networking-c-nva/dns-dev.tf index ccedee72..11c721fe 100644 --- a/fast/stages/2-networking-c-nva/dns-dev.tf +++ b/fast/stages/2-networking-c-nva/dns-dev.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,3 +70,16 @@ module "dev-dns-peer-landing-rev-10" { } } } + + +# DNS policy to enable query logging + +resource "google_dns_policy" "dev-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.dev-spoke-project.project_id + enable_logging = true + networks { + network_url = module.dev-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-c-nva/dns-landing.tf b/fast/stages/2-networking-c-nva/dns-landing.tf index 5c8e1777..b93fc08a 100644 --- a/fast/stages/2-networking-c-nva/dns-landing.tf +++ b/fast/stages/2-networking-c-nva/dns-landing.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,6 +25,7 @@ moved { module "landing-dns-fwd-onprem-example" { source = "../../../modules/dns" + count = length(var.dns.resolvers) > 0 ? 1 : 0 project_id = module.landing-project.project_id name = "example-com" zone_config = { @@ -34,7 +35,7 @@ module "landing-dns-fwd-onprem-example" { module.landing-untrusted-vpc.self_link, module.landing-trusted-vpc.self_link ] - forwarders = { for ip in var.dns.onprem : ip => null } + forwarders = { for ip in var.dns.resolvers : ip => null } } } } @@ -46,6 +47,7 @@ moved { module "landing-dns-fwd-onprem-rev-10" { source = "../../../modules/dns" + count = length(var.dns.resolvers) > 0 ? 1 : 0 project_id = module.landing-project.project_id name = "root-reverse-10" zone_config = { @@ -55,7 +57,7 @@ module "landing-dns-fwd-onprem-rev-10" { module.landing-untrusted-vpc.self_link, module.landing-trusted-vpc.self_link ] - forwarders = { for ip in var.dns.onprem : ip => null } + forwarders = { for ip in var.dns.resolvers : ip => null } } } } @@ -95,3 +97,18 @@ module "landing-dns-policy-googleapis" { } rules_file = var.factories_config.dns_policy_rules_file } + +# DNS policy to enable query logging + +resource "google_dns_policy" "landing-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.landing-project.project_id + enable_logging = true + networks { + network_url = module.landing-trusted-vpc.id + } + networks { + network_url = module.landing-untrusted-vpc.id + } +} diff --git a/fast/stages/2-networking-c-nva/dns-prod.tf b/fast/stages/2-networking-c-nva/dns-prod.tf index 62cfab03..ea0d3a5d 100644 --- a/fast/stages/2-networking-c-nva/dns-prod.tf +++ b/fast/stages/2-networking-c-nva/dns-prod.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,3 +70,15 @@ module "prod-dns-peer-landing-rev-10" { } } } + +# DNS policy to enable query logging + +resource "google_dns_policy" "prod-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.prod-spoke-project.project_id + enable_logging = true + networks { + network_url = module.prod-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-c-nva/variables.tf b/fast/stages/2-networking-c-nva/variables.tf index f62547bc..a376ce42 100644 --- a/fast/stages/2-networking-c-nva/variables.tf +++ b/fast/stages/2-networking-c-nva/variables.tf @@ -1,5 +1,5 @@ /** - * Copyright 2023 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,11 +70,13 @@ variable "custom_roles" { } variable "dns" { - description = "Onprem DNS resolvers." - type = map(list(string)) - default = { - onprem = ["10.0.200.3"] - } + description = "DNS configuration." + type = object({ + enable_logging = optional(bool, true) + resolvers = optional(list(string), []) + }) + default = {} + nullable = false } variable "factories_config" { diff --git a/fast/stages/2-networking-d-separate-envs/README.md b/fast/stages/2-networking-d-separate-envs/README.md index bb3aa4d2..5922ce61 100644 --- a/fast/stages/2-networking-d-separate-envs/README.md +++ b/fast/stages/2-networking-d-separate-envs/README.md @@ -313,8 +313,8 @@ Regions are defined via the `regions` variable which sets up a mapping between t | name | description | modules | resources | |---|---|---|---| -| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns · dns-response-policy | | -| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns · dns-response-policy | | +| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns · dns-response-policy | google_dns_policy | +| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns · dns-response-policy | google_dns_policy | | [main.tf](./main.tf) | Networking folder and hierarchical policy. | folder · net-firewall-policy | | | [monitoring-vpn-onprem.tf](./monitoring-vpn-onprem.tf) | VPN monitoring alerts. | | google_monitoring_alert_policy | | [monitoring.tf](./monitoring.tf) | Network monitoring dashboards. | | google_monitoring_dashboard | @@ -332,20 +332,20 @@ Regions are defined via the `regions` variable which sets up a mapping between t |---|---|:---:|:---:|:---:|:---:| | [automation](variables.tf#L42) | Automation resources created by the bootstrap stage. | object({…}) | ✓ | | 0-bootstrap | | [billing_account](variables.tf#L50) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | object({…}) | ✓ | | 0-bootstrap | -| [folder_ids](variables.tf#L102) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | -| [organization](variables.tf#L122) | Organization details. | object({…}) | ✓ | | 0-bootstrap | -| [prefix](variables.tf#L138) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | +| [folder_ids](variables.tf#L104) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | +| [organization](variables.tf#L124) | Organization details. | object({…}) | ✓ | | 0-bootstrap | +| [prefix](variables.tf#L140) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | -| [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L81) | Configuration for network resource factories. | object({…}) | | {…} | | -| [groups](variables.tf#L112) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | -| [outputs_location](variables.tf#L132) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | -| [psa_ranges](variables.tf#L149) | IP ranges used for Private Service Access (e.g. CloudSQL). | object({…}) | | null | | -| [regions](variables.tf#L168) | Region definitions. | object({…}) | | {…} | | -| [service_accounts](variables.tf#L178) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | -| [vpn_onprem_dev_primary_config](variables.tf#L192) | VPN gateway configuration for onprem interconnection from dev in the primary region. | object({…}) | | null | | -| [vpn_onprem_prod_primary_config](variables.tf#L235) | VPN gateway configuration for onprem interconnection from prod in the primary region. | object({…}) | | null | | +| [dns](variables.tf#L72) | DNS configuration. | object({…}) | | {} | | +| [factories_config](variables.tf#L83) | Configuration for network resource factories. | object({…}) | | {…} | | +| [groups](variables.tf#L114) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | +| [outputs_location](variables.tf#L134) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | +| [psa_ranges](variables.tf#L151) | IP ranges used for Private Service Access (e.g. CloudSQL). | object({…}) | | null | | +| [regions](variables.tf#L170) | Region definitions. | object({…}) | | {…} | | +| [service_accounts](variables.tf#L180) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | +| [vpn_onprem_dev_primary_config](variables.tf#L194) | VPN gateway configuration for onprem interconnection from dev in the primary region. | object({…}) | | null | | +| [vpn_onprem_prod_primary_config](variables.tf#L237) | VPN gateway configuration for onprem interconnection from prod in the primary region. | object({…}) | | null | | ## Outputs diff --git a/fast/stages/2-networking-d-separate-envs/dns-dev.tf b/fast/stages/2-networking-d-separate-envs/dns-dev.tf index bad0db19..cb50147a 100644 --- a/fast/stages/2-networking-d-separate-envs/dns-dev.tf +++ b/fast/stages/2-networking-d-separate-envs/dns-dev.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -40,13 +40,14 @@ moved { module "dev-dns-fwd-onprem-example" { source = "../../../modules/dns" + count = length(var.dns.dev_resolvers) > 0 ? 1 : 0 project_id = module.dev-spoke-project.project_id name = "example-com" zone_config = { domain = "onprem.example.com." forwarding = { client_networks = [module.dev-spoke-vpc.self_link] - forwarders = { for ip in var.dns.dev : ip => null } + forwarders = { for ip in var.dns.dev_resolvers : ip => null } } } } @@ -58,13 +59,14 @@ moved { module "dev-dns-fwd-onprem-rev-10" { source = "../../../modules/dns" + count = length(var.dns.dev_resolvers) > 0 ? 1 : 0 project_id = module.dev-spoke-project.project_id name = "root-reverse-10" zone_config = { domain = "10.in-addr.arpa." forwarding = { client_networks = [module.dev-spoke-vpc.self_link] - forwarders = { for ip in var.dns.dev : ip => null } + forwarders = { for ip in var.dns.dev_resolvers : ip => null } } } } @@ -80,3 +82,15 @@ module "dev-dns-policy-googleapis" { } rules_file = var.factories_config.dns_policy_rules_file } + +# DNS policy to enable query logging + +resource "google_dns_policy" "dev-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.dev-spoke-project.project_id + enable_logging = true + networks { + network_url = module.dev-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-d-separate-envs/dns-prod.tf b/fast/stages/2-networking-d-separate-envs/dns-prod.tf index 17d3d531..c293196c 100644 --- a/fast/stages/2-networking-d-separate-envs/dns-prod.tf +++ b/fast/stages/2-networking-d-separate-envs/dns-prod.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -40,13 +40,14 @@ moved { module "prod-dns-fwd-onprem-example" { source = "../../../modules/dns" + count = length(var.dns.prod_resolvers) > 0 ? 1 : 0 project_id = module.prod-spoke-project.project_id name = "example-com" zone_config = { domain = "onprem.example.com." forwarding = { client_networks = [module.prod-spoke-vpc.self_link] - forwarders = { for ip in var.dns.prod : ip => null } + forwarders = { for ip in var.dns.prod_resolvers : ip => null } } } } @@ -58,13 +59,14 @@ moved { module "prod-dns-fwd-onprem-rev-10" { source = "../../../modules/dns" + count = length(var.dns.prod_resolvers) > 0 ? 1 : 0 project_id = module.prod-spoke-project.project_id name = "root-reverse-10" zone_config = { domain = "10.in-addr.arpa." forwarding = { client_networks = [module.prod-spoke-vpc.self_link] - forwarders = { for ip in var.dns.prod : ip => null } + forwarders = { for ip in var.dns.prod_resolvers : ip => null } } } } @@ -80,3 +82,15 @@ module "prod-dns-policy-googleapis" { } rules_file = var.factories_config.dns_policy_rules_file } + +# DNS policy to enable query logging + +resource "google_dns_policy" "prod-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.prod-spoke-project.project_id + enable_logging = true + networks { + network_url = module.prod-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-d-separate-envs/variables.tf b/fast/stages/2-networking-d-separate-envs/variables.tf index 5d0642df..f6dccda0 100644 --- a/fast/stages/2-networking-d-separate-envs/variables.tf +++ b/fast/stages/2-networking-d-separate-envs/variables.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,12 +70,14 @@ variable "custom_roles" { } variable "dns" { - description = "Onprem DNS resolvers." - type = map(list(string)) - default = { - prod = ["10.0.1.1"] - dev = ["10.0.2.1"] - } + description = "DNS configuration." + type = object({ + dev_resolvers = optional(list(string), []) + enable_logging = optional(bool, true) + prod_resolvers = optional(list(string), []) + }) + default = {} + nullable = false } variable "factories_config" { diff --git a/fast/stages/2-networking-e-nva-bgp/README.md b/fast/stages/2-networking-e-nva-bgp/README.md index 6043e77b..4b684e20 100644 --- a/fast/stages/2-networking-e-nva-bgp/README.md +++ b/fast/stages/2-networking-e-nva-bgp/README.md @@ -461,9 +461,9 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS | name | description | modules | resources | |---|---|---|---| -| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns | | -| [dns-landing.tf](./dns-landing.tf) | Landing DNS zones and peerings setup. | dns · dns-response-policy | | -| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns | | +| [dns-dev.tf](./dns-dev.tf) | Development spoke DNS zones and peerings setup. | dns | google_dns_policy | +| [dns-landing.tf](./dns-landing.tf) | Landing DNS zones and peerings setup. | dns · dns-response-policy | google_dns_policy | +| [dns-prod.tf](./dns-prod.tf) | Production spoke DNS zones and peerings setup. | dns | google_dns_policy | | [main.tf](./main.tf) | Networking folder and hierarchical policy. | folder · net-firewall-policy | | | [monitoring-vpn-onprem.tf](./monitoring-vpn-onprem.tf) | VPN monitoring alerts. | | google_monitoring_alert_policy | | [monitoring.tf](./monitoring.tf) | Network monitoring dashboards. | | google_monitoring_dashboard | @@ -484,24 +484,24 @@ DNS configurations are centralised in the `dns-*.tf` files. Spokes delegate DNS |---|---|:---:|:---:|:---:|:---:| | [automation](variables.tf#L42) | Automation resources created by the bootstrap stage. | object({…}) | ✓ | | 0-bootstrap | | [billing_account](variables.tf#L50) | Billing account id. If billing account is not part of the same org set `is_org_level` to false. | object({…}) | ✓ | | 0-bootstrap | -| [folder_ids](variables.tf#L101) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | -| [organization](variables.tf#L155) | Organization details. | object({…}) | ✓ | | 0-bootstrap | -| [prefix](variables.tf#L171) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | +| [folder_ids](variables.tf#L103) | Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. | object({…}) | ✓ | | 1-resman | +| [organization](variables.tf#L157) | Organization details. | object({…}) | ✓ | | 0-bootstrap | +| [prefix](variables.tf#L173) | Prefix used for resources that need unique names. Use 9 characters or less. | string | ✓ | | 0-bootstrap | | [alert_config](variables.tf#L17) | Configuration for monitoring alerts. | object({…}) | | {…} | | | [custom_roles](variables.tf#L63) | Custom roles defined at the org level, in key => id format. | object({…}) | | null | 0-bootstrap | -| [dns](variables.tf#L72) | Onprem DNS resolvers. | map(list(string)) | | {…} | | -| [factories_config](variables.tf#L80) | Configuration for network resource factories. | object({…}) | | {…} | | -| [gcp_ranges](variables.tf#L111) | GCP address ranges in name => range format. | map(string) | | {…} | | -| [groups](variables.tf#L126) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | -| [ncc_asn](variables.tf#L136) | The NCC Cloud Routers ASN configuration. | map(number) | | {…} | | -| [onprem_cidr](variables.tf#L147) | Onprem addresses in name => range format. | map(string) | | {…} | | -| [outputs_location](variables.tf#L165) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | -| [psa_ranges](variables.tf#L182) | IP ranges used for Private Service Access (e.g. CloudSQL). Ranges is in name => range format. | object({…}) | | null | | -| [regions](variables.tf#L201) | Region definitions. | object({…}) | | {…} | | -| [service_accounts](variables.tf#L213) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | -| [vpn_onprem_primary_config](variables.tf#L227) | VPN gateway configuration for onprem interconnection in the primary region. | object({…}) | | null | | -| [vpn_onprem_secondary_config](variables.tf#L270) | VPN gateway configuration for onprem interconnection in the secondary region. | object({…}) | | null | | -| [zones](variables.tf#L313) | Zones in which NVAs are deployed. | list(string) | | ["b", "c"] | | +| [dns](variables.tf#L72) | DNS configuration. | object({…}) | | {} | | +| [factories_config](variables.tf#L82) | Configuration for network resource factories. | object({…}) | | {…} | | +| [gcp_ranges](variables.tf#L113) | GCP address ranges in name => range format. | map(string) | | {…} | | +| [groups](variables.tf#L128) | Group names or emails to grant organization-level permissions. If just the name is provided, the default organization domain is assumed. | object({…}) | | {} | 0-bootstrap | +| [ncc_asn](variables.tf#L138) | The NCC Cloud Routers ASN configuration. | map(number) | | {…} | | +| [onprem_cidr](variables.tf#L149) | Onprem addresses in name => range format. | map(string) | | {…} | | +| [outputs_location](variables.tf#L167) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | +| [psa_ranges](variables.tf#L184) | IP ranges used for Private Service Access (e.g. CloudSQL). Ranges is in name => range format. | object({…}) | | null | | +| [regions](variables.tf#L203) | Region definitions. | object({…}) | | {…} | | +| [service_accounts](variables.tf#L215) | Automation service accounts in name => email format. | object({…}) | | null | 1-resman | +| [vpn_onprem_primary_config](variables.tf#L229) | VPN gateway configuration for onprem interconnection in the primary region. | object({…}) | | null | | +| [vpn_onprem_secondary_config](variables.tf#L272) | VPN gateway configuration for onprem interconnection in the secondary region. | object({…}) | | null | | +| [zones](variables.tf#L315) | Zones in which NVAs are deployed. | list(string) | | ["b", "c"] | | ## Outputs diff --git a/fast/stages/2-networking-e-nva-bgp/dns-dev.tf b/fast/stages/2-networking-e-nva-bgp/dns-dev.tf index ccedee72..11c721fe 100644 --- a/fast/stages/2-networking-e-nva-bgp/dns-dev.tf +++ b/fast/stages/2-networking-e-nva-bgp/dns-dev.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,3 +70,16 @@ module "dev-dns-peer-landing-rev-10" { } } } + + +# DNS policy to enable query logging + +resource "google_dns_policy" "dev-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.dev-spoke-project.project_id + enable_logging = true + networks { + network_url = module.dev-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-e-nva-bgp/dns-landing.tf b/fast/stages/2-networking-e-nva-bgp/dns-landing.tf index 5c8e1777..b93fc08a 100644 --- a/fast/stages/2-networking-e-nva-bgp/dns-landing.tf +++ b/fast/stages/2-networking-e-nva-bgp/dns-landing.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,6 +25,7 @@ moved { module "landing-dns-fwd-onprem-example" { source = "../../../modules/dns" + count = length(var.dns.resolvers) > 0 ? 1 : 0 project_id = module.landing-project.project_id name = "example-com" zone_config = { @@ -34,7 +35,7 @@ module "landing-dns-fwd-onprem-example" { module.landing-untrusted-vpc.self_link, module.landing-trusted-vpc.self_link ] - forwarders = { for ip in var.dns.onprem : ip => null } + forwarders = { for ip in var.dns.resolvers : ip => null } } } } @@ -46,6 +47,7 @@ moved { module "landing-dns-fwd-onprem-rev-10" { source = "../../../modules/dns" + count = length(var.dns.resolvers) > 0 ? 1 : 0 project_id = module.landing-project.project_id name = "root-reverse-10" zone_config = { @@ -55,7 +57,7 @@ module "landing-dns-fwd-onprem-rev-10" { module.landing-untrusted-vpc.self_link, module.landing-trusted-vpc.self_link ] - forwarders = { for ip in var.dns.onprem : ip => null } + forwarders = { for ip in var.dns.resolvers : ip => null } } } } @@ -95,3 +97,18 @@ module "landing-dns-policy-googleapis" { } rules_file = var.factories_config.dns_policy_rules_file } + +# DNS policy to enable query logging + +resource "google_dns_policy" "landing-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.landing-project.project_id + enable_logging = true + networks { + network_url = module.landing-trusted-vpc.id + } + networks { + network_url = module.landing-untrusted-vpc.id + } +} diff --git a/fast/stages/2-networking-e-nva-bgp/dns-prod.tf b/fast/stages/2-networking-e-nva-bgp/dns-prod.tf index 62cfab03..ea0d3a5d 100644 --- a/fast/stages/2-networking-e-nva-bgp/dns-prod.tf +++ b/fast/stages/2-networking-e-nva-bgp/dns-prod.tf @@ -1,5 +1,5 @@ /** - * Copyright 2022 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,3 +70,15 @@ module "prod-dns-peer-landing-rev-10" { } } } + +# DNS policy to enable query logging + +resource "google_dns_policy" "prod-dns-logging-policy" { + name = "logging-policy" + count = var.dns.enable_logging ? 1 : 0 + project = module.prod-spoke-project.project_id + enable_logging = true + networks { + network_url = module.prod-spoke-vpc.id + } +} diff --git a/fast/stages/2-networking-e-nva-bgp/variables.tf b/fast/stages/2-networking-e-nva-bgp/variables.tf index d634974d..fd2c055e 100644 --- a/fast/stages/2-networking-e-nva-bgp/variables.tf +++ b/fast/stages/2-networking-e-nva-bgp/variables.tf @@ -1,5 +1,5 @@ /** - * Copyright 2023 Google LLC + * Copyright 2024 Google LLC * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -70,11 +70,13 @@ variable "custom_roles" { } variable "dns" { - description = "Onprem DNS resolvers." - type = map(list(string)) - default = { - onprem = ["10.0.200.3"] - } + description = "DNS configuration." + type = object({ + enable_logging = optional(bool, true) + resolvers = optional(list(string), []) + }) + default = {} + nullable = false } variable "factories_config" { diff --git a/tests/fast/stages/s2_networking_a_peering/common.tfvars b/tests/fast/stages/s2_networking_a_peering/common.tfvars index af41a2a2..b46a10ab 100644 --- a/tests/fast/stages/s2_networking_a_peering/common.tfvars +++ b/tests/fast/stages/s2_networking_a_peering/common.tfvars @@ -7,6 +7,10 @@ billing_account = { custom_roles = { service_project_network_admin = "organizations/123456789012/roles/foo" } +dns = { + resolvers = ["10.10.10.10"] + enable_logging = true +} folder_ids = { networking = null networking-dev = null diff --git a/tests/fast/stages/s2_networking_a_peering/stage.yaml b/tests/fast/stages/s2_networking_a_peering/stage.yaml index 3ee8b990..a6dad52d 100644 --- a/tests/fast/stages/s2_networking_a_peering/stage.yaml +++ b/tests/fast/stages/s2_networking_a_peering/stage.yaml @@ -14,4 +14,4 @@ counts: modules: 29 - resources: 151 + resources: 154 diff --git a/tests/fast/stages/s2_networking_b_vpn/common.tfvars b/tests/fast/stages/s2_networking_b_vpn/common.tfvars index 271eb2c0..1aa1f51f 100644 --- a/tests/fast/stages/s2_networking_b_vpn/common.tfvars +++ b/tests/fast/stages/s2_networking_b_vpn/common.tfvars @@ -7,6 +7,10 @@ billing_account = { custom_roles = { service_project_network_admin = "organizations/123456789012/roles/foo" } +dns = { + resolvers = ["10.10.10.10"] + enable_logging = true +} folder_ids = { networking = null networking-dev = null diff --git a/tests/fast/stages/s2_networking_b_vpn/stage.yaml b/tests/fast/stages/s2_networking_b_vpn/stage.yaml index af6e5cac..712fe3ee 100644 --- a/tests/fast/stages/s2_networking_b_vpn/stage.yaml +++ b/tests/fast/stages/s2_networking_b_vpn/stage.yaml @@ -14,4 +14,4 @@ counts: modules: 31 - resources: 188 + resources: 191 diff --git a/tests/fast/stages/s2_networking_c_nva/common.tfvars b/tests/fast/stages/s2_networking_c_nva/common.tfvars index d6fd06d7..8660ee8f 100644 --- a/tests/fast/stages/s2_networking_c_nva/common.tfvars +++ b/tests/fast/stages/s2_networking_c_nva/common.tfvars @@ -7,6 +7,10 @@ billing_account = { custom_roles = { service_project_network_admin = "organizations/123456789012/roles/foo" } +dns = { + resolvers = ["10.10.10.10"] + enable_logging = true +} folder_ids = { networking = null networking-dev = null diff --git a/tests/fast/stages/s2_networking_c_nva/stage.yaml b/tests/fast/stages/s2_networking_c_nva/stage.yaml index 01527c99..8b785567 100644 --- a/tests/fast/stages/s2_networking_c_nva/stage.yaml +++ b/tests/fast/stages/s2_networking_c_nva/stage.yaml @@ -14,4 +14,4 @@ counts: modules: 43 - resources: 199 + resources: 202 diff --git a/tests/fast/stages/s2_networking_d_separate_envs/common.tfvars b/tests/fast/stages/s2_networking_d_separate_envs/common.tfvars index 8e641e33..b7d966a2 100644 --- a/tests/fast/stages/s2_networking_d_separate_envs/common.tfvars +++ b/tests/fast/stages/s2_networking_d_separate_envs/common.tfvars @@ -7,6 +7,11 @@ billing_account = { custom_roles = { service_project_network_admin = "organizations/123456789012/roles/foo" } +dns = { + dev_resolvers = ["10.10.10.10"] + prod_resolvers = ["10.20.10.10"] + enable_logging = true +} folder_ids = { networking = null networking-dev = null diff --git a/tests/fast/stages/s2_networking_d_separate_envs/stage.yaml b/tests/fast/stages/s2_networking_d_separate_envs/stage.yaml index 1c560f76..6df5c894 100644 --- a/tests/fast/stages/s2_networking_d_separate_envs/stage.yaml +++ b/tests/fast/stages/s2_networking_d_separate_envs/stage.yaml @@ -14,4 +14,4 @@ counts: modules: 22 - resources: 172 + resources: 174 diff --git a/tests/fast/stages/s2_networking_e_nva_bgp/common.tfvars b/tests/fast/stages/s2_networking_e_nva_bgp/common.tfvars index d6fd06d7..8660ee8f 100644 --- a/tests/fast/stages/s2_networking_e_nva_bgp/common.tfvars +++ b/tests/fast/stages/s2_networking_e_nva_bgp/common.tfvars @@ -7,6 +7,10 @@ billing_account = { custom_roles = { service_project_network_admin = "organizations/123456789012/roles/foo" } +dns = { + resolvers = ["10.10.10.10"] + enable_logging = true +} folder_ids = { networking = null networking-dev = null diff --git a/tests/fast/stages/s2_networking_e_nva_bgp/stage.yaml b/tests/fast/stages/s2_networking_e_nva_bgp/stage.yaml index dad42420..afc9acd5 100644 --- a/tests/fast/stages/s2_networking_e_nva_bgp/stage.yaml +++ b/tests/fast/stages/s2_networking_e_nva_bgp/stage.yaml @@ -14,4 +14,4 @@ counts: modules: 37 - resources: 210 + resources: 213