Merge branch 'master' into fast-dev-dp

fast/README.md

@@ -47,8 +47,8 @@ As mentioned before, fast relies on multiple stages to progressively bring up yo
 
 - [Security](stages/02-security/README.md)<br/>
   Manages centralized security configurations in a separate stage, typically owned by the security team. This stage implements VPC Security Controls via separate perimeters for environments and central services, and creates projects to host centralized KMS keys used by the whole organization. It's intentionally easy to extend to include other security-related resources, like Secret Manager.
-- [Networking](stages/02-networking/README.md)<br/>
-  Manages centralized network resources in a separate stage, and is typically owned by the networking team. This stage implements a hub-and-spoke design, includes connectivity via VPN to on-premises, and YAML-based factories for firewall rules (hierarchical and VPC-level) and subnets.
+- Networking ([VPN](02-networking/README.md)/[NVA](02-networking-nva/README.md))  
+  Manages centralized network resources in a separate stage, and is typically owned by the networking team. This stage implements a hub-and-spoke design, and includes connectivity via VPN to on-premises, and YAML-based factories for firewall rules (hierarchical and VPC-level) and subnets. It's currently available in two versions: [spokes connected via VPN](02-networking/README.md), [and spokes connected via appliances](02-networking-nva/README.md).
 
 ### Environment-level resources (03)
 

fast/stages/00-bootstrap/README.md

@@ -177,11 +177,15 @@ Below is the outline of the output files generated by this stage:
 │   ├── providers.tf
 │   ├── terraform-bootstrap.auto.tfvars.json
 ├── 02-networking
-│   ├── providers.tf
+│   ├── terraform-bootstrap.auto.tfvars.json
+├── 02-networking-nva
 │   ├── terraform-bootstrap.auto.tfvars.json
 ├── 02-security
-│   ├── providers.tf
 │   ├── terraform-bootstrap.auto.tfvars.json
+├── 03-gke-multitenant-dev
+│   └── terraform-bootstrap.auto.tfvars.json
+├── 03-gke-multitenant-prod
+│   └── terraform-bootstrap.auto.tfvars.json
 ├── 03-project-factory-dev
 │   └── terraform-bootstrap.auto.tfvars.json
 ├── 03-project-factory-prod
@@ -301,9 +305,9 @@ Names used in internal references (e.g. `module.foo-prod.id`) are only used by T
 
 | name | description | sensitive | consumers |
 |---|---|:---:|---|
-| [billing_dataset](outputs.tf#L85) | BigQuery dataset prepared for billing export. |  |  |
-| [project_ids](outputs.tf#L90) | Projects created by this stage. |  |  |
-| [providers](outputs.tf#L101) | Terraform provider files for this stage and dependent stages. | ✓ | <code>stage-01</code> |
-| [tfvars](outputs.tf#L110) | Terraform variable files for the following stages. | ✓ |  |
+| [billing_dataset](outputs.tf#L91) | BigQuery dataset prepared for billing export. |  |  |
+| [project_ids](outputs.tf#L96) | Projects created by this stage. |  |  |
+| [providers](outputs.tf#L107) | Terraform provider files for this stage and dependent stages. | ✓ | <code>stage-01</code> |
+| [tfvars](outputs.tf#L116) | Terraform variable files for the following stages. | ✓ |  |
 
 <!-- END TFDOC -->

fast/stages/00-bootstrap/organization.tf

@@ -191,7 +191,6 @@ resource "google_organization_iam_binding" "org_admin_delegated" {
           "roles/compute.orgFirewallPolicyAdmin",
           "roles/compute.xpnAdmin",
           "roles/orgpolicy.policyAdmin",
-          module.organization.custom_role_id.xpnServiceAdmin
         ],
         local.billing_org ? [
           "roles/billing.admin",

fast/stages/00-bootstrap/outputs.tf

@@ -42,6 +42,12 @@ locals {
       organization       = var.organization
       prefix             = var.prefix
     })
+    "02-networking-nva" = jsonencode({
+      billing_account_id = var.billing_account.id
+      custom_roles       = module.organization.custom_role_id
+      organization       = var.organization
+      prefix             = var.prefix
+    })
     "02-security" = jsonencode({
       billing_account_id = var.billing_account.id
       organization       = var.organization

fast/stages/01-resman/README.md

@@ -175,12 +175,12 @@ Due to its simplicity, this stage lends itself easily to customizations: adding
 
 | name | description | sensitive | consumers |
 |---|---|:---:|---|
-| [networking](outputs.tf#L79) | Data for the networking stage. |  | <code>02-networking</code> |
-| [project_factories](outputs.tf#L89) | Data for the project factories stage. |  | <code>xx-teams</code> |
-| [providers](outputs.tf#L106) | Terraform provider files for this stage and dependent stages. | ✓ | <code>02-networking</code> · <code>02-security</code> · <code>xx-sandbox</code> · <code>xx-teams</code> |
-| [sandbox](outputs.tf#L113) | Data for the sandbox stage. |  | <code>xx-sandbox</code> |
-| [security](outputs.tf#L123) | Data for the networking stage. |  | <code>02-security</code> |
-| [teams](outputs.tf#L133) | Data for the teams stage. |  |  |
-| [tfvars](outputs.tf#L146) | Terraform variable files for the following stages. | ✓ |  |
+| [networking](outputs.tf#L88) | Data for the networking stage. |  | <code>02-networking</code> |
+| [project_factories](outputs.tf#L98) | Data for the project factories stage. |  | <code>xx-teams</code> |
+| [providers](outputs.tf#L115) | Terraform provider files for this stage and dependent stages. | ✓ | <code>02-networking</code> · <code>02-security</code> · <code>xx-sandbox</code> · <code>xx-teams</code> |
+| [sandbox](outputs.tf#L122) | Data for the sandbox stage. |  | <code>xx-sandbox</code> |
+| [security](outputs.tf#L132) | Data for the networking stage. |  | <code>02-security</code> |
+| [teams](outputs.tf#L142) | Data for the teams stage. |  |  |
+| [tfvars](outputs.tf#L155) | Terraform variable files for the following stages. | ✓ |  |
 
 <!-- END TFDOC -->

fast/stages/01-resman/outputs.tf

@@ -25,16 +25,16 @@ locals {
       name   = "networking"
       sa     = module.branch-network-sa.email
     })
+    "02-networking-nva" = templatefile("${path.module}/../../assets/templates/providers.tpl", {
+      bucket = module.branch-network-gcs.name
+      name   = "networking-nva"
+      sa     = module.branch-network-sa.email
+    })
     "02-security" = templatefile("${path.module}/../../assets/templates/providers.tpl", {
       bucket = module.branch-security-gcs.name
       name   = "security"
       sa     = module.branch-security-sa.email
     })
-    "99-sandbox" = templatefile("${path.module}/../../assets/templates/providers.tpl", {
-      bucket = module.branch-sandbox-gcs.name
-      name   = "sandbox"
-      sa     = module.branch-sandbox-sa.email
-    })
     "03-project-factory-dev" = templatefile("${path.module}/../../assets/templates/providers.tpl", {
       bucket = module.branch-teams-dev-projectfactory-gcs.name
       name   = "team-dev"
@@ -45,12 +45,21 @@ locals {
       name   = "team-prod"
       sa     = module.branch-teams-prod-projectfactory-sa.email
     })
+    "99-sandbox" = templatefile("${path.module}/../../assets/templates/providers.tpl", {
+      bucket = module.branch-sandbox-gcs.name
+      name   = "sandbox"
+      sa     = module.branch-sandbox-sa.email
+    })
   }
   tfvars = {
     "02-networking" = jsonencode({
       folder_id          = module.branch-network-folder.id
       project_factory_sa = local._project_factory_sas
     })
+    "02-networkin-nva" = jsonencode({
+      folder_id          = module.branch-network-folder.id
+      project_factory_sa = local._project_factory_sas
+    })
     "02-security" = jsonencode({
       folder_id = module.branch-security-folder.id
       kms_restricted_admins = {

fast/stages/README.md

@@ -17,8 +17,8 @@ Refer to each stage's documentation for a detailed description of its purpose, t
 
 - [Security](02-security/README.md)  
   Manages centralized security configurations in a separate stage, and is typically owned by the security team. This stage implements VPC Security Controls via separate perimeters for environments and central services, and creates projects to host centralized KMS keys used by the whole organization. It's meant to be easily extended to include other security-related resources which are required, like Secret Manager.
-- [Networking](02-networking/README.md)  
-  Manages centralized network resources in a separate stage, and is typically owned by the networking team. This stage implements a hub-and-spoke design, and includes connectivity via VPN to on-premises, and YAML-based factories for firewall rules (hierarchical and VPC-level) and subnets.
+- Networking ([VPN](02-networking/README.md)/[NVA](02-networking-nva/README.md))  
+  Manages centralized network resources in a separate stage, and is typically owned by the networking team. This stage implements a hub-and-spoke design, and includes connectivity via VPN to on-premises, and YAML-based factories for firewall rules (hierarchical and VPC-level) and subnets. It's currently available in two versions: [spokes connected via VPN](02-networking/README.md), [and spokes connected via appliances](02-networking-nva/README.md).
 
 ## Environment-level resources (03)
 

modules/folder/README.md

@@ -223,11 +223,11 @@ module "folder2" {
 
 | name | description | resources |
 |---|---|---|
-| [firewal_policies.tf](./firewal_policies.tf) | None | <code>google_compute_firewall_policy</code> · <code>google_compute_firewall_policy_association</code> · <code>google_compute_firewall_policy_rule</code> |
+| [firewall-policies.tf](./firewall-policies.tf) | None | <code>google_compute_firewall_policy</code> · <code>google_compute_firewall_policy_association</code> · <code>google_compute_firewall_policy_rule</code> |
 | [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | <code>google_folder_iam_binding</code> |
 | [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_folder_exclusion</code> · <code>google_logging_folder_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
 | [main.tf](./main.tf) | Module-level locals and resources. | <code>google_essential_contacts_contact</code> · <code>google_folder</code> |
-| [organization_policies.tf](./organization_policies.tf) | Folder-level organization policies. | <code>google_folder_organization_policy</code> |
+| [organization-policies.tf](./organization-policies.tf) | Folder-level organization policies. | <code>google_folder_organization_policy</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
 | [variables.tf](./variables.tf) | Module variables. |  |
 | [versions.tf](./versions.tf) | Version pins. |  |

modules/net-glb/README.md

@@ -499,13 +499,13 @@ An External Global Load Balancer is made of multiple components, that change dep
 
 | name | description | resources |
 |---|---|---|
-| [backend_services.tf](./backend_services.tf) | Bucket and group backend services. | <code>google_compute_backend_bucket</code> · <code>google_compute_backend_service</code> |
-| [global_forwarding_rule.tf](./global_forwarding_rule.tf) | Global address and forwarding rule. | <code>google_compute_global_address</code> · <code>google_compute_global_forwarding_rule</code> |
-| [health_checks.tf](./health_checks.tf) | Health checks. | <code>google_compute_health_check</code> |
+| [backend-services.tf](./backend-services.tf) | Bucket and group backend services. | <code>google_compute_backend_bucket</code> · <code>google_compute_backend_service</code> |
+| [global-forwarding-rule.tf](./global-forwarding-rule.tf) | Global address and forwarding rule. | <code>google_compute_global_address</code> · <code>google_compute_global_forwarding_rule</code> |
+| [health-checks.tf](./health-checks.tf) | Health checks. | <code>google_compute_health_check</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
-| [ssl_certificates.tf](./ssl_certificates.tf) | SSL certificates. | <code>google_compute_managed_ssl_certificate</code> · <code>google_compute_ssl_certificate</code> |
-| [target_proxy.tf](./target_proxy.tf) | HTTP and HTTPS target proxies. | <code>google_compute_target_http_proxy</code> · <code>google_compute_target_https_proxy</code> |
-| [url_map.tf](./url_map.tf) | URL maps. | <code>google_compute_url_map</code> |
+| [ssl-certificates.tf](./ssl-certificates.tf) | SSL certificates. | <code>google_compute_managed_ssl_certificate</code> · <code>google_compute_ssl_certificate</code> |
+| [target-proxy.tf](./target-proxy.tf) | HTTP and HTTPS target proxies. | <code>google_compute_target_http_proxy</code> · <code>google_compute_target_https_proxy</code> |
+| [url-map.tf](./url-map.tf) | URL maps. | <code>google_compute_url_map</code> |
 | [variables.tf](./variables.tf) | Module variables. |  |
 | [versions.tf](./versions.tf) | Version pins. |  |
 

modules/organization/README.md

@@ -243,11 +243,11 @@ module "org" {
 
 | name | description | resources |
 |---|---|---|
-| [firewall_policies.tf](./firewall_policies.tf) | Hierarchical firewall policies. | <code>google_compute_firewall_policy</code> · <code>google_compute_firewall_policy_association</code> · <code>google_compute_firewall_policy_rule</code> |
+| [firewall-policies.tf](./firewall-policies.tf) | Hierarchical firewall policies. | <code>google_compute_firewall_policy</code> · <code>google_compute_firewall_policy_association</code> · <code>google_compute_firewall_policy_rule</code> |
 | [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | <code>google_organization_iam_audit_config</code> · <code>google_organization_iam_binding</code> · <code>google_organization_iam_custom_role</code> · <code>google_organization_iam_member</code> · <code>google_organization_iam_policy</code> |
 | [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_organization_exclusion</code> · <code>google_logging_organization_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
 | [main.tf](./main.tf) | Module-level locals and resources. | <code>google_essential_contacts_contact</code> |
-| [organization_policies.tf](./organization_policies.tf) | Organization-level organization policies. | <code>google_organization_policy</code> |
+| [organization-policies.tf](./organization-policies.tf) | Organization-level organization policies. | <code>google_organization_policy</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
 | [variables.tf](./variables.tf) | Module variables. |  |
 | [versions.tf](./versions.tf) | Version pins. |  |

modules/project/README.md

@@ -184,13 +184,13 @@ module "project" {
 | [iam.tf](./iam.tf) | Generic and OSLogin-specific IAM bindings and roles. | <code>google_project_iam_binding</code> · <code>google_project_iam_custom_role</code> · <code>google_project_iam_member</code> |
 | [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_project_exclusion</code> · <code>google_logging_project_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
 | [main.tf](./main.tf) | Module-level locals and resources. | <code>google_compute_project_metadata_item</code> · <code>google_essential_contacts_contact</code> · <code>google_monitoring_monitored_project</code> · <code>google_project</code> · <code>google_project_service</code> · <code>google_resource_manager_lien</code> |
-| [organization_policies.tf](./organization_policies.tf) | Project-level organization policies. | <code>google_project_organization_policy</code> |
+| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_project_organization_policy</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
-| [service_accounts.tf](./service_accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_service_identity</code> |
-| [shared_vpc.tf](./shared_vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> |
+| [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_service_identity</code> |
+| [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> |
 | [variables.tf](./variables.tf) | Module variables. |  |
 | [versions.tf](./versions.tf) | Version pins. |  |
-| [vpc_sc.tf](./vpc_sc.tf) | VPC-SC project-level perimeter configuration. | <code>google_access_context_manager_service_perimeter_resource</code> |
+| [vpc-sc.tf](./vpc-sc.tf) | VPC-SC project-level perimeter configuration. | <code>google_access_context_manager_service_perimeter_resource</code> |
 
 ## Variables