From be33a7f880f15b47cf9d9a9a3cdf2266a804ac2c Mon Sep 17 00:00:00 2001 From: Luca Prete Date: Mon, 7 Feb 2022 13:22:58 +0100 Subject: [PATCH] FAST - Fixes 498 - 02-networking-nva stage --- fast/stages/02-networking-nva/README.md | 54 ++++++++++++++++--- .../data/subnets/dev/dev-default-ew1.yaml | 2 +- .../data/subnets/dev/dev-default-ew4.yaml | 2 +- .../landing-trusted-default-ew1.yaml | 2 +- .../landing-trusted-default-ew4.yaml | 2 +- .../landing-untrusted-default-ew1.yaml | 2 +- .../landing-untrusted-default-ew4.yaml | 2 +- .../data/subnets/prod/prod-default-ew1.yaml | 2 +- .../data/subnets/prod/prod-default-ew4.yaml | 2 +- fast/stages/02-networking-nva/variables.tf | 32 ++++++----- 10 files changed, 74 insertions(+), 28 deletions(-) diff --git a/fast/stages/02-networking-nva/README.md b/fast/stages/02-networking-nva/README.md index 1ffc4d0c..b97d0fe4 100644 --- a/fast/stages/02-networking-nva/README.md +++ b/fast/stages/02-networking-nva/README.md @@ -83,9 +83,51 @@ This is an options summary: Minimizing the number of routes (and subnets) in the cloud environment is important, as it simplifies management and it avoids hitting [Cloud Router](https://cloud.google.com/network-connectivity/docs/router/quotas) and [VPC](https://cloud.google.com/vpc/docs/quota) quotas and limits. For this reason, we recommend to carefully plan the IP space used in your cloud environment. This allows the use of larger IP CIDR blocks in routes, whenever possible. -This stage uses a dedicated /16 block, which should be sized to the own needs. The subnets created in each VPC derive from this range. +This stage uses a dedicated /16 block (10.128.0.0/16), which should be sized to the own needs. The subnets created in each VPC derive from this range. -Spoke VPCs also define and reserve two "special" CIDR ranges dedicated to [PSA (Private Service Access)](https://cloud.google.com/vpc/docs/private-services-access) and [Internal HTTPs Load Balancers (L7ILB)](https://cloud.google.com/load-balancing/docs/l7-internal). +The /16 block is evenly split in eight, smaller /19 blocks, assigned to different areas of the GCP network: *landing untrusted europe-west1*, *landing untrusted europe-west4*, *landing trusted europe-west1*, *landing untrusted europe-west4*, *development europe-west1*, *development europe-west4*, *production europe-west1*, *production europe-west4*. + +The first /24 range in every area is allocated for a default subnet, which can be removed or modified as needed. + +Spoke VPCs also define and reserve three "special" CIDR ranges, derived from the respective /19, dedicated to + +- [PSA (Private Service Access)](https://cloud.google.com/vpc/docs/private-services-access): + + + The second-last /24 range is used for PSA (CloudSQL, Postrgres) + + + The third-last /24 range is used for PSA (CloudSQL, MySQL) + +- [Internal HTTPs Load Balancers (L7ILB)](https://cloud.google.com/load-balancing/docs/l7-internal): + + + The last /24 range + + +This is a summary of the subnets allocated by default in this setup: + +| name | description | CIDR | +|---|---|---| +| landing-trusted-default-ew1 | Trusted landing subnet - europe-west1 | 10.128.64.0/24 | +| landing-trusted-default-ew4 | Trusted landing subnet - europe-west4 | 10.128.96.0/24 | +| landing-untrusted-default-ew1 | Untrusted landing subnet - europe-west1 | 10.128.0.0/24 | +| landing-untrusted-default-ew4 | Untrusted landing subnet - europe-west4 | 10.128.32.0/24 | +| dev-default-ew1 | Dev spoke subnet - europe-west1 | 10.128.128.0/24 | +| dev-default-ew1 (PSA MySQL) | PSA subnet for MySQL in dev spoke - europe-west1 | 10.128.157.0/24 | +| dev-default-ew1 (PSA SQL Server) | PSA subnet for Postgres in dev spoke - europe-west1 | 10.128.158.0/24 | +| dev-default-ew1 (L7 ILB) | L7 ILB subnet for dev spoke - europe-west1 | 10.128.92.0/24 | +| dev-default-ew4 | Dev spoke subnet - europe-west4 | 10.128.160.0/24 | +| dev-default-ew4 (PSA MySQL) | PSA subnet for MySQL in dev spoke - europe-west4 | 10.128.189.0/24 | +| dev-default-ew4 (PSA SQL Server) | PSA subnet for Postgres in dev spoke - europe-west4 | 10.128.190.0/24 | +| dev-default-ew4 (L7 ILB) | L7 ILB subnet for dev spoke - europe-west4 | 10.128.93.0/24 | +| prod-default-ew1 | Prod spoke subnet - europe-west1 | 10.128.192.0/24 | +| prod-default-ew1 (PSA MySQL) | PSA subnet for MySQL in prod spoke - europe-west1 | 10.128.221.0/24 | +| prod-default-ew1 (PSA SQL Server) | PSA subnet for Postgres in prod spoke - europe-west1 | 10.128.253.0/24 | +| prod-default-ew1 (L7 ILB) | L7 ILB subnet for prod spoke - europe-west1 | 10.128.60.0/24 | +| prod-default-ew4 | Prod spoke subnet - europe-west4 | 10.128.224.0/24 | +| prod-default-ew4 (PSA MySQL) | PSA subnet for MySQL in prod spoke - europe-west4 | 10.128.222.0/24 | +| prod-default-ew4 (PSA SQL Server) | PSA subnet for Postgres in prod spoke - europe-west4 | 10.128.254.0/24 | +| prod-default-ew4 (L7 ILB) | L7 ILB subnet for prod spoke - europe-west4 | 10.128.61.0/24 | + +These subnets are advertised to on-premises as a whole /16 range (10.128.0.0/16). Routes in GCP are either automatically created (for example, when a subnet is added to a VPC), manually created via static routes, dynamically exchanged through VPC peerings, or dynamically programmed by [Cloud Routers](https://cloud.google.com/network-connectivity/docs/router#docs) when a BGP session is established. BGP sessions can be configured to advertise VPC ranges, and/or custom ranges via custom advertisements. @@ -328,13 +370,13 @@ Don't forget to add a peering zone in the landing project and point it to the ne | [custom_adv](variables.tf#L23) | Custom advertisement definitions in name => range format. | map(string) | | {…} | | | [data_dir](variables.tf#L45) | Relative path for the folder storing configuration data for network resources. | string | | "data" | | | [dns](variables.tf#L51) | Onprem DNS resolvers | map(list(string)) | | {…} | | -| [l7ilb_subnets](variables.tf#L65) | Subnets used for L7 ILBs. | map(list(object({…}))) | | {…} | | +| [l7ilb_subnets](variables.tf#L65) | Subnets used for L7 ILBs. | map(list(object({…}))) | | {…} | | | [onprem_cidr](variables.tf#L83) | Onprem addresses in name => range format. | map(string) | | {…} | | | [outputs_location](variables.tf#L101) | Path where providers and tfvars files for the following stages are written. Leave empty to disable. | string | | null | | | [project_factory_sa](variables.tf#L113) | IAM emails for project factory service accounts | map(string) | | {} | 01-resman | -| [psa_ranges](variables.tf#L120) | IP ranges used for Private Service Access (e.g. CloudSQL). | map(map(string)) | | {…} | | -| [router_configs](variables.tf#L135) | Configurations for CRs and onprem routers. | map(object({…})) | | {…} | | -| [vpn_onprem_configs](variables.tf#L158) | VPN gateway configuration for onprem interconnection. | map(object({…})) | | {…} | | +| [psa_ranges](variables.tf#L120) | IP ranges used for Private Service Access (e.g. CloudSQL). | map(map(string)) | | {…} | | +| [router_configs](variables.tf#L139) | Configurations for CRs and onprem routers. | map(object({…})) | | {…} | | +| [vpn_onprem_configs](variables.tf#L162) | VPN gateway configuration for onprem interconnection. | map(object({…})) | | {…} | | ## Outputs diff --git a/fast/stages/02-networking-nva/data/subnets/dev/dev-default-ew1.yaml b/fast/stages/02-networking-nva/data/subnets/dev/dev-default-ew1.yaml index 3baaf148..d6e4fcdb 100644 --- a/fast/stages/02-networking-nva/data/subnets/dev/dev-default-ew1.yaml +++ b/fast/stages/02-networking-nva/data/subnets/dev/dev-default-ew1.yaml @@ -1,5 +1,5 @@ # skip boilerplate check region: europe-west1 -ip_cidr_range: 10.128.128.0/19 +ip_cidr_range: 10.128.128.0/24 description: Default europe-west1 subnet for dev diff --git a/fast/stages/02-networking-nva/data/subnets/dev/dev-default-ew4.yaml b/fast/stages/02-networking-nva/data/subnets/dev/dev-default-ew4.yaml index 38769455..2a070fb5 100644 --- a/fast/stages/02-networking-nva/data/subnets/dev/dev-default-ew4.yaml +++ b/fast/stages/02-networking-nva/data/subnets/dev/dev-default-ew4.yaml @@ -1,5 +1,5 @@ # skip boilerplate check region: europe-west4 -ip_cidr_range: 10.128.160.0/19 +ip_cidr_range: 10.128.160.0/24 description: Default europe-west4 subnet for dev diff --git a/fast/stages/02-networking-nva/data/subnets/landing-trusted/landing-trusted-default-ew1.yaml b/fast/stages/02-networking-nva/data/subnets/landing-trusted/landing-trusted-default-ew1.yaml index 47404523..1a83620c 100644 --- a/fast/stages/02-networking-nva/data/subnets/landing-trusted/landing-trusted-default-ew1.yaml +++ b/fast/stages/02-networking-nva/data/subnets/landing-trusted/landing-trusted-default-ew1.yaml @@ -1,5 +1,5 @@ # skip boilerplate check region: europe-west1 -ip_cidr_range: 10.128.64.0/19 +ip_cidr_range: 10.128.64.0/24 description: Default europe-west1 subnet for landing trusted diff --git a/fast/stages/02-networking-nva/data/subnets/landing-trusted/landing-trusted-default-ew4.yaml b/fast/stages/02-networking-nva/data/subnets/landing-trusted/landing-trusted-default-ew4.yaml index 463066fb..b302fef6 100644 --- a/fast/stages/02-networking-nva/data/subnets/landing-trusted/landing-trusted-default-ew4.yaml +++ b/fast/stages/02-networking-nva/data/subnets/landing-trusted/landing-trusted-default-ew4.yaml @@ -1,5 +1,5 @@ # skip boilerplate check region: europe-west4 -ip_cidr_range: 10.128.96.0/19 +ip_cidr_range: 10.128.96.0/24 description: Default europe-west4 subnet for landing trusted diff --git a/fast/stages/02-networking-nva/data/subnets/landing-untrusted/landing-untrusted-default-ew1.yaml b/fast/stages/02-networking-nva/data/subnets/landing-untrusted/landing-untrusted-default-ew1.yaml index 2758da5f..fae0f2eb 100644 --- a/fast/stages/02-networking-nva/data/subnets/landing-untrusted/landing-untrusted-default-ew1.yaml +++ b/fast/stages/02-networking-nva/data/subnets/landing-untrusted/landing-untrusted-default-ew1.yaml @@ -1,5 +1,5 @@ # skip boilerplate check region: europe-west1 -ip_cidr_range: 10.128.0.0/19 +ip_cidr_range: 10.128.0.0/24 description: Default europe-west1 subnet for landing untrusted diff --git a/fast/stages/02-networking-nva/data/subnets/landing-untrusted/landing-untrusted-default-ew4.yaml b/fast/stages/02-networking-nva/data/subnets/landing-untrusted/landing-untrusted-default-ew4.yaml index 25bad9db..5588d55e 100644 --- a/fast/stages/02-networking-nva/data/subnets/landing-untrusted/landing-untrusted-default-ew4.yaml +++ b/fast/stages/02-networking-nva/data/subnets/landing-untrusted/landing-untrusted-default-ew4.yaml @@ -1,5 +1,5 @@ # skip boilerplate check region: europe-west4 -ip_cidr_range: 10.128.32.0/19 +ip_cidr_range: 10.128.32.0/24 description: Default europe-west4 subnet for landing untrusted diff --git a/fast/stages/02-networking-nva/data/subnets/prod/prod-default-ew1.yaml b/fast/stages/02-networking-nva/data/subnets/prod/prod-default-ew1.yaml index b829cb94..24155840 100644 --- a/fast/stages/02-networking-nva/data/subnets/prod/prod-default-ew1.yaml +++ b/fast/stages/02-networking-nva/data/subnets/prod/prod-default-ew1.yaml @@ -1,5 +1,5 @@ # skip boilerplate check region: europe-west1 -ip_cidr_range: 10.128.192.0/19 +ip_cidr_range: 10.128.192.0/24 description: Default europe-west1 subnet for prod diff --git a/fast/stages/02-networking-nva/data/subnets/prod/prod-default-ew4.yaml b/fast/stages/02-networking-nva/data/subnets/prod/prod-default-ew4.yaml index dbd716cd..26260e42 100644 --- a/fast/stages/02-networking-nva/data/subnets/prod/prod-default-ew4.yaml +++ b/fast/stages/02-networking-nva/data/subnets/prod/prod-default-ew4.yaml @@ -1,5 +1,5 @@ # skip boilerplate check region: europe-west4 -ip_cidr_range: 10.128.224.0/19 +ip_cidr_range: 10.128.224.0/24 description: Default europe-west4 subnet for prod diff --git a/fast/stages/02-networking-nva/variables.tf b/fast/stages/02-networking-nva/variables.tf index 355eccf4..0659628d 100644 --- a/fast/stages/02-networking-nva/variables.tf +++ b/fast/stages/02-networking-nva/variables.tf @@ -69,13 +69,13 @@ variable "l7ilb_subnets" { region = string }))) default = { - prod = [ - { ip_cidr_range = "10.128.92.0/24", region = "europe-west1" }, - { ip_cidr_range = "10.128.93.0/24", region = "europe-west4" } - ] dev = [ - { ip_cidr_range = "10.128.60.0/24", region = "europe-west1" }, - { ip_cidr_range = "10.128.61.0/24", region = "europe-west4" } + { ip_cidr_range = "10.128.159.0/24", region = "europe-west1" }, + { ip_cidr_range = "10.128.191.0/24", region = "europe-west4" } + ] + prod = [ + { ip_cidr_range = "10.128.223.0/24", region = "europe-west1" }, + { ip_cidr_range = "10.128.255.0/24", region = "europe-west4" } ] } } @@ -121,13 +121,17 @@ variable "psa_ranges" { description = "IP ranges used for Private Service Access (e.g. CloudSQL)." type = map(map(string)) default = { - prod = { - cloudsql-mysql = "10.128.94.0/24" - cloudsql-sqlserver = "10.128.95.0/24" - } dev = { - cloudsql-mysql = "10.128.62.0/24" - cloudsql-sqlserver = "10.128.63.0/24" + cloudsql-mysql-ew1 = "10.128.157.0/24" + cloudsql-mysql-ew4 = "10.128.189.0/24" + cloudsql-sqlserver-ew1 = "10.128.158.0/24" + cloudsql-sqlserver-ew4 = "10.128.190.0/24" + } + prod = { + cloudsql-mysql-ew1 = "10.128.221.0/24" + cloudsql-mysql-ew4 = "10.128.253.0/24" + cloudsql-sqlserver-ew1 = "10.128.222.0/24" + cloudsql-sqlserver-ew4 = "10.128.254.0/24" } } } @@ -143,12 +147,12 @@ variable "router_configs" { })) default = { landing-trusted-ew1 = { - asn = "65534" + asn = "64512" adv = null # adv = { default = false, custom = [] } } landing-trusted-ew4 = { - asn = "65534" + asn = "64512" adv = null # adv = { default = false, custom = [] } }