Add Hybrid NAT support (#2261)

* Updates to support hybid NAT

* Fix readme

* Fix variable order
This commit is contained in:
Julio Castillo 2024-05-09 15:24:41 +02:00 committed by GitHub
parent c9503d5ac5
commit c58850c096
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
9 changed files with 247 additions and 32 deletions

View File

@ -6,6 +6,7 @@ Simple Cloud NAT management, with optional router creation.
- [Basic Example](#basic-example)
- [Subnetwork configuration](#subnetwork-configuration)
- [Reserved IPs and custom rules](#reserved-ips-and-custom-rules)
- [Hybrid NAT](#hybrid-nat)
- [Variables](#variables)
- [Outputs](#outputs)
<!-- END TOC -->
@ -102,6 +103,59 @@ module "nat" {
}
# tftest modules=2 resources=5 inventory=rules.yaml e2e
```
## Hybrid NAT
```hcl
module "vpc1" {
source = "./fabric/modules/net-vpc"
project_id = var.project_id
name = "vpc1"
subnets = [
{
ip_cidr_range = "10.0.0.0/24"
name = "vpc1-subnet"
region = var.region
}
]
subnets_private_nat = [
{
ip_cidr_range = "192.168.15.0/24"
name = "vpc1-nat"
region = var.region
}
]
}
module "vpc1-nat" {
source = "./fabric/modules/net-cloudnat"
project_id = var.project_id
region = var.region
name = "vpc1-nat"
type = "PRIVATE"
router_network = module.vpc1.id
config_source_subnetworks = {
all = false
subnetworks = [
{
self_link = module.vpc1.subnet_ids["${var.region}/vpc1-subnet"]
}
]
}
config_port_allocation = {
enable_endpoint_independent_mapping = false
enable_dynamic_port_allocation = true
}
rules = [
{
description = "private nat"
match = "nexthop.is_hybrid"
source_ranges = [
module.vpc1.subnets_private_nat["${var.region}/vpc1-nat"].id
]
}
]
}
# tftest modules=2 resources=7 inventory=hybrid.yaml
```
<!-- BEGIN TFDOC -->
## Variables
@ -111,15 +165,16 @@ module "nat" {
| [project_id](variables.tf#L82) | Project where resources will be created. | <code>string</code> | ✓ | |
| [region](variables.tf#L87) | Region where resources will be created. | <code>string</code> | ✓ | |
| [addresses](variables.tf#L17) | Optional list of external address self links. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [config_port_allocation](variables.tf#L23) | Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'. | <code title="object&#40;&#123;&#10; enable_endpoint_independent_mapping &#61; optional&#40;bool, true&#41;&#10; enable_dynamic_port_allocation &#61; optional&#40;bool, false&#41;&#10; min_ports_per_vm &#61; optional&#40;number, 64&#41;&#10; max_ports_per_vm &#61; optional&#40;number, 65536&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [config_port_allocation](variables.tf#L23) | Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'. | <code title="object&#40;&#123;&#10; enable_endpoint_independent_mapping &#61; optional&#40;bool, true&#41;&#10; enable_dynamic_port_allocation &#61; optional&#40;bool, false&#41;&#10; min_ports_per_vm &#61; optional&#40;number&#41;&#10; max_ports_per_vm &#61; optional&#40;number&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [config_source_subnetworks](variables.tf#L39) | Subnetwork configuration. | <code title="object&#40;&#123;&#10; all &#61; optional&#40;bool, true&#41;&#10; primary_ranges_only &#61; optional&#40;bool&#41;&#10; subnetworks &#61; optional&#40;list&#40;object&#40;&#123;&#10; self_link &#61; string&#10; all_ranges &#61; optional&#40;bool, true&#41;&#10; secondary_ranges &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [config_timeouts](variables.tf#L58) | Timeout configurations. | <code title="object&#40;&#123;&#10; icmp &#61; optional&#40;number, 30&#41;&#10; tcp_established &#61; optional&#40;number, 1200&#41;&#10; tcp_time_wait &#61; optional&#40;number, 120&#41;&#10; tcp_transitory &#61; optional&#40;number, 30&#41;&#10; udp &#61; optional&#40;number, 30&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [config_timeouts](variables.tf#L58) | Timeout configurations. | <code title="object&#40;&#123;&#10; icmp &#61; optional&#40;number&#41;&#10; tcp_established &#61; optional&#40;number&#41;&#10; tcp_time_wait &#61; optional&#40;number&#41;&#10; tcp_transitory &#61; optional&#40;number&#41;&#10; udp &#61; optional&#40;number&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> | | <code>&#123;&#125;</code> |
| [logging_filter](variables.tf#L71) | Enables logging if not null, value is one of 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', 'ALL'. | <code>string</code> | | <code>null</code> |
| [router_asn](variables.tf#L92) | Router ASN used for auto-created router. | <code>number</code> | | <code>null</code> |
| [router_create](variables.tf#L98) | Create router. | <code>bool</code> | | <code>true</code> |
| [router_name](variables.tf#L104) | Router name, leave blank if router will be created to use auto generated name. | <code>string</code> | | <code>null</code> |
| [router_network](variables.tf#L110) | Name of the VPC used for auto-created router. | <code>string</code> | | <code>null</code> |
| [rules](variables.tf#L116) | List of rules associated with this NAT. | <code title="list&#40;object&#40;&#123;&#10; description &#61; optional&#40;string&#41;,&#10; match &#61; string&#10; source_ips &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#91;&#93;</code> |
| [rules](variables.tf#L116) | List of rules associated with this NAT. | <code title="list&#40;object&#40;&#123;&#10; description &#61; optional&#40;string&#41;&#10; match &#61; string&#10; source_ips &#61; optional&#40;list&#40;string&#41;&#41;&#10; source_ranges &#61; optional&#40;list&#40;string&#41;&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#91;&#93;</code> |
| [type](variables.tf#L136) | Whether this Cloud NAT is used for public or private IP translation. One of 'PUBLIC' or 'PRIVATE'. | <code>string</code> | | <code>&#34;PUBLIC&#34;</code> |
## Outputs

View File

@ -1,5 +1,5 @@
/**
* Copyright 2023 Google LLC
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -47,13 +47,21 @@ resource "google_compute_router" "router" {
}
resource "google_compute_router_nat" "nat" {
project = var.project_id
region = var.region
name = var.name
router = local.router_name
nat_ips = var.addresses
provider = google-beta
project = var.project_id
region = var.region
name = var.name
type = var.type
router = local.router_name
nat_ips = var.addresses
nat_ip_allocate_option = (
length(var.addresses) > 0 ? "MANUAL_ONLY" : "AUTO_ONLY"
var.type == "PRIVATE"
? null
: (
length(var.addresses) > 0
? "MANUAL_ONLY"
: "AUTO_ONLY"
)
)
source_subnetwork_ip_ranges_to_nat = local.subnet_config
icmp_idle_timeout_sec = var.config_timeouts.icmp
@ -114,7 +122,8 @@ resource "google_compute_router_nat" "nat" {
description = rules.value.description
match = rules.value.match
action {
source_nat_active_ips = rules.value.source_ips
source_nat_active_ips = rules.value.source_ips
source_nat_active_ranges = rules.value.source_ranges
}
}
}

View File

@ -1,5 +1,5 @@
/**
* Copyright 2023 Google LLC
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -25,8 +25,8 @@ variable "config_port_allocation" {
type = object({
enable_endpoint_independent_mapping = optional(bool, true)
enable_dynamic_port_allocation = optional(bool, false)
min_ports_per_vm = optional(number, 64)
max_ports_per_vm = optional(number, 65536)
min_ports_per_vm = optional(number)
max_ports_per_vm = optional(number)
})
default = {}
nullable = false
@ -58,11 +58,11 @@ output "foo" {
variable "config_timeouts" {
description = "Timeout configurations."
type = object({
icmp = optional(number, 30)
tcp_established = optional(number, 1200)
tcp_time_wait = optional(number, 120)
tcp_transitory = optional(number, 30)
udp = optional(number, 30)
icmp = optional(number)
tcp_established = optional(number)
tcp_time_wait = optional(number)
tcp_transitory = optional(number)
udp = optional(number)
})
default = {}
nullable = false
@ -116,10 +116,30 @@ variable "router_network" {
variable "rules" {
description = "List of rules associated with this NAT."
type = list(object({
description = optional(string),
match = string
source_ips = list(string)
description = optional(string)
match = string
source_ips = optional(list(string))
source_ranges = optional(list(string))
}))
default = []
nullable = false
validation {
condition = alltrue([
for r in var.rules :
r.source_ips != null || r.source_ranges != null
])
error_message = "All rules must specify either source_ips or source_ranges."
}
}
variable "type" {
description = "Whether this Cloud NAT is used for public or private IP translation. One of 'PUBLIC' or 'PRIVATE'."
type = string
default = "PUBLIC"
nullable = false
validation {
condition = var.type == "PUBLIC" || var.type == "PRIVATE"
error_message = "Field type must be either PUBLIC or PRIVATE."
}
}

View File

@ -662,9 +662,10 @@ module "vpc" {
| [shared_vpc_host](variables.tf#L238) | Enable shared VPC for this project. | <code>bool</code> | | <code>false</code> |
| [shared_vpc_service_projects](variables.tf#L244) | Shared VPC service projects to register with this host. | <code>list&#40;string&#41;</code> | | <code>&#91;&#93;</code> |
| [subnets](variables.tf#L250) | Subnet configuration. | <code title="list&#40;object&#40;&#123;&#10; name &#61; string&#10; ip_cidr_range &#61; string&#10; region &#61; string&#10; description &#61; optional&#40;string&#41;&#10; enable_private_access &#61; optional&#40;bool, true&#41;&#10; flow_logs_config &#61; optional&#40;object&#40;&#123;&#10; aggregation_interval &#61; optional&#40;string&#41;&#10; filter_expression &#61; optional&#40;string&#41;&#10; flow_sampling &#61; optional&#40;number&#41;&#10; metadata &#61; optional&#40;string&#41;&#10; metadata_fields &#61; optional&#40;list&#40;string&#41;&#41;&#10; &#125;&#41;&#41;&#10; ipv6 &#61; optional&#40;object&#40;&#123;&#10; access_type &#61; optional&#40;string, &#34;INTERNAL&#34;&#41;&#10; &#125;&#41;&#41;&#10; secondary_ip_ranges &#61; optional&#40;map&#40;string&#41;&#41;&#10;&#10;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#91;&#93;</code> |
| [subnets_proxy_only](variables.tf#L297) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list&#40;object&#40;&#123;&#10; name &#61; string&#10; ip_cidr_range &#61; string&#10; region &#61; string&#10; description &#61; optional&#40;string&#41;&#10; active &#61; optional&#40;bool, true&#41;&#10; global &#61; optional&#40;bool, false&#41;&#10;&#10;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#91;&#93;</code> |
| [subnets_psc](variables.tf#L331) | List of subnets for Private Service Connect service producers. | <code title="list&#40;object&#40;&#123;&#10; name &#61; string&#10; ip_cidr_range &#61; string&#10; region &#61; string&#10; description &#61; optional&#40;string&#41;&#10;&#10;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#91;&#93;</code> |
| [vpc_create](variables.tf#L363) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
| [subnets_private_nat](variables.tf#L297) | List of private NAT subnets. | <code title="list&#40;object&#40;&#123;&#10; name &#61; string&#10; ip_cidr_range &#61; string&#10; region &#61; string&#10; description &#61; optional&#40;string&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#91;&#93;</code> |
| [subnets_proxy_only](variables.tf#L309) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | <code title="list&#40;object&#40;&#123;&#10; name &#61; string&#10; ip_cidr_range &#61; string&#10; region &#61; string&#10; description &#61; optional&#40;string&#41;&#10; active &#61; optional&#40;bool, true&#41;&#10; global &#61; optional&#40;bool, false&#41;&#10;&#10;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#91;&#93;</code> |
| [subnets_psc](variables.tf#L343) | List of subnets for Private Service Connect service producers. | <code title="list&#40;object&#40;&#123;&#10; name &#61; string&#10; ip_cidr_range &#61; string&#10; region &#61; string&#10; description &#61; optional&#40;string&#41;&#10;&#10;&#10; iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings &#61; optional&#40;map&#40;object&#40;&#123;&#10; role &#61; string&#10; members &#61; list&#40;string&#41;&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10; iam_bindings_additive &#61; optional&#40;map&#40;object&#40;&#123;&#10; member &#61; string&#10; role &#61; string&#10; condition &#61; optional&#40;object&#40;&#123;&#10; expression &#61; string&#10; title &#61; string&#10; description &#61; optional&#40;string&#41;&#10; &#125;&#41;&#41;&#10; &#125;&#41;&#41;, &#123;&#125;&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#91;&#93;</code> |
| [vpc_create](variables.tf#L375) | Create VPC. When set to false, uses a data source to reference existing VPC. | <code>bool</code> | | <code>true</code> |
## Outputs
@ -684,6 +685,7 @@ module "vpc" {
| [subnet_secondary_ranges](outputs.tf#L122) | Map of subnet secondary ranges keyed by name. | |
| [subnet_self_links](outputs.tf#L133) | Map of subnet self links keyed by name. | |
| [subnets](outputs.tf#L142) | Subnet resources. | |
| [subnets_proxy_only](outputs.tf#L151) | L7 ILB or L7 Regional LB subnet resources. | |
| [subnets_psc](outputs.tf#L156) | Private Service Connect subnet resources. | |
| [subnets_private_nat](outputs.tf#L151) | Private NAT subnet resources. | |
| [subnets_proxy_only](outputs.tf#L156) | L7 ILB or L7 Regional LB subnet resources. | |
| [subnets_psc](outputs.tf#L161) | Private Service Connect subnet resources. | |
<!-- END TFDOC -->

View File

@ -1,5 +1,5 @@
/**
* Copyright 2023 Google LLC
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -148,6 +148,11 @@ output "subnets" {
]
}
output "subnets_private_nat" {
description = "Private NAT subnet resources."
value = { for k, v in google_compute_subnetwork.private_nat : k => v }
}
output "subnets_proxy_only" {
description = "L7 ILB or L7 Regional LB subnet resources."
value = { for k, v in google_compute_subnetwork.proxy_only : k => v }

View File

@ -1,5 +1,5 @@
/**
* Copyright 2023 Google LLC
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -124,6 +124,10 @@ locals {
{ for s in var.subnets_proxy_only : "${s.region}/${s.name}" => s },
{ for k, v in local._factory_subnets : k => v if v._is_proxy_only },
)
subnets_private_nat = merge(
{ for s in var.subnets_private_nat : "${s.region}/${s.name}" => s },
# { for k, v in local._factory_subnets : k => v if v._is_proxy_only },
)
subnets_psc = merge(
{ for s in var.subnets_psc : "${s.region}/${s.name}" => s },
{ for k, v in local._factory_subnets : k => v if v._is_psc }
@ -185,6 +189,20 @@ resource "google_compute_subnetwork" "proxy_only" {
role = each.value.active ? "ACTIVE" : "BACKUP"
}
resource "google_compute_subnetwork" "private_nat" {
for_each = local.subnets_private_nat
project = var.project_id
network = local.network.name
name = each.value.name
region = each.value.region
ip_cidr_range = each.value.ip_cidr_range
description = coalesce(
each.value.description,
"Terraform-managed private NAT subnet."
)
purpose = "PRIVATE_NAT"
}
resource "google_compute_subnetwork" "psc" {
for_each = local.subnets_psc
project = var.project_id

View File

@ -1,5 +1,5 @@
/**
* Copyright 2023 Google LLC
* Copyright 2024 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -294,6 +294,18 @@ variable "subnets" {
nullable = false
}
variable "subnets_private_nat" {
description = "List of private NAT subnets."
type = list(object({
name = string
ip_cidr_range = string
region = string
description = optional(string)
}))
default = []
nullable = false
}
variable "subnets_proxy_only" {
description = "List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active."
type = list(object({

View File

@ -1520,6 +1520,7 @@ values:
log_config:
- enable: false
filter: ALL
max_ports_per_vm: null
name: ew1
nat_ip_allocate_option: AUTO_ONLY
nat_ips: null
@ -1551,8 +1552,7 @@ values:
log_config:
- enable: false
filter: ALL
max_ports_per_vm: 65536
min_ports_per_vm: 64
max_ports_per_vm: null
name: ew4
nat_ip_allocate_option: AUTO_ONLY
nat_ips: null

View File

@ -0,0 +1,94 @@
# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
values:
module.vpc1-nat.google_compute_router.router[0]:
bgp: []
description: null
encrypted_interconnect_router: null
name: vpc1-nat-nat
project: project-id
region: europe-west8
module.vpc1-nat.google_compute_router_nat.nat:
drain_nat_ips: null
enable_dynamic_port_allocation: true
enable_endpoint_independent_mapping: false
icmp_idle_timeout_sec: 30
log_config:
- enable: false
filter: ALL
max_ports_per_vm: null
name: vpc1-nat
nat_ip_allocate_option: null
nat_ips: null
project: project-id
region: europe-west8
router: vpc1-nat-nat
rules:
- action:
- source_nat_active_ips: []
source_nat_drain_ips: []
source_nat_drain_ranges: []
description: private nat
match: nexthop.is_hybrid
rule_number: 0
source_subnetwork_ip_ranges_to_nat: LIST_OF_SUBNETWORKS
subnetwork:
- secondary_ip_range_names: []
source_ip_ranges_to_nat:
- ALL_IP_RANGES
tcp_established_idle_timeout_sec: 1200
tcp_time_wait_timeout_sec: 120
tcp_transitory_idle_timeout_sec: 30
type: PRIVATE
udp_idle_timeout_sec: 30
module.vpc1.google_compute_network.network[0]:
auto_create_subnetworks: false
delete_default_routes_on_create: false
description: Terraform-managed.
enable_ula_internal_ipv6: null
name: vpc1
network_firewall_policy_enforcement_order: AFTER_CLASSIC_FIREWALL
project: project-id
routing_mode: GLOBAL
module.vpc1.google_compute_subnetwork.private_nat["europe-west8/vpc1-nat"]:
description: Terraform-managed private NAT subnet.
ip_cidr_range: 192.168.15.0/24
ipv6_access_type: null
log_config: []
name: vpc1-nat
network: vpc1
project: project-id
purpose: PRIVATE_NAT
region: europe-west8
role: null
module.vpc1.google_compute_subnetwork.subnetwork["europe-west8/vpc1-subnet"]:
description: Terraform-managed.
ip_cidr_range: 10.0.0.0/24
ipv6_access_type: null
log_config: []
name: vpc1-subnet
network: vpc1
private_ip_google_access: true
project: project-id
region: europe-west8
role: null
secondary_ip_range: []
counts:
google_compute_network: 1
google_compute_route: 2
google_compute_router: 1
google_compute_router_nat: 1
google_compute_subnetwork: 2