zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
cloud-foundation-fabric/fast/stages/2-networking-e-nva-bgp/README.md

47 KiB
Raw Blame History

Networking with Network Virtual Appliance

This stage sets up the shared network infrastructure for the whole organization.

It is designed for those who would like to leverage Network Virtual Appliances (NVAs) between trusted and untrusted areas of the network, for example for Intrusion Prevention System (IPS) purposes.

We use Network Connectivity Center Router Appliance (NCC-RA) and BGP appliances (for the sake of the demo FRRouting) to avoid different limitations that static routes bring (more here). The goals of this design include:

  • Avoid using network tags to route traffic.
  • Route traffic symmetrically to prevent breaking stateful NVAs.
  • Avoid unnecessary NAT traffic at the NVAs.
  • Avoid cross-regional traffic unless absolutely necessary for disaster recovery.
  • Automatically send all traffic through the cross-regional NVAs if the ones in-region fail.
  • Keep the trusted hub VPC unique, rather than having one per region.

It adopts the common “hub and spoke” reference design, which is well suited for multiple scenarios, and it offers several advantages versus other designs:

  • the "trusted hub" VPC centralizes the external connectivity towards trusted network resources (e.g. on-prem, other cloud environments and the spokes), and it is ready to host cross-environment services like CI/CD, code repositories, and monitoring probes
  • the "spoke" VPCs allow partitioning workloads (e.g. by environment like in this setup), while still retaining controlled access to central connectivity and services
  • Shared VPCs -both in hub and spokes- split the management of the network resources into specific (host) projects, while still allowing them to be consumed from the workload (service) projects
  • the design facilitates DNS centralization

Connectivity between the hub and the spokes is established via VPC network peerings, which offer uncapped bandwidth, lower latencies, at no additional costs and with a very low management overhead. Different ways of implementing connectivity, and related some pros and cons, are discussed below.

The diagram shows the high-level design and it should be used as a reference throughout the following sections.

The final number of subnets, and their IP addressing will depend on the user-specific requirements. It can be easily changed via variables or external data files, without any need to edit the code.

Networking diagram

Table of contents

Design overview and choices

Multi-regional deployment

The stage deploys the the infrastructure in two regions. By default, europe-west1 and europe-west4. Regional resources include NVAs and test VMs. This provides enough redundancy to be resilient to regional failures. In case of a regional failure, the corresponding dynamic routes are withdrawn and traffic will failover in the secondary region.

VPC design

The "landing zone" is divided into two VPC networks:

  • the landing VPC: the connectivity hub towards other trusted networks
  • the DMZ VPC: the connectivity hub towards any other untrusted network

NCC, NVAs and BGP sessions

The VPCs connect through two sets of sample NVA machines: one per region, each containing two instances. The appliances run Container-Optimized OS and a container with FRRouting.

We leverage NCC-RA to allow the NVAs to establish BGP sessions with Cloud Routers in the untrusted and in the trusted VPCs. This allows Cloud Routers to advertise routes to the NVAs, and the NVAs to announce routes to the Cloud Router, so it can program them in the VPC.

Specifically, each NVA establishes two BGP sessions (for redundancy) with the the Cloud Router deployed in the VPC and in the subnet where the interface of that VM is attached to.

Cloud Routers in the DMZ VPC advertise the default route (0.0.0.0/0) to the NVAs. The NVAs advertise the route to the Cloud Routers in the landing. These dynamic routes are then imported through VPC peerings in the spokes.

Cloud Routers in the landing adverts to the NVAs all the subnets of the trusted VPCs. This includes the regional subnets and the cross-regional subnets. The NVAs manipulate the route costs (MED) before advertising them to the Cloud Routers in the DMZ VPC. This is done to guarantee symmetric traffic paths (more here).

NVAs establish extra BGP sessions with both cross-regional NVAs. In this case, the NVAs advertise the regional trusted routes only. This allows cross-spoke (environment) traffic to remain also symmetric (more here). We set these routes to be exchanged at a lower cost than the one set for the other routes.

Following the majority of real-life deployments, we assume appliances to be stateful and not able to synchronize sessions between multiple NVAs within the same regional cluster. For this reason, within each regional cluster, NVAs announce the same routes with different MED costs (1 point of difference between the primary and the secondary). This will cause traffic to go deterministically through one applaiance at the time within each region. You can change this default behavior modifying the cost settings in the NVAs BGP configuration file.

By default, the design assumes that:

  • on-premise networks (and related resources) are considered trusted. As such, the VPNs connecting with on-premises are terminated in GCP, in the landing
  • the public Internet is considered untrusted. As such Cloud NAT is deployed in the DMZ VPC only. Also, the default route is set to carry traffic from the trusted VPCs, through the NVAs, to the DMZ.
  • cross-spoke (environment) traffic and traffic from any untrusted network to any trusted network (and vice versa) pass through the NVAs.
  • any traffic from a trusted network to an untrusted network (e.g. Internet) is natted by the NVAs. Users can configure further exclusions.

The trusted landing VPC acts as a hub: it bridges internal resources with the outside world and it hosts the shared services consumed by the spoke VPCs, connected to the hub through VPC network peerings. Spokes are used to partition the environments. By default:

  • one spoke VPC hosts the development environment resources
  • one spoke VPC hosts the production environment resources

Each virtual network is a shared VPC: shared VPCs are managed in dedicated host projects and shared with other service projects that consume the network resources. Shared VPCs let organization administrators delegate administrative responsibilities, such as creating and managing instances, to Service Project Admins while maintaining centralized control over network resources like subnets, routes, and firewalls.

Users can easily extend the design to host additional environments, or adopt different logical mappings for the spokes (for example, in order to create a new spoke for each company entity). Adding spokes is trivial and it does not increase the design complexity. The steps to add more spokes are provided in the following sections.

In multi-organization scenarios, where production and non-production resources use different Cloud Identity and GCP organizations, the hub/landing VPC is usually part of the production organization. It establishes connections with the production spokes within the same organization, and with non-production spokes in a different organization.

External connectivity

External connectivity to on-prem is implemented leveraging Cloud HA VPN (two tunnels per region). This is what users normally deploy as a final solution, or to validate routing and to transfer data, while waiting for interconnects to be provisioned.

Connectivity to additional on-prem sites or to other cloud providers should be implemented in a similar fashion, via VPN tunnels or interconnects, in the landing VPC (either trusted or untrusted, depending by the nature of the peers), sharing the same regional routers.

Internal connectivity

Internal connectivity (e.g. between the trusted landing VPC and the spokes) is realized with VPC network peerings. As mentioned, there are other ways to implement connectivity. These can be easily retrofitted with minimal code changes, although they introduce additional considerations on service interoperability, quotas and management.

This is an options summary:

  • VPC Peering (used here to connect the trusted landing VPC with the spokes, also used by 02-networking-vpn)
    • Pros: no additional costs, full bandwidth with no configurations, no extra latency
    • Cons: no transitivity (e.g. to GKE masters, Cloud SQL, etc.), no selective exchange of routes, several quotas and limits shared between VPCs in a peering group
  • Multi-NIC appliances (used here to connect the trusted landing and DMZ)
    • Pros: provides additional security features (e.g. IPS), potentially better integration with on-prem systems by using the same vendor
    • Cons: complex HA/failover setup, limited by VM bandwidth and scale, additional costs for VMs and licenses, out of band management of a critical cloud component
  • HA VPN
    • Pros: simple compatibility with GCP services that leverage peering internally, better control on routes, avoids peering groups shared quotas and limits
    • Cons: additional costs, marginal increase in latency, requires multiple tunnels for full bandwidth

IP ranges, subnetting, routing

Minimizing the number of routes (and subnets) in the cloud environment is important, as it simplifies management and it avoids hitting Cloud Router and VPC quotas and limits. For this reason, we recommend to carefully plan the IP space used in your cloud environment. This allows the use of larger IP CIDR blocks in routes, whenever possible.

This stage uses a dedicated /11 block (10.64.0.0/11), which should be sized to the own needs. The subnets created in each VPC derive from this range.

The /11 block is evenly split in eight, smaller /16 blocks, assigned to different areas of the GCP network: landing untrusted europe-west1, landing untrusted europe-west4, landing trusted europe-west1, landing untrusted europe-west4, development europe-west1, development europe-west4, production europe-west1, production europe-west4.

The first /24 range in every area is allocated for a default subnet, which can be removed or modified as needed. The last three /24 ranges can be used for PSA (Private Service Access)via the psa_ranges variable, or for Internal Application Load Balancers (L7 LBs) subnets via the factory.

This is a summary of the subnets allocated by default in this setup:

name description CIDR
landing-default-ew1 Trusted landing subnet - europe-west1 10.128.64.0/24
landing-default-ew4 Trusted landing subnet - europe-west4 10.128.96.0/24
dmz-default-ew1 Untrusted landing subnet - europe-west1 10.128.0.0/24
dmz-default-ew4 Untrusted landing subnet - europe-west4 10.128.32.0/24
dev-default-ew1 Dev spoke subnet - europe-west1 10.68.0.0/24
dev-default-ew1 Free (PSA) - europe-west1 10.68.253.0/24
dev-default-ew1 Free (PSA) - europe-west1 10.68.254.0/24
dev-default-ew1 Free (L7 ILB) - europe-west1 10.68.255.0/24
dev-default-ew4 Dev spoke subnet - europe-west4 10.84.0.0/24
dev-default-ew4 Free (PSA) - europe-west4 10.84.253.0/24
dev-default-ew4 Free (PSA) - europe-west4 10.84.254.0/24
dev-default-ew4 Free (L7 ILB) - europe-west4 10.84.255.0/24
prod-default-ew1 Prod spoke subnet - europe-west1 10.72.0.0/24
prod-default-ew1 Free (PSA) - europe-west1 10.72.253.0/24
prod-default-ew1 Free (PSA) - europe-west1 10.72.254.0/24
prod-default-ew1 Free (L7 ILB) - europe-west1 10.72.255.0/24
prod-default-ew4 Prod spoke subnet - europe-west4 10.88.0.0/24
prod-default-ew4 Free (PSA) - europe-west4 10.88.253.0/24
prod-default-ew4 Free (PSA) - europe-west4 10.88.254.0/24
prod-default-ew4 Free (L7 ILB) - europe-west4 10.88.255.0/24

These subnets can be advertised to on-premises as an aggregate /11 range (10.64.0.0/11). Refer to the var.vpn_onprem_primary_config.router_config and var.vpn_onprem_secondary_config.router_config variables to configure it.

Routes in GCP are either automatically created (for example, when a subnet is added to a VPC), manually created via static routes, dynamically exchanged through VPC peerings, or dynamically programmed by Cloud Routers when a BGP session is established. BGP sessions can be configured to advertise VPC ranges, and/or custom ranges via custom advertisements.

In this setup:

  • routes between multiple subnets within the same VPC are automatically exchanged by GCP
  • the spokes and the trusted landing VPC exchange dynamic routes through VPC peerings
  • on-premises is connected to the trusted landing VPC and it dynamically exchanges BGP routes with GCP (with the landing) using HA VPN
  • the NVAs exchange dynamic routes using BGP with Cloud Routers in the DMZ, Cloud Routers in the landing and cross-regional NVAs. This allows VMs in different environments and different regions to communicate.

The Cloud Routers (connected to the VPN gateways in the landing) are configured to exclude the default advertisement of VPC ranges and they only advertise their respective aggregate ranges, via custom advertisements. This greatly simplifies the routing configuration and avoids quota or limit issues, by keeping the number of routes small, instead of making it proportional to the subnets and to the secondary ranges in the VPCs.

Internet egress

In this setup, Internet egress is realized through Cloud NAT, deployed in the untrusted landing VPC. This allows instances in all other VPCs to reach the Internet, passing through the NVAs (being the public Internet considered untrusted). Cloud NAT is disabled by default; enable it by setting the enable_cloud_nat variable

Several other scenarios are possible, with various degrees of complexity:

  • deploy Cloud NAT in every VPC
  • add forwarding proxies, with optional URL filters
  • send Internet traffic to on-premises, so the existing egress infrastructure can be leveraged

Future pluggable modules will allow users to easily experiment with the above scenarios.

VPC and Hierarchical Firewall

The GCP Firewall is a stateful, distributed feature that allows the creation of L4 policies, either via VPC-level rules or -more recently- via hierarchical policies, applied on the resource hierarchy (organization, folders).

The current setup adopts both firewall types. Hierarchical firewall rules are applied in the networking folder for common ingress rules (egress is open by default): for example, it allows the health checks and the IAP forwarders traffic to reach the VMs.

Rules and policies are defined in simple YAML files, described below.

DNS

DNS goes hand in hand with networking, especially on GCP where Cloud DNS zones and policies are associated at the VPC level. This setup implements both DNS flows:

  • on-prem to cloud via private zones for cloud-managed domains, and an inbound policy used as forwarding target or via delegation (requires some extra configuration) from on-prem DNS resolvers
  • cloud to on-prem via forwarding zones for the on-prem managed domains

DNS configuration is further centralized by leveraging peering zones, so that

  • the hub/landing Cloud DNS hosts configurations for on-prem forwarding, Google API domains, and the top-level private zone/s (e.g. gcp.example.com)
  • the spokes Cloud DNS host configurations for the environment-specific domains (e.g. prod.gcp.example.com), which are bound to the hub/landing leveraging cross-project binding; a peering zone for the . (root) zone is then created on each spoke, delegating all DNS resolution to hub/landing.
  • Private Google Access is enabled via DNS Response Policies for most of the supported domains

To complete the configuration, the 35.199.192.0/19 range should be routed to the VPN tunnels from on-premises, and the following names should be configured for DNS forwarding to cloud:

  • private.googleapis.com
  • restricted.googleapis.com
  • gcp.example.com (used as a placeholder)

In GCP, a forwarding zone in the landing project is configured to forward queries to the placeholder domain onprem.example.com to on-premises.

This configuration is battle-tested, and flexible enough to lend itself to simple modifications without subverting its design.

Stage structure and files layout

VPCs

VPCs are defined in separate files, one for landing (trusted and untrusted), one for prod and one for dev.

These files contain different resources:

  • project (projects): the "host projects" containing the VPCs and enabling the required APIs.
  • VPCs (net-vpc): manages the subnets, the explicit routes for {private,restricted}.googleapis.com and the DNS inbound policy for the trusted landing VPC. Non-infrastructural subnets are created leveraging resource factories. Sample subnets are shipped in data/subnets and can be easily customized to fit users' needs. PSA are configured by the variable psa_ranges if managed services are needed.
  • Cloud NAT (net-cloudnat) (in the untrusted landing VPC only): it manages the networking infrastructure required to enable the Internet egress.

VPNs

The connectivity between on-premises and GCP (the trusted landing VPC) is implemented with Cloud HA VPN (net-vpn) and defined in vpn-onprem.tf. The file implements a single logical connection between on-premises and the trusted landing VPC, both in europe-west1 and europe-west4. The relevant parameters for its configuration are found in the variables vpn_onprem_primary_config and vpn_onprem_secondary_config.

Routing and BGP

Each VPC network (net-vpc) manages a separate routing table, where you can define static routes (e.g. to private.googleapis.com) and receives dynamic routes through VPC peering and BGP sessions established with the neighbor networks (e.g. NCC routers, routers on-premises).

NCC/Cloud Router BGP settings are defined in ncc.tf. NVA BGP settings are defined in the bpg-config.tftpl template file. The variable ncc_asn allows to change the Autonomous System Number (ASN) assigned to the DMZ Cloud Routers, to the landing VPC Cloud Routers and to the NVAs.

BGP sessions for trusted landing to on-premises are configured through the variable vpn_onprem_configs.

Firewall

VPC firewall rules (net-vpc-firewall) are defined per-vpc on each vpc-*.tf file and leverage a resource factory to massively create rules. To add a new firewall rule, create a new file or edit an existing one in the data_folder directory defined in the module net-vpc-firewall, following the examples of the "Rules factory" section of the module documentation. Sample firewall rules are shipped in data/firewall-rules/landing-untrusted and in data/firewall-rules/landing-trusted, and can be easily customized.

Hierarchical firewall policies (folder) are defined in main.tf and managed through a policy factory implemented by the net-firewall-policy module, which is then applied to the Networking folder containing all the core networking infrastructure. Policies are defined in the rules_file file, to define a new one simply use the firewall policy module documentation". Sample hierarchical firewall rules are shipped in data/hierarchical-ingress-rules.yaml and can be easily customised.

DNS architecture

The DNS (dns) infrastructure is defined in [dns-*.tf] files.

Cloud DNS manages onprem forwarding, the main GCP zone (in this example gcp.example.com) and environment-specific zones (i.e. dev.gcp.example.com and prod.gcp.example.com).

Cloud environment

The root DNS zone defined in the landing project acts as the source of truth for DNS within the Cloud environment. The resources defined in the spoke VPCs consume the landing DNS infrastructure through DNS peering (e.g. prod-landing-root-dns-peering). The spokes can optionally define private zones (e.g. prod-dns-private-zone). Granting visibility both to the trusted and untrusted landing VPCs ensures that the whole cloud environment can query such zones.

Cloud to on-prem

Leveraging the forwarding zone defined in the landing project (e.g. onprem-example-dns-forwarding and reverse-10-dns-forwarding), the cloud environment can resolve in-addr.arpa. and onprem.example.com. using the on-premise DNS infrastructure. On-premise resolver IPs are set in the variable dns.onprem.

DNS queries sent to the on-premise infrastructure come from the 35.199.192.0/19 source range.

On-prem to cloud

The Inbound DNS Policy defined in the trusted landing VPC module (net-landing.tf) automatically reserves the first available IP address on each subnet (typically the third one in a CIDR) to expose the Cloud DNS service, so that it can be consumed from outside of GCP.

How to run this stage

This stage is meant to be executed after the resource management stage has run, as it leverages the automation service account and bucket created there, and additional resources configured in the bootstrap stage.

It's of course possible to run this stage in isolation, but that's outside the scope of this document, and you would need to refer to the code for the previous stages for the environmental requirements.

Before running this stage, you need to make sure you have the correct credentials and permissions, and localize variables by assigning values that match your configuration.

Provider and Terraform variables

As all other FAST stages, the mechanism used to pass variable values and pre-built provider files from one stage to the next is also leveraged here.

The commands to link or copy the provider and terraform variable files can be easily derived from the stage-links.sh script in the FAST root folder, passing it a single argument with the local output files folder (if configured) or the GCS output bucket in the automation project (derived from stage 0 outputs). The following examples demonstrate both cases, and the resulting commands that then need to be copy/pasted and run.

../../stage-links.sh ~/fast-config

# copy and paste the following commands for '2-networking-a-peering'

ln -s ~/fast-config/providers/2-networking-providers.tf ./
ln -s ~/fast-config/tfvars/0-globals.auto.tfvars.json ./
ln -s ~/fast-config/tfvars/0-bootstrap.auto.tfvars.json ./
ln -s ~/fast-config/tfvars/1-resman.auto.tfvars.json ./

../../stage-links.sh gs://xxx-prod-iac-core-outputs-0

# copy and paste the following commands for '2-networking-a-peering'

gcloud alpha storage cp gs://xxx-prod-iac-core-outputs-0/providers/2-networking-providers.tf ./
gcloud alpha storage cp gs://xxx-prod-iac-core-outputs-0/tfvars/0-globals.auto.tfvars.json ./
gcloud alpha storage cp gs://xxx-prod-iac-core-outputs-0/tfvars/0-bootstrap.auto.tfvars.json ./
gcloud alpha storage cp gs://xxx-prod-iac-core-outputs-0/tfvars/1-resman.auto.tfvars.json ./

Impersonating the automation service account

The preconfigured provider file uses impersonation to run with this stage's automation service account's credentials. The gcp-devops and organization-admins groups have the necessary IAM bindings in place to do that, so make sure the current user is a member of one of those groups.

Variable configuration

Variables in this stage -- like most other FAST stages -- are broadly divided into three separate sets:

  • variables which refer to global values for the whole organization (org id, billing account id, prefix, etc.), which are pre-populated via the 0-globals.auto.tfvars.json file linked or copied above
  • variables which refer to resources managed by previous stage, which are prepopulated here via the 0-bootstrap.auto.tfvars.json and 1-resman.auto.tfvars.json files linked or copied above
  • and finally variables that optionally control this stage's behaviour and customizations, and can to be set in a custom terraform.tfvars file

The latter set is explained in the Customization sections below, and the full list can be found in the Variables table at the bottom of this document.

Note that the outputs_location variable is disabled by default, you need to explicitly set it in your terraform.tfvars file if you want output files to be generated by this stage. This is a sample terraform.tfvars that configures it, refer to the bootstrap stage documentation for more details:

outputs_location = "~/fast-config"

Using delayed billing association for projects

This configuration is possible but unsupported and only exists for development purposes, use at your own risk:

  • temporarily switch billing_account.id to null in 0-globals.auto.tfvars.json
  • for each project resources in the project modules used in this stage (dev-spoke-project, landing-project, prod-spoke-project)
    • apply using -target, for example terraform apply -target 'module.landing-project.google_project.project[0]'
    • untaint the project resource after applying, for example terraform untaint 'module.landing-project.google_project.project[0]'
  • go through the process to associate the billing account with the two projects
  • switch billing_account.id back to the real billing account id
  • resume applying normally

Running the stage

Once provider and variable values are in place and the correct user is configured, the stage can be run:

terraform init
terraform apply

Post-deployment activities

  • On-prem routers should be configured to advertise all relevant CIDRs to the GCP environments. To avoid hitting GCP quotas, we recommend aggregating routes as much as possible.
  • On-prem routers should accept BGP sessions from their cloud peers.
  • On-prem DNS servers should have forward zones for GCP-managed ones.

Private Google Access

Private Google Access (or PGA) enables VMs and on-prem systems to consume Google APIs from within the Google network, and is already fully configured on this environment:

  • DNS response policies in the landing project implement rules for all supported domains reachable via PGA
  • routes for the private and restricted ranges are defined in all VPCs except untrusted

To enable PGA access from on premises advertise the private/restricted ranges via the vpn_onprem_primary_config and vpn_onprem_secondary_config variables, using router or tunnel custom advertisements.

Customizations

Changing default regions

Regions are defined via the regions variable which sets up a mapping between the regions.primary and regions.secondary logical names and actual GCP region names. If you need to change regions from the defaults:

  • change the values of the mappings in the regions variable to the regions you are going to use
  • change the regions in the factory subnet files in the data folder

Configuring the VPNs to on prem

This stage includes basic support for an HA VPN connecting the landing zone in the primary region to on prem. Configuration is via the vpn_onprem_primary_config and vpn_onprem_secondary_config variables, that closely mirrors the variables defined in the net-vpn-ha.

Support for the onprem VPNs is disabled by default so that no resources are created, this is an example of how to configure one variable to enable the VPN in the primary region:

vpn_onprem_primary_config = {
  peer_external_gateways = {
    default = {
      redundancy_type = "SINGLE_IP_INTERNALLY_REDUNDANT"
      interfaces      = ["8.8.8.8"]
    }
  }
  router_config = {
    asn = 65501
    custom_advertise = {
      all_subnets = false
      ip_ranges   = {
        "10.1.0.0/16"     = "gcp"
        "35.199.192.0/19" = "gcp-dns"
        "199.36.153.4/30" = "gcp-restricted"
      }
    }
  }
  tunnels = {
    "0" = {
      bgp_peer = {
        address = "169.254.1.1"
        asn     = 65500
      }
      bgp_session_range               = "169.254.1.2/30"
      peer_external_gateway_interface = 0
      shared_secret                   = "foo"
      vpn_gateway_interface           = 0
    }
    "1" = {
      bgp_peer = {
        address = "169.254.2.1"
        asn     = 64513
      }
      bgp_session_range               = "169.254.2.2/30"
      peer_external_gateway_interface = 1
      shared_secret                   = "foo"
      vpn_gateway_interface           = 1
    }
  }
}

Adding an environment

To create a new environment (e.g. staging), a few changes are required:

Create a net-staging.tf file by copying net-prod.tf file. Adapt the new file by replacing the value "prod" with the value "staging". Running diff net-dev.tf net-prod.tf can help to see how environment files differ.

The new VPC requires a set of dedicated CIDRs, one per region, added to variable gcp_ranges (for example as spoke_staging_ew1 and spoke_staging_ew4). gcp_ranges is a map that "resolves" CIDR names to the actual addresses, and will be used later to configure routing.

Variables managing L7 Internal Load Balancers (l7ilb_subnets) and Private Service Access (psa_ranges) should also be adapted, and subnets and firewall rules for the new spoke should be added, as described above.

Configure the NVAs deployed updating the sample BGP config file.

DNS configurations are centralised in the dns-*.tf files. Spokes delegate DNS resolution to Landing through DNS peering, and optionally define a private zone (e.g. dev.gcp.example.com) which the landing peers to. To configure DNS for a new environment, copy one of the other environments DNS files e.g. (dns-dev.tf) into a new dns-*.tf file suffixed with the environment name (e.g. dns-staging.tf), and update its content accordingly. Don't forget to add a peering zone from the landing to the newly created environment private zone.

Files

name description modules resources
dns-dev.tf Development spoke DNS zones and peerings setup. dns
dns-landing.tf Landing DNS zones and peerings setup. dns · dns-response-policy
dns-prod.tf Production spoke DNS zones and peerings setup. dns
main.tf Networking folder and hierarchical policy. folder · net-firewall-policy
monitoring-vpn-onprem.tf VPN monitoring alerts. google_monitoring_alert_policy
monitoring.tf Network monitoring dashboards. google_monitoring_dashboard
ncc.tf None ncc-spoke-ra google_network_connectivity_hub
net-dev.tf Dev spoke VPC and related resources. net-vpc · net-vpc-firewall · net-vpc-peering · project
net-landing.tf Landing VPC and related resources. net-cloudnat · net-vpc · net-vpc-firewall · project
net-prod.tf Production spoke VPC and related resources. net-vpc · net-vpc-firewall · net-vpc-peering · project
nva.tf None compute-vm · simple-nva google_compute_address
outputs.tf Module outputs. google_storage_bucket_object · local_file
regions.tf Compute short names for regions.
test-resources.tf temporary instances for testing compute-vm
variables.tf Module variables.
vpn-onprem.tf VPN between landing and onprem. net-vpn-ha

Variables

name description type required default producer
automation Automation resources created by the bootstrap stage. object({…}) ✓ 0-bootstrap
billing_account Billing account id. If billing account is not part of the same org set is_org_level to false. object({…}) ✓ 0-bootstrap
folder_ids Folders to be used for the networking resources in folders/nnnnnnnnnnn format. If null, folder will be created. object({…}) ✓ 1-resman
organization Organization details. object({…}) ✓ 0-bootstrap
prefix Prefix used for resources that need unique names. Use 9 characters or less. string ✓ 0-bootstrap
alert_config Configuration for monitoring alerts. object({…}) {…}
custom_roles Custom roles defined at the org level, in key => id format. object({…}) null 0-bootstrap
dns DNS configuration. object({…}) {}
enable_cloud_nat Deploy Cloud NAT. bool false
essential_contacts Email used for essential contacts, unset if null. string null
factories_config Configuration for network resource factories. object({…}) {…}
gcp_ranges GCP address ranges in name => range format. map(string) {…}
ncc_asn The NCC Cloud Routers ASN configuration. map(number) {…}
onprem_cidr Onprem addresses in name => range format. map(string) {…}
outputs_location Path where providers and tfvars files for the following stages are written. Leave empty to disable. string null
psa_ranges IP ranges used for Private Service Access (e.g. CloudSQL). Ranges is in name => range format. object({…}) null
regions Region definitions. object({…}) {…}
service_accounts Automation service accounts in name => email format. object({…}) null 1-resman
vpn_onprem_primary_config VPN gateway configuration for onprem interconnection in the primary region. object({…}) null
vpn_onprem_secondary_config VPN gateway configuration for onprem interconnection in the secondary region. object({…}) null
zones Zones in which NVAs are deployed. list(string) ["b", "c"]

Outputs

name description sensitive consumers
host_project_ids Network project ids.
host_project_numbers Network project numbers.
shared_vpc_self_links Shared VPC host projects.
tfvars Terraform variables file for the following stages. ✓
vpn_gateway_endpoints External IP Addresses for the GCP VPN gateways.