cloud-foundation-fabric/modules/ncc-spoke-ra

NCC Spoke RA Module

This module allows management of NCC Spokes backed by Router Appliances. Network virtual appliances used as router appliances allow to connect an external network to Google Cloud by using a SD-WAN router or another appliance with BGP capabilities (site-to-cloud connectivity). It is also possible to enable site-to-site data transfer, although this feature is not available in all regions, particularly not in EMEA.

The module manages a hub (optionally), a spoke, and the corresponding Cloud Router and BGP sessions to the router appliance(s).

Examples

Simple hub & spoke

module "spoke-ra" {
  source     = "./fabric/modules/ncc-spoke-ra"
  hub        = { create = true, name = "ncc-hub" }
  name       = "spoke-ra"
  project_id = "my-project"
  asn        = 65000
  peer_asn   = 65001
  ras = [
    {
      vm = "projects/my-project/zones/europe-west1-b/instances/router-app"
      ip = "10.0.0.3"
    }
  ]
  region     = "europe-west1"
  subnetwork = var.subnet.self_link
  vpc        = "my-vpc"
}
# tftest modules=1 resources=7

Two spokes

module "spoke-ra-a" {
  source     = "./fabric/modules/ncc-spoke-ra"
  hub        = { name = "ncc-hub" }
  name       = "spoke-ra-a"
  project_id = "my-project"
  asn        = 65000
  peer_asn   = 65001
  ras = [
    {
      vm = "projects/my-project/zones/europe-west1-b/instances/router-app-a"
      ip = "10.0.0.3"
    }
  ]
  region     = "europe-west1"
  subnetwork = "projects/my-project/regions/europe-west1/subnetworks/subnet"
  vpc        = "my-vpc1"
}

module "spoke-ra-b" {
  source     = "./fabric/modules/ncc-spoke-ra"
  hub        = { name = "ncc-hub" }
  name       = "spoke-ra-b"
  project_id = "my-project"
  asn        = 65000
  peer_asn   = 65002
  ras = [
    {
      vm = "projects/my-project/zones/europe-west3-b/instances/router-app-b"
      ip = "10.1.0.5"
    }
  ]
  region     = "europe-west3"
  subnetwork = "projects/my-project/regions/europe-west3/subnetworks/subnet"
  vpc        = "my-vpc2"
}
# tftest modules=2 resources=12

Spoke with load-balanced router appliances

module "spoke-ra" {
  source     = "./fabric/modules/ncc-spoke-ra"
  hub        = { name = "ncc-hub" }
  name       = "spoke-ra"
  project_id = "my-project"
  asn        = 65000
  custom_advertise = {
    all_subnets = true
    ip_ranges = {
      "peered-vpc" = "10.10.0.0/24"
    }
  }
  ip_intf1 = "10.0.0.14"
  ip_intf2 = "10.0.0.15"
  peer_asn = 65001
  ras = [
    {
      vm = "projects/my-project/zones/europe-west1-b/instances/router-app-a"
      ip = "10.0.0.3"
    },
    {
      vm = "projects/my-project/zones/europe-west1-c/instances/router-app-b"
      ip = "10.0.0.4"
    }
  ]
  region     = "europe-west1"
  subnetwork = var.subnet.self_link
  vpc        = "my-vpc"
}
# tftest modules=1 resources=8

Variables

name	description	type	required	default
asn	Autonomous System Number for the CR. All spokes in a hub should use the same ASN.	number	✓
hub	The name of the NCC hub to create or use.	object({…})	✓
name	The name of the NCC spoke.	string	✓
peer_asn	Peer Autonomous System Number used by the router appliances.	number	✓
project_id	The ID of the project where the NCC hub & spokes will be created.	string	✓
ras	List of router appliances this spoke is associated with.	list(object({…}))	✓
region	Region where the spoke is located.	string	✓
subnetwork	The URI of the subnetwork that CR interfaces belong to.	string	✓
vpc	A reference to the network to which the CR belongs.	string	✓
custom_advertise	IP ranges to advertise if not using default route advertisement (subnet ranges).	object({…})		null
data_transfer	Site-to-site data transfer feature, available only in some regions.	bool		false
ip_intf1	IP address for the CR interface 1. It must belong to the primary range of the subnet. If you don't specify a value Google will try to find a free address.	string		null
ip_intf2	IP address for the CR interface 2. It must belong to the primary range of the subnet. If you don't specify a value Google will try to find a free address.	string		null
keepalive	The interval in seconds between BGP keepalive messages that are sent to the peer.	number		null

Outputs

name	description	sensitive
hub_name	NCC hub name (only if auto-created).