91 lines
4.4 KiB
Markdown
91 lines
4.4 KiB
Markdown
# Containerized on-premises infrastructure
|
|
|
|
This module manages a `cloud-config` configuration that starts an emulated on-premises infrastructure running in Docker Compose on a single instance, and connects it via static or dynamic VPN to a Google Cloud VPN gateway.
|
|
|
|
The emulated on-premises infrastructure is composed of:
|
|
|
|
- a [Strongswan container](./docker-images/strongswan) managing the VPN tunnel to GCP
|
|
- an optional Bird container managing the BGP session
|
|
- a CoreDNS container servng local DNS and forwarding to GCP
|
|
- an Nginx container serving a simple static web page
|
|
- a [generic Linux container](./docker-images/toolbox) used as a jump host inside the on-premises network
|
|
|
|
A complete scenario using this module is available in the networking blueprints.
|
|
|
|
The module renders the generated cloud config in the `cloud_config` output, to be used in instances or instance templates via the `user-data` metadata.
|
|
|
|
## Examples
|
|
|
|
### Static VPN
|
|
|
|
```hcl
|
|
module "cloud-vpn" {
|
|
source = "./fabric/modules/net-vpn-static"
|
|
project_id = "my-project"
|
|
region = "europe-west1"
|
|
network = "my-vpc"
|
|
name = "to-on-prem"
|
|
remote_ranges = ["192.168.192.0/24"]
|
|
tunnels = {
|
|
remote-0 = {
|
|
peer_ip = module.vm.external_ip
|
|
traffic_selectors = { local = ["0.0.0.0/0"], remote = null }
|
|
}
|
|
}
|
|
}
|
|
|
|
module "on-prem" {
|
|
source = "./fabric/modules/cloud-config-container/onprem"
|
|
vpn_config = {
|
|
type = "static"
|
|
peer_ip = module.cloud-vpn.address
|
|
shared_secret = module.cloud-vpn.random_secret
|
|
}
|
|
}
|
|
|
|
module "vm" {
|
|
source = "./fabric/modules/compute-vm"
|
|
project_id = "my-project"
|
|
zone = "europe-west8-b"
|
|
name = "cos-nginx-tls"
|
|
network_interfaces = [{
|
|
nat = true
|
|
network = "default"
|
|
subnetwork = "gce"
|
|
}]
|
|
metadata = {
|
|
user-data = module.on-prem.cloud_config
|
|
google-logging-enabled = true
|
|
}
|
|
boot_disk = {
|
|
initialize_params = {
|
|
image = "projects/cos-cloud/global/images/family/cos-stable"
|
|
type = "pd-ssd"
|
|
size = 10
|
|
}
|
|
}
|
|
tags = ["ssh"]
|
|
}
|
|
# tftest skip
|
|
```
|
|
<!-- BEGIN TFDOC -->
|
|
|
|
## Variables
|
|
|
|
| name | description | type | required | default |
|
|
|---|---|:---:|:---:|:---:|
|
|
| [vpn_config](variables.tf#L35) | VPN configuration, type must be one of 'dynamic' or 'static'. | <code title="object({ peer_ip = string shared_secret = string type = optional(string, "static") peer_ip2 = optional(string) shared_secret2 = optional(string) })">object({…})</code> | ✓ | |
|
|
| [config_variables](variables.tf#L17) | Additional variables used to render the cloud-config and CoreDNS templates. | <code>map(any)</code> | | <code>{}</code> |
|
|
| [coredns_config](variables.tf#L23) | CoreDNS configuration path, if null default will be used. | <code>string</code> | | <code>null</code> |
|
|
| [local_ip_cidr_range](variables.tf#L29) | IP CIDR range used for the Docker onprem network. | <code>string</code> | | <code>"192.168.192.0/24"</code> |
|
|
| [vpn_dynamic_config](variables.tf#L46) | BGP configuration for dynamic VPN, ignored if VPN type is 'static'. | <code title="object({ local_bgp_asn = number local_bgp_address = string peer_bgp_asn = number peer_bgp_address = string local_bgp_asn2 = number local_bgp_address2 = string peer_bgp_asn2 = number peer_bgp_address2 = string })">object({…})</code> | | <code title="{ local_bgp_asn = 64514 local_bgp_address = "169.254.1.2" peer_bgp_asn = 64513 peer_bgp_address = "169.254.1.1" local_bgp_asn2 = 64514 local_bgp_address2 = "169.254.2.2" peer_bgp_asn2 = 64520 peer_bgp_address2 = "169.254.2.1" }">{…}</code> |
|
|
| [vpn_static_ranges](variables.tf#L70) | Remote CIDR ranges for static VPN, ignored if VPN type is 'dynamic'. | <code>list(string)</code> | | <code>["10.0.0.0/8"]</code> |
|
|
|
|
## Outputs
|
|
|
|
| name | description | sensitive |
|
|
|---|---|:---:|
|
|
| [cloud_config](outputs.tf#L17) | Rendered cloud-config file to be passed as user-data instance metadata. | |
|
|
|
|
<!-- END TFDOC -->
|