Skip to content

Commit

Permalink
feat: Add support to proxy-only subnetworks and new IP CIDR allocation (
Browse files Browse the repository at this point in the history 
#1040)

Co-authored-by: Daniel Andrade <[email protected]>
  • Loading branch information
@Samir-Cit @daniel-cit
Samir-Cit and daniel-cit authored Dec 21, 2023
1 parent f16e805 commit 79b217e
Show file tree
Hide file tree
Showing 18 changed files with 327 additions and 101 deletions.
2 changes: 1 addition & 1 deletion 0-bootstrap/terraform.example.tfvars
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ default_region = "us-central1"
# gcp_audit_viewer = "[email protected]"
# }
# }
#



/* ----------------------------------------
Expand Down
35 changes: 22 additions & 13 deletions 3-networks-dual-svpc/envs/development/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,40 +22,48 @@ locals {
/*
* Base network ranges
*/
base_private_service_cidr = "10.16.64.0/21"
base_private_service_cidr = "10.16.8.0/21"
base_subnet_primary_ranges = {
(local.default_region1) = "10.0.64.0/21"
(local.default_region2) = "10.1.64.0/21"
(local.default_region1) = "10.0.64.0/18"
(local.default_region2) = "10.1.64.0/18"
}
base_subnet_proxy_ranges = {
(local.default_region1) = "10.18.2.0/23"
(local.default_region2) = "10.19.2.0/23"
}
base_subnet_secondary_ranges = {
(local.default_region1) = [
{
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-pod"
ip_cidr_range = "100.64.64.0/21"
ip_cidr_range = "100.64.64.0/18"
},
{
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-svc"
ip_cidr_range = "100.64.72.0/21"
ip_cidr_range = "100.65.64.0/18"
}
]
}
/*
* Restricted network ranges
*/
restricted_private_service_cidr = "10.24.64.0/21"
restricted_private_service_cidr = "10.16.40.0/21"
restricted_subnet_primary_ranges = {
(local.default_region1) = "10.8.64.0/21"
(local.default_region2) = "10.9.64.0/21"
(local.default_region1) = "10.8.64.0/18"
(local.default_region2) = "10.9.64.0/18"
}
restricted_subnet_proxy_ranges = {
(local.default_region1) = "10.26.2.0/23"
(local.default_region2) = "10.27.2.0/23"
}
restricted_subnet_secondary_ranges = {
(local.default_region1) = [
{
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-pod"
ip_cidr_range = "100.72.64.0/21"
ip_cidr_range = "100.72.64.0/18"
},
{
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-svc"
ip_cidr_range = "100.72.72.0/21"
ip_cidr_range = "100.73.64.0/18"
}
]
}
Expand All @@ -76,13 +84,14 @@ module "base_env" {
enable_partner_interconnect = false
base_private_service_cidr = local.base_private_service_cidr
base_subnet_primary_ranges = local.base_subnet_primary_ranges
base_subnet_proxy_ranges = local.base_subnet_proxy_ranges
base_subnet_secondary_ranges = local.base_subnet_secondary_ranges
base_private_service_connect_ip = "10.2.64.5"
base_private_service_connect_ip = "10.17.0.2"
restricted_private_service_cidr = local.restricted_private_service_cidr
restricted_subnet_primary_ranges = local.restricted_subnet_primary_ranges
restricted_subnet_proxy_ranges = local.restricted_subnet_proxy_ranges
restricted_subnet_secondary_ranges = local.restricted_subnet_secondary_ranges
restricted_private_service_connect_ip = "10.10.64.5"
restricted_private_service_connect_ip = "10.17.0.6"
remote_state_bucket = var.remote_state_bucket
tfc_org_name = var.tfc_org_name

}
34 changes: 22 additions & 12 deletions 3-networks-dual-svpc/envs/non-production/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,40 +22,48 @@ locals {
/*
* Base network ranges
*/
base_private_service_cidr = "10.16.128.0/21"
base_private_service_cidr = "10.16.16.0/21"
base_subnet_primary_ranges = {
(local.default_region1) = "10.0.128.0/21"
(local.default_region2) = "10.1.128.0/21"
(local.default_region1) = "10.0.128.0/18"
(local.default_region2) = "10.1.128.0/18"
}
base_subnet_proxy_ranges = {
(local.default_region1) = "10.18.4.0/23"
(local.default_region2) = "10.19.4.0/23"
}
base_subnet_secondary_ranges = {
(local.default_region1) = [
{
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-pod"
ip_cidr_range = "100.64.128.0/21"
ip_cidr_range = "100.64.128.0/18"
},
{
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-svc"
ip_cidr_range = "100.64.136.0/21"
ip_cidr_range = "100.65.128.0/18"
}
]
}
/*
* Restricted network ranges
*/
restricted_private_service_cidr = "10.24.128.0/21"
restricted_private_service_cidr = "10.16.48.0/21"
restricted_subnet_primary_ranges = {
(local.default_region1) = "10.8.128.0/21"
(local.default_region2) = "10.9.128.0/21"
(local.default_region1) = "10.8.128.0/18"
(local.default_region2) = "10.9.128.0/18"
}
restricted_subnet_proxy_ranges = {
(local.default_region1) = "10.26.4.0/23"
(local.default_region2) = "10.27.4.0/23"
}
restricted_subnet_secondary_ranges = {
(local.default_region1) = [
{
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-pod"
ip_cidr_range = "100.72.128.0/21"
ip_cidr_range = "100.72.128.0/18"
},
{
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-svc"
ip_cidr_range = "100.72.136.0/21"
ip_cidr_range = "100.73.128.0/18"
}
]
}
Expand All @@ -76,12 +84,14 @@ module "base_env" {
enable_partner_interconnect = false
base_private_service_cidr = local.base_private_service_cidr
base_subnet_primary_ranges = local.base_subnet_primary_ranges
base_subnet_proxy_ranges = local.base_subnet_proxy_ranges
base_subnet_secondary_ranges = local.base_subnet_secondary_ranges
base_private_service_connect_ip = "10.2.128.5"
base_private_service_connect_ip = "10.17.0.3"
restricted_private_service_cidr = local.restricted_private_service_cidr
restricted_subnet_proxy_ranges = local.restricted_subnet_proxy_ranges
restricted_subnet_primary_ranges = local.restricted_subnet_primary_ranges
restricted_subnet_secondary_ranges = local.restricted_subnet_secondary_ranges
restricted_private_service_connect_ip = "10.10.128.5"
restricted_private_service_connect_ip = "10.17.0.7"
remote_state_bucket = var.remote_state_bucket
tfc_org_name = var.tfc_org_name
}
34 changes: 22 additions & 12 deletions 3-networks-dual-svpc/envs/production/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,40 +22,48 @@ locals {
/*
* Base network ranges
*/
base_private_service_cidr = "10.16.192.0/21"
base_private_service_cidr = "10.16.24.0/21"
base_subnet_primary_ranges = {
(local.default_region1) = "10.0.192.0/21"
(local.default_region2) = "10.1.192.0/21"
(local.default_region1) = "10.0.192.0/18"
(local.default_region2) = "10.1.192.0/18"
}
base_subnet_proxy_ranges = {
(local.default_region1) = "10.18.6.0/23"
(local.default_region2) = "10.19.6.0/23"
}
base_subnet_secondary_ranges = {
(local.default_region1) = [
{
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-pod"
ip_cidr_range = "100.64.192.0/21"
ip_cidr_range = "100.64.192.0/18"
},
{
range_name = "rn-${local.environment_code}-shared-base-${local.default_region1}-gke-svc"
ip_cidr_range = "100.64.200.0/21"
ip_cidr_range = "100.65.192.0/18"
}
]
}
/*
* Restricted network ranges
*/
restricted_private_service_cidr = "10.24.192.0/21"
restricted_private_service_cidr = "10.16.56.0/21"
restricted_subnet_primary_ranges = {
(local.default_region1) = "10.8.192.0/21"
(local.default_region2) = "10.9.192.0/21"
(local.default_region1) = "10.8.192.0/18"
(local.default_region2) = "10.9.192.0/18"
}
restricted_subnet_proxy_ranges = {
(local.default_region1) = "10.26.6.0/23"
(local.default_region2) = "10.27.6.0/23"
}
restricted_subnet_secondary_ranges = {
(local.default_region1) = [
{
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-pod"
ip_cidr_range = "100.72.192.0/21"
ip_cidr_range = "100.72.192.0/18"
},
{
range_name = "rn-${local.environment_code}-shared-restricted-${local.default_region1}-gke-svc"
ip_cidr_range = "100.72.200.0/21"
ip_cidr_range = "100.73.192.0/18"
}
]
}
Expand All @@ -76,12 +84,14 @@ module "base_env" {
enable_partner_interconnect = false
base_private_service_cidr = local.base_private_service_cidr
base_subnet_primary_ranges = local.base_subnet_primary_ranges
base_subnet_proxy_ranges = local.base_subnet_proxy_ranges
base_subnet_secondary_ranges = local.base_subnet_secondary_ranges
base_private_service_connect_ip = "10.2.192.5"
base_private_service_connect_ip = "10.17.0.4"
restricted_private_service_cidr = local.restricted_private_service_cidr
restricted_subnet_primary_ranges = local.restricted_subnet_primary_ranges
restricted_subnet_proxy_ranges = local.restricted_subnet_proxy_ranges
restricted_subnet_secondary_ranges = local.restricted_subnet_secondary_ranges
restricted_private_service_connect_ip = "10.10.192.5"
restricted_private_service_connect_ip = "10.17.0.8"
remote_state_bucket = var.remote_state_bucket
tfc_org_name = var.tfc_org_name
}
2 changes: 2 additions & 0 deletions 3-networks-dual-svpc/modules/base_env/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
| base\_private\_service\_cidr | CIDR range for private service networking. Used for Cloud SQL and other managed services in the Base Shared Vpc. | `string` | n/a | yes |
| base\_private\_service\_connect\_ip | The base subnet internal IP to be used as the private service connect endpoint in the Base Shared VPC | `string` | n/a | yes |
| base\_subnet\_primary\_ranges | The base subnet primary IPTs ranges to the Base Shared Vpc. | `map(string)` | n/a | yes |
| base\_subnet\_proxy\_ranges | The base proxy-only subnet primary IPTs ranges to the Base Shared Vpc. | `map(string)` | n/a | yes |
| base\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Base Shared Vpc. | `map(list(map(string)))` | n/a | yes |
| base\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br> flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br> metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br> metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br> filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br> aggregation_interval = optional(string, "INTERVAL_5_SEC")<br> flow_sampling = optional(string, "0.5")<br> metadata = optional(string, "INCLUDE_ALL_METADATA")<br> metadata_fields = optional(list(string), [])<br> filter_expr = optional(string, "true")<br> })</pre> | `{}` | no |
| custom\_restricted\_services | List of custom services to be protected by the VPC-SC perimeter. If empty, all supported services (https://cloud.google.com/vpc-service-controls/docs/supported-products) will be protected. | `list(string)` | `[]` | no |
Expand All @@ -24,6 +25,7 @@
| restricted\_private\_service\_cidr | CIDR range for private service networking. Used for Cloud SQL and other managed services in the Restricted Shared Vpc. | `string` | n/a | yes |
| restricted\_private\_service\_connect\_ip | The base subnet internal IP to be used as the private service connect endpoint in the Restricted Shared VPC | `string` | n/a | yes |
| restricted\_subnet\_primary\_ranges | The base subnet primary IPTs ranges to the Restricted Shared Vpc. | `map(string)` | n/a | yes |
| restricted\_subnet\_proxy\_ranges | The base proxy-only subnet primary IPTs ranges to the Restricted Shared Vpc. | `map(string)` | n/a | yes |
| restricted\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Restricted Shared Vpc | `map(list(map(string)))` | n/a | yes |
| restricted\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br> flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br> metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br> metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br> filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br> aggregation_interval = optional(string, "INTERVAL_5_SEC")<br> flow_sampling = optional(string, "0.5")<br> metadata = optional(string, "INCLUDE_ALL_METADATA")<br> metadata_fields = optional(list(string), [])<br> filter_expr = optional(string, "true")<br> })</pre> | `{}` | no |
| tfc\_org\_name | Name of the TFC organization | `string` | n/a | yes |
Expand Down
37 changes: 37 additions & 0 deletions 3-networks-dual-svpc/modules/base_env/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -218,6 +218,24 @@ module "restricted_shared_vpc" {
subnet_flow_logs_metadata_fields = var.restricted_vpc_flow_logs.metadata_fields
subnet_flow_logs_filter = var.restricted_vpc_flow_logs.filter_expr
description = "Second ${var.env} subnet example."
},
{
subnet_name = "sb-${var.environment_code}-shared-restricted-${var.default_region1}-proxy"
subnet_ip = var.restricted_subnet_proxy_ranges[var.default_region1]
subnet_region = var.default_region1
subnet_flow_logs = false
description = "First ${var.env} proxy-only subnet example."
role = "ACTIVE"
purpose = "REGIONAL_MANAGED_PROXY"
},
{
subnet_name = "sb-${var.environment_code}-shared-restricted-${var.default_region2}-proxy"
subnet_ip = var.restricted_subnet_proxy_ranges[var.default_region2]
subnet_region = var.default_region2
subnet_flow_logs = false
description = "Second ${var.env} proxy-only subnet example."
role = "ACTIVE"
purpose = "REGIONAL_MANAGED_PROXY"
}
]
secondary_ranges = {
Expand Down Expand Up @@ -270,8 +288,27 @@ module "base_shared_vpc" {
subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
subnet_flow_logs_filter = var.base_vpc_flow_logs.filter_expr
description = "Second ${var.env} subnet example."
},
{
subnet_name = "sb-${var.environment_code}-shared-base-${var.default_region1}-proxy"
subnet_ip = var.base_subnet_proxy_ranges[var.default_region1]
subnet_region = var.default_region1
subnet_flow_logs = false
description = "First ${var.env} proxy-only subnet example."
role = "ACTIVE"
purpose = "REGIONAL_MANAGED_PROXY"
},
{
subnet_name = "sb-${var.environment_code}-shared-base-${var.default_region2}-proxy"
subnet_ip = var.base_subnet_proxy_ranges[var.default_region2]
subnet_region = var.default_region2
subnet_flow_logs = false
description = "Second ${var.env} proxy-only subnet example."
role = "ACTIVE"
purpose = "REGIONAL_MANAGED_PROXY"
}
]

secondary_ranges = {
"sb-${var.environment_code}-shared-base-${var.default_region1}" = var.base_subnet_secondary_ranges[var.default_region1]
}
Expand Down
10 changes: 10 additions & 0 deletions 3-networks-dual-svpc/modules/base_env/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,11 @@ variable "base_subnet_primary_ranges" {
description = "The base subnet primary IPTs ranges to the Base Shared Vpc."
}

variable "base_subnet_proxy_ranges" {
type = map(string)
description = "The base proxy-only subnet primary IPTs ranges to the Base Shared Vpc."
}

variable "base_subnet_secondary_ranges" {
type = map(list(map(string)))
description = "The base subnet secondary IPTs ranges to the Base Shared Vpc."
Expand Down Expand Up @@ -109,6 +114,11 @@ variable "restricted_subnet_primary_ranges" {
description = "The base subnet primary IPTs ranges to the Restricted Shared Vpc."
}

variable "restricted_subnet_proxy_ranges" {
type = map(string)
description = "The base proxy-only subnet primary IPTs ranges to the Restricted Shared Vpc."
}

variable "restricted_subnet_secondary_ranges" {
type = map(list(map(string)))
description = "The base subnet secondary IPTs ranges to the Restricted Shared Vpc"
Expand Down
Loading

0 comments on commit 79b217e

Please sign in to comment.