string | ✓ | |
+| [projects_create](variables.tf#L26) | Parameters for the creation of the new project. | object({…}) | | null |
+| [region_configs](variables.tf#L35) | The primary and secondary region parameters. | object({…}) | | {…} |
+| [test_vms_behind_ilb](variables.tf#L59) | Whether there should be an ILB L4 in front of the test VMs in the spoke. | string | | "false" |
+| [vpc_landing_trusted_config](variables.tf#L77) | The configuration of the landing trusted VPC | object({…}) | | {…} |
+| [vpc_landing_untrusted_config](variables.tf#L65) | The configuration of the landing untrusted VPC | object({…}) | | {…} |
+| [vpc_spoke_config](variables.tf#L89) | The configuration of the spoke-01 VPC | object({…}) | | {…} |
+
+
diff --git a/blueprints/networking/glb-hybrid-neg-internal/data/nva-startup-script.tftpl b/blueprints/networking/glb-hybrid-neg-internal/data/nva-startup-script.tftpl
new file mode 100644
index 0000000000..f5ce03e4b6
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/data/nva-startup-script.tftpl
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+echo 'Enabling IP forwarding'
+sed '/net.ipv4.ip_forward=1/s/^#//g' -i /etc/sysctl.conf &&
+sysctl -p /etc/sysctl.conf &&
+/etc/init.d/procps restart
+
+echo 'Setting routes'
+ip route add ${spoke-r1-subnet} via ${gateway-trusted} dev ens5
+ip route add ${spoke-r2-subnet} via ${gateway-trusted} dev ens5
+
+echo 'Setting NAT masquerade, so that HCs can reach the spoke through the NVA using the trusted intf source IP'
+iptables \
+ -t nat \
+ -A POSTROUTING \
+ -s 130.211.0.0/22,35.191.0.0/16 \
+ -d ${spoke-r1-subnet} \
+ -p tcp \
+ --dport 80 \
+ -j MASQUERADE
+iptables \
+ -t nat \
+ -A POSTROUTING \
+ -s 130.211.0.0/22,35.191.0.0/16 \
+ -d ${spoke-r2-subnet} \
+ -p tcp \
+ --dport 80 \
+ -j MASQUERADE
diff --git a/blueprints/networking/glb-hybrid-neg-internal/diagram.png b/blueprints/networking/glb-hybrid-neg-internal/diagram.png
new file mode 100644
index 0000000000..bf82cd80a4
Binary files /dev/null and b/blueprints/networking/glb-hybrid-neg-internal/diagram.png differ
diff --git a/blueprints/networking/glb-hybrid-neg-internal/diagram.svg b/blueprints/networking/glb-hybrid-neg-internal/diagram.svg
new file mode 100644
index 0000000000..3c90fc424e
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/diagram.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/blueprints/networking/glb-hybrid-neg-internal/landing-hub.tf b/blueprints/networking/glb-hybrid-neg-internal/landing-hub.tf
new file mode 100644
index 0000000000..29ff2ca1ae
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/landing-hub.tf
@@ -0,0 +1,247 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+################################################################################
+# Base Hierarchy #
+################################################################################
+
+module "project_landing" {
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/project"
+ billing_account = (var.projects_create != null
+ ? var.projects_create.billing_account_id
+ : null
+ )
+ name = "landing"
+ parent = (var.projects_create != null
+ ? var.projects_create.parent
+ : null
+ )
+ prefix = var.prefix
+ project_create = var.projects_create != null
+
+ services = [
+ "compute.googleapis.com",
+ "networkmanagement.googleapis.com",
+ # Logging and Monitoring
+ "logging.googleapis.com",
+ "monitoring.googleapis.com"
+ ]
+}
+
+################################################################################
+# Networking #
+################################################################################
+
+module "vpc_landing_untrusted" {
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-vpc"
+ project_id = module.project_landing.project_id
+ name = "landing-untrusted"
+
+ routes = {
+ spoke1-r1 = {
+ dest_range = var.vpc_spoke_config.r1_cidr
+ next_hop_type = "ilb"
+ next_hop = module.nva_untrusted_ilbs["r1"].forwarding_rule_self_link
+ }
+ spoke1-r2 = {
+ dest_range = var.vpc_spoke_config.r2_cidr
+ next_hop_type = "ilb"
+ next_hop = module.nva_untrusted_ilbs["r2"].forwarding_rule_self_link
+ }
+ }
+
+ subnets = [
+ {
+ ip_cidr_range = var.vpc_landing_untrusted_config.r1_cidr
+ name = "untrusted-${var.region_configs.r1.region_name}"
+ region = var.region_configs.r1.region_name
+ },
+ {
+ ip_cidr_range = var.vpc_landing_untrusted_config.r2_cidr
+ name = "untrusted-${var.region_configs.r2.region_name}"
+ region = var.region_configs.r2.region_name
+ }
+ ]
+}
+
+module "vpc_landing_trusted" {
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-vpc"
+ project_id = module.project_landing.project_id
+ name = "landing-trusted"
+ subnets = [
+ {
+ ip_cidr_range = var.vpc_landing_trusted_config.r1_cidr
+ name = "trusted-${var.region_configs.r1.region_name}"
+ region = var.region_configs.r1.region_name
+ },
+ {
+ ip_cidr_range = var.vpc_landing_trusted_config.r2_cidr
+ name = "trusted-${var.region_configs.r2.region_name}"
+ region = var.region_configs.r2.region_name
+ }
+ ]
+}
+
+module "firewall_landing_untrusted" {
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-vpc-firewall"
+ project_id = module.project_landing.project_id
+ network = module.vpc_landing_untrusted.name
+
+ ingress_rules = {
+ allow-ssh-from-hcs = {
+ description = "Allow health checks to NVAs coming on port 22."
+ targets = ["ssh"]
+ source_ranges = [
+ "130.211.0.0/22",
+ "35.191.0.0/16"
+ ]
+ rules = [{ protocol = "tcp", ports = [22] }]
+ }
+ }
+}
+
+module "nats_landing" {
+ for_each = var.region_configs
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-cloudnat"
+ project_id = module.project_landing.project_id
+ region = each.value.region_name
+ name = "nat-${each.value.region_name}"
+ router_network = module.vpc_landing_untrusted.self_link
+}
+
+module "nva_instance_templates" {
+ for_each = var.region_configs
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/compute-vm"
+ project_id = module.project_landing.project_id
+ can_ip_forward = true
+ create_template = true
+ name = "nva-${each.value.region_name}"
+ service_account_create = true
+ zone = each.value.zone
+
+ metadata = {
+ startup-script = templatefile(
+ "${path.module}/data/nva-startup-script.tftpl",
+ {
+ gateway-trusted = cidrhost(module.vpc_landing_trusted.subnet_ips["${each.value.region_name}/trusted-${each.value.region_name}"], 1)
+ spoke-r1-subnet = module.vpc_spoke_01.subnet_ips["${var.region_configs.r1.region_name}/spoke-01-${var.region_configs.r1.region_name}"]
+ spoke-r2-subnet = module.vpc_spoke_01.subnet_ips["${var.region_configs.r2.region_name}/spoke-01-${var.region_configs.r2.region_name}"]
+ }
+ )
+ }
+
+ network_interfaces = [
+ {
+ network = module.vpc_landing_untrusted.self_link
+ subnetwork = module.vpc_landing_untrusted.subnet_self_links["${each.value.region_name}/untrusted-${each.value.region_name}"]
+ },
+ {
+ network = module.vpc_landing_trusted.self_link
+ subnetwork = module.vpc_landing_trusted.subnet_self_links["${each.value.region_name}/trusted-${each.value.region_name}"]
+ }
+ ]
+
+ tags = [
+ "http-server",
+ "https-server",
+ "ssh"
+ ]
+}
+
+module "nva_migs" {
+ for_each = var.region_configs
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/compute-mig"
+ project_id = module.project_landing.project_id
+ location = each.value.zone
+ name = "nva-${each.value.region_name}"
+ target_size = 1
+ instance_template = module.nva_instance_templates[each.key].template.self_link
+}
+
+module "nva_untrusted_ilbs" {
+ for_each = var.region_configs
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-ilb"
+ project_id = module.project_landing.project_id
+ region = each.value.region_name
+ name = "nva-ilb-${each.value.region_name}"
+ service_label = "nva-ilb-${each.value.region_name}"
+ vpc_config = {
+ network = module.vpc_landing_untrusted.self_link
+ subnetwork = module.vpc_landing_untrusted.subnet_self_links["${each.value.region_name}/untrusted-${each.value.region_name}"]
+ }
+ backends = [{
+ group = module.nva_migs[each.key].group_manager.instance_group
+ }]
+ health_check_config = {
+ tcp = {
+ port = 22
+ }
+ }
+}
+
+module "hybrid-glb" {
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-glb"
+ project_id = module.project_landing.project_id
+ name = "hybrid-glb"
+ backend_service_configs = {
+ default = {
+ backends = [
+ {
+ backend = "neg-r1"
+ balancing_mode = "RATE"
+ max_rate = { per_endpoint = 100 }
+ },
+ {
+ backend = "neg-r2"
+ balancing_mode = "RATE"
+ max_rate = { per_endpoint = 100 }
+ }
+ ]
+ }
+ }
+ neg_configs = {
+ neg-r1 = {
+ hybrid = {
+ network = module.vpc_landing_untrusted.name
+ zone = var.region_configs.r1.zone
+ endpoints = {
+ r1 = {
+ ip_address = (var.test_vms_behind_ilb
+ ? module.test_vm_ilbs["r1"].forwarding_rule_address
+ : module.test_vms["r1"].internal_ip
+ )
+ port = 80
+ }
+ }
+ }
+ }
+ neg-r2 = {
+ hybrid = {
+ network = module.vpc_landing_untrusted.name
+ zone = var.region_configs.r2.zone
+ endpoints = {
+ r2 = {
+ ip_address = (var.test_vms_behind_ilb
+ ? module.test_vm_ilbs["r2"].forwarding_rule_address
+ : module.test_vms["r2"].internal_ip
+ )
+ port = 80
+ }
+ }
+ }
+ }
+ }
+}
diff --git a/blueprints/networking/glb-hybrid-neg-internal/outputs.tf b/blueprints/networking/glb-hybrid-neg-internal/outputs.tf
new file mode 100644
index 0000000000..8190cc901e
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/outputs.tf
@@ -0,0 +1,15 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
diff --git a/blueprints/networking/glb-hybrid-neg-internal/spoke.tf b/blueprints/networking/glb-hybrid-neg-internal/spoke.tf
new file mode 100644
index 0000000000..d205c6332c
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/spoke.tf
@@ -0,0 +1,144 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "project_spoke_01" {
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/project"
+ billing_account = (var.projects_create != null
+ ? var.projects_create.billing_account_id
+ : null
+ )
+ name = "spoke-01"
+ parent = (var.projects_create != null
+ ? var.projects_create.parent
+ : null
+ )
+ prefix = var.prefix
+
+ services = [
+ "compute.googleapis.com",
+ "networkmanagement.googleapis.com",
+ # Logging and Monitoring
+ "logging.googleapis.com",
+ "monitoring.googleapis.com"
+ ]
+}
+
+module "vpc_spoke_01" {
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-vpc"
+ project_id = module.project_spoke_01.project_id
+ name = "spoke-01"
+ subnets = [
+ {
+ ip_cidr_range = var.vpc_spoke_config.r1_cidr
+ name = "spoke-01-${var.region_configs.r1.region_name}"
+ region = var.region_configs.r1.region_name
+ },
+ {
+ ip_cidr_range = var.vpc_spoke_config.r2_cidr
+ name = "spoke-01-${var.region_configs.r2.region_name}"
+ region = var.region_configs.r2.region_name
+ }
+ ]
+ peering_config = {
+ peer_vpc_self_link = module.vpc_landing_trusted.self_link
+ import_routes = true
+ }
+}
+
+module "firewall_spoke_01" {
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-vpc-firewall"
+ project_id = module.project_spoke_01.project_id
+ network = module.vpc_spoke_01.name
+
+ ingress_rules = {
+ allow-nva-hcs = {
+ description = "Allow health checks coming on port 80 and 443 from NVAs."
+ targets = ["http-server", "https-server"]
+ source_ranges = [
+ module.vpc_landing_trusted.subnet_ips["${var.region_configs.r1.region_name}/trusted-${var.region_configs.r1.region_name}"],
+ module.vpc_landing_trusted.subnet_ips["${var.region_configs.r2.region_name}/trusted-${var.region_configs.r2.region_name}"]
+ ]
+ rules = [{ protocol = "tcp", ports = [80, 443] }]
+ }
+ }
+}
+
+# NAT is used to install nginx for test purposed, even if NVAs are still not ready
+
+module "nats_spoke_01" {
+ for_each = var.region_configs
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-cloudnat"
+ name = "spoke-01-${each.value.region_name}"
+ project_id = module.project_spoke_01.project_id
+ region = each.value.region_name
+ router_network = module.vpc_spoke_01.name
+}
+
+module "test_vms" {
+ for_each = var.region_configs
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/compute-vm"
+ name = "spoke-01-${each.value.region_name}"
+ project_id = module.project_spoke_01.project_id
+ create_template = var.test_vms_behind_ilb
+ service_account_create = true
+ zone = each.value.zone
+
+ metadata = {
+ startup-script = "apt update && apt install -y nginx"
+ }
+
+ network_interfaces = [{
+ network = module.vpc_spoke_01.self_link
+ subnetwork = module.vpc_spoke_01.subnet_self_links["${each.value.region_name}/spoke-01-${each.value.region_name}"]
+ }]
+
+ tags = [
+ "http-server",
+ "https-server",
+ "ssh"
+ ]
+}
+
+module "test_vm_migs" {
+ for_each = var.test_vms_behind_ilb ? var.region_configs : {}
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/compute-mig"
+ project_id = module.project_spoke_01.project_id
+ location = each.value.zone
+ name = "test-vm-${each.value.region_name}"
+ target_size = 1
+ instance_template = module.test_vms[each.key].template.self_link
+}
+
+module "test_vm_ilbs" {
+ for_each = var.test_vms_behind_ilb ? var.region_configs : {}
+ source = "git::https://github.com/terraform-google-modules/cloud-foundation-fabric//modules/net-ilb"
+ project_id = module.project_spoke_01.project_id
+ region = each.value.region_name
+ name = "test-vm-ilb-${each.value.region_name}"
+ service_label = "test-vm-ilb-${each.value.region_name}"
+ vpc_config = {
+ network = module.vpc_spoke_01.self_link
+ subnetwork = module.vpc_spoke_01.subnet_self_links["${each.value.region_name}/spoke-01-${each.value.region_name}"]
+ }
+ backends = [{
+ group = module.test_vm_migs[each.key].group_manager.instance_group
+ }]
+ health_check_config = {
+ tcp = {
+ port = 80
+ }
+ }
+}
diff --git a/blueprints/networking/glb-hybrid-neg-internal/variables.tf b/blueprints/networking/glb-hybrid-neg-internal/variables.tf
new file mode 100644
index 0000000000..9795c31049
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/variables.tf
@@ -0,0 +1,99 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "prefix" {
+ description = "Prefix used for resource names."
+ type = string
+ validation {
+ condition = var.prefix != ""
+ error_message = "Prefix cannot be empty."
+ }
+}
+
+variable "projects_create" {
+ description = "Parameters for the creation of the new project."
+ type = object({
+ billing_account_id = string
+ parent = string
+ })
+ default = null
+}
+
+variable "region_configs" {
+ description = "The primary and secondary region parameters."
+ type = object({
+ r1 = object({
+ region_name = string
+ zone = string
+ })
+ r2 = object({
+ region_name = string
+ zone = string
+ })
+ })
+ default = {
+ r1 = {
+ region_name = "europe-west1"
+ zone = "europe-west1-b"
+ }
+ r2 = {
+ region_name = "europe-west2"
+ zone = "europe-west2-b"
+ }
+ }
+}
+
+variable "test_vms_behind_ilb" {
+ description = "Whether there should be an ILB L4 in front of the test VMs in the spoke."
+ type = string
+ default = false
+}
+
+variable "vpc_landing_untrusted_config" {
+ description = "The configuration of the landing untrusted VPC"
+ type = object({
+ r1_cidr = string
+ r2_cidr = string
+ })
+ default = {
+ r1_cidr = "192.168.1.0/24",
+ r2_cidr = "192.168.2.0/24"
+ }
+}
+
+variable "vpc_landing_trusted_config" {
+ description = "The configuration of the landing trusted VPC"
+ type = object({
+ r1_cidr = string
+ r2_cidr = string
+ })
+ default = {
+ r1_cidr = "192.168.11.0/24",
+ r2_cidr = "192.168.22.0/24"
+ }
+}
+
+variable "vpc_spoke_config" {
+ description = "The configuration of the spoke-01 VPC"
+ type = object({
+ r1_cidr = string
+ r2_cidr = string
+ })
+ default = {
+ r1_cidr = "192.168.101.0/24",
+ r2_cidr = "192.168.102.0/24"
+ }
+}