Merge pull request #1365 from merit/master

feat(net-cloudnat): add toggle for independent endpoint mapping and dynamic port allocation
GoogleCloudPlatform · May 12, 2023 · b153474 · b153474
2 parents 7d9f522 + 20b8002
commit b153474
Show file tree

Hide file tree

Showing 5 changed files with 58 additions and 31 deletions.
diff --git a/blueprints/networking/filtering-proxy-psc/main.tf b/blueprints/networking/filtering-proxy-psc/main.tf
@@ -79,8 +79,12 @@ module "nat" {
   name                  = "default"
   router_network        = module.vpc.name
   config_source_subnets = "LIST_OF_SUBNETWORKS"
-  # 64512/11 = 5864 . 11 is the number of usable IPs in the proxy subnet
-  config_min_ports_per_vm = 5864
+  config_port_allocation = {
+    enable_endpoint_independent_mapping = false
+    enable_dynamic_port_allocation      = true
+    # 64512/11 = 5864 . 11 is the number of usable IPs in the proxy subnet
+    min_ports_per_vm = 5864
+  }
   subnetworks = [
     {
       self_link            = module.vpc.subnet_self_links["${var.region}/proxy"]

diff --git a/blueprints/networking/filtering-proxy/main.tf b/blueprints/networking/filtering-proxy/main.tf
@@ -98,7 +98,11 @@ module "nat" {
   router_network        = module.vpc.name
   config_source_subnets = "LIST_OF_SUBNETWORKS"
   # 64512/11 = 5864 . 11 is the number of usable IPs in the proxy subnet
-  config_min_ports_per_vm = 5864
+  config_port_allocation = {
+    enable_dynamic_port_allocation      = true
+    enable_endpoint_independent_mapping = false
+    min_ports_per_vm                    = 5864
+  }
   subnetworks = [
     {
       self_link            = module.vpc.subnet_self_links["${var.region}/proxy"]

diff --git a/modules/net-cloudnat/README.md b/modules/net-cloudnat/README.md
@@ -20,19 +20,19 @@ module "nat" {
 
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [name](variables.tf#L57) | Name of the Cloud NAT resource. | <code>string</code> | ✓ |  |
-| [project_id](variables.tf#L62) | Project where resources will be created. | <code>string</code> | ✓ |  |
-| [region](variables.tf#L67) | Region where resources will be created. | <code>string</code> | ✓ |  |
+| [config_port_allocation](variables.tf#L23) | Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'. | <code title="object&#40;&#123;&#10;  enable_endpoint_independent_mapping &#61; optional&#40;bool, true&#41;&#10;  enable_dynamic_port_allocation      &#61; optional&#40;bool, false&#41;&#10;  min_ports_per_vm                    &#61; optional&#40;number, 64&#41;&#10;  max_ports_per_vm                    &#61; optional&#40;number, 65536&#41;&#10;&#125;&#41;&#10;&#10;&#10;default &#61; &#123;&#10;  enable_endpoint_independent_mapping &#61; true&#10;  enable_dynamic_port_allocation      &#61; false&#10;  min_ports_per_vm                    &#61; 64&#10;  max_ports_per_vm                    &#61; 65536&#10;&#125;">object&#40;&#123;&#8230;&#125;</code> | ✓ |  |
+| [name](variables.tf#L73) | Name of the Cloud NAT resource. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L78) | Project where resources will be created. | <code>string</code> | ✓ |  |
+| [region](variables.tf#L83) | Region where resources will be created. | <code>string</code> | ✓ |  |
 | [addresses](variables.tf#L17) | Optional list of external address self links. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
-| [config_min_ports_per_vm](variables.tf#L23) | Minimum number of ports allocated to a VM from this NAT config. | <code>number</code> |  | <code>64</code> |
-| [config_source_subnets](variables.tf#L29) | Subnetwork configuration (ALL_SUBNETWORKS_ALL_IP_RANGES, ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, LIST_OF_SUBNETWORKS). | <code>string</code> |  | <code>&#34;ALL_SUBNETWORKS_ALL_IP_RANGES&#34;</code> |
-| [config_timeouts](variables.tf#L35) | Timeout configurations. | <code title="object&#40;&#123;&#10;  icmp            &#61; number&#10;  tcp_established &#61; number&#10;  tcp_transitory  &#61; number&#10;  udp             &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  icmp            &#61; 30&#10;  tcp_established &#61; 1200&#10;  tcp_transitory  &#61; 30&#10;  udp             &#61; 30&#10;&#125;">&#123;&#8230;&#125;</code> |
-| [logging_filter](variables.tf#L51) | Enables logging if not null, value is one of 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', 'ALL'. | <code>string</code> |  | <code>null</code> |
-| [router_asn](variables.tf#L72) | Router ASN used for auto-created router. | <code>number</code> |  | <code>64514</code> |
-| [router_create](variables.tf#L78) | Create router. | <code>bool</code> |  | <code>true</code> |
-| [router_name](variables.tf#L84) | Router name, leave blank if router will be created to use auto generated name. | <code>string</code> |  | <code>null</code> |
-| [router_network](variables.tf#L90) | Name of the VPC used for auto-created router. | <code>string</code> |  | <code>null</code> |
-| [subnetworks](variables.tf#L96) | Subnetworks to NAT, only used when config_source_subnets equals LIST_OF_SUBNETWORKS. | <code title="list&#40;object&#40;&#123;&#10;  self_link            &#61; string,&#10;  config_source_ranges &#61; list&#40;string&#41;&#10;  secondary_ranges     &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#91;&#93;</code> |
+| [config_source_subnets](variables.tf#L45) | Subnetwork configuration (ALL_SUBNETWORKS_ALL_IP_RANGES, ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES, LIST_OF_SUBNETWORKS). | <code>string</code> |  | <code>&#34;ALL_SUBNETWORKS_ALL_IP_RANGES&#34;</code> |
+| [config_timeouts](variables.tf#L51) | Timeout configurations. | <code title="object&#40;&#123;&#10;  icmp            &#61; number&#10;  tcp_established &#61; number&#10;  tcp_transitory  &#61; number&#10;  udp             &#61; number&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  icmp            &#61; 30&#10;  tcp_established &#61; 1200&#10;  tcp_transitory  &#61; 30&#10;  udp             &#61; 30&#10;&#125;">&#123;&#8230;&#125;</code> |
+| [logging_filter](variables.tf#L67) | Enables logging if not null, value is one of 'ERRORS_ONLY', 'TRANSLATIONS_ONLY', 'ALL'. | <code>string</code> |  | <code>null</code> |
+| [router_asn](variables.tf#L88) | Router ASN used for auto-created router. | <code>number</code> |  | <code>64514</code> |
+| [router_create](variables.tf#L94) | Create router. | <code>bool</code> |  | <code>true</code> |
+| [router_name](variables.tf#L100) | Router name, leave blank if router will be created to use auto generated name. | <code>string</code> |  | <code>null</code> |
+| [router_network](variables.tf#L106) | Name of the VPC used for auto-created router. | <code>string</code> |  | <code>null</code> |
+| [subnetworks](variables.tf#L112) | Subnetworks to NAT, only used when config_source_subnets equals LIST_OF_SUBNETWORKS. | <code title="list&#40;object&#40;&#123;&#10;  self_link            &#61; string,&#10;  config_source_ranges &#61; list&#40;string&#41;&#10;  secondary_ranges     &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">list&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#91;&#93;</code> |
 
 ## Outputs
 

diff --git a/modules/net-cloudnat/main.tf b/modules/net-cloudnat/main.tf
@@ -34,18 +34,21 @@ resource "google_compute_router" "router" {
 }
 
 resource "google_compute_router_nat" "nat" {
-  project                            = var.project_id
-  region                             = var.region
-  name                               = var.name
-  router                             = local.router_name
-  nat_ips                            = var.addresses
-  nat_ip_allocate_option             = length(var.addresses) > 0 ? "MANUAL_ONLY" : "AUTO_ONLY"
-  source_subnetwork_ip_ranges_to_nat = var.config_source_subnets
-  min_ports_per_vm                   = var.config_min_ports_per_vm
-  icmp_idle_timeout_sec              = var.config_timeouts.icmp
-  udp_idle_timeout_sec               = var.config_timeouts.udp
-  tcp_established_idle_timeout_sec   = var.config_timeouts.tcp_established
-  tcp_transitory_idle_timeout_sec    = var.config_timeouts.tcp_transitory
+  project                             = var.project_id
+  region                              = var.region
+  name                                = var.name
+  router                              = local.router_name
+  nat_ips                             = var.addresses
+  nat_ip_allocate_option              = length(var.addresses) > 0 ? "MANUAL_ONLY" : "AUTO_ONLY"
+  source_subnetwork_ip_ranges_to_nat  = var.config_source_subnets
+  icmp_idle_timeout_sec               = var.config_timeouts.icmp
+  udp_idle_timeout_sec                = var.config_timeouts.udp
+  tcp_established_idle_timeout_sec    = var.config_timeouts.tcp_established
+  tcp_transitory_idle_timeout_sec     = var.config_timeouts.tcp_transitory
+  enable_endpoint_independent_mapping = var.config_port_allocation.enable_endpoint_independent_mapping
+  enable_dynamic_port_allocation      = var.config_port_allocation.enable_dynamic_port_allocation
+  min_ports_per_vm                    = var.config_port_allocation.min_ports_per_vm
+  max_ports_per_vm                    = var.config_port_allocation.max_ports_per_vm
 
   log_config {
     enable = var.logging_filter == null ? false : true

diff --git a/modules/net-cloudnat/variables.tf b/modules/net-cloudnat/variables.tf
@@ -20,10 +20,26 @@ variable "addresses" {
   default     = []
 }
 
-variable "config_min_ports_per_vm" {
-  description = "Minimum number of ports allocated to a VM from this NAT config."
-  type        = number
-  default     = 64
+variable "config_port_allocation" {
+  description = "Configuration for how to assign ports to virtual machines. min_ports_per_vm and max_ports_per_vm have no effect unless enable_dynamic_port_allocation is set to 'true'."
+  type = object({
+    enable_endpoint_independent_mapping = optional(bool, true)
+    enable_dynamic_port_allocation      = optional(bool, false)
+    min_ports_per_vm                    = optional(number, 64)
+    max_ports_per_vm                    = optional(number, 65536)
+  })
+
+  default = {
+    enable_endpoint_independent_mapping = true
+    enable_dynamic_port_allocation      = false
+    min_ports_per_vm                    = 64
+    max_ports_per_vm                    = 65536
+  }
+
+  validation {
+    condition     = var.config_port_allocation.enable_dynamic_port_allocation ? var.config_port_allocation.enable_endpoint_independent_mapping == false : true
+    error_message = "You must set enable_endpoint_independent_mapping to false to set enable_dynamic_port_allocation to true."
+  }
 }
 
 variable "config_source_subnets" {