diff --git a/blueprints/networking/shared-vpc-gke/main.tf b/blueprints/networking/shared-vpc-gke/main.tf index 302ce73547..88f484630f 100644 --- a/blueprints/networking/shared-vpc-gke/main.tf +++ b/blueprints/networking/shared-vpc-gke/main.tf @@ -1,4 +1,4 @@ -# Copyright 2022 Google LLC +# Copyright 2023 Google LLC # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -102,6 +102,11 @@ module "vpc-shared" { ip_cidr_range = var.ip_ranges.gce name = "gce" region = var.region + iam = { + "roles/compute.networkUser" = concat(var.owners_gce, [ + "serviceAccount:${module.project-svc-gce.service_accounts.cloud_services}", + ]) + } }, { ip_cidr_range = var.ip_ranges.gke @@ -111,24 +116,17 @@ module "vpc-shared" { pods = var.ip_secondary_ranges.gke-pods services = var.ip_secondary_ranges.gke-services } + iam = { + "roles/compute.networkUser" = concat(var.owners_gke, [ + "serviceAccount:${module.project-svc-gke.service_accounts.cloud_services}", + "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}", + ]) + "roles/compute.securityAdmin" = [ + "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}", + ] + } } ] - subnet_iam = { - "${var.region}/gce" = { - "roles/compute.networkUser" = concat(var.owners_gce, [ - "serviceAccount:${module.project-svc-gce.service_accounts.cloud_services}", - ]) - } - "${var.region}/gke" = { - "roles/compute.networkUser" = concat(var.owners_gke, [ - "serviceAccount:${module.project-svc-gke.service_accounts.cloud_services}", - "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}", - ]) - "roles/compute.securityAdmin" = [ - "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}", - ] - } - } } module "vpc-shared-firewall" { diff --git a/fast/stages/2-networking-a-peering/landing.tf b/fast/stages/2-networking-a-peering/landing.tf index 013c6e86a6..e2309f1bba 100644 --- a/fast/stages/2-networking-a-peering/landing.tf +++ b/fast/stages/2-networking-a-peering/landing.tf @@ -55,7 +55,9 @@ module "landing-vpc" { private = true restricted = true } - data_folder = "${var.factories_config.data_dir}/subnets/landing" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing" + } } module "landing-firewall" { diff --git a/fast/stages/2-networking-a-peering/spoke-dev.tf b/fast/stages/2-networking-a-peering/spoke-dev.tf index 838ba6a4f6..bfff002b41 100644 --- a/fast/stages/2-networking-a-peering/spoke-dev.tf +++ b/fast/stages/2-networking-a-peering/spoke-dev.tf @@ -46,12 +46,14 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" - psa_config = try(var.psa_ranges.dev, null) + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } + psa_config = try(var.psa_ranges.dev, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-a-peering/spoke-prod.tf b/fast/stages/2-networking-a-peering/spoke-prod.tf index 7569647ef1..505005bdb1 100644 --- a/fast/stages/2-networking-a-peering/spoke-prod.tf +++ b/fast/stages/2-networking-a-peering/spoke-prod.tf @@ -45,12 +45,14 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" - psa_config = try(var.psa_ranges.prod, null) + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } + psa_config = try(var.psa_ranges.prod, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-b-vpn/landing.tf b/fast/stages/2-networking-b-vpn/landing.tf index 013c6e86a6..e2309f1bba 100644 --- a/fast/stages/2-networking-b-vpn/landing.tf +++ b/fast/stages/2-networking-b-vpn/landing.tf @@ -55,7 +55,9 @@ module "landing-vpc" { private = true restricted = true } - data_folder = "${var.factories_config.data_dir}/subnets/landing" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing" + } } module "landing-firewall" { diff --git a/fast/stages/2-networking-b-vpn/spoke-dev.tf b/fast/stages/2-networking-b-vpn/spoke-dev.tf index 838ba6a4f6..bfff002b41 100644 --- a/fast/stages/2-networking-b-vpn/spoke-dev.tf +++ b/fast/stages/2-networking-b-vpn/spoke-dev.tf @@ -46,12 +46,14 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" - psa_config = try(var.psa_ranges.dev, null) + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } + psa_config = try(var.psa_ranges.dev, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-b-vpn/spoke-prod.tf b/fast/stages/2-networking-b-vpn/spoke-prod.tf index 7569647ef1..505005bdb1 100644 --- a/fast/stages/2-networking-b-vpn/spoke-prod.tf +++ b/fast/stages/2-networking-b-vpn/spoke-prod.tf @@ -45,12 +45,14 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" - psa_config = try(var.psa_ranges.prod, null) + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } + psa_config = try(var.psa_ranges.prod, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-c-nva/landing.tf b/fast/stages/2-networking-c-nva/landing.tf index e7329a4358..fb19c31b9e 100644 --- a/fast/stages/2-networking-c-nva/landing.tf +++ b/fast/stages/2-networking-c-nva/landing.tf @@ -54,7 +54,9 @@ module "landing-untrusted-vpc" { logging = false } create_googleapis_routes = null - data_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted" + } } module "landing-untrusted-firewall" { @@ -110,7 +112,9 @@ module "landing-trusted-vpc" { name = "prod-trusted-landing-0" delete_default_routes_on_create = true mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/landing-trusted" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing-trusted" + } dns_policy = { inbound = true } diff --git a/fast/stages/2-networking-c-nva/spoke-dev.tf b/fast/stages/2-networking-c-nva/spoke-dev.tf index a90d25aa3e..0f6e8b8f97 100644 --- a/fast/stages/2-networking-c-nva/spoke-dev.tf +++ b/fast/stages/2-networking-c-nva/spoke-dev.tf @@ -45,11 +45,13 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } delete_default_routes_on_create = true psa_config = try(var.psa_ranges.dev, null) # Set explicit routes for googleapis; send everything else to NVAs diff --git a/fast/stages/2-networking-c-nva/spoke-prod.tf b/fast/stages/2-networking-c-nva/spoke-prod.tf index 8dd5af441c..9895950933 100644 --- a/fast/stages/2-networking-c-nva/spoke-prod.tf +++ b/fast/stages/2-networking-c-nva/spoke-prod.tf @@ -44,11 +44,13 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } delete_default_routes_on_create = true psa_config = try(var.psa_ranges.prod, null) # Set explicit routes for googleapis; send everything else to NVAs diff --git a/fast/stages/2-networking-d-separate-envs/spoke-dev.tf b/fast/stages/2-networking-d-separate-envs/spoke-dev.tf index b5b485bea8..61562f4483 100644 --- a/fast/stages/2-networking-d-separate-envs/spoke-dev.tf +++ b/fast/stages/2-networking-d-separate-envs/spoke-dev.tf @@ -46,12 +46,14 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" - psa_config = try(var.psa_ranges.dev, null) + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } + psa_config = try(var.psa_ranges.dev, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-d-separate-envs/spoke-prod.tf b/fast/stages/2-networking-d-separate-envs/spoke-prod.tf index bf43728d04..7b42f54682 100644 --- a/fast/stages/2-networking-d-separate-envs/spoke-prod.tf +++ b/fast/stages/2-networking-d-separate-envs/spoke-prod.tf @@ -45,12 +45,14 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" - psa_config = try(var.psa_ranges.prod, null) + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } + psa_config = try(var.psa_ranges.prod, null) # set explicit routes for googleapis in case the default route is deleted create_googleapis_routes = { private = true diff --git a/fast/stages/2-networking-e-nva-bgp/landing.tf b/fast/stages/2-networking-e-nva-bgp/landing.tf index ab6c94eb4a..07331717cc 100644 --- a/fast/stages/2-networking-e-nva-bgp/landing.tf +++ b/fast/stages/2-networking-e-nva-bgp/landing.tf @@ -55,7 +55,9 @@ module "landing-untrusted-vpc" { logging = false } create_googleapis_routes = null - data_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted" + } } module "landing-untrusted-firewall" { @@ -111,7 +113,9 @@ module "landing-trusted-vpc" { name = "prod-trusted-landing-0" delete_default_routes_on_create = true mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/landing-trusted" + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/landing-trusted" + } dns_policy = { inbound = true } diff --git a/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf b/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf index 0c70b5507a..56b65e3999 100644 --- a/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf +++ b/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf @@ -45,11 +45,13 @@ module "dev-spoke-project" { } module "dev-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.dev-spoke-project.project_id - name = "dev-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/dev" + source = "../../../modules/net-vpc" + project_id = module.dev-spoke-project.project_id + name = "dev-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/dev" + } delete_default_routes_on_create = true psa_config = try(var.psa_ranges.dev, null) # Set explicit routes for googleapis; send everything else to NVAs diff --git a/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf b/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf index c0ba44147c..6ae49dee98 100644 --- a/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf +++ b/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf @@ -44,11 +44,13 @@ module "prod-spoke-project" { } module "prod-spoke-vpc" { - source = "../../../modules/net-vpc" - project_id = module.prod-spoke-project.project_id - name = "prod-spoke-0" - mtu = 1500 - data_folder = "${var.factories_config.data_dir}/subnets/prod" + source = "../../../modules/net-vpc" + project_id = module.prod-spoke-project.project_id + name = "prod-spoke-0" + mtu = 1500 + factories_config = { + subnets_folder = "${var.factories_config.data_dir}/subnets/prod" + } delete_default_routes_on_create = true psa_config = try(var.psa_ranges.prod, null) # Set explicit routes for googleapis; send everything else to NVAs diff --git a/modules/net-vpc/README.md b/modules/net-vpc/README.md index a51b07136f..976dd3fd23 100644 --- a/modules/net-vpc/README.md +++ b/modules/net-vpc/README.md @@ -112,38 +112,34 @@ module "vpc" { name = "subnet-1" region = "europe-west1" ip_cidr_range = "10.0.1.0/24" + iam = { + "roles/compute.networkUser" = [ + "user:user1@example.com", "group:group1@example.com" + ] + } + iam_bindings = { + "roles/compute.networkUser" = { + members = ["group:group2@example.com"] + condition = { + expression = "resource.matchTag('123456789012/env', 'prod')" + title = "test_condition" + } + } + } }, { name = "subnet-2" region = "europe-west1" ip_cidr_range = "10.0.1.0/24" - } - ] - subnet_iam = { - "europe-west1/subnet-1" = { - "roles/compute.networkUser" = [ - "user:user1@example.com", "group:group1@example.com" - ] - } - } - subnet_iam_bindings = { - "europe-west1/subnet-1" = { - "roles/compute.networkUser" = { - members = ["group:group2@example.com"] - condition = { - expression = "resource.matchTag('123456789012/env', 'prod')" - title = "test_condition" + iam_bindings_additive = { + subnet-2-am1 = { + member = "user:am1@example.com" + role = "roles/compute.networkUser" + subnet = "europe-west1/subnet-2" } } } - } - subnet_iam_bindings_additive = { - subnet-2-am1 = { - member = "user:am1@example.com" - role = "roles/compute.networkUser" - subnet = "europe-west1/subnet-2" - } - } + ] } # tftest modules=1 resources=8 inventory=subnet-iam.yaml ``` @@ -212,6 +208,15 @@ module "vpc-host" { pods = "172.16.0.0/20" services = "192.168.0.0/24" } + iam = { + "roles/compute.networkUser" = [ + local.service_project_1.cloud_services_service_account, + local.service_project_1.gke_service_account + ] + "roles/compute.securityAdmin" = [ + local.service_project_1.gke_service_account + ] + } } ] shared_vpc_host = true @@ -219,17 +224,6 @@ module "vpc-host" { local.service_project_1.project_id, local.service_project_2.project_id ] - subnet_iam = { - "europe-west1/subnet-1" = { - "roles/compute.networkUser" = [ - local.service_project_1.cloud_services_service_account, - local.service_project_1.gke_service_account - ] - "roles/compute.securityAdmin" = [ - local.service_project_1.gke_service_account - ] - } - } } # tftest modules=1 resources=9 inventory=shared-vpc.yaml ``` @@ -350,10 +344,12 @@ The `net-vpc` module includes a subnet factory (see [Resource Factories](../../b ```hcl module "vpc" { - source = "./fabric/modules/net-vpc" - project_id = "my-project" - name = "my-network" - data_folder = "config/subnets" + source = "./fabric/modules/net-vpc" + project_id = "my-project" + name = "my-network" + factories_config = { + subnets_folder = "config/subnets" + } } # tftest modules=1 resources=10 files=subnet-simple,subnet-simple-2,subnet-detailed,subnet-proxy,subnet-proxy-global,subnet-psc inventory=factory.yaml ``` @@ -379,38 +375,39 @@ description: Sample description ip_cidr_range: 10.0.0.0/24 # optional attributes enable_private_access: false # defaults to true -iam: # grant roles/compute.networkUser - - group:lorem@example.com - - serviceAccount:fbz@prj.iam.gserviceaccount.com - - user:foobar@example.com +iam: + roles/compute.networkUser: + - group:lorem@example.com + - serviceAccount:fbz@prj.iam.gserviceaccount.com + - user:foobar@example.com secondary_ip_ranges: # map of secondary ip ranges secondary-range-a: 192.168.0.0/24 -flow_logs: # enable, set to empty map to use defaults +flow_logs_config: # enable, set to empty map to use defaults aggregation_interval: "INTERVAL_5_SEC" flow_sampling: 0.5 metadata: "INCLUDE_ALL_METADATA" - filter_expression: null ``` ```yaml # tftest-file id=subnet-proxy path=config/subnets/subnet-proxy.yaml region: europe-west4 ip_cidr_range: 10.1.0.0/24 -purpose: REGIONAL_MANAGED_PROXY +proxy_only: true ``` ```yaml # tftest-file id=subnet-proxy-global path=config/subnets/subnet-proxy-global.yaml region: australia-southeast2 ip_cidr_range: 10.4.0.0/24 -purpose: GLOBAL_MANAGED_PROXY +proxy_only: true +global: true ``` ```yaml # tftest-file id=subnet-psc path=config/subnets/subnet-psc.yaml region: europe-west4 ip_cidr_range: 10.2.0.0/24 -purpose: PRIVATE_SERVICE_CONNECT +psc: true ``` ### Custom Routes diff --git a/modules/net-vpc/subnets.tf b/modules/net-vpc/subnets.tf index dfca6fd75c..f006503945 100644 --- a/modules/net-vpc/subnets.tf +++ b/modules/net-vpc/subnets.tf @@ -27,7 +27,7 @@ locals { active = try(v.active, true) description = try(v.description, null) enable_private_access = try(v.enable_private_access, true) - flow_logs_config = can(v.flow_logs) ? { + flow_logs_config = can(v.flow_logs_config) ? { aggregation_interval = try(v.flow_logs_config.aggregation_interval, null) filter_expression = try(v.flow_logs_config.filter_expression, null) flow_sampling = try(v.flow_logs_config.flow_sampling, null)