This [blueprint](./private-cloud-function-from-onprem/) shows how to invoke a [private Google Cloud Function](https://cloud.google.com/functions/docs/networking/network-settings) from the on-prem environment via a [Private Service Connect endpoint](https://cloud.google.com/vpc/docs/private-service-connect#benefits-apis).
+
+
This [blueprint](./psc-hybrid/) shows how to privately connect to on-premise services (IP + port) from GCP, leveraging [Private Service Connect (PSC)](https://cloud.google.com/vpc/docs/private-service-connect) and [Hybrid Network Endpoint Groups](https://cloud.google.com/load-balancing/docs/negs/hybrid-neg-concepts).
+
+
This [blueprint](./decentralized-firewall/) shows how a decentralized firewall management can be organized using the [firewall factory](../factories/net-vpc-firewall-yaml/).
This [blueprint](./filtering-proxy/) how to deploy a filtering HTTP proxy to restrict Internet access, in a simplified setup using a VPC with two subnets and a Cloud DNS zone, and an optional MIG for scaling.
+
This [blueprint](./glb-hybrid-neg-internal/) shows the experimental use of hybrid NEGs behind external Global Load Balancers (GLBs) to connect to GCP instances living in spoke VPCs and behind Network Virtual Appliances (NVAs).
This [blueprint](./hub-and-spoke-peering/) implements a hub and spoke topology via VPC peering, a common design where a landing zone VPC (hub) is connected to on-premises, and then peered with satellite VPCs (spokes) to further partition the infrastructure.
+
This [blueprint](./hub-and-spoke-vpn/) implements a hub and spoke topology via dynamic VPN tunnels, a common design where peering cannot be used due to limitations on the number of spokes or connectivity to managed services.
-The sample highlights the lack of transitivity in peering: the absence of connectivity between spokes, and the need create workarounds for private service access to managed services. One such workaround is shown for private GKE, allowing access from hub and all spokes to GKE masters via a dedicated VPN.
+The blueprint shows how to implement spoke transitivity via BGP advertisements, how to expose hub DNS zones to spokes via DNS peering, and allows easy testing of different VPN and BGP configurations.
This [blueprint](./hub-and-spoke-vpn/) implements a hub and spoke topology via dynamic VPN tunnels, a common design where peering cannot be used due to limitations on the number of spokes or connectivity to managed services.
+ This [blueprint](./hub-and-spoke-peering/) implements a hub and spoke topology via VPC peering, a common design where a landing zone VPC (hub) is connected to on-premises, and then peered with satellite VPCs (spokes) to further partition the infrastructure.
-The blueprint shows how to implement spoke transitivity via BGP advertisements, how to expose hub DNS zones to spokes via DNS peering, and allows easy testing of different VPN and BGP configurations.
+The sample highlights the lack of transitivity in peering: the absence of connectivity between spokes, and the need create workarounds for private service access to managed services. One such workaround is shown for private GKE, allowing access from hub and all spokes to GKE masters via a dedicated VPN.
This [blueprint](./private-cloud-function-from-onprem/) shows how to invoke a [private Google Cloud Function](https://cloud.google.com/functions/docs/networking/network-settings) from the on-prem environment via a [Private Service Connect endpoint](https://cloud.google.com/vpc/docs/private-service-connect#benefits-apis).
-
- This [blueprint](./psc-hybrid/) shows how to privately connect to on-premise services (IP + port) from GCP, leveraging [Private Service Connect (PSC)](https://cloud.google.com/vpc/docs/private-service-connect) and [Hybrid Network Endpoint Groups](https://cloud.google.com/load-balancing/docs/negs/hybrid-neg-concepts).
+ This [blueprint](./filtering-proxy/) how to deploy a filtering HTTP proxy to restrict Internet access, in a simplified setup using a VPC with two subnets and a Cloud DNS zone, and an optional MIG for scaling.
string | ✓ | |
+| [ilb_create](variables.tf#L17) | Whether we should create an ILB L4 in front of the test VMs in the spoke. | string | | "false" |
+| [ip_config](variables.tf#L23) | The subnet IP configurations. | object({…}) | | {} |
+| [project_names](variables.tf#L45) | The project names. | object({…}) | | {…} |
+| [projects_create](variables.tf#L57) | Parameters for the creation of the new project. | object({…}) | | null |
+| [regions](variables.tf#L66) | Region definitions. | object({…}) | | {…} |
+
+## Outputs
+
+| name | description | sensitive |
+|---|---|:---:|
+| [glb_ip_address](outputs.tf#L17) | Load balancer IP address. | |
+
+
+## Test
+```hcl
+module "test" {
+ source = "./fabric/blueprints/networking/glb-hybrid-neg-internal"
+ prefix = "prefix"
+ projects_create = {
+ billing_account_id = "123456-123456-123456"
+ parent = "folders/123456789"
+ }
+}
+
+# tftest modules=21 resources=64
+```
diff --git a/blueprints/networking/glb-hybrid-neg-internal/data/nva-startup-script.tftpl b/blueprints/networking/glb-hybrid-neg-internal/data/nva-startup-script.tftpl
new file mode 100644
index 0000000000..62b9988a6d
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/data/nva-startup-script.tftpl
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+echo 'Enabling IP forwarding'
+sed '/net.ipv4.ip_forward=1/s/^#//g' -i /etc/sysctl.conf &&
+sysctl -p /etc/sysctl.conf &&
+/etc/init.d/procps restart
+
+echo 'Setting routes'
+ip route add ${spoke-primary} via ${gateway-trusted} dev ens5
+ip route add ${spoke-secondary} via ${gateway-trusted} dev ens5
+
+echo 'Setting NAT masquerade, so that HCs can reach the spoke through the NVA using the trusted intf source IP'
+iptables \
+ -t nat \
+ -A POSTROUTING \
+ -s 130.211.0.0/22,35.191.0.0/16 \
+ -d ${spoke-primary} \
+ -p tcp \
+ --dport 80 \
+ -j MASQUERADE
+iptables \
+ -t nat \
+ -A POSTROUTING \
+ -s 130.211.0.0/22,35.191.0.0/16 \
+ -d ${spoke-secondary} \
+ -p tcp \
+ --dport 80 \
+ -j MASQUERADE
diff --git a/blueprints/networking/glb-hybrid-neg-internal/diagram.png b/blueprints/networking/glb-hybrid-neg-internal/diagram.png
new file mode 100644
index 0000000000..bf82cd80a4
Binary files /dev/null and b/blueprints/networking/glb-hybrid-neg-internal/diagram.png differ
diff --git a/blueprints/networking/glb-hybrid-neg-internal/diagram.svg b/blueprints/networking/glb-hybrid-neg-internal/diagram.svg
new file mode 100644
index 0000000000..3c90fc424e
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/diagram.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/blueprints/networking/glb-hybrid-neg-internal/glb.tf b/blueprints/networking/glb-hybrid-neg-internal/glb.tf
new file mode 100644
index 0000000000..4d67d68a30
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/glb.tf
@@ -0,0 +1,71 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+# tfdoc:file:description External Global Load Balancer.
+
+module "hybrid-glb" {
+ source = "../../../modules/net-glb"
+ project_id = module.project_landing.project_id
+ name = "hybrid-glb"
+ backend_service_configs = {
+ default = {
+ backends = [
+ {
+ backend = "neg-primary"
+ balancing_mode = "RATE"
+ max_rate = { per_endpoint = 100 }
+ },
+ {
+ backend = "neg-secondary"
+ balancing_mode = "RATE"
+ max_rate = { per_endpoint = 100 }
+ }
+ ]
+ }
+ }
+ neg_configs = {
+ neg-primary = {
+ hybrid = {
+ network = module.vpc_landing_untrusted.name
+ zone = local.zones["primary"]
+ endpoints = {
+ primary = {
+ ip_address = (var.ilb_create
+ ? module.test_vm_ilbs["primary"].forwarding_rule_address
+ : module.test_vms["primary"].internal_ip
+ )
+ port = 80
+ }
+ }
+ }
+ }
+ neg-secondary = {
+ hybrid = {
+ network = module.vpc_landing_untrusted.name
+ zone = local.zones["secondary"]
+ endpoints = {
+ secondary = {
+ ip_address = (var.ilb_create
+ ? module.test_vm_ilbs["secondary"].forwarding_rule_address
+ : module.test_vms["secondary"].internal_ip
+ )
+ port = 80
+ }
+ }
+ }
+ }
+ }
+}
diff --git a/blueprints/networking/glb-hybrid-neg-internal/main.tf b/blueprints/networking/glb-hybrid-neg-internal/main.tf
new file mode 100644
index 0000000000..55600156bd
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/main.tf
@@ -0,0 +1,122 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+locals {
+ zones = {
+ primary = "${var.regions.primary}-b"
+ secondary = "${var.regions.secondary}-b"
+ }
+}
+
+module "project_landing" {
+ source = "../../../modules/project"
+ billing_account = (var.projects_create != null
+ ? var.projects_create.billing_account_id
+ : null
+ )
+ name = var.project_names.landing
+ parent = (var.projects_create != null
+ ? var.projects_create.parent
+ : null
+ )
+ prefix = var.prefix
+ project_create = var.projects_create != null
+
+ services = [
+ "compute.googleapis.com",
+ "networkmanagement.googleapis.com",
+ # Logging and Monitoring
+ "logging.googleapis.com",
+ "monitoring.googleapis.com"
+ ]
+}
+
+module "vpc_landing_untrusted" {
+ source = "../../../modules/net-vpc"
+ project_id = module.project_landing.project_id
+ name = "landing-untrusted"
+
+ routes = {
+ spoke1-primary = {
+ dest_range = var.ip_config.spoke_primary
+ next_hop_type = "ilb"
+ next_hop = module.nva_untrusted_ilbs["primary"].forwarding_rule_self_link
+ }
+ spoke1-secondary = {
+ dest_range = var.ip_config.spoke_secondary
+ next_hop_type = "ilb"
+ next_hop = module.nva_untrusted_ilbs["secondary"].forwarding_rule_self_link
+ }
+ }
+
+ subnets = [
+ {
+ ip_cidr_range = var.ip_config.untrusted_primary
+ name = "untrusted-${var.regions.primary}"
+ region = var.regions.primary
+ },
+ {
+ ip_cidr_range = var.ip_config.untrusted_secondary
+ name = "untrusted-${var.regions.secondary}"
+ region = var.regions.secondary
+ }
+ ]
+}
+
+module "vpc_landing_trusted" {
+ source = "../../../modules/net-vpc"
+ project_id = module.project_landing.project_id
+ name = "landing-trusted"
+ subnets = [
+ {
+ ip_cidr_range = var.ip_config.trusted_primary
+ name = "trusted-${var.regions.primary}"
+ region = var.regions.primary
+ },
+ {
+ ip_cidr_range = var.ip_config.trusted_secondary
+ name = "trusted-${var.regions.secondary}"
+ region = var.regions.secondary
+ }
+ ]
+}
+
+module "firewall_landing_untrusted" {
+ source = "../../../modules/net-vpc-firewall"
+ project_id = module.project_landing.project_id
+ network = module.vpc_landing_untrusted.name
+
+ ingress_rules = {
+ allow-ssh-from-hcs = {
+ description = "Allow health checks to NVAs coming on port 22."
+ targets = ["ssh"]
+ source_ranges = [
+ "130.211.0.0/22",
+ "35.191.0.0/16"
+ ]
+ rules = [{ protocol = "tcp", ports = [22] }]
+ }
+ }
+}
+
+module "nats_landing" {
+ for_each = var.regions
+ source = "../../../modules/net-cloudnat"
+ project_id = module.project_landing.project_id
+ region = each.value
+ name = "nat-${each.value}"
+ router_network = module.vpc_landing_untrusted.self_link
+}
diff --git a/blueprints/networking/glb-hybrid-neg-internal/nva.tf b/blueprints/networking/glb-hybrid-neg-internal/nva.tf
new file mode 100644
index 0000000000..1d2a508f87
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/nva.tf
@@ -0,0 +1,87 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+# tfdoc:file:description Network Virtual Appliances (NVAs).
+
+module "nva_instance_templates" {
+ for_each = var.regions
+ source = "../../../modules/compute-vm"
+ project_id = module.project_landing.project_id
+ can_ip_forward = true
+ create_template = true
+ name = "nva-${each.value}"
+ service_account_create = true
+ zone = local.zones[each.key]
+
+ metadata = {
+ startup-script = templatefile(
+ "${path.module}/data/nva-startup-script.tftpl",
+ {
+ gateway-trusted = cidrhost(module.vpc_landing_trusted.subnet_ips["${each.value}/trusted-${each.value}"], 1)
+ spoke-primary = var.ip_config.spoke_primary
+ spoke-secondary = var.ip_config.spoke_secondary
+ }
+ )
+ }
+
+ network_interfaces = [
+ {
+ network = module.vpc_landing_untrusted.self_link
+ subnetwork = module.vpc_landing_untrusted.subnet_self_links["${each.value}/untrusted-${each.value}"]
+ },
+ {
+ network = module.vpc_landing_trusted.self_link
+ subnetwork = module.vpc_landing_trusted.subnet_self_links["${each.value}/trusted-${each.value}"]
+ }
+ ]
+
+ tags = [
+ "http-server",
+ "https-server",
+ "ssh"
+ ]
+}
+
+module "nva_migs" {
+ for_each = var.regions
+ source = "../../../modules/compute-mig"
+ project_id = module.project_landing.project_id
+ location = local.zones[each.key]
+ name = "nva-${each.value}"
+ target_size = 1
+ instance_template = module.nva_instance_templates[each.key].template.self_link
+}
+
+module "nva_untrusted_ilbs" {
+ for_each = var.regions
+ source = "../../../modules/net-ilb"
+ project_id = module.project_landing.project_id
+ region = each.value
+ name = "nva-ilb-${local.zones[each.key]}"
+ service_label = "nva-ilb-${local.zones[each.key]}"
+ vpc_config = {
+ network = module.vpc_landing_untrusted.self_link
+ subnetwork = module.vpc_landing_untrusted.subnet_self_links["${each.value}/untrusted-${each.value}"]
+ }
+ backends = [{
+ group = module.nva_migs[each.key].group_manager.instance_group
+ }]
+ health_check_config = {
+ tcp = {
+ port = 22
+ }
+ }
+}
diff --git a/blueprints/networking/glb-hybrid-neg-internal/outputs.tf b/blueprints/networking/glb-hybrid-neg-internal/outputs.tf
new file mode 100644
index 0000000000..7d8ce185ff
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/outputs.tf
@@ -0,0 +1,20 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "glb_ip_address" {
+ description = "Load balancer IP address."
+ value = module.hybrid-glb.address
+}
diff --git a/blueprints/networking/glb-hybrid-neg-internal/spoke.tf b/blueprints/networking/glb-hybrid-neg-internal/spoke.tf
new file mode 100644
index 0000000000..1769d4c682
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/spoke.tf
@@ -0,0 +1,146 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+# tfdoc:file:description VPC Spoke(s) and test VMs.
+
+module "project_spoke_01" {
+ source = "../../../modules/project"
+ billing_account = (var.projects_create != null
+ ? var.projects_create.billing_account_id
+ : null
+ )
+ name = var.project_names.spoke_01
+ parent = (var.projects_create != null
+ ? var.projects_create.parent
+ : null
+ )
+ prefix = var.prefix
+
+ services = [
+ "compute.googleapis.com",
+ "networkmanagement.googleapis.com",
+ # Logging and Monitoring
+ "logging.googleapis.com",
+ "monitoring.googleapis.com"
+ ]
+}
+
+module "vpc_spoke_01" {
+ source = "../../../modules/net-vpc"
+ project_id = module.project_spoke_01.project_id
+ name = "spoke-01"
+ subnets = [
+ {
+ ip_cidr_range = var.ip_config.spoke_primary
+ name = "spoke-01-${var.regions.primary}"
+ region = var.regions.primary
+ },
+ {
+ ip_cidr_range = var.ip_config.spoke_secondary
+ name = "spoke-01-${var.regions.secondary}"
+ region = var.regions.secondary
+ }
+ ]
+ peering_config = {
+ peer_vpc_self_link = module.vpc_landing_trusted.self_link
+ import_routes = true
+ }
+}
+
+module "firewall_spoke_01" {
+ source = "../../../modules/net-vpc-firewall"
+ project_id = module.project_spoke_01.project_id
+ network = module.vpc_spoke_01.name
+
+ ingress_rules = {
+ allow-nva-hcs = {
+ description = "Allow health checks coming on port 80 and 443 from NVAs."
+ targets = ["http-server", "https-server"]
+ source_ranges = [
+ var.ip_config.trusted_primary,
+ var.ip_config.trusted_secondary
+ ]
+ rules = [{ protocol = "tcp", ports = [80, 443] }]
+ }
+ }
+}
+
+# NAT is used to install nginx for test purposed, even if NVAs are still not ready
+
+module "nats_spoke_01" {
+ for_each = var.regions
+ source = "../../../modules/net-cloudnat"
+ name = "spoke-01-${each.value}"
+ project_id = module.project_spoke_01.project_id
+ region = each.value
+ router_network = module.vpc_spoke_01.name
+}
+
+module "test_vms" {
+ for_each = var.regions
+ source = "../../../modules/compute-vm"
+ name = "spoke-01-${each.value}"
+ project_id = module.project_spoke_01.project_id
+ create_template = var.ilb_create
+ service_account_create = true
+ zone = local.zones[each.key]
+
+ metadata = {
+ startup-script = "apt update && apt install -y nginx"
+ }
+
+ network_interfaces = [{
+ network = module.vpc_spoke_01.self_link
+ subnetwork = module.vpc_spoke_01.subnet_self_links["${each.value}/spoke-01-${each.value}"]
+ }]
+
+ tags = [
+ "http-server",
+ "https-server",
+ "ssh"
+ ]
+}
+
+module "test_vm_migs" {
+ for_each = var.ilb_create ? var.regions : {}
+ source = "../../../modules/compute-mig"
+ project_id = module.project_spoke_01.project_id
+ location = local.zones[each.key]
+ name = "test-vm-${each.value}"
+ target_size = 1
+ instance_template = module.test_vms[each.key].template.self_link
+}
+
+module "test_vm_ilbs" {
+ for_each = var.ilb_create ? var.regions : {}
+ source = "../../../modules/net-ilb"
+ project_id = module.project_spoke_01.project_id
+ region = each.value
+ name = "test-vm-ilb-${each.value}"
+ service_label = "test-vm-ilb-${each.value}"
+ vpc_config = {
+ network = module.vpc_spoke_01.self_link
+ subnetwork = module.vpc_spoke_01.subnet_self_links["${each.value}/spoke-01-${each.value}"]
+ }
+ backends = [{
+ group = module.test_vm_migs[each.key].group_manager.instance_group
+ }]
+ health_check_config = {
+ tcp = {
+ port = 80
+ }
+ }
+}
diff --git a/blueprints/networking/glb-hybrid-neg-internal/variables.tf b/blueprints/networking/glb-hybrid-neg-internal/variables.tf
new file mode 100644
index 0000000000..3f96b86797
--- /dev/null
+++ b/blueprints/networking/glb-hybrid-neg-internal/variables.tf
@@ -0,0 +1,76 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "ilb_create" {
+ description = "Whether we should create an ILB L4 in front of the test VMs in the spoke."
+ type = string
+ default = false
+}
+
+variable "ip_config" {
+ description = "The subnet IP configurations."
+ type = object({
+ spoke_primary = optional(string, "192.168.101.0/24")
+ spoke_secondary = optional(string, "192.168.102.0/24")
+ trusted_primary = optional(string, "192.168.11.0/24")
+ trusted_secondary = optional(string, "192.168.22.0/24")
+ untrusted_primary = optional(string, "192.168.1.0/24")
+ untrusted_secondary = optional(string, "192.168.2.0/24")
+ })
+ default = {}
+}
+
+variable "prefix" {
+ description = "Prefix used for resource names."
+ type = string
+ validation {
+ condition = var.prefix != ""
+ error_message = "Prefix cannot be empty."
+ }
+}
+
+variable "project_names" {
+ description = "The project names."
+ type = object({
+ landing = string
+ spoke_01 = string
+ })
+ default = {
+ landing = "landing"
+ spoke_01 = "spoke-01"
+ }
+}
+
+variable "projects_create" {
+ description = "Parameters for the creation of the new project."
+ type = object({
+ billing_account_id = string
+ parent = string
+ })
+ default = null
+}
+
+variable "regions" {
+ description = "Region definitions."
+ type = object({
+ primary = string
+ secondary = string
+ })
+ default = {
+ primary = "europe-west1"
+ secondary = "europe-west4"
+ }
+}