add apigee non-vpc peering mode support

modules/apigee/README.md

@@ -135,14 +135,24 @@ module "apigee" {
 module "apigee" {
   source     = "./fabric/modules/apigee"
   project_id = "my-project"
+  organization = {
+    display_name            = "My Organization"
+    description             = "My Organization"
+    authorized_network      = "my-vpc"
+    runtime_type            = "CLOUD"
+    billing_type            = "Pay-as-you-go"
+    database_encryption_key = "123456789"
+    analytics_region        = "europe-west1"
+    disable_vpc_peering     = false
+  }
   instances = {
     europe-west1 = {
       runtime_ip_cidr_range         = "10.0.4.0/22"
       troubleshooting_ip_cidr_range = "10.1.1.0/28"
     }
   }
 }
-# tftest modules=1 resources=1
+# tftest modules=1 resources=2
 ```
 
 ### New endpoint attachment
@@ -180,13 +190,13 @@ module "apigee" {
 
 | name | description | type | required | default |
 |---|---|:---:|:---:|:---:|
-| [project_id](variables.tf#L95) | Project ID. | <code>string</code> | ✓ |  |
+| [project_id](variables.tf#L96) | Project ID. | <code>string</code> | ✓ |  |
 | [addons_config](variables.tf#L17) | Addons configuration. | <code title="object&#40;&#123;&#10;  advanced_api_ops    &#61; optional&#40;bool, false&#41;&#10;  api_security        &#61; optional&#40;bool, false&#41;&#10;  connectors_platform &#61; optional&#40;bool, false&#41;&#10;  integration         &#61; optional&#40;bool, false&#41;&#10;  monetization        &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
 | [endpoint_attachments](variables.tf#L29) | Endpoint attachments. | <code title="map&#40;object&#40;&#123;&#10;  region             &#61; string&#10;  service_attachment &#61; string&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [envgroups](variables.tf#L39) | Environment groups (NAME => [HOSTNAMES]). | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [environments](variables.tf#L46) | Environments. | <code title="map&#40;object&#40;&#123;&#10;  display_name    &#61; optional&#40;string&#41;&#10;  description     &#61; optional&#40;string, &#34;Terraform-managed&#34;&#41;&#10;  deployment_type &#61; optional&#40;string&#41;&#10;  api_proxy_type  &#61; optional&#40;string&#41;&#10;  node_config &#61; optional&#40;object&#40;&#123;&#10;    min_node_count &#61; optional&#40;number&#41;&#10;    max_node_count &#61; optional&#40;number&#41;&#10;  &#125;&#41;&#41;&#10;  iam       &#61; optional&#40;map&#40;list&#40;string&#41;&#41;&#41;&#10;  envgroups &#61; optional&#40;list&#40;string&#41;&#41;&#10;  regions   &#61; optional&#40;list&#40;string&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [instances](variables.tf#L65) | Instances ([REGION] => [INSTANCE]). | <code title="map&#40;object&#40;&#123;&#10;  display_name                  &#61; optional&#40;string&#41;&#10;  description                   &#61; optional&#40;string, &#34;Terraform-managed&#34;&#41;&#10;  runtime_ip_cidr_range         &#61; string&#10;  troubleshooting_ip_cidr_range &#61; string&#10;  disk_encryption_key           &#61; optional&#40;string&#41;&#10;  consumer_accept_list          &#61; optional&#40;list&#40;string&#41;&#41;&#10;  enable_nat                    &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [organization](variables.tf#L80) | Apigee organization. If set to null the organization must already exist. | <code title="object&#40;&#123;&#10;  display_name            &#61; optional&#40;string&#41;&#10;  description             &#61; optional&#40;string, &#34;Terraform-managed&#34;&#41;&#10;  authorized_network      &#61; optional&#40;string&#41;&#10;  runtime_type            &#61; optional&#40;string, &#34;CLOUD&#34;&#41;&#10;  billing_type            &#61; optional&#40;string&#41;&#10;  database_encryption_key &#61; optional&#40;string&#41;&#10;  analytics_region        &#61; optional&#40;string, &#34;europe-west1&#34;&#41;&#10;  retention               &#61; optional&#40;string&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [instances](variables.tf#L65) | Instances ([REGION] => [INSTANCE]). | <code title="map&#40;object&#40;&#123;&#10;  display_name                  &#61; optional&#40;string&#41;&#10;  description                   &#61; optional&#40;string, &#34;Terraform-managed&#34;&#41;&#10;  runtime_ip_cidr_range         &#61; optional&#40;string&#41;&#10;  troubleshooting_ip_cidr_range &#61; optional&#40;string&#41;&#10;  disk_encryption_key           &#61; optional&#40;string&#41;&#10;  consumer_accept_list          &#61; optional&#40;list&#40;string&#41;&#41;&#10;  enable_nat                    &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [organization](variables.tf#L80) | Apigee organization. If set to null the organization must already exist. | <code title="object&#40;&#123;&#10;  display_name            &#61; optional&#40;string&#41;&#10;  description             &#61; optional&#40;string, &#34;Terraform-managed&#34;&#41;&#10;  authorized_network      &#61; optional&#40;string&#41;&#10;  runtime_type            &#61; optional&#40;string, &#34;CLOUD&#34;&#41;&#10;  billing_type            &#61; optional&#40;string&#41;&#10;  database_encryption_key &#61; optional&#40;string&#41;&#10;  analytics_region        &#61; optional&#40;string, &#34;europe-west1&#34;&#41;&#10;  retention               &#61; optional&#40;string&#41;&#10;  disable_vpc_peering     &#61; optional&#40;bool, false&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
 
 ## Outputs
 

modules/apigee/main.tf

@@ -23,11 +23,12 @@ resource "google_apigee_organization" "organization" {
   count                                = var.organization == null ? 0 : 1
   analytics_region                     = var.organization.analytics_region
   project_id                           = var.project_id
-  authorized_network                   = var.organization.authorized_network
+  authorized_network                   = var.organization.disable_vpc_peering ? null : var.organization.authorized_network
   billing_type                         = var.organization.billing_type
   runtime_type                         = var.organization.runtime_type
   runtime_database_encryption_key_name = var.organization.database_encryption_key
   retention                            = var.organization.retention
+  disable_vpc_peering                  = var.organization.disable_vpc_peering
 }
 
 resource "google_apigee_envgroup" "envgroups" {
@@ -91,7 +92,7 @@ resource "google_apigee_instance" "instances" {
   description              = each.value.description
   location                 = each.key
   org_id                   = local.org_id
-  ip_range                 = "${each.value.runtime_ip_cidr_range},${each.value.troubleshooting_ip_cidr_range}"
+  ip_range                 = var.organization.disable_vpc_peering ? null : "${each.value.runtime_ip_cidr_range},${each.value.troubleshooting_ip_cidr_range}"
   disk_encryption_key_name = each.value.disk_encryption_key
   consumer_accept_list     = each.value.consumer_accept_list
 }
@@ -117,6 +118,9 @@ resource "google_apigee_instance_attachment" "instance_attachments" {
   instance_id = google_apigee_instance.instances[each.value.region].id
   environment = try(google_apigee_environment.environments[each.value.environment].name,
   "${local.org_id}/environments/${each.value.environment}")
+  lifecycle {
+    ignore_changes = [environment]
+  }
 }
 
 resource "google_apigee_endpoint_attachment" "endpoint_attachments" {

modules/apigee/variables.tf

@@ -67,8 +67,8 @@ variable "instances" {
   type = map(object({
     display_name                  = optional(string)
     description                   = optional(string, "Terraform-managed")
-    runtime_ip_cidr_range         = string
-    troubleshooting_ip_cidr_range = string
+    runtime_ip_cidr_range         = optional(string)
+    troubleshooting_ip_cidr_range = optional(string)
     disk_encryption_key           = optional(string)
     consumer_accept_list          = optional(list(string))
     enable_nat                    = optional(bool, false)
@@ -88,6 +88,7 @@ variable "organization" {
     database_encryption_key = optional(string)
     analytics_region        = optional(string, "europe-west1")
     retention               = optional(string)
+    disable_vpc_peering     = optional(bool, false)
   })
   default = null
 }

tests/modules/apigee/all.tfvars

@@ -7,6 +7,7 @@ organization = {
   billing_type            = "Pay-as-you-go"
   database_encryption_key = "123456789"
   analytics_region        = "europe-west1"
+  disable_vpc_peering     = false
 }
 envgroups = {
   test = ["test.example.com"]

tests/modules/apigee/all.yaml

@@ -71,6 +71,7 @@ values:
     retention: DELETION_RETENTION_UNSPECIFIED
     runtime_database_encryption_key_name: '123456789'
     runtime_type: CLOUD
+    disable_vpc_peering: false
 
 counts:
   google_apigee_endpoint_attachment: 2

tests/modules/apigee/instance_only_psc_mode.tfvars

@@ -0,0 +1,18 @@
+project_id = "my-project"
+organization = {
+  display_name = "My Organization"
+  description  = "My Organization"
+  # authorized_network      = "my-vpc"
+  runtime_type            = "CLOUD"
+  billing_type            = "Pay-as-you-go"
+  database_encryption_key = "123456789"
+  analytics_region        = "europe-west1"
+  disable_vpc_peering     = true
+}
+instances = {
+  europe-west1 = {
+    # runtime_ip_cidr_range         = "10.0.4.0/22"
+    # troubleshooting_ip_cidr_range = "10.1.1.0/28"
+  }
+}
+

tests/modules/apigee/instance_only_psc_mode.yaml

@@ -0,0 +1,37 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  google_apigee_instance.instances["europe-west1"]:
+    description: Terraform-managed
+    disk_encryption_key_name: null
+    display_name: null
+    # ip_range: 10.0.4.0/22,10.1.1.0/28
+    location: europe-west1
+    name: instance-europe-west1
+  google_apigee_organization.organization[0]:
+    analytics_region: europe-west1
+    # authorized_network: my-vpc
+    billing_type: Pay-as-you-go
+    description: null
+    display_name: null
+    project_id: my-project
+    retention: DELETION_RETENTION_UNSPECIFIED
+    runtime_database_encryption_key_name: '123456789'
+    runtime_type: CLOUD
+    disable_vpc_peering: true
+
+counts:
+  google_apigee_instance: 1
+  google_apigee_organization: 1

tests/modules/apigee/instance_only_vpc_mode.tfvars

@@ -0,0 +1,18 @@
+project_id = "my-project"
+organization = {
+  display_name            = "My Organization"
+  description             = "My Organization"
+  authorized_network      = "my-vpc"
+  runtime_type            = "CLOUD"
+  billing_type            = "Pay-as-you-go"
+  database_encryption_key = "123456789"
+  analytics_region        = "europe-west1"
+  disable_vpc_peering     = false
+}
+instances = {
+  europe-west1 = {
+    runtime_ip_cidr_range         = "10.0.4.0/22"
+    troubleshooting_ip_cidr_range = "10.1.1.0/28"
+  }
+}
+

tests/modules/apigee/instance_only_vpc_mode.yaml

@@ -0,0 +1,37 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+values:
+  google_apigee_instance.instances["europe-west1"]:
+    description: Terraform-managed
+    disk_encryption_key_name: null
+    display_name: null
+    ip_range: 10.0.4.0/22,10.1.1.0/28
+    location: europe-west1
+    name: instance-europe-west1
+  google_apigee_organization.organization[0]:
+    analytics_region: europe-west1
+    authorized_network: my-vpc
+    billing_type: Pay-as-you-go
+    description: null
+    display_name: null
+    project_id: my-project
+    retention: DELETION_RETENTION_UNSPECIFIED
+    runtime_database_encryption_key_name: '123456789'
+    runtime_type: CLOUD
+    disable_vpc_peering: false
+
+counts:
+  google_apigee_instance: 1
+  google_apigee_organization: 1

tests/modules/apigee/no_instances.tfvars

@@ -7,6 +7,7 @@ organization = {
   billing_type            = "PAYG"
   database_encryption_key = "123456789"
   analytics_region        = "europe-west1"
+  disable_vpc_peering     = false
 }
 envgroups = {
   test = ["test.example.com"]

tests/modules/apigee/no_instances.yaml

@@ -43,6 +43,7 @@ values:
     retention: DELETION_RETENTION_UNSPECIFIED
     runtime_database_encryption_key_name: '123456789'
     runtime_type: CLOUD
+    disable_vpc_peering: false
 
 counts:
   google_apigee_envgroup: 2

tests/modules/apigee/organization_only_psc_mode.tfvars

@@ -0,0 +1,11 @@
+project_id = "my-project"
+organization = {
+  display_name            = "My Organization"
+  description             = "My Organization"
+  authorized_network      = null
+  runtime_type            = "CLOUD"
+  billing_type            = "PAYG"
+  database_encryption_key = "123456789"
+  analytics_region        = "europe-west1"
+  disable_vpc_peering     = true
+}

tests/modules/apigee/instance_only.yaml → tests/modules/apigee/organization_only_psc_mode.yaml

@@ -13,11 +13,17 @@
 # limitations under the License.
 
 values:
-  google_apigee_instance.instances["europe-west1"]:
-    ip_range: 10.0.4.0/22,10.1.1.0.0/28
-    location: europe-west1
-    name: "instance-europe-west1"
-    org_id: organizations/my-project
+  google_apigee_organization.organization[0]:
+    analytics_region: europe-west1
+    authorized_network: null
+    billing_type: PAYG
+    description: null
+    display_name: null
+    project_id: my-project
+    retention: DELETION_RETENTION_UNSPECIFIED
+    runtime_database_encryption_key_name: '123456789'
+    runtime_type: CLOUD
+    disable_vpc_peering: true
 
 counts:
-  google_apigee_instance: 1
+  google_apigee_organization: 1

tests/modules/apigee/organization_only.tfvars → tests/modules/apigee/organization_only_vpc_mode.tfvars

@@ -7,4 +7,5 @@ organization = {
   billing_type            = "PAYG"
   database_encryption_key = "123456789"
   analytics_region        = "europe-west1"
-}
+  disable_vpc_peering     = false
+}

tests/modules/apigee/organization_only.yaml → tests/modules/apigee/organization_only_vpc_mode.yaml

@@ -23,6 +23,7 @@ values:
     retention: DELETION_RETENTION_UNSPECIFIED
     runtime_database_encryption_key_name: '123456789'
     runtime_type: CLOUD
+    disable_vpc_peering: false
 
 counts:
   google_apigee_organization: 1

tests/modules/apigee/organization_retention.tfvars

@@ -8,4 +8,5 @@ organization = {
   database_encryption_key = "123456789"
   analytics_region        = "europe-west1"
   retention               = "MINIMUM"
-}
+  disable_vpc_peering     = false
+}

tests/modules/apigee/organization_retention.yaml

@@ -23,6 +23,7 @@ values:
     retention: MINIMUM
     runtime_database_encryption_key_name: '123456789'
     runtime_type: CLOUD
+    disable_vpc_peering: false
 
 counts:
   google_apigee_organization: 1

tests/modules/apigee/tftest.yaml

@@ -21,7 +21,9 @@ tests:
   env_only_with_api_proxy_type:
   env_only_with_deployment_type:
   envgroup_only:
-  instance_only:
+  instance_only_psc_mode:
+  instance_only_vpc_mode:
   no_instances:
-  organization_only:
+  organization_only_psc_mode:
+  organization_only_vpc_mode:
   organization_retention: