diff --git a/blueprints/networking/shared-vpc-gke/main.tf b/blueprints/networking/shared-vpc-gke/main.tf
index 302ce73547..88f484630f 100644
--- a/blueprints/networking/shared-vpc-gke/main.tf
+++ b/blueprints/networking/shared-vpc-gke/main.tf
@@ -1,4 +1,4 @@
-# Copyright 2022 Google LLC
+# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
@@ -102,6 +102,11 @@ module "vpc-shared" {
ip_cidr_range = var.ip_ranges.gce
name = "gce"
region = var.region
+ iam = {
+ "roles/compute.networkUser" = concat(var.owners_gce, [
+ "serviceAccount:${module.project-svc-gce.service_accounts.cloud_services}",
+ ])
+ }
},
{
ip_cidr_range = var.ip_ranges.gke
@@ -111,24 +116,17 @@ module "vpc-shared" {
pods = var.ip_secondary_ranges.gke-pods
services = var.ip_secondary_ranges.gke-services
}
+ iam = {
+ "roles/compute.networkUser" = concat(var.owners_gke, [
+ "serviceAccount:${module.project-svc-gke.service_accounts.cloud_services}",
+ "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}",
+ ])
+ "roles/compute.securityAdmin" = [
+ "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}",
+ ]
+ }
}
]
- subnet_iam = {
- "${var.region}/gce" = {
- "roles/compute.networkUser" = concat(var.owners_gce, [
- "serviceAccount:${module.project-svc-gce.service_accounts.cloud_services}",
- ])
- }
- "${var.region}/gke" = {
- "roles/compute.networkUser" = concat(var.owners_gke, [
- "serviceAccount:${module.project-svc-gke.service_accounts.cloud_services}",
- "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}",
- ])
- "roles/compute.securityAdmin" = [
- "serviceAccount:${module.project-svc-gke.service_accounts.robots.container-engine}",
- ]
- }
- }
}
module "vpc-shared-firewall" {
diff --git a/fast/stages/2-networking-a-peering/landing.tf b/fast/stages/2-networking-a-peering/landing.tf
index 013c6e86a6..e2309f1bba 100644
--- a/fast/stages/2-networking-a-peering/landing.tf
+++ b/fast/stages/2-networking-a-peering/landing.tf
@@ -55,7 +55,9 @@ module "landing-vpc" {
private = true
restricted = true
}
- data_folder = "${var.factories_config.data_dir}/subnets/landing"
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/landing"
+ }
}
module "landing-firewall" {
diff --git a/fast/stages/2-networking-a-peering/spoke-dev.tf b/fast/stages/2-networking-a-peering/spoke-dev.tf
index 838ba6a4f6..bfff002b41 100644
--- a/fast/stages/2-networking-a-peering/spoke-dev.tf
+++ b/fast/stages/2-networking-a-peering/spoke-dev.tf
@@ -46,12 +46,14 @@ module "dev-spoke-project" {
}
module "dev-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.dev-spoke-project.project_id
- name = "dev-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/dev"
- psa_config = try(var.psa_ranges.dev, null)
+ source = "../../../modules/net-vpc"
+ project_id = module.dev-spoke-project.project_id
+ name = "dev-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
+ }
+ psa_config = try(var.psa_ranges.dev, null)
# set explicit routes for googleapis in case the default route is deleted
create_googleapis_routes = {
private = true
diff --git a/fast/stages/2-networking-a-peering/spoke-prod.tf b/fast/stages/2-networking-a-peering/spoke-prod.tf
index 7569647ef1..505005bdb1 100644
--- a/fast/stages/2-networking-a-peering/spoke-prod.tf
+++ b/fast/stages/2-networking-a-peering/spoke-prod.tf
@@ -45,12 +45,14 @@ module "prod-spoke-project" {
}
module "prod-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.prod-spoke-project.project_id
- name = "prod-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/prod"
- psa_config = try(var.psa_ranges.prod, null)
+ source = "../../../modules/net-vpc"
+ project_id = module.prod-spoke-project.project_id
+ name = "prod-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
+ }
+ psa_config = try(var.psa_ranges.prod, null)
# set explicit routes for googleapis in case the default route is deleted
create_googleapis_routes = {
private = true
diff --git a/fast/stages/2-networking-b-vpn/landing.tf b/fast/stages/2-networking-b-vpn/landing.tf
index 013c6e86a6..e2309f1bba 100644
--- a/fast/stages/2-networking-b-vpn/landing.tf
+++ b/fast/stages/2-networking-b-vpn/landing.tf
@@ -55,7 +55,9 @@ module "landing-vpc" {
private = true
restricted = true
}
- data_folder = "${var.factories_config.data_dir}/subnets/landing"
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/landing"
+ }
}
module "landing-firewall" {
diff --git a/fast/stages/2-networking-b-vpn/spoke-dev.tf b/fast/stages/2-networking-b-vpn/spoke-dev.tf
index 838ba6a4f6..bfff002b41 100644
--- a/fast/stages/2-networking-b-vpn/spoke-dev.tf
+++ b/fast/stages/2-networking-b-vpn/spoke-dev.tf
@@ -46,12 +46,14 @@ module "dev-spoke-project" {
}
module "dev-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.dev-spoke-project.project_id
- name = "dev-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/dev"
- psa_config = try(var.psa_ranges.dev, null)
+ source = "../../../modules/net-vpc"
+ project_id = module.dev-spoke-project.project_id
+ name = "dev-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
+ }
+ psa_config = try(var.psa_ranges.dev, null)
# set explicit routes for googleapis in case the default route is deleted
create_googleapis_routes = {
private = true
diff --git a/fast/stages/2-networking-b-vpn/spoke-prod.tf b/fast/stages/2-networking-b-vpn/spoke-prod.tf
index 7569647ef1..505005bdb1 100644
--- a/fast/stages/2-networking-b-vpn/spoke-prod.tf
+++ b/fast/stages/2-networking-b-vpn/spoke-prod.tf
@@ -45,12 +45,14 @@ module "prod-spoke-project" {
}
module "prod-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.prod-spoke-project.project_id
- name = "prod-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/prod"
- psa_config = try(var.psa_ranges.prod, null)
+ source = "../../../modules/net-vpc"
+ project_id = module.prod-spoke-project.project_id
+ name = "prod-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
+ }
+ psa_config = try(var.psa_ranges.prod, null)
# set explicit routes for googleapis in case the default route is deleted
create_googleapis_routes = {
private = true
diff --git a/fast/stages/2-networking-c-nva/landing.tf b/fast/stages/2-networking-c-nva/landing.tf
index e7329a4358..fb19c31b9e 100644
--- a/fast/stages/2-networking-c-nva/landing.tf
+++ b/fast/stages/2-networking-c-nva/landing.tf
@@ -54,7 +54,9 @@ module "landing-untrusted-vpc" {
logging = false
}
create_googleapis_routes = null
- data_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted"
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted"
+ }
}
module "landing-untrusted-firewall" {
@@ -110,7 +112,9 @@ module "landing-trusted-vpc" {
name = "prod-trusted-landing-0"
delete_default_routes_on_create = true
mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/landing-trusted"
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/landing-trusted"
+ }
dns_policy = {
inbound = true
}
diff --git a/fast/stages/2-networking-c-nva/spoke-dev.tf b/fast/stages/2-networking-c-nva/spoke-dev.tf
index a90d25aa3e..0f6e8b8f97 100644
--- a/fast/stages/2-networking-c-nva/spoke-dev.tf
+++ b/fast/stages/2-networking-c-nva/spoke-dev.tf
@@ -45,11 +45,13 @@ module "dev-spoke-project" {
}
module "dev-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.dev-spoke-project.project_id
- name = "dev-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/dev"
+ source = "../../../modules/net-vpc"
+ project_id = module.dev-spoke-project.project_id
+ name = "dev-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
+ }
delete_default_routes_on_create = true
psa_config = try(var.psa_ranges.dev, null)
# Set explicit routes for googleapis; send everything else to NVAs
diff --git a/fast/stages/2-networking-c-nva/spoke-prod.tf b/fast/stages/2-networking-c-nva/spoke-prod.tf
index 8dd5af441c..9895950933 100644
--- a/fast/stages/2-networking-c-nva/spoke-prod.tf
+++ b/fast/stages/2-networking-c-nva/spoke-prod.tf
@@ -44,11 +44,13 @@ module "prod-spoke-project" {
}
module "prod-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.prod-spoke-project.project_id
- name = "prod-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/prod"
+ source = "../../../modules/net-vpc"
+ project_id = module.prod-spoke-project.project_id
+ name = "prod-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
+ }
delete_default_routes_on_create = true
psa_config = try(var.psa_ranges.prod, null)
# Set explicit routes for googleapis; send everything else to NVAs
diff --git a/fast/stages/2-networking-d-separate-envs/spoke-dev.tf b/fast/stages/2-networking-d-separate-envs/spoke-dev.tf
index b5b485bea8..61562f4483 100644
--- a/fast/stages/2-networking-d-separate-envs/spoke-dev.tf
+++ b/fast/stages/2-networking-d-separate-envs/spoke-dev.tf
@@ -46,12 +46,14 @@ module "dev-spoke-project" {
}
module "dev-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.dev-spoke-project.project_id
- name = "dev-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/dev"
- psa_config = try(var.psa_ranges.dev, null)
+ source = "../../../modules/net-vpc"
+ project_id = module.dev-spoke-project.project_id
+ name = "dev-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
+ }
+ psa_config = try(var.psa_ranges.dev, null)
# set explicit routes for googleapis in case the default route is deleted
create_googleapis_routes = {
private = true
diff --git a/fast/stages/2-networking-d-separate-envs/spoke-prod.tf b/fast/stages/2-networking-d-separate-envs/spoke-prod.tf
index bf43728d04..7b42f54682 100644
--- a/fast/stages/2-networking-d-separate-envs/spoke-prod.tf
+++ b/fast/stages/2-networking-d-separate-envs/spoke-prod.tf
@@ -45,12 +45,14 @@ module "prod-spoke-project" {
}
module "prod-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.prod-spoke-project.project_id
- name = "prod-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/prod"
- psa_config = try(var.psa_ranges.prod, null)
+ source = "../../../modules/net-vpc"
+ project_id = module.prod-spoke-project.project_id
+ name = "prod-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
+ }
+ psa_config = try(var.psa_ranges.prod, null)
# set explicit routes for googleapis in case the default route is deleted
create_googleapis_routes = {
private = true
diff --git a/fast/stages/2-networking-e-nva-bgp/landing.tf b/fast/stages/2-networking-e-nva-bgp/landing.tf
index ab6c94eb4a..07331717cc 100644
--- a/fast/stages/2-networking-e-nva-bgp/landing.tf
+++ b/fast/stages/2-networking-e-nva-bgp/landing.tf
@@ -55,7 +55,9 @@ module "landing-untrusted-vpc" {
logging = false
}
create_googleapis_routes = null
- data_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted"
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/landing-untrusted"
+ }
}
module "landing-untrusted-firewall" {
@@ -111,7 +113,9 @@ module "landing-trusted-vpc" {
name = "prod-trusted-landing-0"
delete_default_routes_on_create = true
mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/landing-trusted"
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/landing-trusted"
+ }
dns_policy = {
inbound = true
}
diff --git a/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf b/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf
index 0c70b5507a..56b65e3999 100644
--- a/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf
+++ b/fast/stages/2-networking-e-nva-bgp/spoke-dev.tf
@@ -45,11 +45,13 @@ module "dev-spoke-project" {
}
module "dev-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.dev-spoke-project.project_id
- name = "dev-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/dev"
+ source = "../../../modules/net-vpc"
+ project_id = module.dev-spoke-project.project_id
+ name = "dev-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/dev"
+ }
delete_default_routes_on_create = true
psa_config = try(var.psa_ranges.dev, null)
# Set explicit routes for googleapis; send everything else to NVAs
diff --git a/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf b/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf
index c0ba44147c..6ae49dee98 100644
--- a/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf
+++ b/fast/stages/2-networking-e-nva-bgp/spoke-prod.tf
@@ -44,11 +44,13 @@ module "prod-spoke-project" {
}
module "prod-spoke-vpc" {
- source = "../../../modules/net-vpc"
- project_id = module.prod-spoke-project.project_id
- name = "prod-spoke-0"
- mtu = 1500
- data_folder = "${var.factories_config.data_dir}/subnets/prod"
+ source = "../../../modules/net-vpc"
+ project_id = module.prod-spoke-project.project_id
+ name = "prod-spoke-0"
+ mtu = 1500
+ factories_config = {
+ subnets_folder = "${var.factories_config.data_dir}/subnets/prod"
+ }
delete_default_routes_on_create = true
psa_config = try(var.psa_ranges.prod, null)
# Set explicit routes for googleapis; send everything else to NVAs
diff --git a/modules/net-vpc/README.md b/modules/net-vpc/README.md
index 3be4d37ddf..976dd3fd23 100644
--- a/modules/net-vpc/README.md
+++ b/modules/net-vpc/README.md
@@ -112,38 +112,34 @@ module "vpc" {
name = "subnet-1"
region = "europe-west1"
ip_cidr_range = "10.0.1.0/24"
+ iam = {
+ "roles/compute.networkUser" = [
+ "user:user1@example.com", "group:group1@example.com"
+ ]
+ }
+ iam_bindings = {
+ "roles/compute.networkUser" = {
+ members = ["group:group2@example.com"]
+ condition = {
+ expression = "resource.matchTag('123456789012/env', 'prod')"
+ title = "test_condition"
+ }
+ }
+ }
},
{
name = "subnet-2"
region = "europe-west1"
ip_cidr_range = "10.0.1.0/24"
- }
- ]
- subnet_iam = {
- "europe-west1/subnet-1" = {
- "roles/compute.networkUser" = [
- "user:user1@example.com", "group:group1@example.com"
- ]
- }
- }
- subnet_iam_bindings = {
- "europe-west1/subnet-1" = {
- "roles/compute.networkUser" = {
- members = ["group:group2@example.com"]
- condition = {
- expression = "resource.matchTag('123456789012/env', 'prod')"
- title = "test_condition"
+ iam_bindings_additive = {
+ subnet-2-am1 = {
+ member = "user:am1@example.com"
+ role = "roles/compute.networkUser"
+ subnet = "europe-west1/subnet-2"
}
}
}
- }
- subnet_iam_bindings_additive = {
- subnet-2-am1 = {
- member = "user:am1@example.com"
- role = "roles/compute.networkUser"
- subnet = "europe-west1/subnet-2"
- }
- }
+ ]
}
# tftest modules=1 resources=8 inventory=subnet-iam.yaml
```
@@ -212,6 +208,15 @@ module "vpc-host" {
pods = "172.16.0.0/20"
services = "192.168.0.0/24"
}
+ iam = {
+ "roles/compute.networkUser" = [
+ local.service_project_1.cloud_services_service_account,
+ local.service_project_1.gke_service_account
+ ]
+ "roles/compute.securityAdmin" = [
+ local.service_project_1.gke_service_account
+ ]
+ }
}
]
shared_vpc_host = true
@@ -219,17 +224,6 @@ module "vpc-host" {
local.service_project_1.project_id,
local.service_project_2.project_id
]
- subnet_iam = {
- "europe-west1/subnet-1" = {
- "roles/compute.networkUser" = [
- local.service_project_1.cloud_services_service_account,
- local.service_project_1.gke_service_account
- ]
- "roles/compute.securityAdmin" = [
- local.service_project_1.gke_service_account
- ]
- }
- }
}
# tftest modules=1 resources=9 inventory=shared-vpc.yaml
```
@@ -350,10 +344,12 @@ The `net-vpc` module includes a subnet factory (see [Resource Factories](../../b
```hcl
module "vpc" {
- source = "./fabric/modules/net-vpc"
- project_id = "my-project"
- name = "my-network"
- data_folder = "config/subnets"
+ source = "./fabric/modules/net-vpc"
+ project_id = "my-project"
+ name = "my-network"
+ factories_config = {
+ subnets_folder = "config/subnets"
+ }
}
# tftest modules=1 resources=10 files=subnet-simple,subnet-simple-2,subnet-detailed,subnet-proxy,subnet-proxy-global,subnet-psc inventory=factory.yaml
```
@@ -379,38 +375,39 @@ description: Sample description
ip_cidr_range: 10.0.0.0/24
# optional attributes
enable_private_access: false # defaults to true
-iam: # grant roles/compute.networkUser
- - group:lorem@example.com
- - serviceAccount:fbz@prj.iam.gserviceaccount.com
- - user:foobar@example.com
+iam:
+ roles/compute.networkUser:
+ - group:lorem@example.com
+ - serviceAccount:fbz@prj.iam.gserviceaccount.com
+ - user:foobar@example.com
secondary_ip_ranges: # map of secondary ip ranges
secondary-range-a: 192.168.0.0/24
-flow_logs: # enable, set to empty map to use defaults
+flow_logs_config: # enable, set to empty map to use defaults
aggregation_interval: "INTERVAL_5_SEC"
flow_sampling: 0.5
metadata: "INCLUDE_ALL_METADATA"
- filter_expression: null
```
```yaml
# tftest-file id=subnet-proxy path=config/subnets/subnet-proxy.yaml
region: europe-west4
ip_cidr_range: 10.1.0.0/24
-purpose: REGIONAL_MANAGED_PROXY
+proxy_only: true
```
```yaml
# tftest-file id=subnet-proxy-global path=config/subnets/subnet-proxy-global.yaml
region: australia-southeast2
ip_cidr_range: 10.4.0.0/24
-purpose: GLOBAL_MANAGED_PROXY
+proxy_only: true
+global: true
```
```yaml
# tftest-file id=subnet-psc path=config/subnets/subnet-psc.yaml
region: europe-west4
ip_cidr_range: 10.2.0.0/24
-purpose: PRIVATE_SERVICE_CONNECT
+psc: true
```
### Custom Routes
@@ -539,30 +536,27 @@ module "vpc" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
-| [name](variables.tf#L93) | The name of the network being created. | string
| ✓ | |
-| [project_id](variables.tf#L109) | The ID of the project where this VPC will be created. | string
| ✓ | |
+| [name](variables.tf#L95) | The name of the network being created. | string
| ✓ | |
+| [project_id](variables.tf#L111) | The ID of the project where this VPC will be created. | string
| ✓ | |
| [auto_create_subnetworks](variables.tf#L17) | Set to true to create an auto mode subnet, defaults to custom mode. | bool
| | false
|
| [create_googleapis_routes](variables.tf#L23) | Toggle creation of googleapis private/restricted routes. Disabled when vpc creation is turned off, or when set to null. | object({…})
| | {}
|
-| [data_folder](variables.tf#L34) | An optional folder containing the subnet configurations in YaML format. | string
| | null
|
-| [delete_default_routes_on_create](variables.tf#L40) | Set to true to delete the default routes at creation time. | bool
| | false
|
-| [description](variables.tf#L46) | An optional description of this resource (triggers recreation on change). | string
| | "Terraform-managed."
|
-| [dns_policy](variables.tf#L52) | DNS policy setup for the VPC. | object({…})
| | null
|
-| [firewall_policy_enforcement_order](variables.tf#L65) | Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'. | string
| | "AFTER_CLASSIC_FIREWALL"
|
-| [ipv6_config](variables.tf#L77) | Optional IPv6 configuration for this network. | object({…})
| | {}
|
-| [mtu](variables.tf#L87) | Maximum Transmission Unit in bytes. The minimum value for this field is 1460 (the default) and the maximum value is 1500 bytes. | number
| | null
|
-| [peering_config](variables.tf#L98) | VPC peering configuration. | object({…})
| | null
|
-| [psa_config](variables.tf#L114) | The Private Service Access configuration for Service Networking. | object({…})
| | null
|
-| [routes](variables.tf#L124) | Network routes, keyed by name. | map(object({…}))
| | {}
|
-| [routing_mode](variables.tf#L145) | The network routing mode (default 'GLOBAL'). | string
| | "GLOBAL"
|
-| [shared_vpc_host](variables.tf#L155) | Enable shared VPC for this project. | bool
| | false
|
-| [shared_vpc_service_projects](variables.tf#L161) | Shared VPC service projects to register with this host. | list(string)
| | []
|
-| [subnet_iam](variables.tf#L167) | Subnet IAM bindings in {REGION/NAME => {ROLE => [MEMBERS]} format. | map(map(list(string)))
| | {}
|
-| [subnet_iam_bindings](variables.tf#L173) | Authoritative IAM bindings in {REGION/NAME => {ROLE => {members = [], condition = {}}}}. | map(map(object({…})))
| | {}
|
-| [subnet_iam_bindings_additive](variables.tf#L187) | Individual additive IAM bindings. Keys are arbitrary. | map(object({…}))
| | {}
|
-| [subnets](variables.tf#L203) | Subnet configuration. | list(object({…}))
| | []
|
-| [subnets_proxy_only](variables.tf#L230) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | list(object({…}))
| | []
|
-| [subnets_psc](variables.tf#L244) | List of subnets for Private Service Connect service producers. | list(object({…}))
| | []
|
-| [vpc_create](variables.tf#L256) | Create VPC. When set to false, uses a data source to reference existing VPC. | bool
| | true
|
+| [delete_default_routes_on_create](variables.tf#L34) | Set to true to delete the default routes at creation time. | bool
| | false
|
+| [description](variables.tf#L40) | An optional description of this resource (triggers recreation on change). | string
| | "Terraform-managed."
|
+| [dns_policy](variables.tf#L46) | DNS policy setup for the VPC. | object({…})
| | null
|
+| [factories_config](variables.tf#L59) | Paths to data files and folders that enable factory functionality. | object({…})
| | null
|
+| [firewall_policy_enforcement_order](variables.tf#L67) | Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'. | string
| | "AFTER_CLASSIC_FIREWALL"
|
+| [ipv6_config](variables.tf#L79) | Optional IPv6 configuration for this network. | object({…})
| | {}
|
+| [mtu](variables.tf#L89) | Maximum Transmission Unit in bytes. The minimum value for this field is 1460 (the default) and the maximum value is 1500 bytes. | number
| | null
|
+| [peering_config](variables.tf#L100) | VPC peering configuration. | object({…})
| | null
|
+| [psa_config](variables.tf#L116) | The Private Service Access configuration for Service Networking. | object({…})
| | null
|
+| [routes](variables.tf#L126) | Network routes, keyed by name. | map(object({…}))
| | {}
|
+| [routing_mode](variables.tf#L147) | The network routing mode (default 'GLOBAL'). | string
| | "GLOBAL"
|
+| [shared_vpc_host](variables.tf#L157) | Enable shared VPC for this project. | bool
| | false
|
+| [shared_vpc_service_projects](variables.tf#L163) | Shared VPC service projects to register with this host. | list(string)
| | []
|
+| [subnets](variables.tf#L169) | Subnet configuration. | list(object({…}))
| | []
|
+| [subnets_proxy_only](variables.tf#L215) | List of proxy-only subnets for Regional HTTPS or Internal HTTPS load balancers. Note: Only one proxy-only subnet for each VPC network in each region can be active. | list(object({…}))
| | []
|
+| [subnets_psc](variables.tf#L248) | List of subnets for Private Service Connect service producers. | list(object({…}))
| | []
|
+| [vpc_create](variables.tf#L279) | Create VPC. When set to false, uses a data source to reference existing VPC. | bool
| | true
|
## Outputs
diff --git a/modules/net-vpc/subnets.tf b/modules/net-vpc/subnets.tf
index 2dc1c33db7..f006503945 100644
--- a/modules/net-vpc/subnets.tf
+++ b/modules/net-vpc/subnets.tf
@@ -1,5 +1,5 @@
/**
- * Copyright 2022 Google LLC
+ * Copyright 2023 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,68 +18,112 @@
locals {
_factory_data = {
- for f in try(fileset(var.data_folder, "**/*.yaml"), []) :
- trimsuffix(basename(f), ".yaml") => yamldecode(file("${var.data_folder}/${f}"))
+ for f in try(fileset(var.factories_config.subnets_folder, "**/*.yaml"), []) :
+ trimsuffix(basename(f), ".yaml") => yamldecode(file("${var.factories_config.subnets_folder}/${f}"))
}
_factory_subnets = {
- for k, v in local._factory_data : "${v.region}/${try(v.name, k)}" => {
- name = try(v.name, k)
- ip_cidr_range = v.ip_cidr_range
- region = v.region
+ for k, v in local._factory_data :
+ "${v.region}/${try(v.name, k)}" => {
+ active = try(v.active, true)
description = try(v.description, null)
enable_private_access = try(v.enable_private_access, true)
- flow_logs_config = try(v.flow_logs, null)
- ipv6 = try(v.ipv6, null)
- secondary_ip_ranges = try(v.secondary_ip_ranges, null)
- iam = try(v.iam, [])
- iam_members = try(v.iam_members, [])
- purpose = try(v.purpose, null)
- active = try(v.active, null)
- global = null
+ flow_logs_config = can(v.flow_logs_config) ? {
+ aggregation_interval = try(v.flow_logs_config.aggregation_interval, null)
+ filter_expression = try(v.flow_logs_config.filter_expression, null)
+ flow_sampling = try(v.flow_logs_config.flow_sampling, null)
+ metadata = try(v.flow_logs_config.metadata, null)
+ metadata_fields = try(v.flow_logs_config.metadata_fields, null)
+ } : null
+ global = try(v.global, false)
+ ip_cidr_range = v.ip_cidr_range
+ ipv6 = can(v.ipv6) ? {
+ access_type = try(v.ipv6.access_type, "INTERNAL")
+ } : null
+ name = try(v.name, k)
+ region = v.region
+ secondary_ip_ranges = try(v.secondary_ip_ranges, null)
+ iam = try(v.iam, {})
+ iam_bindings = can(v.iam_bindings) ? {
+ for k2, v2 in v.iam_bindings :
+ k2 => {
+ members = v2.members
+ condition = can(v2.condition) ? {
+ expression = v2.condition.expression
+ title = v2.condition.title
+ description = try(v2.condition.description, null)
+ } : null
+ }
+ } : {}
+ iam_bindings_additive = can(v.iam_bindings_additive) ? {
+ for k2, v2 in v.iam_bindings_additive :
+ k2 => {
+ member = v2.member
+ role = v2.role
+ condition = can(v2.condition) ? {
+ expression = v2.condition.expression
+ title = v2.condition.title
+ description = try(v2.condition.description, null)
+ } : null
+ }
+ } : {}
+ _is_regular = !try(v.psc == true, false) && !try(v.proxy_only == true, false)
+ _is_psc = try(v.psc == true, false)
+ _is_proxy_only = try(v.proxy_only == true, false)
}
}
- _factory_subnets_iam = [
- for k, v in local._factory_subnets : {
- subnet = k
- role = "roles/compute.networkUser"
- members = v.iam
- } if v.purpose == null && v.iam != null
- ]
- _subnet_iam = flatten([
- for subnet, roles in(var.subnet_iam == null ? {} : var.subnet_iam) : [
- for role, members in roles : {
- members = members
- role = role
- subnet = subnet
- }
- ]
- ])
- subnet_iam = concat(
- [for k in local._factory_subnets_iam : k if length(k.members) > 0],
- local._subnet_iam
+
+ all_subnets = merge(
+ { for k, v in google_compute_subnetwork.subnetwork : k => v },
+ { for k, v in google_compute_subnetwork.proxy_only : k => v },
+ { for k, v in google_compute_subnetwork.psc : k => v }
)
+ subnet_iam = flatten(concat(
+ [
+ for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [
+ for role, members in s.iam :
+ {
+ role = role
+ members = members
+ subnet = "${s.region}/${s.name}"
+ }
+ ]
+ ],
+ ))
subnet_iam_bindings = flatten([
- for subnet, roles in(var.subnet_iam_bindings == null ? {} : var.subnet_iam_bindings) : [
- for role, data in roles : {
+ for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : [
+ for role, data in s.iam_bindings : {
role = role
- subnet = subnet
+ subnet = "${s.region}/${s.name}"
members = data.members
condition = data.condition
}
]
])
+ # note: all additive bindings share a single namespace for the key.
+ # In other words, if you have multiple additive bindings with the
+ # same name, only one will be used
+ subnet_iam_bindings_additive = merge([
+ for s in concat(var.subnets, var.subnets_psc, var.subnets_proxy_only, values(local._factory_subnets)) : {
+ for key, data in s.iam_bindings_additive :
+ key => {
+ role = data.role
+ subnet = "${s.region}/${s.name}"
+ member = data.member
+ condition = data.condition
+ }
+ }
+ ]...)
subnets = merge(
{ for s in var.subnets : "${s.region}/${s.name}" => s },
- { for k, v in local._factory_subnets : k => v if v.purpose == null }
+ { for k, v in local._factory_subnets : k => v if v._is_regular }
)
subnets_proxy_only = merge(
{ for s in var.subnets_proxy_only : "${s.region}/${s.name}" => s },
- { for k, v in local._factory_subnets : k => v if v.purpose == "REGIONAL_MANAGED_PROXY" },
- { for k, v in local._factory_subnets : k => v if v.purpose == "GLOBAL_MANAGED_PROXY" }
+ { for k, v in local._factory_subnets : k => v if v._is_proxy_only },
)
subnets_psc = merge(
{ for s in var.subnets_psc : "${s.region}/${s.name}" => s },
- { for k, v in local._factory_subnets : k => v if v.purpose == "PRIVATE_SERVICE_CONNECT" }
+ { for k, v in local._factory_subnets : k => v if v._is_psc }
)
}
@@ -130,19 +174,12 @@ resource "google_compute_subnetwork" "proxy_only" {
name = each.value.name
region = each.value.region
ip_cidr_range = each.value.ip_cidr_range
- description = (
- each.value.description == null
- ? "Terraform-managed proxy-only subnet for Regional HTTPS, Internal HTTPS or Cross-Regional HTTPS Internal LB."
- : each.value.description
- )
- purpose = try(
- each.value.purpose,
- each.value.global == true
- ? "GLOBAL_MANAGED_PROXY"
- : "REGIONAL_MANAGED_PROXY"
+ description = coalesce(
+ each.value.description,
+ "Terraform-managed proxy-only subnet for Regional HTTPS, Internal HTTPS or Cross-Regional HTTPS Internal LB."
)
-
- role = each.value.active != false ? "ACTIVE" : "BACKUP"
+ purpose = each.value.global ? "GLOBAL_MANAGED_PROXY" : "REGIONAL_MANAGED_PROXY"
+ role = each.value.active ? "ACTIVE" : "BACKUP"
}
resource "google_compute_subnetwork" "psc" {
@@ -152,22 +189,22 @@ resource "google_compute_subnetwork" "psc" {
name = each.value.name
region = each.value.region
ip_cidr_range = each.value.ip_cidr_range
- description = (
- each.value.description == null
- ? "Terraform-managed subnet for Private Service Connect (PSC NAT)."
- : each.value.description
+ description = coalesce(
+ each.value.description,
+ "Terraform-managed subnet for Private Service Connect (PSC NAT)."
)
purpose = "PRIVATE_SERVICE_CONNECT"
}
+
resource "google_compute_subnetwork_iam_binding" "authoritative" {
for_each = {
for binding in local.subnet_iam :
"${binding.subnet}.${binding.role}" => binding
}
project = var.project_id
- subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
- region = google_compute_subnetwork.subnetwork[each.value.subnet].region
+ subnetwork = local.all_subnets[each.value.subnet].name
+ region = local.all_subnets[each.value.subnet].region
role = each.value.role
members = each.value.members
}
@@ -178,8 +215,8 @@ resource "google_compute_subnetwork_iam_binding" "bindings" {
"${binding.subnet}.${binding.role}.${try(binding.condition.title, "")}" => binding
}
project = var.project_id
- subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
- region = google_compute_subnetwork.subnetwork[each.value.subnet].region
+ subnetwork = local.all_subnets[each.value.subnet].name
+ region = local.all_subnets[each.value.subnet].region
role = each.value.role
members = each.value.members
dynamic "condition" {
@@ -192,13 +229,11 @@ resource "google_compute_subnetwork_iam_binding" "bindings" {
}
}
-# TODO: merge factory subnet IAM members
-
resource "google_compute_subnetwork_iam_member" "bindings" {
- for_each = var.subnet_iam_bindings_additive
+ for_each = local.subnet_iam_bindings_additive
project = var.project_id
- subnetwork = google_compute_subnetwork.subnetwork[each.value.subnet].name
- region = google_compute_subnetwork.subnetwork[each.value.subnet].region
+ subnetwork = local.all_subnets[each.value.subnet].name
+ region = local.all_subnets[each.value.subnet].region
role = each.value.role
member = each.value.member
dynamic "condition" {
diff --git a/modules/net-vpc/variables.tf b/modules/net-vpc/variables.tf
index 30d7afd3f7..439b5a56f1 100644
--- a/modules/net-vpc/variables.tf
+++ b/modules/net-vpc/variables.tf
@@ -31,12 +31,6 @@ variable "create_googleapis_routes" {
default = {}
}
-variable "data_folder" {
- description = "An optional folder containing the subnet configurations in YaML format."
- type = string
- default = null
-}
-
variable "delete_default_routes_on_create" {
description = "Set to true to delete the default routes at creation time."
type = bool
@@ -62,6 +56,14 @@ variable "dns_policy" {
default = null
}
+variable "factories_config" {
+ description = "Paths to data files and folders that enable factory functionality."
+ type = object({
+ subnets_folder = string
+ })
+ default = null
+}
+
variable "firewall_policy_enforcement_order" {
description = "Order that Firewall Rules and Firewall Policies are evaluated. Can be either 'BEFORE_CLASSIC_FIREWALL' or 'AFTER_CLASSIC_FIREWALL'."
type = string
@@ -164,42 +166,6 @@ variable "shared_vpc_service_projects" {
default = []
}
-variable "subnet_iam" {
- description = "Subnet IAM bindings in {REGION/NAME => {ROLE => [MEMBERS]} format."
- type = map(map(list(string)))
- default = {}
-}
-
-variable "subnet_iam_bindings" {
- description = "Authoritative IAM bindings in {REGION/NAME => {ROLE => {members = [], condition = {}}}}."
- type = map(map(object({
- members = list(string)
- condition = optional(object({
- expression = string
- title = string
- description = optional(string)
- }))
- })))
- nullable = false
- default = {}
-}
-
-variable "subnet_iam_bindings_additive" {
- description = "Individual additive IAM bindings. Keys are arbitrary."
- type = map(object({
- member = string
- role = string
- subnet = string
- condition = optional(object({
- expression = string
- title = string
- description = optional(string)
- }))
- }))
- nullable = false
- default = {}
-}
-
variable "subnets" {
description = "Subnet configuration."
type = list(object({
@@ -222,6 +188,25 @@ variable "subnets" {
# enable_private_access = optional(string)
}))
secondary_ip_ranges = optional(map(string))
+
+ iam = optional(map(list(string)), {})
+ iam_bindings = optional(map(object({
+ members = list(string)
+ condition = optional(object({
+ expression = string
+ title = string
+ description = optional(string)
+ }))
+ })), {})
+ iam_bindings_additive = optional(map(object({
+ member = string
+ role = string
+ condition = optional(object({
+ expression = string
+ title = string
+ description = optional(string)
+ }))
+ })), {})
}))
default = []
nullable = false
@@ -234,8 +219,27 @@ variable "subnets_proxy_only" {
ip_cidr_range = string
region = string
description = optional(string)
- active = bool
+ active = optional(bool, true)
global = optional(bool, false)
+
+ iam = optional(map(list(string)), {})
+ iam_bindings = optional(map(object({
+ members = list(string)
+ condition = optional(object({
+ expression = string
+ title = string
+ description = optional(string)
+ }))
+ })), {})
+ iam_bindings_additive = optional(map(object({
+ member = string
+ role = string
+ condition = optional(object({
+ expression = string
+ title = string
+ description = optional(string)
+ }))
+ })), {})
}))
default = []
nullable = false
@@ -248,6 +252,25 @@ variable "subnets_psc" {
ip_cidr_range = string
region = string
description = optional(string)
+
+ iam = optional(map(list(string)), {})
+ iam_bindings = optional(map(object({
+ members = list(string)
+ condition = optional(object({
+ expression = string
+ title = string
+ description = optional(string)
+ }))
+ })), {})
+ iam_bindings_additive = optional(map(object({
+ member = string
+ role = string
+ condition = optional(object({
+ expression = string
+ title = string
+ description = optional(string)
+ }))
+ })), {})
}))
default = []
nullable = false