NCC in 2-net-a-simple

fast/stages/2-networking-a-simple/main.tf

@@ -21,7 +21,11 @@ locals {
     for k, v in coalesce(var.service_accounts, {}) :
     k => "serviceAccount:${v}" if v != null
   }
-  spoke_connection = var.spoke_configs.peering_configs != null ? "peering" : "vpn"
+  spoke_connection = coalesce(
+    var.spoke_configs.peering_configs != null ? "peering" : null,
+    var.spoke_configs.vpn_configs != null ? "vpn" : null,
+    var.spoke_configs.ncc_configs != null ? "ncc" : null,
+  )
   stage3_sas_delegated_grants = [
     "roles/composer.sharedVpcAgent",
     "roles/compute.networkUser",

fast/stages/2-networking-a-simple/monitoring-vpn.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

fast/stages/2-networking-a-simple/monitoring.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

fast/stages/2-networking-a-simple/net-landing.tf

@@ -22,13 +22,18 @@ module "landing-project" {
   name            = "prod-net-landing-0"
   parent          = var.folder_ids.networking-prod
   prefix          = var.prefix
-  services = [
+  services = concat([
     "compute.googleapis.com",
     "dns.googleapis.com",
     "iap.googleapis.com",
     "networkmanagement.googleapis.com",
     "stackdriver.googleapis.com"
-  ]
+    ], (
+    local.spoke_connection == "ncc"
+    ? ["networkconnectivity.googleapis.com"]
+    : []
+    )
+  )
   shared_vpc_host_config = {
     enabled = true
   }
@@ -59,6 +64,7 @@ module "landing-vpc" {
 }
 
 module "landing-firewall" {
+  count      = local.spoke_connection != "ncc" ? 1 : 0
   source     = "../../../modules/net-vpc-firewall"
   project_id = module.landing-project.project_id
   network    = module.landing-vpc.name
@@ -73,7 +79,7 @@ module "landing-firewall" {
 
 module "landing-nat-primary" {
   source         = "../../../modules/net-cloudnat"
-  count          = var.enable_cloud_nat ? 1 : 0
+  count          = var.enable_cloud_nat && local.spoke_connection != "ncc" ? 1 : 0
   project_id     = module.landing-project.project_id
   region         = var.regions.primary
   name           = local.region_shortnames[var.regions.primary]

fast/stages/2-networking-a-simple/outputs.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

fast/stages/2-networking-a-simple/spoke-ncc.tf

@@ -0,0 +1,63 @@
+/**
+ * Copyright 2024 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+# tfdoc:file:description Peerings between landing and spokes.
+
+resource "google_network_connectivity_hub" "default" {
+  count       = local.spoke_connection == "ncc" ? 1 : 0
+  name        = "hub"
+  description = "Hub"
+  project     = module.landing-project.project_id
+}
+
+resource "google_network_connectivity_spoke" "spoke-dev" {
+  count       = local.spoke_connection == "ncc" ? 1 : 0
+  name        = "dev-spoke-0"
+  project     = module.dev-spoke-project.id
+  location    = "global"
+  description = "NCC Spoke dev"
+  hub         = google_network_connectivity_hub.default[0].id
+  linked_vpc_network {
+    uri                   = module.dev-spoke-vpc.self_link
+    exclude_export_ranges = var.spoke_configs.ncc_configs.dev.exclude_export_ranges
+  }
+}
+
+resource "google_network_connectivity_spoke" "spoke-prod" {
+  count       = local.spoke_connection == "ncc" ? 1 : 0
+  name        = "prod-spoke-0"
+  project     = module.prod-spoke-project.id
+  location    = "global"
+  description = "NCC Spoke prod"
+  hub         = google_network_connectivity_hub.default[0].id
+  linked_vpc_network {
+    uri                   = module.prod-spoke-vpc.self_link
+    exclude_export_ranges = var.spoke_configs.ncc_configs.prod.exclude_export_ranges
+  }
+}
+
+resource "google_network_connectivity_spoke" "onprem-primary-vpn" {
+  count       = local.spoke_connection == "ncc" && var.vpn_onprem_primary_config != null ? 1 : 0
+  name        = "onprem-primary-vpn"
+  location    = var.regions.primary
+  project     = module.landing-project.project_id
+  description = "Onprem primary VPN spoke"
+  hub         = google_network_connectivity_hub.default[0].id
+  linked_vpn_tunnels {
+    site_to_site_data_transfer = false
+    uris                       = [for _, v in module.landing-to-onprem-primary-vpn[0].tunnel_self_links : v]
+  }
+}

fast/stages/2-networking-a-simple/spoke-peerings.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,11 +16,6 @@
 
 # tfdoc:file:description Peerings between landing and spokes.
 
-moved {
-  from = module.peering-dev
-  to   = module.peering-dev[0]
-}
-
 module "peering-dev" {
   count         = local.spoke_connection == "peering" ? 1 : 0
   source        = "../../../modules/net-vpc-peering"
@@ -30,11 +25,6 @@ module "peering-dev" {
   routes_config = var.spoke_configs.peering_configs.dev
 }
 
-moved {
-  from = module.peering-prod
-  to   = module.peering-prod[0]
-}
-
 module "peering-prod" {
   count         = local.spoke_connection == "peering" ? 1 : 0
   source        = "../../../modules/net-vpc-peering"

fast/stages/2-networking-a-simple/spoke-vpns.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -36,11 +36,6 @@ locals {
   }
 }
 
-moved {
-  from = module.landing-to-spokes-primary-vpn
-  to   = module.landing-to-spokes-primary-vpn[0]
-}
-
 module "landing-to-spokes-primary-vpn" {
   count      = local.spoke_connection == "vpn" ? 1 : 0
   source     = "../../../modules/net-vpn-ha"
@@ -96,11 +91,6 @@ module "landing-to-spokes-primary-vpn" {
   }
 }
 
-moved {
-  from = module.landing-to-spokes-secondary-vpn
-  to   = module.landing-to-spokes-secondary-vpn[1]
-}
-
 module "landing-to-spokes-secondary-vpn" {
   count      = local.spoke_connection == "vpn" ? 1 : 0
   source     = "../../../modules/net-vpn-ha"
@@ -137,11 +127,6 @@ module "landing-to-spokes-secondary-vpn" {
   }
 }
 
-moved {
-  from = module.dev-to-landing-primary-vpn
-  to   = module.dev-to-landing-primary-vpn[1]
-}
-
 module "dev-to-landing-primary-vpn" {
   count      = local.spoke_connection == "vpn" ? 1 : 0
   source     = "../../../modules/net-vpn-ha"
@@ -178,11 +163,6 @@ module "dev-to-landing-primary-vpn" {
   }
 }
 
-moved {
-  from = module.prod-to-landing-primary-vpn
-  to   = module.prod-to-landing-primary-vpn[1]
-}
-
 module "prod-to-landing-primary-vpn" {
   count      = local.spoke_connection == "vpn" ? 1 : 0
   source     = "../../../modules/net-vpn-ha"
@@ -219,10 +199,6 @@ module "prod-to-landing-primary-vpn" {
   }
 }
 
-moved {
-  from = module.prod-to-landing-secondary-vpn
-  to   = module.prod-to-landing-secondary-vpn[1]
-}
 module "prod-to-landing-secondary-vpn" {
   count      = local.spoke_connection == "vpn" ? 1 : 0
   source     = "../../../modules/net-vpn-ha"

fast/stages/2-networking-a-simple/test-resources.tf

@@ -17,29 +17,33 @@
 # tfdoc:file:description Temporary instances for testing
 
 locals {
-  test-vms = var.create_test_instances != true ? {} : {
-    dev-spoke-primary = {
-      region     = var.regions.primary
-      project_id = module.dev-spoke-project.project_id
-      zone       = "b"
-      network    = module.dev-spoke-vpc.self_link
-      subnetwork = module.dev-spoke-vpc.subnet_self_links["${var.regions.primary}/dev-default"]
-    }
-    landing-primary = {
-      region     = var.regions.primary
-      project_id = module.landing-project.project_id
-      zone       = "b"
-      network    = module.landing-vpc.self_link
-      subnetwork = module.landing-vpc.subnet_self_links["${var.regions.primary}/landing-default"]
-    }
-    prod-spoke-primary = {
-      region     = var.regions.primary
-      project_id = module.prod-spoke-project.project_id
-      zone       = "b"
-      network    = module.prod-spoke-vpc.self_link
-      subnetwork = module.prod-spoke-vpc.subnet_self_links["${var.regions.primary}/prod-default"]
-    }
-  }
+  test-vms = var.create_test_instances != true ? {} : merge(
+    {
+      dev-spoke-primary = {
+        region     = var.regions.primary
+        project_id = module.dev-spoke-project.project_id
+        zone       = "b"
+        network    = module.dev-spoke-vpc.self_link
+        subnetwork = module.dev-spoke-vpc.subnet_self_links["${var.regions.primary}/dev-default"]
+      }
+      prod-spoke-primary = {
+        region     = var.regions.primary
+        project_id = module.prod-spoke-project.project_id
+        zone       = "b"
+        network    = module.prod-spoke-vpc.self_link
+        subnetwork = module.prod-spoke-vpc.subnet_self_links["${var.regions.primary}/prod-default"]
+      }
+    },
+    local.spoke_connection == "ncc" ? {} :
+    {
+      landing-primary = {
+        region     = var.regions.primary
+        project_id = module.landing-project.project_id
+        zone       = "b"
+        network    = module.landing-vpc.self_link
+        subnetwork = module.landing-vpc.subnet_self_links["${var.regions.primary}/landing-default"]
+      }
+  })
 }
 
 module "test-vms" {

fast/stages/2-networking-a-simple/variables.tf

@@ -130,6 +130,18 @@ variable "regions" {
 variable "spoke_configs" {
   description = "Spoke connectivity configurations."
   type = object({
+    ncc_configs = optional(object({
+      dev = optional(object({
+        exclude_export_ranges = list(string)
+        }), {
+        exclude_export_ranges = []
+      })
+      prod = optional(object({
+        exclude_export_ranges = list(string)
+        }), {
+        exclude_export_ranges = []
+      })
+    }))
     peering_configs = optional(object({
       dev = optional(object({
         export        = optional(bool, true)
@@ -172,8 +184,14 @@ variable "spoke_configs" {
     peering_configs = {}
   }
   validation {
-    condition     = (var.spoke_configs.peering_configs == null) != (var.spoke_configs.vpn_configs == null)
-    error_message = "Only one of `var.spoke_configs.peering_configs` or `var.spoke_configs.vpn_configs` must be configured."
+    condition = length(
+      compact([
+        var.spoke_configs.peering_configs != null ? "peering" : null,
+        var.spoke_configs.vpn_configs != null ? "vpn" : null,
+        var.spoke_configs.ncc_configs != null ? "ncc" : null,
+      ])
+    ) == 1
+    error_message = "Only one of `var.spoke_configs.ncc_configs`, `var.spoke_configs.peering_configs` or `var.spoke_configs.vpn_configs` must be configured."
   }
 }
 

fast/stages/2-networking-a-simple/vpn-onprem.tf

@@ -1,5 +1,5 @@
 /**
- * Copyright 2022 Google LLC
+ * Copyright 2024 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

fast/stages/2-networking-c-separate-envs/data/subnets/dev/dev-dataplatform.yaml

@@ -1,9 +1,9 @@
 # skip boilerplate check
 
 name: dev-dataplatform
-region: europe-west1
+region: primary
 description: Default subnet for dev Data Platform
 ip_cidr_range: 10.68.2.0/24
 secondary_ip_ranges:
-   pods: 100.69.0.0/16
-   services: 100.71.2.0/24
+  pods: 100.69.0.0/16
+  services: 100.71.2.0/24

tests/fast/stages/s2_networking_a_simple/ncc.tfvars

@@ -0,0 +1,41 @@
+automation = {
+  outputs_bucket = "test"
+}
+billing_account = {
+  id = "000000-111111-222222"
+}
+custom_roles = {
+  service_project_network_admin = "organizations/123456789012/roles/foo"
+}
+dns = {
+  resolvers      = ["10.10.10.10"]
+  enable_logging = true
+}
+enable_cloud_nat   = true
+essential_contacts = "[email protected]"
+folder_ids = {
+  networking      = null
+  networking-dev  = null
+  networking-prod = null
+}
+groups = {
+  gcp-network-admins = "gcp-vpc-network-admins"
+}
+organization = {
+  domain      = "fast.example.com"
+  id          = 123456789012
+  customer_id = "C00000000"
+}
+prefix = "fast2"
+service_accounts = {
+  data-platform-dev    = "string"
+  data-platform-prod   = "string"
+  gke-dev              = "string"
+  gke-prod             = "string"
+  project-factory      = "string"
+  project-factory-dev  = "string"
+  project-factory-prod = "string"
+}
+spoke_configs = {
+  ncc_configs = {}
+}