3-networks

3-networks

The purpose of this step is to:

• Setup the global DNS Hub.
• Setup base and restricted shared VPCs with default DNS, NAT (optional), Private Service networking, VPC service controls, onprem dedicated interconnect and baseline firewall rules for each environment.

Prerequisites

1. 0-bootstrap executed successfully.
2. 1-org executed successfully.
3. 2-environments executed successfully.
4. Obtain the value for the access_context_manager_policy_id variable. Can be obtained by running gcloud access-context-manager policies list --organization YOUR-ORGANIZATION_ID --format="value(name)".

Usage

Using Dedicated Interconnect

If you have the prerequisites listed in the Dedicated Interconnect README follow this steps to enable Dedicated Interconnect to access onprem.

1. Rename interconnect.tf.example to interconnect.tf in each environment folder in 3-networks/envs/<ENV>
2. Update the file interconnect.tf with values that are valid for your environment for the interconnects, locations, candidate subnetworks, vlan_tag8021q and peer info.
3. The candidate subnetworks and vlan_tag8021q variables can be set to null to allow the interconnect module to auto generate these values.

OPTIONAL - Using High Availability VPN

If you are not able to use dedicated interconnect, you can also use an HA VPN to access onprem.

1. Rename vpn.tf.example to vpn.tf in each environment folder in 3-networks/envs/<ENV>
2. Create secret for VPN private preshared key echo '<YOUR-PRESHARED-KEY-SECRET>' | gcloud secrets create <VPN_PRIVATE_PSK_SECRET_NAME> --project <ENV_SECRETS_PROJECT> --replication-policy=automatic --data-file=-
3. Create secret for VPN restricted preshared key echo '<YOUR-PRESHARED-KEY-SECRET>' | gcloud secrets create <VPN_RESTRICTED_PSK_SECRET_NAME> --project <ENV_SECRETS_PROJECT> --replication-policy=automatic --data-file=-
4. Update in the file vpn.tf the values for environment, vpn_psk_secret_name, on_prem_router_ip_address1, on_prem_router_ip_address2 and bgp_peer_asn.
5. Verify other default values are valid for your environment.

Setup to run via Cloud Build

1. Clone repo gcloud source repos clone gcp-networks --project=YOUR_CLOUD_BUILD_PROJECT_ID
2. Change to the freshly cloned repo and change to non-master branch git checkout -b plan
3. Copy contents of foundation to new repo cp -RT ../terraform-example-foundation/3-networks/ . (modify accordingly based on your current directory).
4. Copy cloud build configuration files for terraform cp ../terraform-example-foundation/build/cloudbuild-tf-* . (modify accordingly based on your current directory)
5. Copy terraform wrapper script cp ../terraform-example-foundation/build/tf-wrapper.sh . to the root of your new repository (modify accordingly based on your current directory).
6. Ensure wrapper script can be executed chmod 755 ./tf-wrapper.sh.
7. Rename common.auto.example.tfvars to common.auto.tfvars and update the file with values from your environment and bootstrap.
8. Rename shared.auto.example.tfvars to shared.auto.tfvars and update the file with the target_name_server_addresses (the list of target name servers for the DNS forwarding zone in the DNS Hub).
9. Rename access_context.auto.example.tfvars to access_context.auto.tfvars and update the file with the access_context_manager_policy_id.
10. Commit changes with git add . and git commit -m 'Your message'
11. You will need only once to manually plan + apply the shared environment since development, non-production and production depend on it.
    1. cd to ./envs/shared/
    2. Update backend.tf with your bucket name from the bootstrap step.
    3. Run terraform init
    4. Run terraform plan and review output
    5. Run terraform apply
    6. If you would like the bucket to be replaced by cloud build at run time, change the bucket name back to UPDATE_ME
12. Push your plan branch to trigger a plan git push --set-upstream origin plan (the branch plan is not a special one. Any branch which name is different from development, non-production or production will trigger a terraform plan).
    1. Review the plan output in your cloud build project https://console.cloud.google.com/cloud-build/builds?project=YOUR_CLOUD_BUILD_PROJECT_ID
13. Merge changes to production with git checkout -b production and git push origin production
    1. Review the apply output in your cloud build project https://console.cloud.google.com/cloud-build/builds?project=YOUR_CLOUD_BUILD_PROJECT_ID
14. After production has been applied, apply development and non-production
15. Merge changes to development with git checkout -b development and git push origin development
    1. Review the apply output in your cloud build project https://console.cloud.google.com/cloud-build/builds?project=YOUR_CLOUD_BUILD_PROJECT_ID
16. Merge changes to non-production with git checkout -b non-production and git push origin non-production
    1. Review the apply output in your cloud build project https://console.cloud.google.com/cloud-build/builds?project=YOUR_CLOUD_BUILD_PROJECT_ID

Setup to run via Jenkins

1. Clone the repo you created manually in bootstrap: git clone <YOUR_NEW_REPO-3-networks>

2. Navigate into the repo cd YOUR_NEW_REPO_CLONE-3-networks and change to a non production branch git checkout -b plan (the branch plan is not a special one. Any branch which name is different from development, non-production or production will trigger a terraform plan).

3. Copy contents of foundation to new repo cp -RT ../terraform-example-foundation/3-networks/ . (modify accordingly based on your current directory).

4. Copy the Jenkinsfile script cp ../terraform-example-foundation/build/Jenkinsfile . to the root of your new repository (modify accordingly based on your current directory).

5. Update the variables located in the environment {} section of the Jenkinsfile with values from your environment:

   _POLICY_REPO (optional)
   _TF_SA_EMAIL
   _STATE_BUCKET_NAME
   

6. Copy terraform wrapper script cp ../terraform-example-foundation/build/tf-wrapper.sh . to the root of your new repository (modify accordingly based on your current directory).

7. Ensure wrapper script can be executed chmod 755 ./tf-wrapper.sh.

8. Rename common.auto.example.tfvars to common.auto.tfvars and update the file with values from your environment and bootstrap.

9. Rename shared.auto.example.tfvars to shared.auto.tfvars and update the file with the target_name_server_addresses.

10. Rename access_context.auto.example.tfvars to access_context.auto.tfvars and update the file with the access_context_manager_policy_id.

11. Commit changes with git add . and git commit -m 'Your message'

12. You will need to manually plan + apply the shared environment (only once) since development, non-production and production depend on it.

    1. cd to ./envs/shared/
    2. Update backend.tf with your bucket name from the bootstrap step.
    3. Run terraform init
    4. Run terraform plan and review output
    5. Run terraform apply
    6. If you would like the bucket to be replaced by cloud build at run time, change the bucket name back to UPDATE_ME

13. Push your plan branch git push --set-upstream origin plan. The branch plan is not a special one. Any branch which name is different from development, non-production or production will trigger a terraform plan.

    • Assuming you configured an automatic trigger in your Jenkins Master (see Jenkins sub-module README), this will trigger a plan. You can also trigger a Jenkins job manually. Given the many options to do this in Jenkins, it is out of the scope of this document see Jenkins website for more details.
    1. Review the plan output in your Master's web UI.

14. Merge changes to production branch with git checkout -b production and git push origin production

    1. Review the apply output in your Master's web UI (You might want to use the option to "Scan Multibranch Pipeline Now" in your Jenkins Master UI).

15. After production has been applied, apply development and non-production

16. Merge changes to development with git checkout -b development and git push origin development

    1. Review the apply output in your Master's web UI (You might want to use the option to "Scan Multibranch Pipeline Now" in your Jenkins Master UI).

17. Merge changes to non-production with git checkout -b non-production and git push origin non-production

    1. Review the apply output in your Master's web UI (You might want to use the option to "Scan Multibranch Pipeline Now" in your Jenkins Master UI).

18. You can now move to the instructions in the step 4-projects.

Run terraform locally

1. Change into 3-networks folder.
2. Run cp ../build/tf-wrapper.sh .
3. Run chmod 755 ./tf-wrapper.sh
4. Rename common.auto.example.tfvars to common.auto.tfvars and update the file with values from your environment and bootstrap.
5. Rename shared.auto.example.tfvars to shared.auto.tfvars and update the file with the target_name_server_addresses.
6. Rename access_context.auto.example.tfvars to access_context.auto.tfvars and update the file with the access_context_manager_policy_id.
7. Update backend.tf with your bucket from bootstrap. You can run for i in `find -name 'backend.tf'`; do sed -i 's/UPDATE_ME/<YOUR-BUCKET-NAME>/' $i; done. You can run terraform output gcs_bucket_tfstate in the 0-bootstrap folder to obtain the bucket name.

We will now deploy each of our environments(development/production/non-production) using this script. When using Cloud Build or Jenkins as your CI/CD tool each environment corresponds to a branch in the repository for 3-networks step and only the corresponding environment is applied.

1. Run ./tf-wrapper.sh init shared
2. Run ./tf-wrapper.sh plan shared and review output.
3. Run ./tf-wrapper.sh apply shared
4. Run ./tf-wrapper.sh init production
5. Run ./tf-wrapper.sh plan production and review output.
6. Run ./tf-wrapper.sh apply production
7. Run ./tf-wrapper.sh init non-production
8. Run ./tf-wrapper.sh plan non-production and review output.
9. Run ./tf-wrapper.sh apply non-production
10. Run ./tf-wrapper.sh init development
11. Run ./tf-wrapper.sh plan development and review output.
12. Run ./tf-wrapper.sh apply development

If you received any errors or made any changes to the Terraform config or any .tfvarsyou must re-run ./tf-wrapper.sh plan <env> before run ./tf-wrapper.sh apply <env>