Skip to content

Commit 02decb3

Browse files
renato-rudnickirenato-rudnicki
committed
removing base references
1 parent b6810c7 commit 02decb3

File tree

18 files changed

+57
-292
lines changed

18 files changed

+57
-292
lines changed

‎3-networks-hub-and-spoke/envs/shared/README.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,6 @@ The purpose of this step is to set up the global [DNS Hub](https://cloud.google.
5050

5151
## Outputs
5252

53-
| Name | Description |
54-
|------|-------------|
55-
| dns\_hub\_project\_id | The DNS hub project ID |
53+
No outputs.
5654

5755
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎3-networks-hub-and-spoke/envs/shared/net-hubs-transitivity.tf‎

Lines changed: 0 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,6 @@
1616

1717
locals {
1818
enable_transitivity = var.enable_hub_and_spoke_transitivity
19-
base_regional_aggregates = {
20-
(local.default_region1) = [
21-
"10.0.0.0/16",
22-
"100.64.0.0/16"
23-
]
24-
(local.default_region2) = [
25-
"10.1.0.0/16",
26-
"100.65.0.0/16"
27-
]
28-
}
2919
restricted_regional_aggregates = {
3020
(local.default_region1) = [
3121
"10.8.0.0/16",
@@ -38,40 +28,6 @@ locals {
3828
}
3929
}
4030

41-
/*
42-
* Base Network Transitivity
43-
*/
44-
45-
module "base_transitivity" {
46-
source = "../../modules/transitivity"
47-
count = local.enable_transitivity ? 1 : 0
48-
49-
project_id = local.base_net_hub_project_id
50-
regions = keys(local.base_subnet_primary_ranges)
51-
vpc_name = module.base_shared_vpc.network_name
52-
gw_subnets = { for region in keys(local.base_subnet_primary_ranges) : region => "sb-c-shared-base-hub-${region}" }
53-
regional_aggregates = local.base_regional_aggregates
54-
firewall_policy = module.base_shared_vpc.firewall_policy
55-
commands = [
56-
# Accept all ICMP (troubleshooting)
57-
"iptables -A INPUT -p icmp -j ACCEPT",
58-
# Accept SSH local traffic to the eth0 interface (health checking)
59-
"iptables -A INPUT -p tcp --dport 22 -d $(curl -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip) -j ACCEPT",
60-
# Drop everything else
61-
"iptables -A INPUT -j DROP",
62-
# Accept all return transit traffic for established flows
63-
"iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT",
64-
# Accept all transit traffic from internal ranges
65-
# Replace by actual multiple source/destination/proto/ports rules for fine-grained ACLs.
66-
"iptables -A FORWARD -s ${join(",", flatten(values(local.base_regional_aggregates)))} -d ${join(",", flatten(values(local.base_regional_aggregates)))} -j ACCEPT",
67-
# Drop everything else
68-
"iptables -A FORWARD -j DROP",
69-
# SNAT traffic not to the local eth0 interface
70-
"iptables -t nat -A POSTROUTING ! -d $(curl -H \"Metadata-Flavor: Google\" http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip) -j MASQUERADE",
71-
]
72-
73-
depends_on = [module.base_shared_vpc]
74-
}
7531

7632
/*
7733
* Restricted Network Transitivity

‎3-networks-hub-and-spoke/envs/shared/net-hubs.tf‎

Lines changed: 1 addition & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -167,81 +167,6 @@ locals {
167167
restricted_services_dry_run = length(var.custom_restricted_services) != 0 ? var.custom_restricted_services : local.supported_restricted_service
168168
}
169169

170-
/******************************************
171-
Base Network VPC
172-
*****************************************/
173-
174-
module "base_shared_vpc" {
175-
source = "../../modules/base_shared_vpc"
176-
177-
project_id = local.base_net_hub_project_id
178-
dns_hub_project_id = local.dns_hub_project_id
179-
environment_code = local.environment_code
180-
private_service_connect_ip = "10.17.0.1"
181-
bgp_asn_subnet = local.bgp_asn_number
182-
default_region1 = local.default_region1
183-
default_region2 = local.default_region2
184-
domain = var.domain
185-
dns_enable_inbound_forwarding = var.base_hub_dns_enable_inbound_forwarding
186-
dns_enable_logging = var.base_hub_dns_enable_logging
187-
firewall_enable_logging = var.base_hub_firewall_enable_logging
188-
nat_enabled = var.base_hub_nat_enabled
189-
nat_bgp_asn = var.base_hub_nat_bgp_asn
190-
nat_num_addresses_region1 = var.base_hub_nat_num_addresses_region1
191-
nat_num_addresses_region2 = var.base_hub_nat_num_addresses_region2
192-
windows_activation_enabled = var.base_hub_windows_activation_enabled
193-
mode = "hub"
194-
195-
subnets = [
196-
{
197-
subnet_name = "sb-c-shared-base-hub-${local.default_region1}"
198-
subnet_ip = local.base_subnet_primary_ranges[local.default_region1]
199-
subnet_region = local.default_region1
200-
subnet_private_access = "true"
201-
subnet_flow_logs = var.base_vpc_flow_logs.enable_logging
202-
subnet_flow_logs_interval = var.base_vpc_flow_logs.aggregation_interval
203-
subnet_flow_logs_sampling = var.base_vpc_flow_logs.flow_sampling
204-
subnet_flow_logs_metadata = var.base_vpc_flow_logs.metadata
205-
subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
206-
subnet_flow_logs_filter = var.base_vpc_flow_logs.filter_expr
207-
description = "Base network hub subnet for ${local.default_region1}"
208-
},
209-
{
210-
subnet_name = "sb-c-shared-base-hub-${local.default_region2}"
211-
subnet_ip = local.base_subnet_primary_ranges[local.default_region2]
212-
subnet_region = local.default_region2
213-
subnet_private_access = "true"
214-
subnet_flow_logs = var.base_vpc_flow_logs.enable_logging
215-
subnet_flow_logs_interval = var.base_vpc_flow_logs.aggregation_interval
216-
subnet_flow_logs_sampling = var.base_vpc_flow_logs.flow_sampling
217-
subnet_flow_logs_metadata = var.base_vpc_flow_logs.metadata
218-
subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
219-
subnet_flow_logs_filter = var.base_vpc_flow_logs.filter_expr
220-
description = "Base network hub subnet for ${local.default_region2}"
221-
},
222-
{
223-
subnet_name = "sb-c-shared-base-hub-${local.default_region1}-proxy"
224-
subnet_ip = local.base_subnet_proxy_ranges[local.default_region1]
225-
subnet_region = local.default_region1
226-
subnet_flow_logs = false
227-
description = "Base network hub proxy-only subnet for ${local.default_region1}"
228-
role = "ACTIVE"
229-
purpose = "REGIONAL_MANAGED_PROXY"
230-
},
231-
{
232-
subnet_name = "sb-c-shared-base-hub-${local.default_region2}-proxy"
233-
subnet_ip = local.base_subnet_proxy_ranges[local.default_region2]
234-
subnet_region = local.default_region2
235-
subnet_flow_logs = false
236-
description = "Base network hub proxy-only subnet for ${local.default_region2}"
237-
role = "ACTIVE"
238-
purpose = "REGIONAL_MANAGED_PROXY"
239-
}
240-
]
241-
secondary_ranges = {}
242-
243-
}
244-
245170
/******************************************
246171
Restricted Network VPC
247172
*****************************************/
@@ -251,7 +176,6 @@ module "restricted_shared_vpc" {
251176

252177
project_id = local.restricted_net_hub_project_id
253178
project_number = local.restricted_net_hub_project_number
254-
dns_hub_project_id = local.dns_hub_project_id
255179
environment_code = local.environment_code
256180
private_service_connect_ip = "10.17.0.5"
257181
access_context_manager_policy_id = var.access_context_manager_policy_id
@@ -279,6 +203,7 @@ module "restricted_shared_vpc" {
279203
nat_num_addresses_region1 = var.restricted_hub_nat_num_addresses_region1
280204
nat_num_addresses_region2 = var.restricted_hub_nat_num_addresses_region2
281205
windows_activation_enabled = var.restricted_hub_windows_activation_enabled
206+
target_name_server_addresses = var.target_name_server_addresses
282207
mode = "hub"
283208

284209
subnets = [

‎3-networks-hub-and-spoke/envs/shared/outputs.tf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,3 @@
1414
* limitations under the License.
1515
*/
1616

17-
output "dns_hub_project_id" {
18-
value = local.dns_hub_project_id
19-
description = "The DNS hub project ID"
20-
}

‎3-networks-hub-and-spoke/envs/shared/remote.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
*/
1616

1717
locals {
18-
dns_hub_project_id = data.terraform_remote_state.org.outputs.dns_hub_project_id
1918
interconnect_project_id = data.terraform_remote_state.org.outputs.interconnect_project_id
2019
interconnect_project_number = data.terraform_remote_state.org.outputs.interconnect_project_number
2120
parent_folder = data.terraform_remote_state.bootstrap.outputs.common_config.parent_folder
@@ -33,7 +32,6 @@ locals {
3332
development_folder_name = data.terraform_remote_state.env_development.outputs.env_folder
3433
nonproduction_folder_name = data.terraform_remote_state.env_nonproduction.outputs.env_folder
3534
production_folder_name = data.terraform_remote_state.env_production.outputs.env_folder
36-
base_net_hub_project_id = data.terraform_remote_state.org.outputs.base_net_hub_project_id
3735
restricted_net_hub_project_id = data.terraform_remote_state.org.outputs.restricted_net_hub_project_id
3836
restricted_net_hub_project_number = data.terraform_remote_state.org.outputs.restricted_net_hub_project_number
3937
organization_service_account = data.terraform_remote_state.bootstrap.outputs.organization_step_terraform_service_account_email

‎3-networks-hub-and-spoke/modules/base_env/README.md‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
| restricted\_subnet\_proxy\_ranges | The base proxy-only subnet primary IPTs ranges to the Restricted Shared Vpc. | `map(string)` | n/a | yes |
3434
| restricted\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Restricted Shared Vpc | `map(list(map(string)))` | n/a | yes |
3535
| restricted\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br> flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br> metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br> metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br> filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br> aggregation_interval = optional(string, "INTERVAL_5_SEC")<br> flow_sampling = optional(string, "0.5")<br> metadata = optional(string, "INCLUDE_ALL_METADATA")<br> metadata_fields = optional(list(string), [])<br> filter_expr = optional(string, "true")<br> })</pre> | `{}` | no |
36+
| target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | n/a | yes |
3637
| tfc\_org\_name | Name of the TFC organization | `string` | n/a | yes |
3738

3839
## Outputs
@@ -41,13 +42,6 @@
4142
|------|-------------|
4243
| access\_level\_name | Access context manager access level name for the enforced perimeter |
4344
| access\_level\_name\_dry\_run | Access context manager access level name for the dry-run perimeter |
44-
| base\_host\_project\_id | The base host project ID |
45-
| base\_network\_name | The name of the VPC being created |
46-
| base\_network\_self\_link | The URI of the VPC being created |
47-
| base\_subnets\_ips | The IPs and CIDRs of the subnets being created |
48-
| base\_subnets\_names | The names of the subnets being created |
49-
| base\_subnets\_secondary\_ranges | The secondary ranges associated with these subnets |
50-
| base\_subnets\_self\_links | The self-links of subnets being created |
5145
| enforce\_vpcsc | Enable the enforced mode for VPC Service Controls. It is not recommended to enable VPC-SC on the first run deploying your foundation. Review [best practices for enabling VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/enable), then only enforce the perimeter after you have analyzed the access patterns in your dry-run perimeter and created the necessary exceptions for your use cases. |
5246
| restricted\_host\_project\_id | The restricted host project ID |
5347
| restricted\_network\_name | The name of the VPC being created |

‎3-networks-hub-and-spoke/modules/base_env/main.tf‎

Lines changed: 10 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,6 @@ module "restricted_shared_vpc" {
166166

167167
project_id = local.restricted_project_id
168168
project_number = local.restricted_project_number
169-
dns_hub_project_id = local.dns_hub_project_id
170169
restricted_net_hub_project_id = local.restricted_net_hub_project_id
171170
restricted_net_hub_project_number = local.restricted_net_hub_project_number
172171
environment_code = var.environment_code
@@ -183,15 +182,16 @@ module "restricted_shared_vpc" {
183182
"serviceAccount:${local.projects_service_account}",
184183
"serviceAccount:${local.organization_service_account}",
185184
], var.perimeter_additional_members))
186-
private_service_cidr = var.restricted_private_service_cidr
187-
private_service_connect_ip = var.restricted_private_service_connect_ip
188-
ingress_policies = var.ingress_policies
189-
egress_policies = var.egress_policies
190-
bgp_asn_subnet = local.bgp_asn_number
191-
default_region1 = var.default_region1
192-
default_region2 = var.default_region2
193-
domain = var.domain
194-
mode = "spoke"
185+
private_service_cidr = var.restricted_private_service_cidr
186+
private_service_connect_ip = var.restricted_private_service_connect_ip
187+
ingress_policies = var.ingress_policies
188+
egress_policies = var.egress_policies
189+
bgp_asn_subnet = local.bgp_asn_number
190+
default_region1 = var.default_region1
191+
default_region2 = var.default_region2
192+
domain = var.domain
193+
mode = "spoke"
194+
target_name_server_addresses = var.target_name_server_addresses
195195

196196
subnets = [
197197
{
@@ -244,72 +244,3 @@ module "restricted_shared_vpc" {
244244
}
245245
}
246246

247-
/******************************************
248-
Base shared VPC
249-
*****************************************/
250-
251-
module "base_shared_vpc" {
252-
source = "../base_shared_vpc"
253-
254-
project_id = local.base_project_id
255-
dns_hub_project_id = local.dns_hub_project_id
256-
base_net_hub_project_id = local.base_net_hub_project_id
257-
environment_code = var.environment_code
258-
private_service_cidr = var.base_private_service_cidr
259-
private_service_connect_ip = var.base_private_service_connect_ip
260-
default_region1 = var.default_region1
261-
default_region2 = var.default_region2
262-
domain = var.domain
263-
bgp_asn_subnet = local.bgp_asn_number
264-
mode = "spoke"
265-
266-
subnets = [
267-
{
268-
subnet_name = "sb-${var.environment_code}-shared-base-${var.default_region1}"
269-
subnet_ip = var.base_subnet_primary_ranges[var.default_region1]
270-
subnet_region = var.default_region1
271-
subnet_private_access = "true"
272-
subnet_flow_logs = true
273-
subnet_flow_logs_interval = var.base_vpc_flow_logs.aggregation_interval
274-
subnet_flow_logs_sampling = var.base_vpc_flow_logs.flow_sampling
275-
subnet_flow_logs_metadata = var.base_vpc_flow_logs.metadata
276-
subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
277-
subnet_flow_logs_filter = var.base_vpc_flow_logs.filter_expr
278-
description = "First ${var.env} subnet example."
279-
},
280-
{
281-
subnet_name = "sb-${var.environment_code}-shared-base-${var.default_region2}"
282-
subnet_ip = var.base_subnet_primary_ranges[var.default_region2]
283-
subnet_region = var.default_region2
284-
subnet_private_access = "true"
285-
subnet_flow_logs = true
286-
subnet_flow_logs_interval = var.base_vpc_flow_logs.aggregation_interval
287-
subnet_flow_logs_sampling = var.base_vpc_flow_logs.flow_sampling
288-
subnet_flow_logs_metadata = var.base_vpc_flow_logs.metadata
289-
subnet_flow_logs_metadata_fields = var.base_vpc_flow_logs.metadata_fields
290-
subnet_flow_logs_filter = var.base_vpc_flow_logs.filter_expr
291-
description = "Second ${var.env} subnet example."
292-
},
293-
{
294-
subnet_name = "sb-${var.environment_code}-shared-base-${var.default_region1}-proxy"
295-
subnet_ip = var.base_subnet_proxy_ranges[var.default_region1]
296-
subnet_region = var.default_region1
297-
description = "First ${var.env} proxy-only subnet example."
298-
subnet_flow_logs = false
299-
role = "ACTIVE"
300-
purpose = "REGIONAL_MANAGED_PROXY"
301-
},
302-
{
303-
subnet_name = "sb-${var.environment_code}-shared-base-${var.default_region2}-proxy"
304-
subnet_ip = var.base_subnet_proxy_ranges[var.default_region2]
305-
subnet_region = var.default_region2
306-
description = "Second ${var.env} proxy-only subnet example."
307-
subnet_flow_logs = false
308-
role = "ACTIVE"
309-
purpose = "REGIONAL_MANAGED_PROXY"
310-
}
311-
]
312-
secondary_ranges = {
313-
"sb-${var.environment_code}-shared-base-${var.default_region1}" = var.base_subnet_secondary_ranges[var.default_region1]
314-
}
315-
}

‎3-networks-hub-and-spoke/modules/base_env/outputs.tf‎

Lines changed: 0 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -74,42 +74,3 @@ output "restricted_service_perimeter_name" {
7474
}
7575

7676

77-
78-
/******************************************
79-
Private Outputs
80-
*****************************************/
81-
82-
output "base_host_project_id" {
83-
value = local.base_project_id
84-
description = "The base host project ID"
85-
}
86-
87-
output "base_network_name" {
88-
value = module.base_shared_vpc.network_name
89-
description = "The name of the VPC being created"
90-
}
91-
92-
output "base_network_self_link" {
93-
value = module.base_shared_vpc.network_self_link
94-
description = "The URI of the VPC being created"
95-
}
96-
97-
output "base_subnets_names" {
98-
value = module.base_shared_vpc.subnets_names
99-
description = "The names of the subnets being created"
100-
}
101-
102-
output "base_subnets_ips" {
103-
value = module.base_shared_vpc.subnets_ips
104-
description = "The IPs and CIDRs of the subnets being created"
105-
}
106-
107-
output "base_subnets_self_links" {
108-
value = module.base_shared_vpc.subnets_self_links
109-
description = "The self-links of subnets being created"
110-
}
111-
112-
output "base_subnets_secondary_ranges" {
113-
value = module.base_shared_vpc.subnets_secondary_ranges
114-
description = "The secondary ranges associated with these subnets"
115-
}

‎3-networks-hub-and-spoke/modules/base_env/remote.tf‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@
1717
locals {
1818
restricted_project_id = data.terraform_remote_state.org.outputs.shared_vpc_projects[var.env].restricted_shared_vpc_project_id
1919
restricted_project_number = data.terraform_remote_state.org.outputs.shared_vpc_projects[var.env].restricted_shared_vpc_project_number
20-
base_project_id = data.terraform_remote_state.org.outputs.shared_vpc_projects[var.env].base_shared_vpc_project_id
21-
dns_hub_project_id = data.terraform_remote_state.org.outputs.dns_hub_project_id
22-
base_net_hub_project_id = data.terraform_remote_state.org.outputs.base_net_hub_project_id
2320
restricted_net_hub_project_id = data.terraform_remote_state.org.outputs.restricted_net_hub_project_id
2421
restricted_net_hub_project_number = data.terraform_remote_state.org.outputs.restricted_net_hub_project_number
2522
organization_service_account = data.terraform_remote_state.bootstrap.outputs.organization_step_terraform_service_account_email

0 commit comments

Comments
 (0)