removing dns_hub_project_id references

renato-rudnicki · renato-rudnicki · commit 573bdf4d89cc · 2024-11-12T17:06:56.000-03:00
diff --git a/3-networks-hub-and-spoke/envs/shared/README.md b/3-networks-hub-and-spoke/envs/shared/README.md
@@ -50,8 +50,6 @@ The purpose of this step is to set up the global [DNS Hub](https://cloud.google.
 
 ## Outputs
 
-| Name | Description |
-|------|-------------|
-| dns\_hub\_project\_id | The DNS hub project ID |
+No outputs.
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/3-networks-hub-and-spoke/envs/shared/net-hubs.tf b/3-networks-hub-and-spoke/envs/shared/net-hubs.tf
@@ -175,7 +175,6 @@ module "base_shared_vpc" {
   source = "../../modules/base_shared_vpc"
 
   project_id                    = local.base_net_hub_project_id
-  dns_hub_project_id            = local.dns_hub_project_id
   environment_code              = local.environment_code
   private_service_connect_ip    = "10.17.0.1"
   bgp_asn_subnet                = local.bgp_asn_number
@@ -190,6 +189,7 @@ module "base_shared_vpc" {
   nat_num_addresses_region1     = var.base_hub_nat_num_addresses_region1
   nat_num_addresses_region2     = var.base_hub_nat_num_addresses_region2
   windows_activation_enabled    = var.base_hub_windows_activation_enabled
+  target_name_server_addresses  = var.target_name_server_addresses
   mode                          = "hub"
 
   subnets = [
@@ -251,7 +251,6 @@ module "restricted_shared_vpc" {
 
   project_id                       = local.restricted_net_hub_project_id
   project_number                   = local.restricted_net_hub_project_number
-  dns_hub_project_id               = local.dns_hub_project_id
   environment_code                 = local.environment_code
   private_service_connect_ip       = "10.17.0.5"
   access_context_manager_policy_id = var.access_context_manager_policy_id
@@ -279,6 +278,7 @@ module "restricted_shared_vpc" {
   nat_num_addresses_region1     = var.restricted_hub_nat_num_addresses_region1
   nat_num_addresses_region2     = var.restricted_hub_nat_num_addresses_region2
   windows_activation_enabled    = var.restricted_hub_windows_activation_enabled
+  target_name_server_addresses  = var.target_name_server_addresses
   mode                          = "hub"
 
   subnets = [
diff --git a/3-networks-hub-and-spoke/envs/shared/outputs.tf b/3-networks-hub-and-spoke/envs/shared/outputs.tf
@@ -14,7 +14,3 @@
  * limitations under the License.
  */
 
-output "dns_hub_project_id" {
-  value       = local.dns_hub_project_id
-  description = "The DNS hub project ID"
-}
diff --git a/3-networks-hub-and-spoke/envs/shared/remote.tf b/3-networks-hub-and-spoke/envs/shared/remote.tf
@@ -15,7 +15,6 @@
  */
 
 locals {
-  dns_hub_project_id                = data.terraform_remote_state.org.outputs.dns_hub_project_id
   interconnect_project_id           = data.terraform_remote_state.org.outputs.interconnect_project_id
   interconnect_project_number       = data.terraform_remote_state.org.outputs.interconnect_project_number
   parent_folder                     = data.terraform_remote_state.bootstrap.outputs.common_config.parent_folder
diff --git a/3-networks-hub-and-spoke/envs/shared/remote.tf.cloud.example b/3-networks-hub-and-spoke/envs/shared/remote.tf.cloud.example
@@ -15,7 +15,6 @@
  */
 
 locals {
-  dns_hub_project_id                = data.tfe_outputs.org.nonsensitive_values.dns_hub_project_id
   interconnect_project_id           = data.tfe_outputs.org.nonsensitive_values.interconnect_project_id
   interconnect_project_number       = data.tfe_outputs.org.nonsensitive_values.interconnect_project_number
   parent_folder                     = data.tfe_outputs.bootstrap.nonsensitive_values.common_config.parent_folder
diff --git a/3-networks-hub-and-spoke/modules/base_env/README.md b/3-networks-hub-and-spoke/modules/base_env/README.md
@@ -33,6 +33,7 @@
 | restricted\_subnet\_proxy\_ranges | The base proxy-only subnet primary IPTs ranges to the Restricted Shared Vpc. | `map(string)` | n/a | yes |
 | restricted\_subnet\_secondary\_ranges | The base subnet secondary IPTs ranges to the Restricted Shared Vpc | `map(list(map(string)))` | n/a | yes |
 | restricted\_vpc\_flow\_logs | aggregation\_interval: Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Possible values are: INTERVAL\_5\_SEC, INTERVAL\_30\_SEC, INTERVAL\_1\_MIN, INTERVAL\_5\_MIN, INTERVAL\_10\_MIN, INTERVAL\_15\_MIN.<br>  flow\_sampling: Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. The value of the field must be in [0, 1].<br>  metadata: Configures whether metadata fields should be added to the reported VPC flow logs. Possible values are: EXCLUDE\_ALL\_METADATA, INCLUDE\_ALL\_METADATA, CUSTOM\_METADATA.<br>  metadata\_fields: ist of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM\_METADATA.<br>  filter\_expr: Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. | <pre>object({<br>    aggregation_interval = optional(string, "INTERVAL_5_SEC")<br>    flow_sampling        = optional(string, "0.5")<br>    metadata             = optional(string, "INCLUDE_ALL_METADATA")<br>    metadata_fields      = optional(list(string), [])<br>    filter_expr          = optional(string, "true")<br>  })</pre> | `{}` | no |
+| target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | n/a | yes |
 | tfc\_org\_name | Name of the TFC organization | `string` | n/a | yes |
 
 ## Outputs
diff --git a/3-networks-hub-and-spoke/modules/base_env/main.tf b/3-networks-hub-and-spoke/modules/base_env/main.tf
@@ -166,7 +166,6 @@ module "restricted_shared_vpc" {
 
   project_id                        = local.restricted_project_id
   project_number                    = local.restricted_project_number
-  dns_hub_project_id                = local.dns_hub_project_id
   restricted_net_hub_project_id     = local.restricted_net_hub_project_id
   restricted_net_hub_project_number = local.restricted_net_hub_project_number
   environment_code                  = var.environment_code
@@ -183,15 +182,16 @@ module "restricted_shared_vpc" {
     "serviceAccount:${local.projects_service_account}",
     "serviceAccount:${local.organization_service_account}",
   ], var.perimeter_additional_members))
-  private_service_cidr       = var.restricted_private_service_cidr
-  private_service_connect_ip = var.restricted_private_service_connect_ip
-  ingress_policies           = var.ingress_policies
-  egress_policies            = var.egress_policies
-  bgp_asn_subnet             = local.bgp_asn_number
-  default_region1            = var.default_region1
-  default_region2            = var.default_region2
-  domain                     = var.domain
-  mode                       = "spoke"
+  private_service_cidr         = var.restricted_private_service_cidr
+  private_service_connect_ip   = var.restricted_private_service_connect_ip
+  ingress_policies             = var.ingress_policies
+  egress_policies              = var.egress_policies
+  bgp_asn_subnet               = local.bgp_asn_number
+  default_region1              = var.default_region1
+  default_region2              = var.default_region2
+  domain                       = var.domain
+  mode                         = "spoke"
+  target_name_server_addresses = var.target_name_server_addresses
 
   subnets = [
     {
@@ -251,17 +251,17 @@ module "restricted_shared_vpc" {
 module "base_shared_vpc" {
   source = "../base_shared_vpc"
 
-  project_id                 = local.base_project_id
-  dns_hub_project_id         = local.dns_hub_project_id
-  base_net_hub_project_id    = local.base_net_hub_project_id
-  environment_code           = var.environment_code
-  private_service_cidr       = var.base_private_service_cidr
-  private_service_connect_ip = var.base_private_service_connect_ip
-  default_region1            = var.default_region1
-  default_region2            = var.default_region2
-  domain                     = var.domain
-  bgp_asn_subnet             = local.bgp_asn_number
-  mode                       = "spoke"
+  project_id                   = local.base_project_id
+  base_net_hub_project_id      = local.base_net_hub_project_id
+  environment_code             = var.environment_code
+  private_service_cidr         = var.base_private_service_cidr
+  private_service_connect_ip   = var.base_private_service_connect_ip
+  default_region1              = var.default_region1
+  default_region2              = var.default_region2
+  domain                       = var.domain
+  bgp_asn_subnet               = local.bgp_asn_number
+  mode                         = "spoke"
+  target_name_server_addresses = var.target_name_server_addresses
 
   subnets = [
     {
diff --git a/3-networks-hub-and-spoke/modules/base_env/remote.tf b/3-networks-hub-and-spoke/modules/base_env/remote.tf
@@ -18,7 +18,6 @@ locals {
   restricted_project_id             = data.terraform_remote_state.org.outputs.shared_vpc_projects[var.env].restricted_shared_vpc_project_id
   restricted_project_number         = data.terraform_remote_state.org.outputs.shared_vpc_projects[var.env].restricted_shared_vpc_project_number
   base_project_id                   = data.terraform_remote_state.org.outputs.shared_vpc_projects[var.env].base_shared_vpc_project_id
-  dns_hub_project_id                = data.terraform_remote_state.org.outputs.dns_hub_project_id
   base_net_hub_project_id           = data.terraform_remote_state.org.outputs.base_net_hub_project_id
   restricted_net_hub_project_id     = data.terraform_remote_state.org.outputs.restricted_net_hub_project_id
   restricted_net_hub_project_number = data.terraform_remote_state.org.outputs.restricted_net_hub_project_number
diff --git a/3-networks-hub-and-spoke/modules/base_env/remote.tf.cloud.example b/3-networks-hub-and-spoke/modules/base_env/remote.tf.cloud.example
@@ -18,7 +18,6 @@ locals {
   restricted_project_id             = data.tfe_outputs.org.nonsensitive_values.shared_vpc_projects[var.env].restricted_shared_vpc_project_id
   restricted_project_number         = data.tfe_outputs.org.nonsensitive_values.shared_vpc_projects[var.env].restricted_shared_vpc_project_number
   base_project_id                   = data.tfe_outputs.org.nonsensitive_values.shared_vpc_projects[var.env].base_shared_vpc_project_id
-  dns_hub_project_id                = data.tfe_outputs.org.nonsensitive_values.dns_hub_project_id
   base_net_hub_project_id           = data.tfe_outputs.org.nonsensitive_values.base_net_hub_project_id
   restricted_net_hub_project_id     = data.tfe_outputs.org.nonsensitive_values.restricted_net_hub_project_id
   restricted_net_hub_project_number = data.tfe_outputs.org.nonsensitive_values.restricted_net_hub_project_number
diff --git a/3-networks-hub-and-spoke/modules/base_env/variables.tf b/3-networks-hub-and-spoke/modules/base_env/variables.tf
@@ -14,6 +14,11 @@
  * limitations under the License.
  */
 
+variable "target_name_server_addresses" {
+  description = "List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones."
+  type        = list(map(any))
+}
+
 variable "remote_state_bucket" {
   description = "Backend bucket to load Terraform Remote State Data from previous steps."
   type        = string
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/README.md b/3-networks-hub-and-spoke/modules/base_shared_vpc/README.md
@@ -9,7 +9,6 @@
 | default\_region2 | Default region 2 for subnets and Cloud Routers | `string` | n/a | yes |
 | dns\_enable\_inbound\_forwarding | Toggle inbound query forwarding for VPC DNS. | `bool` | `true` | no |
 | dns\_enable\_logging | Toggle DNS logging for VPC DNS. | `bool` | `true` | no |
-| dns\_hub\_project\_id | The DNS hub project ID | `string` | n/a | yes |
 | domain | The DNS name of peering managed zone, for instance 'example.com.' | `string` | n/a | yes |
 | enable\_all\_vpc\_internal\_traffic | Enable firewall policy rule to allow internal traffic (ingress and egress). | `bool` | `false` | no |
 | enable\_transitivity\_traffic | Enable a firewall policy rule to allow traffic between Hub and Spokes (ingress only). | `bool` | `true` | no |
@@ -25,6 +24,7 @@
 | project\_id | Project ID for Private Shared VPC. | `string` | n/a | yes |
 | secondary\_ranges | Secondary ranges that will be used in some of the subnets | `map(list(object({ range_name = string, ip_cidr_range = string })))` | `{}` | no |
 | subnets | The list of subnets being created | <pre>list(object({<br>    subnet_name                      = string<br>    subnet_ip                        = string<br>    subnet_region                    = string<br>    subnet_private_access            = optional(string, "false")<br>    subnet_private_ipv6_access       = optional(string)<br>    subnet_flow_logs                 = optional(string, "false")<br>    subnet_flow_logs_interval        = optional(string, "INTERVAL_5_SEC")<br>    subnet_flow_logs_sampling        = optional(string, "0.5")<br>    subnet_flow_logs_metadata        = optional(string, "INCLUDE_ALL_METADATA")<br>    subnet_flow_logs_filter          = optional(string, "true")<br>    subnet_flow_logs_metadata_fields = optional(list(string), [])<br>    description                      = optional(string)<br>    purpose                          = optional(string)<br>    role                             = optional(string)<br>    stack_type                       = optional(string)<br>    ipv6_access_type                 = optional(string)<br>  }))</pre> | `[]` | no |
+| target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | n/a | yes |
 | windows\_activation\_enabled | Enable Windows license activation for Windows workloads. | `bool` | `false` | no |
 
 ## Outputs
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/dns.tf b/3-networks-hub-and-spoke/modules/base_shared_vpc/dns.tf
@@ -32,8 +32,8 @@ resource "google_dns_policy" "default_policy" {
  Creates DNS Peering to DNS HUB
 *****************************************/
 data "google_compute_network" "vpc_dns_hub" {
-  name    = "vpc-net-dns"
-  project = var.dns_hub_project_id
+  name    = module.main.network_name
+  project = var.project_id
 }
 
 module "peering_zone" {
@@ -71,5 +71,5 @@ module "dns_forwarding_zone" {
   private_visibility_config_networks = [
     module.main.network_self_link
   ]
-  target_network = data.google_compute_network.vpc_dns_hub.self_link
+  target_name_server_addresses = var.target_name_server_addresses
 }
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf b/3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf
@@ -15,10 +15,11 @@
  */
 
 locals {
-  mode                    = var.mode == "hub" ? "-hub" : "-spoke"
-  vpc_name                = "${var.environment_code}-shared-base${local.mode}"
-  network_name            = "vpc-${local.vpc_name}"
-  private_googleapis_cidr = module.private_service_connect.private_service_connect_ip
+  mode                         = var.mode == "hub" ? "-hub" : "-spoke"
+  vpc_name                     = "${var.environment_code}-shared-base${local.mode}"
+  network_name                 = "vpc-${local.vpc_name}"
+  private_googleapis_cidr      = module.private_service_connect.private_service_connect_ip
+  google_private_service_range = "35.199.192.0/19"
 }
 
 /******************************************
@@ -128,7 +129,7 @@ module "region1_router1" {
     advertised_groups = ["ALL_SUBNETS"]
     advertised_ip_ranges = concat(
       [{ range = local.private_googleapis_cidr }],
-      var.private_service_cidr != null ? [{ range = "35.199.192.0/19" }] : []
+      var.private_service_cidr != null ? [{ range = local.google_private_service_range }] : []
     )
   }
 }
@@ -147,7 +148,7 @@ module "region1_router2" {
     advertised_groups = ["ALL_SUBNETS"]
     advertised_ip_ranges = concat(
       [{ range = local.private_googleapis_cidr }],
-      var.private_service_cidr != null ? [{ range = "35.199.192.0/19" }] : []
+      var.private_service_cidr != null ? [{ range = local.google_private_service_range }] : []
     )
   }
 }
@@ -166,7 +167,7 @@ module "region2_router1" {
     advertised_groups = ["ALL_SUBNETS"]
     advertised_ip_ranges = concat(
       [{ range = local.private_googleapis_cidr }],
-      var.private_service_cidr != null ? [{ range = "35.199.192.0/19" }] : []
+      var.private_service_cidr != null ? [{ range = local.google_private_service_range }] : []
     )
   }
 }
@@ -185,7 +186,7 @@ module "region2_router2" {
     advertised_groups = ["ALL_SUBNETS"]
     advertised_ip_ranges = concat(
       [{ range = local.private_googleapis_cidr }],
-      var.private_service_cidr != null ? [{ range = "35.199.192.0/19" }] : []
+      var.private_service_cidr != null ? [{ range = local.google_private_service_range }] : []
     )
   }
 }
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/variables.tf b/3-networks-hub-and-spoke/modules/base_shared_vpc/variables.tf
@@ -14,14 +14,14 @@
  * limitations under the License.
  */
 
-variable "project_id" {
-  type        = string
-  description = "Project ID for Private Shared VPC."
+variable "target_name_server_addresses" {
+  description = "List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones."
+  type        = list(map(any))
 }
 
-variable "dns_hub_project_id" {
+variable "project_id" {
   type        = string
-  description = "The DNS hub project ID"
+  description = "Project ID for Private Shared VPC."
 }
 
 variable "base_net_hub_project_id" {
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/dns.tf b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/dns.tf
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/main.tf b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/main.tf
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/variables.tf b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/variables.tf
