fix project for vpc_dns_hub

renato-rudnicki · renato-rudnicki · commit 62274d7ac03b · 2024-11-14T10:41:50.000-03:00
diff --git a/3-networks-hub-and-spoke/envs/development/README.md b/3-networks-hub-and-spoke/envs/development/README.md
@@ -25,6 +25,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
 | perimeter\_additional\_members | The list of additional members to be added to the enforced perimeter access level members list. To be able to see the resources protected by the VPC Service Controls in the restricted perimeter, add your user in this list. Entries must be in the standard GCP form: `user:email@example.com` or `serviceAccount:my-service-account@example.com`. | `list(string)` | `[]` | no |
 | perimeter\_additional\_members\_dry\_run | The list of additional members to be added to the dry-run perimeter access level members list. To be able to see the resources protected by the VPC Service Controls in the restricted perimeter, add your user in this list. Entries must be in the standard GCP form: `user:email@example.com` or `serviceAccount:my-service-account@example.com`. | `list(string)` | `[]` | no |
 | remote\_state\_bucket | Backend bucket to load Terraform Remote State Data from previous steps. | `string` | n/a | yes |
+| target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | n/a | yes |
 | tfc\_org\_name | Name of the TFC organization | `string` | `""` | no |
 
 ## Outputs
diff --git a/3-networks-hub-and-spoke/envs/development/main.tf b/3-networks-hub-and-spoke/envs/development/main.tf
@@ -94,4 +94,5 @@ module "base_env" {
   restricted_private_service_connect_ip = "10.17.0.6"
   remote_state_bucket                   = var.remote_state_bucket
   tfc_org_name                          = var.tfc_org_name
+  target_name_server_addresses          = var.target_name_server_addresses
 }
diff --git a/3-networks-hub-and-spoke/envs/development/variables.tf b/3-networks-hub-and-spoke/envs/development/variables.tf
@@ -14,6 +14,11 @@
  * limitations under the License.
  */
 
+variable "target_name_server_addresses" {
+  description = "List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones."
+  type        = list(map(any))
+}
+
 variable "remote_state_bucket" {
   description = "Backend bucket to load Terraform Remote State Data from previous steps."
   type        = string
diff --git a/3-networks-hub-and-spoke/envs/nonproduction/README.md b/3-networks-hub-and-spoke/envs/nonproduction/README.md
@@ -25,6 +25,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
 | perimeter\_additional\_members | The list of additional members to be added to the enforced perimeter access level members list. To be able to see the resources protected by the VPC Service Controls in the restricted perimeter, add your user in this list. Entries must be in the standard GCP form: `user:email@example.com` or `serviceAccount:my-service-account@example.com`. | `list(string)` | `[]` | no |
 | perimeter\_additional\_members\_dry\_run | The list of additional members to be added to the dry-run perimeter access level members list. To be able to see the resources protected by the VPC Service Controls in the restricted perimeter, add your user in this list. Entries must be in the standard GCP form: `user:email@example.com` or `serviceAccount:my-service-account@example.com`. | `list(string)` | `[]` | no |
 | remote\_state\_bucket | Backend bucket to load Terraform Remote State Data from previous steps. | `string` | n/a | yes |
+| target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | n/a | yes |
 | tfc\_org\_name | Name of the TFC organization | `string` | `""` | no |
 
 ## Outputs
diff --git a/3-networks-hub-and-spoke/envs/nonproduction/main.tf b/3-networks-hub-and-spoke/envs/nonproduction/main.tf
@@ -96,4 +96,5 @@ module "base_env" {
   restricted_private_service_connect_ip = "10.17.0.7"
   remote_state_bucket                   = var.remote_state_bucket
   tfc_org_name                          = var.tfc_org_name
+  target_name_server_addresses          = var.target_name_server_addresses
 }
diff --git a/3-networks-hub-and-spoke/envs/nonproduction/variables.tf b/3-networks-hub-and-spoke/envs/nonproduction/variables.tf
@@ -14,6 +14,11 @@
  * limitations under the License.
  */
 
+variable "target_name_server_addresses" {
+  description = "List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones."
+  type        = list(map(any))
+}
+
 variable "remote_state_bucket" {
   description = "Backend bucket to load Terraform Remote State Data from previous steps."
   type        = string
diff --git a/3-networks-hub-and-spoke/envs/production/README.md b/3-networks-hub-and-spoke/envs/production/README.md
@@ -25,6 +25,7 @@ The purpose of this step is to set up base and restricted shared VPCs with defau
 | perimeter\_additional\_members | The list of additional members to be added to the enforced perimeter access level members list. To be able to see the resources protected by the VPC Service Controls in the restricted perimeter, add your user in this list. Entries must be in the standard GCP form: `user:email@example.com` or `serviceAccount:my-service-account@example.com`. | `list(string)` | `[]` | no |
 | perimeter\_additional\_members\_dry\_run | The list of additional members to be added to the dry-run perimeter access level members list. To be able to see the resources protected by the VPC Service Controls in the restricted perimeter, add your user in this list. Entries must be in the standard GCP form: `user:email@example.com` or `serviceAccount:my-service-account@example.com`. | `list(string)` | `[]` | no |
 | remote\_state\_bucket | Backend bucket to load Terraform Remote State Data from previous steps. | `string` | n/a | yes |
+| target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones. | `list(map(any))` | n/a | yes |
 | tfc\_org\_name | Name of the TFC organization | `string` | `""` | no |
 
 ## Outputs
diff --git a/3-networks-hub-and-spoke/envs/production/main.tf b/3-networks-hub-and-spoke/envs/production/main.tf
@@ -96,4 +96,5 @@ module "base_env" {
   restricted_private_service_connect_ip = "10.17.0.8"
   remote_state_bucket                   = var.remote_state_bucket
   tfc_org_name                          = var.tfc_org_name
+  target_name_server_addresses          = var.target_name_server_addresses
 }
diff --git a/3-networks-hub-and-spoke/envs/production/variables.tf b/3-networks-hub-and-spoke/envs/production/variables.tf
@@ -14,6 +14,11 @@
  * limitations under the License.
  */
 
+variable "target_name_server_addresses" {
+  description = "List of IPv4 address of target name servers for the forwarding zone configuration. See https://cloud.google.com/dns/docs/overview#dns-forwarding-zones for details on target name servers in the context of Cloud DNS forwarding zones."
+  type        = list(map(any))
+}
+
 variable "remote_state_bucket" {
   description = "Backend bucket to load Terraform Remote State Data from previous steps."
   type        = string
diff --git a/3-networks-hub-and-spoke/envs/shared/README.md b/3-networks-hub-and-spoke/envs/shared/README.md
@@ -50,6 +50,8 @@ The purpose of this step is to set up the global [DNS Hub](https://cloud.google.
 
 ## Outputs
 
-No outputs.
+| Name | Description |
+|------|-------------|
+| project | Project name |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/3-networks-hub-and-spoke/envs/shared/outputs.tf b/3-networks-hub-and-spoke/envs/shared/outputs.tf
@@ -14,3 +14,8 @@
  * limitations under the License.
  */
 
+output "project" {
+  value       = local.restricted_net_hub_project_id
+  description = "Project name"
+}
+
diff --git a/3-networks-hub-and-spoke/modules/base_env/README.md b/3-networks-hub-and-spoke/modules/base_env/README.md
@@ -58,5 +58,6 @@
 | restricted\_subnets\_names | The names of the subnets being created |
 | restricted\_subnets\_secondary\_ranges | The secondary ranges associated with these subnets |
 | restricted\_subnets\_self\_links | The self-links of subnets being created |
+| target\_name\_server\_addresses | List of IPv4 address of target name servers for the forwarding zone configuration |
 
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
diff --git a/3-networks-hub-and-spoke/modules/base_env/outputs.tf b/3-networks-hub-and-spoke/modules/base_env/outputs.tf
@@ -14,6 +14,11 @@
  * limitations under the License.
  */
 
+output "target_name_server_addresses" {
+  value       = var.target_name_server_addresses
+  description = "List of IPv4 address of target name servers for the forwarding zone configuration"
+}
+
 /*********************
  Restricted Outputs
 *********************/
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/README.md b/3-networks-hub-and-spoke/modules/base_shared_vpc/README.md
@@ -34,6 +34,7 @@
 | firewall\_policy | Policy created for firewall policy rules. |
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |
+| project | Project name |
 | region1\_router1 | Router 1 for Region 1 |
 | region1\_router2 | Router 2 for Region 1 |
 | region2\_router1 | Router 1 for Region 2 |
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/dns.tf b/3-networks-hub-and-spoke/modules/base_shared_vpc/dns.tf
@@ -32,8 +32,10 @@ resource "google_dns_policy" "default_policy" {
  Creates DNS Peering to DNS HUB
 *****************************************/
 data "google_compute_network" "vpc_dns_hub" {
-  name    = module.main.network_name
-  project = var.project_id
+  count = var.mode == "spoke" ? 1 : 0
+
+  name    = data.google_compute_network.vpc_base_net_hub[0].name
+  project = var.restricted_net_hub_project_id
 }
 
 module "peering_zone" {
@@ -51,7 +53,7 @@ module "peering_zone" {
   private_visibility_config_networks = [
     module.main.network_self_link
   ]
-  target_network = data.google_compute_network.vpc_dns_hub.self_link
+  target_network = data.google_compute_network.vpc_dns_hub[0].self_link
 }
 
 /******************************************
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf b/3-networks-hub-and-spoke/modules/base_shared_vpc/main.tf
@@ -70,7 +70,7 @@ module "main" {
 data "google_compute_network" "vpc_base_net_hub" {
   count   = var.mode == "spoke" ? 1 : 0
   name    = "vpc-c-shared-base-hub"
-  project = var.base_net_hub_project_id
+  project = var.restricted_net_hub_project_id
 }
 
 module "peering" {
diff --git a/3-networks-hub-and-spoke/modules/base_shared_vpc/outputs.tf b/3-networks-hub-and-spoke/modules/base_shared_vpc/outputs.tf
@@ -14,6 +14,11 @@
  * limitations under the License.
  */
 
+output "project" {
+  value       = var.project_id
+  description = "Project name"
+}
+
 output "network_name" {
   value       = module.main.network_name
   description = "The name of the VPC being created"
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/README.md
@@ -49,6 +49,7 @@
 | firewall\_policy | Policy created for firewall policy rules. |
 | network\_name | The name of the VPC being created |
 | network\_self\_link | The URI of the VPC being created |
+| project | Project name |
 | region1\_router1 | Router 1 for Region 1 |
 | region1\_router2 | Router 2 for Region 1 |
 | region2\_router1 | Router 1 for Region 2 |
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/dns.tf b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/dns.tf
@@ -32,8 +32,10 @@ resource "google_dns_policy" "default_policy" {
  Creates DNS Peering to DNS HUB
 *****************************************/
 data "google_compute_network" "vpc_dns_hub" {
-  name    = module.main.network_name
-  project = var.project_id
+  count = var.mode == "spoke" ? 1 : 0
+
+  name    = data.google_compute_network.vpc_restricted_net_hub[0].name
+  project = var.restricted_net_hub_project_id
 }
 
 module "peering_zone" {
@@ -51,7 +53,7 @@ module "peering_zone" {
   private_visibility_config_networks = [
     module.main.network_self_link
   ]
-  target_network = data.google_compute_network.vpc_dns_hub.self_link
+  target_network = data.google_compute_network.vpc_dns_hub[0].self_link
 }
 
 /******************************************
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/outputs.tf b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/outputs.tf
@@ -14,6 +14,11 @@
  * limitations under the License.
  */
 
+output "project" {
+  value       = var.project_id
+  description = "Project name"
+}
+
 output "network_name" {
   value       = module.main.network_name
   description = "The name of the VPC being created"
diff --git a/3-networks-hub-and-spoke/modules/restricted_shared_vpc/variables.tf b/3-networks-hub-and-spoke/modules/restricted_shared_vpc/variables.tf
@@ -19,7 +19,6 @@ variable "target_name_server_addresses" {
   type        = list(map(any))
 }
 
-
 variable "access_context_manager_policy_id" {
   type        = number
   description = "The id of the default Access Context Manager policy. Can be obtained by running `gcloud access-context-manager policies list --organization YOUR_ORGANIZATION_ID --format=\"value(name)\"`."

Original file line number	Diff line number	Diff line change
`@@ -94,4 +94,5 @@ module "base_env" {`
`94`	`94`	`restricted_private_service_connect_ip = "10.17.0.6"`
`95`	`95`	`remote_state_bucket = var.remote_state_bucket`
`96`	`96`	`tfc_org_name = var.tfc_org_name`
	`97`	`+ target_name_server_addresses = var.target_name_server_addresses`
`97`	`98`	`}`
Original file line number	Diff line number	Diff line change
`@@ -96,4 +96,5 @@ module "base_env" {`
`96`	`96`	`restricted_private_service_connect_ip = "10.17.0.7"`
`97`	`97`	`remote_state_bucket = var.remote_state_bucket`
`98`	`98`	`tfc_org_name = var.tfc_org_name`
	`99`	`+ target_name_server_addresses = var.target_name_server_addresses`
`99`	`100`	`}`